ework-web 0.1.0

package/src/views/issueThread.ts

@@ -0,0 +1,179 @@
+import type { Config } from "../config";
+import { classifyActor, renderCommentCard, type CommentView } from "../render/components";
+import { renderMarkdown } from "../render/markdown";
+import { renderLayout, escapeHtml } from "../render/layout";
+import { hydrateReactions } from "../reactions";
+import {
+  StoreError,
+  countComments,
+  getProject,
+  getIssueWithMeta,
+  listCommentsPage,
+  listCommentsSince,
+  getDefaultUpstreamUrl,
+  type CommentRow,
+  type IssueWithMeta,
+} from "../store";
+import { webUrlFromClone } from "./projectUpstreams";
+
+export const PAGE_SIZE = 30;
+
+export interface IssueThreadPayload {
+  owner: string;
+  repo: string;
+  number: number;
+  issueTitle: string;
+  state: string;
+  totalComments: number;
+  pageSize: number;
+  currentPage: number;
+  hasOlder: boolean;
+  sinceISO: string;
+  commentSort: "desc" | "asc";
+  comments: CommentView[];
+}
+
+function toView(c: CommentRow): CommentView {
+  return {
+    id: c.id,
+    tag: classifyActor(c.body, c.author_kind),
+    login: c.author,
+    avatar: "",
+    created_at: c.created_at,
+    body_html: renderMarkdown(c.body),
+  };
+}
+
+export function viewsFromComments(rows: CommentRow[]): CommentView[] {
+  const views = rows.map((r) => toView(r));
+  hydrateReactions(views);
+  return views;
+}
+
+export function payloadFromComments(
+  issue: IssueWithMeta,
+  comments: CommentView[],
+  page: number,
+  hasOlder: boolean,
+  commentSort: "desc" | "asc"
+): IssueThreadPayload {
+  const last = comments.length > 0 ? comments[comments.length - 1] : null;
+  const sinceISO = last?.created_at || issue.updated_at;
+  return {
+    owner: issue.project_owner,
+    repo: issue.project_name,
+    number: issue.number,
+    issueTitle: issue.title,
+    state: issue.state,
+    totalComments: issue.comment_count,
+    pageSize: PAGE_SIZE,
+    currentPage: page,
+    hasOlder,
+    sinceISO,
+    commentSort,
+    comments,
+  };
+}
+
+// app.js's state model is "items[0] = newest" (DESC). For DESC mode we send the server's
+// ASC-ordered rows reversed; for ASC mode we send them as-is. The displayOrder is then a
+// pure function of commentSort + the canonical DESC internal state.
+function orderForDisplay(views: CommentView[], sort: "desc" | "asc"): CommentView[] {
+  return sort === "asc" ? views : views.slice().reverse();
+}
+
+export function buildIssueThread(
+  cfg: Config,
+  owner: string,
+  repo: string,
+  number: number,
+  viewerLogin?: string
+): { html: string } {
+  const project = getProject(owner, repo);
+  if (!project) throw new StoreError(404, `项目 ${owner}/${repo} 不存在`);
+  const issue = getIssueWithMeta(project.id, number);
+  if (!issue) throw new StoreError(404, `#${number} 在 ${owner}/${repo} 不存在`);
+
+  const total = countComments(issue.id);
+  const totalPages = Math.max(1, Math.ceil(total / PAGE_SIZE));
+  const currentPage = totalPages;
+  const { rows } = listCommentsPage(issue.id, currentPage, PAGE_SIZE);
+  const views = viewsFromComments(rows);
+  const hasOlder = currentPage > 1;
+  const displayViews = orderForDisplay(views, cfg.commentSort);
+  const payload = payloadFromComments(issue, displayViews, currentPage, hasOlder, cfg.commentSort);
+
+  const descriptionHtml = renderMarkdown(issue.body);
+  const descriptionCollapsed = issue.body.length > 1200;
+  const upstreamWebUrl = (() => {
+    const clone = getDefaultUpstreamUrl(project);
+    if (!clone) return null;
+    return webUrlFromClone(clone);
+  })();
+
+  const html = renderLayout(
+    {
+      title: `${issue.title} · ${owner}/${repo}#${number}`,
+      issueTitle: issue.title,
+      repoPath: `${owner}/${repo}`,
+      issueNumber: number,
+      state: issue.state,
+      totalComments: issue.comment_count,
+      descriptionHtml,
+      descriptionCollapsed,
+      writesEnabled: cfg.writesEnabled,
+      operatorLogin: viewerLogin ?? cfg.operatorLogin,
+      upstreamWebUrl,
+    },
+    safeJsonEmbed(payload),
+    displayViews.map(renderCommentCard).join("")
+  );
+  return { html };
+}
+
+export interface IssuePageData {
+  issue: IssueWithMeta;
+  views: CommentView[];
+  currentPage: number;
+  hasOlder: boolean;
+}
+
+export function fetchIssuePage(
+  owner: string,
+  repo: string,
+  number: number,
+  page: number
+): IssuePageData {
+  const project = getProject(owner, repo);
+  if (!project) throw new StoreError(404, `项目 ${owner}/${repo} 不存在`);
+  const issue = getIssueWithMeta(project.id, number);
+  if (!issue) throw new StoreError(404, `#${number} 不存在`);
+  const { rows, page: clamped } = listCommentsPage(issue.id, page, PAGE_SIZE);
+  const views = viewsFromComments(rows);
+  return { issue, views, currentPage: clamped, hasOlder: clamped > 1 };
+}
+
+export function fetchIssueSince(
+  owner: string,
+  repo: string,
+  number: number,
+  sinceISO: string
+): CommentView[] {
+  const project = getProject(owner, repo);
+  if (!project) throw new StoreError(404, `项目 ${owner}/${repo} 不存在`);
+  const issue = getIssueWithMeta(project.id, number);
+  if (!issue) throw new StoreError(404, `#${number} 不存在`);
+  const rows = listCommentsSince(issue.id, sinceISO);
+  return viewsFromComments(rows);
+}
+
+export function safeJsonEmbed(v: unknown): string {
+  return JSON.stringify(v).replace(/</g, "\\u003c").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+
+export function errorPage(title: string, detail: string): string {
+  return `<!doctype html><html lang="zh"><head><meta charset="utf-8"><title>${escapeHtml(title)}</title>
+  <style>body{font-family:system-ui,sans-serif;background:#1b1b1b;color:#e6e6e6;display:flex;align-items:center;justify-content:center;height:100vh;margin:0}
+  .box{max-width:560px;padding:2rem}h1{font-size:18px;margin:0 0 .5rem}pre{background:#0d1117;padding:.8rem;border-radius:6px;overflow:auto;white-space:pre-wrap;font-size:12.5px}</style>
+  </head><body><div class="box"><h1>${escapeHtml(title)}</h1><pre>${escapeHtml(detail)}</pre></div></body></html>`;
+}

package/src/views/issues.ts

@@ -0,0 +1,66 @@
+import { THEME_CSS, escapeHtml, escapeAttr, containsCI, highlightAll, tabNavHTML } from "../render/layout";
+import { listAllIssues, type IssueWithMeta } from "../store";
+import { relTime } from "../render/components";
+
+export const FEED_PAGE_SIZE = 50;
+
+function issueRow(it: IssueWithMeta, q: string): string {
+  const href = `/${encodeURIComponent(it.project_owner)}/${encodeURIComponent(it.project_name)}/issues/${it.number}`;
+  const title = q ? highlightAll(it.title, q) : escapeHtml(it.title);
+  const projectStr = `${escapeHtml(it.project_owner)}<span style="opacity:.55">/</span>${escapeHtml(it.project_name)}`;
+  return `<a class="row" href="${escapeAttr(href)}">
+    <div class="row-title">${title}</div>
+    <div class="row-meta">${projectStr} · #${it.number} · 💬 ${it.comment_count} · ${relTime(it.updated_at)}</div>
+  </a>`;
+}
+
+export function buildIssuesFeed(
+  state: "open" | "closed" | "all",
+  q: string
+): string {
+  const issues = listAllIssues({ state, q, limit: FEED_PAGE_SIZE });
+  const matchesFirst = q
+    ? [...issues].sort((a, b) => Number(containsCI(b.title, q)) - Number(containsCI(a.title, q)))
+    : issues;
+  const openActive = state === "open" ? " active" : "";
+  const closedActive = state === "closed" ? " active" : "";
+  const allActive = state === "all" ? " active" : "";
+  const qParam = q ? `&q=${encodeURIComponent(q)}` : "";
+  const rows = matchesFirst.length
+    ? matchesFirst.map((it) => issueRow(it, q)).join("")
+    : `<div class="empty">暂无工单</div>`;
+  return `<!doctype html>
+<html lang="zh"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<link rel="icon" type="image/svg+xml" href="/favicon.svg">
+<title>Issues · 全部</title>
+<style>${THEME_CSS}
+.feed-wrap{max-width:900px;margin:0 auto;padding:.4rem 1rem 3rem}
+.search{margin:.4rem 0 .8rem;display:flex;gap:.4rem}
+.search input{flex:1;background:var(--bg-elev);color:var(--text);border:1px solid var(--border);border-radius:8px;padding:.5rem .7rem;font:inherit}
+.tabs-sub{display:flex;gap:.3rem;margin-bottom:.6rem}
+.tabs-sub a{padding:.3rem .8rem;border-radius:6px;font-size:13px;color:var(--text-muted)}
+.tabs-sub a.active{background:var(--bg-muted);color:var(--text);font-weight:600}
+.row{display:block;padding:.6rem .2rem;border-bottom:1px solid var(--border);color:var(--text)}
+.row:hover{text-decoration:none;background:var(--bg-muted)}
+.row-title{font-weight:500;overflow-wrap:anywhere}
+.row-meta{color:var(--text-muted);font-size:12px;margin-top:.2rem}
+.empty{color:var(--text-muted);text-align:center;padding:2rem;font-size:13px}
+</style></head><body>
+<header class="topbar"><span style="font-weight:600">📦 ework</span></header>
+${tabNavHTML("issues")}
+<main class="feed-wrap">
+  <form class="search" method="GET" action="/issues">
+    <input type="text" name="q" value="${escapeAttr(q)}" placeholder="搜索全部项目的标题/正文/项目名…">
+    <input type="hidden" name="state" value="${state}">
+    <button type="submit" style="background:var(--bg-muted);color:var(--text);border:1px solid var(--border);border-radius:8px;padding:.4rem .8rem;font-size:13px">搜索</button>
+  </form>
+  <div class="tabs-sub">
+    <a class="tab${openActive}" href="/issues?state=open${qParam}">Open</a>
+    <a class="tab${closedActive}" href="/issues?state=closed${qParam}">Closed</a>
+    <a class="tab${allActive}" href="/issues?state=all${qParam}">All</a>
+  </div>
+  <div class="rows">${rows}</div>
+</main>
+</body></html>`;
+}

package/src/views/projectMembers.ts

@@ -0,0 +1,146 @@
+import { THEME_CSS, escapeHtml, escapeAttr, tabNavHTML } from "../render/layout";
+import {
+  countProjectAdmins,
+  listProjectMembersWithUsers,
+  listUsers,
+  type ProjectMemberWithUser,
+  type ProjectRole,
+  type ProjectRow,
+  type UserRow,
+} from "../store";
+import { projectSettingsTabsHTML } from "./projectUpstreams";
+
+interface Flash {
+  kind: "ok" | "err";
+  msg: string;
+}
+
+const ALL_ROLES: ProjectRole[] = ["reader", "writer", "admin"];
+
+function roleBadge(role: ProjectRole): string {
+  const cls = role === "admin" ? "admin" : role === "writer" ? "writer" : "reader";
+  return `<span class="badge role-${cls}">${escapeHtml(role)}</span>`;
+}
+
+export function buildProjectMembersPage(
+  viewer: UserRow,
+  project: ProjectRow,
+  flash: Flash | null,
+): string {
+  const members = listProjectMembersWithUsers(project.id);
+  const users = listUsers();
+  const memberLogins = new Set(members.map((m) => m.user_login));
+  const candidates = users.filter((u) => u.is_active === 1 && !memberLogins.has(u.login));
+
+  const flashHtml = flash ? `<div class="flash ${flash.kind}">${escapeHtml(flash.msg)}</div>` : "";
+
+  const rowsHtml = members.length
+    ? `<table>
+<thead><tr><th>用户</th><th>角色</th><th>加入时间</th><th>操作</th></tr></thead>
+<tbody>
+${members
+  .map((m) => memberRowHtml(m, viewer, project))
+  .join("")}
+</tbody>
+</table>`
+    : `<div class="hint">该项目还没有成员记录（site-admin 已自动获得 admin 权限，可在下方添加）。</div>`;
+
+  const candOptions = candidates
+    .map((u) => `<option value="${escapeAttr(u.login)}">${escapeHtml(u.login)} (${escapeHtml(u.kind)})</option>`)
+    .join("");
+  const addFormHtml = candidates.length
+    ? `<form class="card" method="POST" action="${escapeAttr(`/${encodeURIComponent(project.owner)}/${encodeURIComponent(project.name)}/settings/members/add`)}">
+<h2>添加成员</h2>
+<div class="form-grid">
+<div><label for="n-login">用户</label><select id="n-login" name="login" required>${candOptions}</select></div>
+<div><label for="n-role">角色</label><select id="n-role" name="role">${ALL_ROLES.map((r) => `<option value="${r}"${r === "writer" ? " selected" : ""}>${r}</option>`).join("")}</select></div>
+</div>
+<div class="hint">reader = 只读（预留）；writer = 可创建 issue、评论、关闭、上传；admin = 可管理 webhook 和成员。</div>
+<button class="primary" type="submit">添加</button>
+</form>`
+    : `<div class="card"><h2>添加成员</h2><div class="hint">没有可添加的候选用户。先在 <a href="/admin/users">用户管理</a> 创建账户。</div></div>`;
+
+  return `<!doctype html>
+<html lang="zh"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<link rel="icon" type="image/svg+xml" href="/favicon.svg">
+<title>成员 · ${escapeHtml(project.owner)}/${escapeHtml(project.name)}</title>
+<style>${THEME_CSS}
+.flash{padding:.5rem .7rem;border-radius:6px;font-size:13px;margin-bottom:.8rem}
+.flash.ok{background:color-mix(in srgb,var(--green) 18%,transparent);color:var(--green)}
+.flash.err{background:color-mix(in srgb,#f85149 18%,transparent);color:#f85149}
+.wrap{max-width:920px;margin:0 auto;padding:1rem}
+h1{font-size:18px;margin:0 0 .4rem}
+h1 a{color:var(--text)}
+.subtabs{display:flex;gap:.4rem;padding:.4rem 0 0;border-bottom:1px solid var(--border);margin-bottom:.9rem}
+.subtab{padding:.35rem .8rem;border-radius:6px 6px 0 0;font-size:13px;color:var(--text-muted)}
+.subtab.active{background:var(--bg-muted);color:var(--text);font-weight:600}
+.card{background:var(--bg-elev);border:1px solid var(--border);border-radius:10px;padding:.9rem 1rem;margin-bottom:.9rem}
+.card h2{font-size:14px;margin:0 0 .7rem;font-weight:600}
+table{width:100%;border-collapse:collapse;font-size:13px}
+th,td{text-align:left;padding:.55rem .45rem;border-bottom:1px solid var(--border);vertical-align:middle}
+th{color:var(--text-muted);font-weight:600;font-size:12px}
+td.login{font-weight:600}
+td.muted{color:var(--text-muted);font-size:12px;white-space:nowrap}
+td.act{white-space:nowrap}
+td.act form{display:inline-flex;gap:.3rem;align-items:center}
+select{padding:.3rem .4rem;border:1px solid var(--border);border-radius:4px;background:var(--bg);color:var(--text);font:inherit;font-size:12px}
+button.btn-mini,.btn-mini{padding:.3rem .55rem;border:0;border-radius:4px;background:var(--bg-muted);color:var(--text);font:inherit;font-size:12px;cursor:pointer;border:1px solid var(--border)}
+button.btn-mini:hover{border-color:var(--accent)}
+button.btn-danger{padding:.3rem .55rem;border:0;border-radius:4px;background:#f85149;color:#fff;font:inherit;font-size:12px;cursor:pointer}
+button[disabled]{opacity:.4;cursor:not-allowed}
+.badge{font-size:11px;font-weight:600;padding:.1rem .45rem;border-radius:4px;line-height:1.5;background:var(--bg-muted);color:var(--text-muted)}
+.badge.role-admin{background:color-mix(in srgb,var(--system) 18%,transparent);color:var(--system)}
+.badge.role-writer{background:color-mix(in srgb,var(--green) 18%,transparent);color:var(--green)}
+.badge.role-reader{background:var(--bg-muted);color:var(--text-muted)}
+.badge.bot{background:color-mix(in srgb,var(--bot) 18%,transparent);color:var(--bot)}
+.badge.inactive{background:#f85149;color:#fff}
+.hint{color:var(--text-muted);font-size:12px;line-height:1.5;margin:.4rem 0}
+label{display:block;font-size:12px;color:var(--text-muted);margin:0 0 .25rem}
+select{width:100%;box-sizing:border-box;padding:.5rem .65rem;border:1px solid var(--border);border-radius:6px;background:var(--bg);color:var(--text);font:inherit;font-size:14px;margin-bottom:.7rem}
+button.primary{padding:.5rem 1rem;border:0;border-radius:6px;background:var(--accent);color:#fff;font-size:13px;cursor:pointer}
+.form-grid{display:grid;grid-template-columns:1fr 1fr;gap:.6rem}
+</style></head><body>
+<header class="topbar"><span style="font-weight:600">👥 ${escapeHtml(project.owner)}/${escapeHtml(project.name)} · 成员</span></header>
+${tabNavHTML("projects")}
+<main class="wrap">
+<h1><a href="/${escapeAttr(project.owner)}/${escapeAttr(project.name)}/issues">${escapeHtml(project.owner)}/${escapeHtml(project.name)}</a> · 成员</h1>
+${projectSettingsTabsHTML(project.owner, project.name, "members")}
+${flashHtml}
+
+<div class="card">
+<h2>当前成员（${members.length}）</h2>
+${rowsHtml}
+</div>
+
+${addFormHtml}
+</main></body></html>`;
+}
+
+function memberRowHtml(m: ProjectMemberWithUser, viewer: UserRow, project: ProjectRow): string {
+  const isSelf = m.user_login === viewer.login;
+  const isAdminCountOne = m.role === "admin" && countProjectAdmins(project.id) <= 1;
+  const kindBadge = m.user_kind === "bot" ? `<span class="badge bot">bot</span>` : m.user_kind === "system" ? `<span class="badge">system</span>` : "";
+  const inactiveBadge = m.user_is_active === 1 ? "" : `<span class="badge inactive">禁用</span>`;
+  const selfNote = isSelf ? `<span class="meta">(你)</span>` : "";
+  const disableRole = isSelf && isAdminCountOne;
+  const disableRemove = isAdminCountOne;
+
+  const roleSelect = `<form method="POST" action="${escapeAttr(`/${encodeURIComponent(project.owner)}/${encodeURIComponent(project.name)}/settings/members/${encodeURIComponent(m.user_login)}/role`)}">
+<select name="role" onchange="this.form.submit()">
+${ALL_ROLES.map((r) => `<option value="${r}"${r === m.role ? " selected" : ""}>${r}</option>`).join("")}
+</select>
+${disableRole ? `<span class="meta" title="最后一个 admin 不能改自己">🔒</span>` : ""}
+</form>`;
+
+  const removeBtn = `<form method="POST" action="${escapeAttr(`/${encodeURIComponent(project.owner)}/${encodeURIComponent(project.name)}/settings/members/${encodeURIComponent(m.user_login)}/remove`)}" onsubmit="return confirm('移除成员 ${escapeAttr(m.user_login)}？')">
+<button type="submit" class="btn-danger"${disableRemove ? " disabled title='最后一个 admin 不能移除'" : ""}>移除</button>
+</form>`;
+
+  return `<tr>
+<td class="login">${escapeHtml(m.user_login)} ${selfNote} ${kindBadge} ${inactiveBadge}</td>
+<td>${roleBadge(m.role)}</td>
+<td class="muted">${escapeHtml((m.created_at || "").slice(0, 10))}</td>
+<td class="act">${roleSelect} ${removeBtn}</td>
+</tr>`;
+}

package/src/views/projectUpstreams.ts

@@ -0,0 +1,145 @@
+import { THEME_CSS, escapeHtml, escapeAttr, tabNavHTML } from "../render/layout";
+import {
+  getDefaultUpstreamUrl,
+  getProjectUpstreamUrls,
+  setProjectUpstreamUrls,
+  StoreError,
+  type ProjectRow,
+  type UserRow,
+} from "../store";
+
+interface Flash {
+  kind: "ok" | "err";
+  msg: string;
+}
+
+export function projectSettingsTabsHTML(
+  owner: string,
+  name: string,
+  active: "webhooks" | "members" | "upstreams",
+): string {
+  const base = `/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/settings`;
+  const cls = (which: typeof active) => (active === which ? " active" : "");
+  return `<nav class="subtabs">
+    <a class="subtab${cls("webhooks")}" href="${escapeAttr(base)}/webhooks">Webhooks</a>
+    <a class="subtab${cls("members")}" href="${escapeAttr(base)}/members">成员</a>
+    <a class="subtab${cls("upstreams")}" href="${escapeAttr(base)}/upstreams">上游</a>
+  </nav>`;
+}
+
+// Try to convert a Git clone URL into a clickable web URL. Returns null if the
+// protocol can't be reliably mapped (e.g. SSH SCP form `git@host:o/r`).
+function webUrlFromClone(cloneUrl: string): string | null {
+  if (/^https?:\/\//i.test(cloneUrl)) {
+    return cloneUrl.replace(/\.git$/i, "");
+  }
+  if (/^ssh:\/\/([^/]+)\/(.+)$/i.test(cloneUrl)) {
+    // ssh://user@host:port/owner/repo → https://host/owner/repo
+    const m = cloneUrl.match(/^ssh:\/\/(?:[^@]*@)?([^:/]+)(?::\d+)?\/(.+)$/i);
+    if (m && m[1] && m[2]) return `https://${m[1]}/${m[2].replace(/\.git$/i, "")}`;
+  }
+  return null;
+}
+
+function urlRowHtml(url: string, idx: number): string {
+  const isDefault = idx === 0;
+  const webUrl = webUrlFromClone(url);
+  const link = webUrl
+    ? `<a href="${escapeAttr(webUrl)}" target="_blank" rel="noopener noreferrer">${escapeHtml(url)}</a>`
+    : `<code>${escapeHtml(url)}</code>`;
+  return `<tr>
+    <td class="idx">${isDefault ? '<span class="badge default">默认</span>' : String(idx + 1)}</td>
+    <td class="url">${link}</td>
+  </tr>`;
+}
+
+export function buildProjectUpstreamsPage(
+  _viewer: UserRow,
+  project: ProjectRow,
+  flash: Flash | null,
+): string {
+  const urls = getProjectUpstreamUrls(project);
+  const rowsHtml = urls.length
+    ? `<table>
+<thead><tr><th>序</th><th>URL</th></tr></thead>
+<tbody>${urls.map((u, i) => urlRowHtml(u, i)).join("")}</tbody>
+</table>`
+    : `<div class="hint">该项目还没有绑定上游 Git 仓库。在下方添加（每行一个 URL，第一个为默认上游）。</div>`;
+
+  const flashHtml = flash ? `<div class="flash ${flash.kind}">${escapeHtml(flash.msg)}</div>` : "";
+  const formAction = `/${encodeURIComponent(project.owner)}/${encodeURIComponent(project.name)}/settings/upstreams`;
+  const textareaContent = escapeHtml(urls.join("\n"));
+
+  return `<!doctype html>
+<html lang="zh"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<link rel="icon" type="image/svg+xml" href="/favicon.svg">
+<title>上游 · ${escapeHtml(project.owner)}/${escapeHtml(project.name)}</title>
+<style>${THEME_CSS}
+.flash{padding:.5rem .7rem;border-radius:6px;font-size:13px;margin-bottom:.8rem}
+.flash.ok{background:color-mix(in srgb,var(--green) 18%,transparent);color:var(--green)}
+.flash.err{background:color-mix(in srgb,#f85149 18%,transparent);color:#f85149}
+.wrap{max-width:920px;margin:0 auto;padding:1rem}
+h1{font-size:18px;margin:0 0 .4rem}
+h1 a{color:var(--text)}
+.subtabs{display:flex;gap:.4rem;padding:.4rem 0 0;border-bottom:1px solid var(--border);margin-bottom:.9rem}
+.subtab{padding:.35rem .8rem;border-radius:6px 6px 0 0;font-size:13px;color:var(--text-muted)}
+.subtab.active{background:var(--bg-muted);color:var(--text);font-weight:600}
+.card{background:var(--bg-elev);border:1px solid var(--border);border-radius:10px;padding:.9rem 1rem;margin-bottom:.9rem}
+.card h2{font-size:14px;margin:0 0 .7rem;font-weight:600}
+table{width:100%;border-collapse:collapse;font-size:13px}
+th,td{text-align:left;padding:.55rem .45rem;border-bottom:1px solid var(--border);vertical-align:middle}
+th{color:var(--text-muted);font-weight:600;font-size:12px}
+td.url{word-break:break-all}
+td.url code{font-family:ui-monospace,monospace;font-size:12px}
+td.idx{width:60px;color:var(--text-muted);white-space:nowrap}
+.badge.default{background:color-mix(in srgb,var(--accent) 18%,transparent);color:var(--accent);font-size:11px;font-weight:600;padding:.1rem .45rem;border-radius:4px}
+.hint{color:var(--text-muted);font-size:12px;line-height:1.5;margin:.4rem 0}
+label{display:block;font-size:12px;color:var(--text-muted);margin:0 0 .25rem}
+textarea{width:100%;box-sizing:border-box;padding:.5rem .65rem;border:1px solid var(--border);border-radius:6px;background:var(--bg);color:var(--text);font:inherit;font-family:ui-monospace,monospace;font-size:13px;margin-bottom:.7rem;min-height:120px;resize:vertical}
+button.primary{padding:.5rem 1rem;border:0;border-radius:6px;background:var(--accent);color:#fff;font-size:13px;cursor:pointer}
+</style></head><body>
+<header class="topbar"><span style="font-weight:600">🔗 ${escapeHtml(project.owner)}/${escapeHtml(project.name)} · 上游</span></header>
+${tabNavHTML("projects")}
+<main class="wrap">
+<h1><a href="/${escapeAttr(project.owner)}/${escapeAttr(project.name)}/issues">${escapeHtml(project.owner)}/${escapeHtml(project.name)}</a> · 上游 Git 仓库</h1>
+${projectSettingsTabsHTML(project.owner, project.name, "upstreams")}
+${flashHtml}
+
+<div class="card">
+<h2>当前绑定的上游（${urls.length}）</h2>
+${rowsHtml}
+</div>
+
+<form class="card" method="POST" action="${escapeAttr(formAction)}">
+<h2>编辑上游 URL</h2>
+<label for="f-urls">每行一个 URL；第一个为<strong>默认上游</strong>（webhook payload 的 <code>repository.clone_url</code> 会用它）</label>
+<textarea id="f-urls" name="urls" placeholder="https://gitea.example.com/owner/repo.git&#10;git@github.com:owner/repo.git">${textareaContent}</textarea>
+<div class="hint">支持协议：<code>http(s)://</code>、<code>ssh://</code>、<code>git@host:owner/repo</code>。最多 10 个。空行会被忽略，重复会被去重。</div>
+<button class="primary" type="submit">保存</button>
+</form>
+</main></body></html>`;
+}
+
+export function parseUpstreamUrlsForm(text: string): string[] {
+  return text
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0);
+}
+
+export function trySetUpstreamUrls(
+  projectId: number,
+  raw: string,
+): { ok: true; urls: string[] } | { ok: false; msg: string } {
+  try {
+    const urls = parseUpstreamUrlsForm(raw);
+    const cleaned = setProjectUpstreamUrls(projectId, urls);
+    return { ok: true, urls: cleaned };
+  } catch (e) {
+    const msg = e instanceof StoreError ? e.message : e instanceof Error ? e.message : "保存失败";
+    return { ok: false, msg };
+  }
+}
+
+export { getDefaultUpstreamUrl, webUrlFromClone };