fedipod-server 0.29.0 → 0.31.0

package/lib/client/localapi.mjs

@@ -1,87 +0,0 @@
-// localapi.mjs — talking to an agent on this machine.
-//
-// The agent serves https and nothing else, on the one port it was given. Its
-// certificate is signed by this install's own certificate authority, which no
-// public trust store knows about, so a plain fetch() would refuse it. Every
-// caller here is on loopback reaching a listener this install started, so the
-// answer is to trust that one authority — never to skip verification.
-//
-// Returns a small fetch-shaped result ({ status, ok, text(), json() }) so call
-// sites read the way they did when this was cleartext http.
-
-import https from 'node:https';
-import fs from 'node:fs';
-import path from 'node:path';
-import { rootOf, apRoot } from '../device/home.mjs';
-import { certPaths } from '../device/certs.mjs';
-
-/**
- * The authorities worth offering for a loopback call: this install's, and the
- * machine's default install's. The well-known door on 8030 is held by
- * whichever agent got there first, which may belong to a different root than
- * the one this command is acting in — so both are candidates. An empty list
- * means no certificate has been minted anywhere, and the call will fail the
- * way any unreachable agent does.
- */
-export function localCa(home) {
-  const read = (root) => {
-    try { return fs.readFileSync(certPaths(path.join(root, 'certs')).caCert); } catch { return null; }
-  };
-  // This install's own authority decides, and alone: every install names its
-  // authority the same thing, so offering two lets the verifier match by name
-  // and then fail on the signature. Only an install with no authority of its
-  // own falls back to the machine's default — that is the case of a command
-  // run outside any install reaching the well-known door.
-  const mine = home ? read(rootOf(home)) : null;
-  if (mine) return [mine];
-  try { const fallback = read(apRoot()); if (fallback) return [fallback]; } catch { /* no home dir */ }
-  return null;
-}
-
-/**
- * One request to an agent on this machine. `home` names any identity under the
- * install, which is how the CA is found; `port` is the agent's own port.
- */
-export async function localFetch(home, port, pathname, opts = {}) {
-  const res = await once(home, port, pathname, opts);
-  // The well-known door answers with a redirect to whichever agent holds it,
-  // so a probe that lands there has to follow it the way fetch() would.
-  if (opts.redirect === 'manual' || res.status < 300 || res.status >= 400) return res;
-  const to = res.headers?.location;
-  if (!to) return res;
-  const target = new URL(to, `https://localhost:${port}`);
-  return once(home, Number(target.port) || 443, target.pathname + target.search, opts);
-}
-
-function once(home, port, pathname, { method = 'GET', headers = {}, body, timeout = 0 } = {}) {
-  const ca = localCa(home);
-  return new Promise((resolve, reject) => {
-    const req = https.request({
-      host: 'localhost', port, path: pathname, method,
-      // One-shot calls: a kept-alive socket holds the agent's listener open, so
-      // a shutdown asked for over this channel would never finish.
-      headers: { connection: 'close', ...headers },
-      ...(ca ? { ca } : {}),
-      // The certificate carries localhost and *.localhost; on some systems
-      // "localhost" resolves to ::1 first, which the name check still covers.
-      servername: 'localhost',
-    }, (res) => {
-      const chunks = [];
-      res.on('data', (c) => chunks.push(c));
-      res.on('end', () => {
-        const text = Buffer.concat(chunks).toString('utf8');
-        resolve({
-          status: res.statusCode,
-          ok: res.statusCode >= 200 && res.statusCode < 300,
-          headers: res.headers,
-          text: async () => text,
-          json: async () => JSON.parse(text),
-        });
-      });
-    });
-    req.on('error', reject);
-    if (timeout) req.setTimeout(timeout, () => req.destroy(new Error('timed out')));
-    if (body !== undefined && body !== null) req.write(body);
-    req.end();
-  });
-}

package/lib/client/masto/accounts.mjs

@@ -1,310 +0,0 @@
-// accounts.mjs — the account endpoints: the owner's credentials and profile
-// editor, follow requests, markers, relationships, search and lookup, block
-// and mute, follow and unfollow, an account and its lists and statuses, and
-// the web-push subscription a client login holds.
-
-import crypto from 'node:crypto';
-import * as podMedia from '../../pod/media.mjs';
-import * as social from '../../core/social.mjs';
-import { readBody, readMultipart } from './body.mjs';
-
-export async function handle(api, ctx) {
-  const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
-
-  if (pathname === '/api/v1/accounts/verify_credentials') {
-    const cfg0 = api.store.getConfig() || {};
-    return send(200, {
-      ...api.selfAccount(),
-      // `source` is what the editor fills its inputs from: the raw text it
-      // will send back, not the HTML the profile renders.
-      source: {
-        privacy: 'public', sensitive: false, language: 'en',
-        note: cfg0.summary || '',
-        fields: (cfg0.fields || []).map(f => ({ name: f.name, value: f.value })),
-      },
-    });
-  }
-
-  // The profile editor. Everything it can send is carried: the name and bio,
-  // both pictures, and the extra fields. An avatar or header arrives as file
-  // bytes, so it goes to the pod's media container first and the actor gets
-  // the URL — the same path a posted attachment takes.
-  if (pathname === '/api/v1/accounts/update_credentials') {
-    if (req.method !== 'PATCH' && req.method !== 'POST') return send(405, { error: 'PATCH expected' });
-    const ct = String(req.headers['content-type'] || '');
-    // readBody already covers JSON and urlencoded; only the file case differs.
-    let form = {}, files = {};
-    if (ct.includes('multipart/form-data')) ({ fields: form, files } = await readMultipart(req));
-    else form = await readBody(req);
-
-    const cfg = { ...api.store.getConfig() };
-    const putImage = async (f) => {
-      const ext = (f.filename || '').includes('.')
-        ? f.filename.split('.').pop().replace(/[^\w]/g, '') : 'bin';
-      const slug = new Date().toISOString().slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex') + '.' + ext;
-      const url = api.urls.media + slug;
-      await api.agent.publisher.ensureMediaContainer();
-      await podMedia.write(api.agent.remote, url, f.data, f.contentType);
-      return url;
-    };
-
-    if ('display_name' in form) cfg.name = String(form.display_name).trim() || cfg.handle;
-    if ('note' in form) cfg.summary = String(form.note) || undefined;
-    if ('locked' in form) cfg.approveJoins = form.locked === 'true' || form.locked === true;
-    if (files.avatar?.data?.length) cfg.icon = await putImage(files.avatar);
-    if (files.header?.data?.length) cfg.image = await putImage(files.header);
-
-    // fields_attributes arrives as fields_attributes[0][name] etc. A row with
-    // no name is how the editor says "delete this one", so it is dropped.
-    const rows = [];
-    for (const [k, v] of Object.entries(form)) {
-      const m = /^fields_attributes\[(\d+)\]\[(name|value)\]$/.exec(k);
-      if (!m) continue;
-      (rows[Number(m[1])] ||= {})[m[2]] = String(v);
-    }
-    if (rows.length) cfg.fields = rows.filter(r => r && r.name?.trim())
-      .map(r => ({ name: r.name.trim(), value: (r.value || '').trim() }));
-
-    api.store.setConfig(cfg);
-    Object.assign(api.agent.publisher.config, {
-      name: cfg.name, summary: cfg.summary, icon: cfg.icon, image: cfg.image,
-      fields: cfg.fields, approveJoins: !!cfg.approveJoins,
-    });
-    await api.store.flush();
-    // publishProfile says whether the world can actually read the actor it
-    // just wrote. Discarding that reported success for a save that left the
-    // account undiscoverable — the one outcome the caller needed to hear.
-    const published = await api.agent.publisher.publishProfile();
-    const unreachable = published?.unreachable;
-    if (unreachable?.length) {
-      api.log(`profile saved but NOT publicly readable: ${unreachable.join(', ')}`);
-    }
-    api.log(`profile updated from a client: ${Object.keys(form).join(', ') || '(files only)'}`);
-    return send(200, api.selfAccount());
-  }
-
-  // Follow requests. The queue, and the two answers to it, have existed since
-  // groups did — `agent.store.getRequests()`, `admitRequest`, `refuseRequest`,
-  // all driven from the record page — but the facade stubbed the list to `[]`
-  // and offered no authorize/reject. So a locked account could see and answer
-  // its requests in FediPod's own page and in NO Mastodon client: Phanpy,
-  // Tuba and Whalebird all showed nothing waiting.
-  if (pathname === '/api/v1/follow_requests' && req.method === 'GET') {
-    const limit = Math.min(Number(url.searchParams.get('limit')) || 40, 80);
-    return send(200, api.store.getRequests().slice(0, limit)
-      .map((r) => api.account(r.actor)));
-  }
-  const mReq = /^\/api\/v1\/follow_requests\/([a-f0-9]+)\/(authorize|reject)$/.exec(pathname);
-  if (mReq && req.method === 'POST') {
-    // The client addresses an account by the id it was given for it, which is
-    // this store's own hash of the actor URL — the same one every other
-    // account route here uses.
-    const actorUrl = api.store.urlFor(mReq[1]);
-    if (!actorUrl) return send(404, { error: 'Record not found' });
-    if (!api.store.getRequests().some((r) => r.actor === actorUrl)) {
-      return send(404, { error: 'Record not found' });
-    }
-    try {
-      if (mReq[2] === 'authorize') await social.admitRequest(api.agent, actorUrl);
-      else await social.refuseRequest(api.agent, actorUrl);
-    } catch (e) { return send(422, { error: e.message }); }
-    await api.store.flush();
-    return send(200, api.relationship(actorUrl));
-  }
-
-  if (pathname === '/api/v1/markers') {
-    if (req.method === 'POST') {
-      const body = await readBody(req);
-      const markers = api.store.read('masto-markers.json', {});
-      for (const [k, v] of Object.entries(body)) {
-        const lastId = v?.last_read_id || v;
-        if (typeof lastId === 'string') {
-          markers[k] = { last_read_id: lastId, version: (markers[k]?.version || 0) + 1, updated_at: new Date().toISOString() };
-        }
-      }
-      api.store.write('masto-markers.json', markers);
-      return send(200, markers);
-    }
-    return send(200, api.store.read('masto-markers.json', {}));
-  }
-
-  if (pathname === '/api/v1/accounts/relationships') {
-    const ids = [...url.searchParams.getAll('id[]'), ...url.searchParams.getAll('id')];
-    const rels = ids.map(id => api.store.urlFor(id)).filter(Boolean).map(u => api.relationship(u));
-    return send(200, rels);
-  }
-
-  if (pathname === '/api/v1/accounts/search') {
-    return send(200, await api.accountSearch(url.searchParams.get('q')));
-  }
-
-  if (pathname === '/api/v1/accounts/lookup') {
-    const acct = String(url.searchParams.get('acct') || '').replace(/^@/, '');
-    const cfg = api.store.getConfig();
-    if (acct === cfg?.handle || acct === `${cfg?.handle}@${api.host}`) {
-      return send(200, api.selfAccount());
-    }
-    // By host with its port, as the account is shown; and by hostname alone,
-    // for a client that drops the port from an address it was given.
-    const hit = Object.entries(api.store.getActors()).find(([u, a]) => {
-      try {
-        const at = new URL(u);
-        return `${a.preferredUsername}@${at.host}` === acct || `${a.preferredUsername}@${at.hostname}` === acct;
-      } catch { return false; }
-    });
-    return hit ? send(200, api.account(hit[0])) : send(404, { error: 'Record not found' });
-  }
-
-  // Block and mute, from where the trouble is seen. A block also unfollows —
-  // intake refuses a blocked author already — and a mute is view-only: their
-  // posts stay out of the timelines, nothing federates.
-  const mRel = /^\/api\/v1\/accounts\/([a-f0-9]+)\/(block|unblock|mute|unmute)$/.exec(pathname);
-  if (mRel && req.method === 'POST') {
-    const actorUrl = api.store.urlFor(mRel[1]);
-    if (!actorUrl) return send(404, { error: 'Record not found' });
-    if (mRel[2] === 'block' || mRel[2] === 'unblock') {
-      if (mRel[2] === 'block') await social.blockActor(api.agent, actorUrl);
-      else await social.unblockActor(api.agent, actorUrl);
-    } else {
-      const m = api.store.getMuted();
-      if (mRel[2] === 'mute' && !m.actors.includes(actorUrl)) m.actors.push(actorUrl);
-      if (mRel[2] === 'unmute') m.actors = m.actors.filter(a => a !== actorUrl);
-      api.store.setMuted(m);
-    }
-    return send(200, api.relationship(actorUrl));
-  }
-
-  const mFollow = /^\/api\/v1\/accounts\/([a-f0-9]+)\/(follow|unfollow)$/.exec(pathname);
-  if (mFollow && req.method === 'POST') {
-    const actorUrl = api.store.urlFor(mFollow[1]);
-    if (!actorUrl) return send(404, { error: 'Record not found' });
-    if (mFollow[2] === 'follow') await social.followActor(api.agent, actorUrl);
-    else await social.unfollowActor(api.agent, actorUrl).catch(() => {});   // already-gone is fine
-    return send(200, api.relationship(actorUrl));
-  }
-
-  const mAccount = /^\/api\/v1\/accounts\/([a-f0-9]+)$/.exec(pathname);
-  if (mAccount && req.method === 'GET') {
-    const actorUrl = api.store.urlFor(mAccount[1]);
-    return actorUrl ? send(200, api.account(actorUrl)) : send(404, { error: 'Record not found' });
-  }
-
-  // Web push: one subscription per client login. The agent pushes payloads
-  // to the browser's push service itself, so a closed client still hears.
-  if (pathname === '/api/v1/push/subscription') {
-    const token = (/^Bearer (.+)$/.exec(req.headers.authorization || '') || [])[1];
-    if (!token) return send(401, { error: 'The access token is invalid' });
-    // A client that ignores the missing `vapid` and subscribes anyway must
-    // not be told it worked — a stored subscription nothing ever pushes to is
-    // the same silent nothing the toggle was.
-    if (!api.webPush) return send(422, { error: 'this instance does not send web push' });
-    if (req.method === 'GET') {
-      const sub = api.push.get(token);
-      return sub ? send(200, api.push.json(token, sub)) : send(404, { error: 'Record not found' });
-    }
-    if (req.method === 'POST') {
-      const body = await readBody(req);
-      const sub = api.push.set(token, {
-        endpoint: body.subscription?.endpoint,
-        keys: body.subscription?.keys,
-        alerts: body.data?.alerts,
-      });
-      if (!sub) return send(422, { error: 'a https endpoint and p256dh/auth keys are required' });
-      return send(200, api.push.json(token, sub));
-    }
-    if (req.method === 'PUT') {
-      const body = await readBody(req);
-      const sub = api.push.setAlerts(token, body.data?.alerts);
-      return sub ? send(200, api.push.json(token, sub)) : send(404, { error: 'Record not found' });
-    }
-    if (req.method === 'DELETE') {
-      api.push.drop(token);
-      return send(200, {});
-    }
-  }
-
-  if (/^\/api\/v1\/accounts\/[a-f0-9]+\/featured_tags$/.test(pathname)) return send(200, []);
-
-  // The instance's own directory is its one account; there is nothing to
-  // suggest and nothing trending, so those screens are empty rather than 404.
-  if (pathname === '/api/v1/directory') return send(200, api.urls?.actor ? [api.account(api.urls.actor)] : []);
-  if (pathname === '/api/v1/suggestions') return send(200, []);
-
-  // The lists this account is on — what "add to list" from a profile reads.
-  const mAccLists = /^\/api\/v1\/accounts\/([a-f0-9]+)\/lists$/.exec(pathname);
-  if (mAccLists && req.method === 'GET') {
-    const actorUrl = api.store.urlFor(mAccLists[1]);
-    if (!actorUrl) return send(404, { error: 'Record not found' });
-    return send(200, api.store.getLists().filter(l => (l.members || []).includes(actorUrl))
-      .map(l => ({ id: l.id, title: l.title, replies_policy: l.repliesPolicy || 'list', exclusive: false })));
-  }
-
-  // The people muted and blocked, as accounts; the domains blocked, as names.
-  if (pathname === '/api/v1/mutes' && req.method === 'GET') {
-    return send(200, (api.store.getMuted().actors || []).map(a => api.account(a)));
-  }
-  if (pathname === '/api/v1/blocks' && req.method === 'GET') {
-    return send(200, (api.store.getBlocklist().actors || []).map(a => api.account(a)));
-  }
-  if (pathname === '/api/v1/domain_blocks') {
-    const b = api.store.getBlocklist();
-    if (req.method === 'GET') return send(200, [...b.domains]);
-    const body = await readBody(req);
-    const domain = String(body.domain || url.searchParams.get('domain') || '').trim().toLowerCase();
-    if (!/^[a-z0-9.-]+\.[a-z]{2,}$/u.test(domain)) return send(422, { error: 'a domain is required' });
-    if (req.method === 'POST' && !b.domains.includes(domain)) b.domains.push(domain);
-    if (req.method === 'DELETE') b.domains = b.domains.filter(d => d !== domain);
-    api.store.setBlocklist(b);
-    Promise.resolve(api.agent?.publisher?.publishCollections?.({ blocked: true })).catch(() => {});
-    return send(200, {});
-  }
-
-  // The counts these back are rendered from the same two arrays (see
-  // `account`), so a client that shows a number here can always open it.
-  const mAccList = /^\/api\/v1\/accounts\/([a-f0-9]+)\/(following|followers)$/.exec(pathname);
-  if (mAccList && req.method === 'GET') {
-    const actorUrl = api.store.urlFor(mAccList[1]);
-    if (!actorUrl) return send(404, { error: 'Record not found' });
-    // Only our own lists are known. A remote actor's collections live on its
-    // own server, and opening a profile is not worth a fetch of a stranger's
-    // pod — an empty list, not an error, is what the API can honestly say.
-    const mine = actorUrl === api.urls?.actor;
-    const c = api.store.getContacts();
-    // Reversed: the contact arrays append, and page()'s cursors read
-    // newest-first — fed as stored, since_id answered with its complement.
-    const recs = (!mine ? []
-      : mAccList[2] === 'followers' ? c.followers
-        : c.following.filter(f => f.accepted))   // pending is not following
-      .slice().reverse();
-    const { items, headers } = api.page(recs, url,
-      { limit: 40, max: 80, idOf: (r) => api.store.idFor(r.actor) });
-    return send(200, items.map(r => api.account(r.actor)), headers);
-  }
-
-  // Who among the people I follow also follows THEM — a graph we do not hold,
-  // and the shape is an entry per requested account, not a bare list.
-  if (pathname === '/api/v1/accounts/familiar_followers') {
-    const ids = [...url.searchParams.getAll('id[]'), ...url.searchParams.getAll('id')];
-    return send(200, ids.map(id => ({ id, accounts: [] })));
-  }
-
-  const mAccStatuses = /^\/api\/v1\/accounts\/([a-f0-9]+)\/statuses$/.exec(pathname);
-  if (mAccStatuses) {
-    const actorUrl = api.store.urlFor(mAccStatuses[1]);
-    const all = api.store.getStatuses();
-    const q = url.searchParams;
-    const is = (name) => q.get(name) === 'true' || q.get(name) === '1';
-    const pinnedOnly = is('pinned');
-    const tagged = String(q.get('tagged') || '').replace(/^#/, '').toLowerCase();
-    const isBoost = (s) => !!s.via && s.via !== s.actor;
-    const { items, headers } = api.page(
-      all.filter(s => s.actor === actorUrl && (!pinnedOnly || s.pinned))
-        .filter(s => !is('exclude_replies') || !s.inReplyTo)
-        .filter(s => !is('exclude_reblogs') || !isBoost(s))
-        .filter(s => !is('only_media') || (s.attachments || []).length > 0)
-        .filter(s => !tagged || (s.tags || []).some(t => String(t.name).toLowerCase() === tagged)), url);
-    return send(200, items.map(s => api.statusOrBoost(s, { all })), headers);
-  }
-
-  return false;
-}

package/lib/client/masto/body.mjs

@@ -1,156 +0,0 @@
-// body.mjs — reading what a client sent: JSON, form-encoded or multipart
-// bodies, the poll a compose request carries, and the text of a post back out
-// of its HTML.
-
-
-
-/**
- * A poll out of a compose request, or null when there is none. A JSON client
- * sends a `poll` object; a form-encoded one spells the same thing out in
- * Rails's bracket notation, which is the shape the option list arrives in.
- */
-export function pollParams(body) {
-  const nested = body?.poll && typeof body.poll === 'object' ? body.poll : null;
-  const options = [].concat(nested?.options ?? body?.['poll[options][]'] ?? [])
-    .map(o => String(o ?? '').trim()).filter(Boolean);
-  const rawExpiry = nested?.expires_in ?? body?.['poll[expires_in]'];
-  const rawMultiple = nested?.multiple ?? body?.['poll[multiple]'];
-  if (!options.length && rawExpiry === undefined) return null;
-  return {
-    options,
-    expiresIn: rawExpiry === undefined || rawExpiry === null || rawExpiry === ''
-      ? null : Number(rawExpiry),
-    multiple: rawMultiple === true || rawMultiple === 'true' || rawMultiple === '1',
-  };
-}
-
-// Accepts JSON or form-encoded bodies (OAuth posts are often form-encoded).
-// The source of a post that predates raw-text storage: its HTML back to
-// typed text, near enough to edit.
-export function htmlToText(html) {
-  return String(html)
-    .replace(/<br\s*\/?>/gi, '\n')
-    .replace(/<\/p>\s*<p[^>]*>/gi, '\n\n')
-    .replace(/<[^>]+>/g, '')
-    .replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>')
-    .replace(/&quot;/g, '"').replace(/&#39;/g, "'")
-    .trim();
-}
-
-export function readBody(req) {
-  return new Promise((resolve, reject) => {
-    let data = '';
-    req.on('data', c => {
-      data += c;
-      // Destroying the socket without settling left the awaiting handler
-      // pending for the life of the process and the client waiting on a
-      // response that would never come.
-      if (data.length > 1e6) { req.destroy(); reject(new Error('request body too large')); }
-    });
-    req.on('end', () => {
-      const ct = String(req.headers['content-type'] || '');
-      try {
-        if (ct.includes('application/json')) return resolve(data ? JSON.parse(data) : {});
-        // A multipart body is not a query string: read as one it becomes a
-        // single nonsense key, so every field a client sent that way arrived
-        // undefined. Sengi registers its OAuth client with a FormData, which
-        // is multipart, so /api/v1/apps saw no redirect_uris and handed back
-        // the out-of-band URN, leaving the client nowhere to come back to.
-        if (ct.includes('multipart/form-data')) return resolve(textFields(data, ct));
-        // A form-encoded list is the same key repeated, spelled with a
-        // trailing `[]`. Reading it as a plain object kept only the last one,
-        // so a client sending its poll or its media that way lost all but the
-        // final value. Only the `[]` keys become lists: everything else keeps
-        // the single value the rest of this file reads.
-        const form = new URLSearchParams(data);
-        const out = {};
-        for (const key of new Set(form.keys())) {
-          out[key] = key.endsWith('[]') ? form.getAll(key) : form.get(key);
-        }
-        resolve(out);
-      } catch (e) { reject(e); }
-    });
-    req.on('error', reject);
-  });
-}
-
-/**
- * The text fields of a multipart body that arrived as text. readBody
- * accumulates the body as a string, so this reads the fields out of that
- * string rather than out of bytes — which is all a client sending a plain
- * form this way has in it. A body with a FILE in it is not this reader's:
- * a text round trip corrupts binary, and the upload endpoints take their
- * bytes from readMultipart below.
- */
-function textFields(data, contentType) {
-  const m = /boundary=(?:"([^"]+)"|([^;]+))/.exec(contentType);
-  if (!m) return {};
-  const out = {};
-  for (const part of data.split('--' + (m[1] || m[2]).trim())) {
-    const sep = part.indexOf('\r\n\r\n');
-    if (sep < 0) continue;
-    const head = part.slice(0, sep);
-    const name = /name="([^"]*)"/.exec(head)?.[1];
-    // A file part is skipped rather than kept as mangled text.
-    if (!name || /filename="/.test(head)) continue;
-    const value = part.slice(sep + 4).replace(/\r\n$/, '');
-    if (name.endsWith('[]')) (out[name] ||= []).push(value);
-    else out[name] = value;
-  }
-  return out;
-}
-
-// Minimal multipart/form-data reader for media uploads: string fields plus
-// at most one file part (Mastodon's media endpoints send exactly one).
-export function readMultipart(req, limit = 12e6) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    let n = 0;
-    req.on('data', c => {
-      n += c.length;
-      if (n > limit) { reject(new Error('upload too large')); req.destroy(); return; }
-      chunks.push(c);
-    });
-    req.on('error', reject);
-    req.on('end', () => {
-      try {
-        const m = /boundary=(?:"([^"]+)"|([^;]+))/.exec(String(req.headers['content-type'] || ''));
-        if (!m) return resolve({ fields: {}, file: null });
-        const buf = Buffer.concat(chunks);
-        const boundary = Buffer.from('--' + (m[1] || m[2]).trim());
-        const fields = {};
-        // `file` is the last one seen, which is what the single-file media
-        // upload wants. `files` keys them by field name, because the profile
-        // editor submits an avatar and a header in one request.
-        const files = {};
-        let file = null;
-        let i = buf.indexOf(boundary);
-        while (i >= 0) {
-          const start = i + boundary.length;
-          if (buf.slice(start, start + 2).toString() === '--') break;
-          const next = buf.indexOf(boundary, start);
-          if (next < 0) break;
-          const part = buf.slice(start + 2, next - 2);        // strip the CRLFs framing the part
-          const sep = part.indexOf('\r\n\r\n');
-          if (sep >= 0) {
-            const head = part.slice(0, sep).toString();
-            const body = part.slice(sep + 4);
-            const name = /name="([^"]*)"/.exec(head)?.[1];
-            const filename = /filename="([^"]*)"/.exec(head)?.[1];
-            if (filename !== undefined) {
-              file = {
-                filename,
-                contentType: /content-type:\s*([^\r\n]+)/i.exec(head)?.[1]?.trim() || 'application/octet-stream',
-                data: body,
-              };
-              if (name) files[name] = file;
-            } else if (name) fields[name] = body.toString();
-          }
-          i = next;
-        }
-        resolve({ fields, file, files });
-      } catch (e) { reject(e); }
-    });
-  });
-}
-