@weibaohui/dsh-git-server 0.1.0

package/server/dist/router.js

@@ -0,0 +1,185 @@
+function compilePattern(pattern) {
+    const paramNames = [];
+    let source;
+    // macaron-style regex route: leading "/^" (drop the slash and the anchors —
+    // the compiled form already anchors ^/… and tolerates a trailing slash)
+    if (pattern.startsWith('/^')) {
+        const body = pattern.slice(2).replace(/\$$/, '').replace(/^\^/, '');
+        const compiled = compilePattern('/' + body);
+        return compiled;
+    }
+    if (pattern.startsWith('^')) {
+        // Full regex form, e.g. /^:type(issues|pulls)$ — :name(rx) becomes a named
+        // capture; bare :name matches [^/]+; other chars literal.
+        source = pattern.slice(1);
+        source = source.replace(/:([a-zA-Z_][a-zA-Z0-9_]*)\(((?:[^()\\]|\\.)*)\)/g, (_m, name, rx) => {
+            paramNames.push(name);
+            return `(${rx})`;
+        });
+        source = source.replace(/:([a-zA-Z_][a-zA-Z0-9_]*)/g, (_m, name) => {
+            paramNames.push(name);
+            return `([^/]+)`;
+        });
+        return { regex: new RegExp('^' + source + '$'), paramNames };
+    }
+    const segs = pattern.split('/');
+    const parts = [];
+    for (let i = 0; i < segs.length; i++) {
+        const seg = segs[i];
+        if (seg === '') {
+            if (i === 0)
+                parts.push('');
+            continue;
+        }
+        if (seg === '*') {
+            paramNames.push('*');
+            parts.push('(.*)');
+            continue;
+        }
+        // general segment scan: literal text mixed with :name and :name(rx) params
+        // (e.g. `:sha([a-f0-9]{7,40}).:ext(patch|diff)`)
+        let rx = '';
+        let k = 0;
+        let matched = false;
+        while (k < seg.length) {
+            if (seg[k] === ':') {
+                const nm = /^:([a-zA-Z_][a-zA-Z0-9_]*)/.exec(seg.slice(k));
+                if (nm) {
+                    paramNames.push(nm[1]);
+                    matched = true;
+                    k += nm[0].length;
+                    if (seg[k] === '(') {
+                        // balanced-paren rx group — wrap in a capture group for params
+                        let depth = 1;
+                        let e = k + 1;
+                        while (e < seg.length && depth > 0) {
+                            if (seg[e] === '(')
+                                depth++;
+                            else if (seg[e] === ')')
+                                depth--;
+                            else if (seg[e] === '\\')
+                                e++;
+                            e++;
+                        }
+                        rx += '(' + seg.slice(k + 1, e - 1) + ')';
+                        k = e;
+                    }
+                    else {
+                        rx += '([^/]+)';
+                        k += 0;
+                    }
+                    continue;
+                }
+            }
+            rx += seg[k].replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+            k++;
+        }
+        if (matched) {
+            parts.push(rx);
+            continue;
+        }
+        parts.push(seg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+    }
+    source = parts.join('/');
+    return { regex: new RegExp('^' + source + '/?$'), paramNames };
+}
+/** macaron Tree semantics: at any segment position a static literal beats a
+ *  :param, which beats a * wildcard — regardless of registration order. */
+function segmentKinds(pattern) {
+    if (pattern.startsWith('/^') || pattern.startsWith('^'))
+        return [1];
+    return pattern
+        .split('/')
+        .slice(1)
+        .filter((s) => s !== '')
+        .map((seg) => (seg === '*' ? 2 : seg.includes(':') ? 1 : 0));
+}
+export class Router {
+    routes = [];
+    add(method, pattern, ...handlers) {
+        const { regex, paramNames } = compilePattern(pattern);
+        this.routes.push({ method, pattern, regex, paramNames, handlers, kinds: segmentKinds(pattern) });
+    }
+    get(pattern, ...h) { this.add('GET', pattern, ...h); }
+    post(pattern, ...h) { this.add('POST', pattern, ...h); }
+    put(pattern, ...h) { this.add('PUT', pattern, ...h); }
+    patch(pattern, ...h) { this.add('PATCH', pattern, ...h); }
+    delete(pattern, ...h) { this.add('DELETE', pattern, ...h); }
+    head(pattern, ...h) { this.add('HEAD', pattern, ...h); }
+    options(pattern, ...h) { this.add('OPTIONS', pattern, ...h); }
+    any(pattern, ...h) { this.add('ANY', pattern, ...h); }
+    /** Route(pattern, "GET,POST", handlers...) — macaron style */
+    route(pattern, methods, ...h) {
+        for (const m of methods.split(','))
+            this.add(m.trim().toUpperCase(), pattern, ...h);
+    }
+    combo(pattern, ...h) {
+        // treated as route registered for GET + POST when handlers count allows;
+        // gogs uses Combo().Get(x).Post(y) — handled by route() calls at registration
+        this.route(pattern, 'GET,POST', ...h);
+    }
+    /** macaron tree priority: a route wins over another if at the first differing
+     *  segment it is more specific (static 0 < param 1 < wildcard 2). Ties keep
+     *  registration order (best stays). */
+    static moreSpecific(a, b) {
+        const n = Math.min(a.kinds.length, b.kinds.length);
+        for (let i = 0; i < n; i++) {
+            if (a.kinds[i] !== b.kinds[i])
+                return a.kinds[i] < b.kinds[i] ? a : b;
+        }
+        return a; // tie — prefer the earlier-registered route (a is current best)
+    }
+    /** Find first matching route. HEAD falls back to GET (SetAutoHead). */
+    match(method, pathname) {
+        let best = null;
+        let getFallback = null;
+        for (const r of this.routes) {
+            if (r.method !== 'ANY' && r.method !== method) {
+                if (!(method === 'HEAD' && r.method === 'GET'))
+                    continue;
+            }
+            const m = r.regex.exec(pathname);
+            if (!m)
+                continue;
+            const hit = {
+                route: r,
+                params: r.paramNames.reduce((acc, name, i) => {
+                    acc[name === '*' ? ':*' : ':' + name] = decodeURIComponent(m[i + 1] ?? '');
+                    return acc;
+                }, {}),
+            };
+            if (method === 'HEAD' && r.method === 'GET') {
+                if (!getFallback || Router.moreSpecific(getFallback.route, hit.route) === hit.route)
+                    getFallback = hit;
+                continue;
+            }
+            if (!best || Router.moreSpecific(best.route, hit.route) === hit.route)
+                best = hit;
+        }
+        return best ?? getFallback;
+    }
+}
+/** Group builder collecting prefix + middleware, mirroring m.Group(). */
+export class GroupBuilder {
+    router;
+    prefix;
+    middleware;
+    constructor(router, prefix, middleware) {
+        this.router = router;
+        this.prefix = prefix;
+        this.middleware = middleware;
+    }
+    Group(prefix, fn, ...middleware) {
+        const g = new GroupBuilder(this.router, this.prefix + prefix, [...this.middleware, ...middleware]);
+        fn(g);
+    }
+    Get(pattern, ...h) { this.router.get(this.prefix + pattern, ...this.middleware, ...h); }
+    Post(pattern, ...h) { this.router.post(this.prefix + pattern, ...this.middleware, ...h); }
+    Put(pattern, ...h) { this.router.put(this.prefix + pattern, ...this.middleware, ...h); }
+    Patch(pattern, ...h) { this.router.patch(this.prefix + pattern, ...this.middleware, ...h); }
+    Delete(pattern, ...h) { this.router.delete(this.prefix + pattern, ...this.middleware, ...h); }
+    Any(pattern, ...h) { this.router.any(this.prefix + pattern, ...this.middleware, ...h); }
+    Route(pattern, methods, ...h) { this.router.route(this.prefix + pattern, methods, ...this.middleware, ...h); }
+    Combo(pattern, ...h) { this.router.route(this.prefix + pattern, 'GET,POST', ...this.middleware, ...h); }
+}
+//# sourceMappingURL=router.js.map

package/server/dist/serv.js

@@ -0,0 +1,43 @@
+// serv subcommand: entrypoint for authorized_keys mode. The system sshd runs
+// `<ts-gogs> serv key-<id>` via a command= restriction on each public key line;
+// the actual git command arrives in SSH_ORIGINAL_COMMAND (gogs cmd/gogs/serv.go).
+import * as db from './db/db.js';
+export async function runServ(keyArg) {
+    const keyID = Number(String(keyArg).replace(/^key-/, ''));
+    const key = db.getPublicKeyByID(keyID);
+    if (!key) {
+        console.error('Serv: cannot find public key:', keyArg);
+        process.exit(1);
+    }
+    const userID = key.owner_id;
+    const identity = {
+        userID,
+        keyID,
+        deployRepoID: null,
+    };
+    if (key.type === 2) {
+        const dk = db.db().prepare('SELECT repo_id FROM deploy_key WHERE key_id = ?').get(keyID);
+        identity.deployRepoID = dk?.repo_id ?? null;
+    }
+    const sshCmd = process.env.SSH_ORIGINAL_COMMAND ?? '';
+    if (!sshCmd) {
+        console.error('Serv: interactive shell is disabled.');
+        process.exit(1);
+    }
+    const { dispatchSSHCommand } = await import('./sshx/dispatch.js');
+    // keep the event loop alive until close() — async handlers (LFS transfer)
+    // must never be cut off by a premature exit
+    const keepAlive = setInterval(() => { }, 1 << 30);
+    dispatchSSHCommand(sshCmd, identity, {
+        write: (chunk) => process.stdout.write(chunk),
+        onStdin: (cb) => {
+            process.stdin.on('data', (d) => cb(d));
+            process.stdin.resume();
+        },
+        close: (code) => {
+            clearInterval(keepAlive);
+            process.exit(code);
+        },
+    });
+}
+//# sourceMappingURL=serv.js.map

package/server/dist/server.js

@@ -0,0 +1,382 @@
+// HTTP server: request pipeline wiring session/context/router/static/SPA,
+// mirroring cmd/gogs/internal/web/web.go dispatch order.
+import * as http from 'node:http';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { conf } from './conf.js';
+import { Context, Session, Contexter, setServeWebHandler } from './context.js';
+import { registerAPIRoutes } from './api/v1.js';
+import { handleGitHTTP } from './gitx/http.js';
+const MIME = {
+    '.html': 'text/html; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.js': 'text/javascript; charset=utf-8',
+    '.mjs': 'text/javascript; charset=utf-8',
+    '.json': 'application/json',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.svg': 'image/svg+xml',
+    '.ico': 'image/x-icon',
+    '.woff': 'font/woff',
+    '.woff2': 'font/woff2',
+    '.ttf': 'font/ttf',
+    '.eot': 'application/vnd.ms-fontobject',
+    '.map': 'application/json',
+    '.txt': 'text/plain; charset=utf-8',
+    '.md': 'text/markdown; charset=utf-8',
+    '.pdf': 'application/pdf',
+    '.wasm': 'application/wasm',
+};
+function serveFile(res, file, cacheForever = true) {
+    try {
+        const stat = fs.statSync(file);
+        if (!stat.isFile())
+            return false;
+        const ext = path.extname(file).toLowerCase();
+        res.setHeader('Content-Type', MIME[ext] ?? 'application/octet-stream');
+        if (cacheForever) {
+            res.setHeader('Cache-Control', 'public, max-age=31536000');
+        }
+        res.setHeader('Content-Length', String(stat.size));
+        fs.createReadStream(file).pipe(res);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function serveStaticPrefix(req, res, pathname) {
+    // static roots, mirroring macaron.Static registration order
+    for (const [prefix, dir] of [
+        ['/css/', path.join(conf.workDir, 'public', 'css')],
+        ['/js/', path.join(conf.workDir, 'public', 'js')],
+        ['/img/', path.join(conf.workDir, 'public', 'img')],
+        ['/plugins/', path.join(conf.workDir, 'public', 'plugins')],
+        ['/assets/', path.join(conf.workDir, 'public', 'assets')],
+        ['/less/', path.join(conf.workDir, 'public', 'less')],
+    ]) {
+        if (pathname.startsWith(prefix)) {
+            const rel = pathname.slice(prefix.length);
+            const safe = path.normalize(rel).replace(/^(\.\.[/\\])+/, '');
+            return serveFile(res, path.join(dir, safe));
+        }
+    }
+    // custom public overrides first
+    const customDir = path.join(conf.customDir, 'public');
+    if (fs.existsSync(customDir)) {
+        const rel = pathname.replace(/^\/+/, '');
+        const safe = path.normalize(rel).replace(/^(\.\.[/\\])+/, '');
+        if (safe && serveFile(res, path.join(customDir, safe)))
+            return true;
+    }
+    return false;
+}
+/** Serve the SPA shell (public/dist/index.html) with WebContext substitution. */
+function serveGone(c) {
+    // 原版 gogs 网页界面已裁撤：dsh 原生 UI 覆盖全部功能，
+    // 3400 只保留 git HTTP 协议 + /api/v1 + /api/dsh（/api/web 登录面已随 SPA 裁撤）
+    c.res.statusCode = 404;
+    c.res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+    c.res.end('web UI removed — use the dsh Git panel; git HTTP and APIs remain on this port');
+}
+let router;
+export async function startServer() {
+    setServeWebHandler((c) => serveGone(c));
+    const { Router } = await import('./router.js');
+    router = new Router();
+    registerAPIRoutes(router);
+    const { registerDshRoutes } = await import('./dshapi.js');
+    registerDshRoutes(router);
+    const server = http.createServer(async (req, res) => {
+        try {
+            await handleRequest(req, res);
+        }
+        catch (e) {
+            console.error('[server panic]', e?.stack ?? e);
+            if (!res.headersSent) {
+                res.statusCode = 500;
+                res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+            }
+            res.end('Internal server error');
+        }
+    });
+    return new Promise((resolve) => {
+        server.listen(conf.httpPort, conf.httpAddr, () => resolve(server));
+    });
+}
+async function handleRequest(req, res) {
+    const url = new URL(req.url ?? '/', 'http://internal');
+    let pathname = decodeURIComponent(url.pathname);
+    if (conf.subpath && pathname.startsWith(conf.subpath + '/')) {
+        pathname = pathname.slice(conf.subpath.length);
+    }
+    else if (conf.subpath && pathname === conf.subpath) {
+        pathname = '/';
+    }
+    // internal: /-/api/sanitize_ipynb (bluemonday-style ipynb HTML sanitizer)
+    if (pathname === '/-/api/sanitize_ipynb' && req.method === 'POST') {
+        const chunks = [];
+        for await (const chunk of req)
+            chunks.push(chunk);
+        const { sanitizeHTML } = await import('./markup.js');
+        res.statusCode = 200;
+        res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+        res.end(sanitizeHTML(Buffer.concat(chunks).toString('utf8')));
+        return;
+    }
+    // internal: /-/metrics (prometheus text format; gated by [prometheus] ENABLED)
+    if (pathname === '/-/metrics' && req.method === 'GET') {
+        if (!conf.prometheusEnabled) {
+            res.statusCode = 404;
+            res.end();
+            return;
+        }
+        if (conf.prometheusEnableBasicAuth) {
+            const expected = 'Basic ' + Buffer.from('gogsmetrics:gogsplant').toString('base64');
+            if (req.headers.authorization !== expected) {
+                res.statusCode = 401;
+                res.end();
+                return;
+            }
+        }
+        const { renderMetrics } = await import('./metrics.js');
+        res.setHeader('Content-Type', 'text/plain; version=0.0.4; charset=utf-8');
+        res.end(renderMetrics());
+        return;
+    }
+    // healthcheck
+    if (pathname === '/healthcheck' && (req.method === 'GET' || req.method === 'HEAD')) {
+        res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+        res.statusCode = 200;
+        res.end(req.method === 'HEAD' ? undefined : '* Database connection: OK\n');
+        return;
+    }
+    // redirect helper (flamego)
+    if (pathname === '/redirect') {
+        let to = url.searchParams.get('to') ?? '';
+        if (!to.startsWith('/') || to.startsWith('//'))
+            to = conf.subpath + '/';
+        res.statusCode = 303;
+        res.setHeader('Location', to);
+        res.end();
+        return;
+    }
+    if (pathname === '/robots.txt') {
+        const f = path.join(conf.customDir, 'robots.txt');
+        if (fs.existsSync(f)) {
+            serveFile(res, f, false);
+        }
+        else {
+            res.statusCode = 404;
+            res.end();
+        }
+        return;
+    }
+    // git smart HTTP: /:username/:reponame(.git)(.wiki)/...
+    if (handleGitHTTP(req, res, pathname))
+        return;
+    const c = new Context(req, res);
+    const session = new Session(cookieValue(req, conf.cookieUserName));
+    c.init(session);
+    // flash cookie read
+    c.flash.readFromCookie(cookieValue(req, 'macaron_flash'));
+    // macaron writes session/flash cookies just before the response flushes
+    const origEnd = res.end.bind(res);
+    res.end = (...args) => {
+        if (!res.headersSent) {
+            const maxAge = 86400 * conf.loginRememberDays;
+            c.SetCookie(conf.cookieUserName, session.sid, maxAge);
+            if (c.flash.hasWrites()) {
+                c.SetCookie('macaron_flash', c.flash.encoded(), 0);
+            }
+        }
+        return origEnd(...args);
+    };
+    // global Contexter (i18n + session auth + common Data), like macaron global middleware
+    await Contexter()(c);
+    // API v1?
+    if (pathname === '/api' || pathname.startsWith('/api/v1') || pathname.startsWith('/api/v1/')) {
+        const match = router.match(req.method ?? 'GET', pathname);
+        if (match) {
+            c.params = match.params;
+            await runChain(match.route.handlers, c);
+            finalize(c);
+            return;
+        }
+        res.statusCode = 404;
+        res.end();
+        return;
+    }
+    // captcha image (flamego/captcha equivalent)
+    if (pathname.startsWith('/captcha/')) {
+        const { newCaptcha } = await import('./toolx.js');
+        const { id, svg } = newCaptcha();
+        res.statusCode = 200;
+        res.setHeader('Content-Type', 'image/svg+xml');
+        res.setHeader('Cache-Control', 'no-store');
+        res.setHeader('Set-Cookie', `gogs_captcha=${id}; Path=${conf.subpath || '/'}; HttpOnly`);
+        res.end(svg);
+        return;
+    }
+    // avatar endpoints
+    // avatar middleware: serve cached → download from gravatar source (once) → default
+    const avatarMatch = /^\/user\/avatar\/([0-9a-f]{32})$/.exec(pathname);
+    if (avatarMatch) {
+        const hash = avatarMatch[1];
+        const cached = path.join(conf.avatarUploadPath, hash);
+        const failMark = path.join(conf.avatarUploadPath, hash + '.failed');
+        const defaultPng = path.join(conf.workDir, 'public', 'img', 'avatar_default.png');
+        const serveDefault = () => {
+            res.setHeader('Cache-Control', 'public, max-age=86400');
+            serveFile(res, defaultPng, false);
+        };
+        if (fs.existsSync(cached)) {
+            res.setHeader('Cache-Control', 'public, max-age=86400');
+            res.setHeader('Content-Type', 'image/png');
+            fs.createReadStream(cached).pipe(res);
+            return;
+        }
+        if (conf.disableGravatar || fs.existsSync(failMark)) {
+            serveDefault();
+            return;
+        }
+        // one-shot gravatar download with short timeout; negative-cached for 24h
+        try {
+            const buf = await downloadAvatar(conf.gravatarSource + hash + '?d=identicon');
+            fs.mkdirSync(conf.avatarUploadPath, { recursive: true });
+            fs.writeFileSync(cached, buf);
+            res.setHeader('Content-Type', 'image/png');
+            res.end(buf);
+        }
+        catch {
+            try {
+                fs.mkdirSync(conf.avatarUploadPath, { recursive: true });
+                fs.writeFileSync(failMark, '');
+            }
+            catch { }
+            serveDefault();
+        }
+        return;
+    }
+    const customAvatarMatch = /^\/user\/avatars\/(\d+)$/.exec(pathname);
+    if (customAvatarMatch) {
+        if (serveFile(res, path.join(conf.avatarUploadPath, customAvatarMatch[1]), false))
+            return;
+        res.statusCode = 302;
+        res.setHeader('Location', conf.subpath + '/img/avatar_default.png');
+        res.end();
+        return;
+    }
+    const repoAvatarMatch = /^\/repo-avatars\/([0-9a-f]{40})$/.exec(pathname);
+    if (repoAvatarMatch) {
+        if (serveFile(res, path.join(conf.repositoryAvatarUploadPath, repoAvatarMatch[1]), false))
+            return;
+        res.statusCode = 302;
+        res.setHeader('Location', conf.subpath + '/img/avatar_default.png');
+        res.end();
+        return;
+    }
+    // go-get meta (gogs ServeGoGet): quick response regardless of repo existence
+    if (url.searchParams.get('go-get') === '1') {
+        const m = /^\/([^/]+)\/([^/]+)$/.exec(pathname);
+        if (m) {
+            const [, ownerName, repoName] = m;
+            let branchName = 'master';
+            const owner = (await import('./db/db.js')).getUserByUsername(ownerName);
+            const repo = owner ? (await import('./db/db.js')).getRepoByOwnerAndName(owner, repoName) : null;
+            if (repo && repo.default_branch)
+                branchName = repo.default_branch;
+            const prefix = conf.externalURL + [ownerName, repoName, 'src', branchName].join('/');
+            const goGetImport = conf.url.host + (conf.subpath || '') + '/' + ownerName + '/' + repoName;
+            const cloneLink = conf.externalURL + path.posix.join(ownerName, repoName) + '.git';
+            const insecureFlag = conf.externalURL.startsWith('https://') ? '' : '--insecure ';
+            res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+            res.statusCode = 200;
+            res.end(`<!doctype html>
+<html>
+\t<head>
+\t\t<meta name="go-import" content="${goGetImport} git ${cloneLink}">
+\t\t<meta name="go-source" content="${goGetImport} _ ${prefix}{/dir} ${prefix}{/dir}/{file}#L{line}">
+\t</head>
+\t<body>
+\t\tgo get ${insecureFlag}${goGetImport}
+\t</body>
+</html>
+`);
+            return;
+        }
+    }
+    // static assets — served BEFORE routes (macaron.Static ordering; otherwise
+    // /css/gogs.min.css would be captured by /:username/:reponame)
+    if (serveStaticPrefix(req, res, pathname))
+        return;
+    // SPA dist static files: vite base './' makes asset URLs relative to the
+    // page path (e.g. /user/sign-in → /user/assets/index-*.js), so any
+    // .../assets/<file> request resolves against public/dist/assets
+    const assetFile = /\/(?:[a-zA-Z0-9_.-]+\/)?assets\/([a-zA-Z0-9_.-]+)$/.exec(pathname);
+    if ((req.method === 'GET' || req.method === 'HEAD') && assetFile) {
+        const safe = path.normalize(assetFile[1]).replace(/^(\.\.\/)+/, '');
+        if (serveFile(res, path.join(conf.workDir, 'public', 'dist', 'assets', safe), false))
+            return;
+        res.statusCode = 404;
+        res.end();
+        return;
+    }
+    // route table
+    const match = router.match(req.method ?? 'GET', pathname);
+    if (match) {
+        c.params = match.params;
+        await runChain(match.route.handlers, c);
+        finalize(c);
+        return;
+    }
+    // web UI removed (see serveGone)
+    if (req.method === 'GET' || req.method === 'HEAD') {
+        serveGone(c);
+        return;
+    }
+    res.statusCode = 404;
+    res.end();
+}
+function downloadAvatar(url) {
+    return new Promise((resolve, reject) => {
+        const mod = url.startsWith('https:') ? require('node:https') : require('node:http');
+        const req2 = mod.get(url, { timeout: 5000 }, (r) => {
+            if (r.statusCode !== 200) {
+                r.resume();
+                return reject(new Error('status ' + r.statusCode));
+            }
+            const chunks = [];
+            r.on('data', (d) => chunks.push(d));
+            r.on('end', () => resolve(Buffer.concat(chunks)));
+        });
+        req2.on('timeout', () => req2.destroy(new Error('timeout')));
+        req2.on('error', reject);
+    });
+}
+function cookieValue(req, name) {
+    const cookie = req.headers.cookie ?? '';
+    for (const part of cookie.split(';')) {
+        const idx = part.indexOf('=');
+        if (idx < 0)
+            continue;
+        if (part.slice(0, idx).trim() === name)
+            return decodeURIComponent(part.slice(idx + 1).trim());
+    }
+    return undefined;
+}
+async function runChain(handlers, c) {
+    for (const h of handlers) {
+        if (c.rendered)
+            return;
+        await h(c);
+    }
+}
+/** After handlers: release session back to the store. */
+function finalize(c) {
+    c.session.Release();
+}
+export { serveFile };
+//# sourceMappingURL=server.js.map