hfs 3.0.7 → 3.1.0-alpha2

package/src/srp.js

@@ -3,19 +3,18 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.srpClientSequence = srpClientSequence;
 exports.srpClientPart = srpClientPart;
-const tssrp6a_1 = require("tssrp6a");
-async function srpClientSequence(username, password, apiCall, extra) {
+async function srpClientSequence(srp, username, password, apiCall, extra) {
     const { pubKey, salt } = await apiCall('loginSrp1', { username });
     if (!salt)
         throw Error('salt');
-    const client = await srpClientPart(username, password, salt, pubKey);
+    const client = await srpClientPart(srp, username, password, salt, pubKey);
     const res = await apiCall('loginSrp2', { pubKey: String(client.A), proof: String(client.M1), ...extra }); // bigint-s must be cast to string to be json-ed
     await client.step3(BigInt(res.proof)).catch(() => Promise.reject('trust'));
     return res;
 }
-async function srpClientPart(username, password, salt, pubKey) {
-    const srp6aNimbusRoutines = new tssrp6a_1.SRPRoutines(new tssrp6a_1.SRPParameters());
-    const srpClient = new tssrp6a_1.SRPClientSession(srp6aNimbusRoutines);
+async function srpClientPart(srp, username, password, salt, pubKey) {
+    const srp6aNimbusRoutines = new srp.SRPRoutines(new srp.SRPParameters());
+    const srpClient = new srp.SRPClientSession(srp6aNimbusRoutines);
     const res = await srpClient.step1(username, password);
     return await res.step2(BigInt(salt), BigInt(pubKey));
 }

package/src/stat.js

@@ -4,9 +4,12 @@ exports.getStatWorker = getStatWorker;
 const node_worker_threads_1 = require("node:worker_threads");
 const node_fs_1 = require("node:fs");
 const cross_1 = require("./cross");
+const first_1 = require("./first");
 // all stat requests for the same worker are serialized, potentially introducing extra latency
 const pool = new Map();
 function getStatWorker(key) {
+    if (first_1.quitting)
+        return () => Promise.reject('quitting');
     const existing = pool.get(key);
     if (existing)
         return existing;
@@ -15,7 +18,7 @@ function getStatWorker(key) {
     const requests = new Map();
     worker.on('message', (msg) => {
         const k = msg.path;
-        requests.get(k)?.resolve(msg.error ? Promise.reject(new Error(msg.error))
+        requests.get(k)?.resolve(msg.error ? Promise.reject(Error(msg.error))
             : Object.setPrototypeOf(msg.result, node_fs_1.Stats.prototype));
         requests.delete(k);
     });

package/src/update.js

@@ -19,7 +19,6 @@ const misc_1 = require("./misc");
 const fs_1 = require("fs");
 const plugins_1 = require("./plugins");
 const promises_1 = require("fs/promises");
-const open_1 = __importDefault(require("open"));
 const config_1 = require("./config");
 const util_os_1 = require("./util-os");
 const first_1 = require("./first");
@@ -134,14 +133,18 @@ async function update(tagOrUrl = '') {
     }
     if (url) {
         console.log("downloading", url);
-        const { body } = await (0, misc_1.httpWithBody)(url);
-        if (!body)
-            throw "Download failed for " + url;
-        await (0, promises_1.writeFile)(LOCAL_UPDATE, body);
+        try {
+            await (0, promises_1.writeFile)(LOCAL_UPDATE, await (0, misc_1.httpStream)(url));
+        }
+        catch (e) {
+            await (0, promises_1.rm)(LOCAL_UPDATE).catch(() => { }); // no leftovers
+            throw "Download failed for " + url + (0, misc_1.prefix)(' – ', e?.message);
+        }
+        console.debug("download finished");
     }
     const bin = process.execPath;
     const binPath = (0, path_1.dirname)(bin);
-    const binFile = 'hfs' + (const_1.IS_WINDOWS ? '.exe' : ''); // currently running bin could have been renamed
+    const binFile = 'hfs' + (const_1.IS_WINDOWS ? '.exe' : ''); // the bin we are currently running could have been renamed
     let newBinFile = binFile;
     do {
         newBinFile = 'new-' + newBinFile;
@@ -170,7 +173,7 @@ async function update(tagOrUrl = '') {
             catch { }
             (0, fs_1.renameSync)(bin, oldBin);
             console.log("launching new version in background", newBinFile);
-            launch(newBin, ['--updating', binFile, '--cwd .'], { sync: true }); // sync necessary to work on Mac by double-click
+            (0, child_process_1.spawnSync)((0, util_os_1.cmdEscape)(newBin), ['--updating', binFile, '--cwd .'], { shell: true, stdio: [0, 1, 2] }); // sync necessary to work on Mac by double-click
         });
         console.log("quitting");
         setTimeout(() => process.exit()); // give time to return (and caller to complete, eg: rest api to reply)
@@ -180,28 +183,18 @@ async function update(tagOrUrl = '') {
         throw e?.message || String(e);
     }
 }
-function launch(cmd, pars = [], options) {
-    return (options?.sync ? child_process_1.spawnSync : child_process_1.spawn)((0, util_os_1.cmdEscape)(cmd), pars, { detached: true, shell: true, stdio: [0, 1, 2], ...options });
-}
 if (argv_1.argv.updating) { // we were launched with a temporary name, restore original name to avoid breaking references
     const bin = process.execPath;
     const dest = (0, path_1.join)((0, path_1.dirname)(bin), argv_1.argv.updating);
     (0, fs_1.renameSync)(bin, dest);
-    // have to relaunch with the new name, or otherwise next update will fail with EBUSY on hfs.exe
+    // have to relaunch with the new name, or otherwise the next update will fail with EBUSY on hfs.exe
     console.log(`renamed binary file to "${argv_1.argv.updating}" and now restarting`);
-    // be sure to test launching both double-clicking and in a terminal
-    if (const_1.IS_WINDOWS) // this method on Mac works only once, and without console
-        (0, first_1.onProcessExit)(() => launch(dest, ['--updated', '--cwd .'])); // launch+sync here would cause old process to stay open, locking ports
-    else {
-        /* open() is the only consistent way that I could find working on macos preserving console input/output over relaunching,
-         * but I couldn't find a way to pass parameters, at least on Linux. The workaround I'm using is to write them to a temp file, that's read and deleted at restart.
-         * For the record, on mac you can: write "./hfs arg1 arg2" to /tmp/tmp.sh with 0o700, and then spawn "open -a Terminal /tmp/tmp.sh"
-         */
-        try {
-            (0, fs_1.writeFileSync)(const_1.ARGS_FILE, JSON.stringify(['--updated', '--cwd', process.cwd().replaceAll(' ', '\\ ')]));
-        }
-        catch { }
-        void (0, open_1.default)(dest);
-    }
+    // if you change anything, be sure to test launching both double-clicking and in a terminal
+    if (const_1.IS_WINDOWS) // windows-only; this method on Mac works only once, and without the console
+        (0, first_1.onProcessExit)(() => (0, child_process_1.spawn)((0, util_os_1.cmdEscape)(dest), ['--updated', '--cwd .'], { detached: true, shell: true, stdio: [0, 1, 2] })); // launch+sync here would cause the old process to stay open, locking ports
+    else if (process.stdin.isTTY && process.stdout.isTTY) // keep interactive terminal users attached to the restarted process
+        (0, child_process_1.spawnSync)(dest, ['--updated', '--cwd', process.cwd()], { stdio: [0, 1, 2] });
+    else
+        (0, child_process_1.spawn)(dest, ['--updated', '--cwd', process.cwd()], { detached: true, stdio: 'ignore' }).unref();
     process.exit();
 }

package/src/upload.js

@@ -54,7 +54,7 @@ const diskSpaceCache = (0, expiringCache_1.expiringCache)(3_000); // invalidate
 const uploadingFiles = new Map();
 // initially sync for formidable; still sync to avoid async races and PUT piping gaps
 function uploadWriter(base, baseUri, filename, ctx) {
-    if (!filename || !(0, misc_1.isValidFileName)(filename))
+    if (!filename || !(0, misc_1.isValidFileName)(filename) || !filename)
         return fail(const_1.HTTP_FOOL);
     if ((0, vfs_1.statusCodeForMissingPerm)(base, 'can_upload', ctx))
         return fail();
@@ -133,10 +133,10 @@ function uploadWriter(base, baseUri, filename, ctx) {
             fs_1.default.unlinkSync(tempName);
         const writeStream = (0, misc_1.createStreamLimiter)(contentLength ?? Infinity);
         const fullSize = stillToWrite + resume;
-        ctx.state.uploadDestinationPath = tempName;
         // allow plugins to mess with the write-stream, because the read-stream can be complicated in case of multipart
         const obj = { ctx, writeStream, fullPath, tempName, resume, fullSize, uri: '' };
         const resEvent = events_1.default.emit('uploadStart', obj);
+        ctx.state.uploadDestinationPath = tempName;
         if (resEvent?.isDefaultPrevented())
             return;
         const fileStream = fs_1.default.createWriteStream(tempName, resume ? { flags: 'r+', start: resume } : undefined);
@@ -282,7 +282,8 @@ function uploadWriter(base, baseUri, filename, ctx) {
         if (msg)
             ctx.body = msg;
         if (status >= 400 // with other codes Chrome will report ERR_CONNECTION_RESET
-            && !ctx.get('x-hfs-wait')) // you can disable the following behavior
+            && !ctx.get('x-hfs-wait') // you can disable the following behavior
+            && !ctx.req.complete) // if request body is already complete, forcing a disconnect can interfere with follow-up requests on reused sockets.
             setTimeout(() => (0, connections_1.disconnect)(ctx), 200); // don't wait, if the upload is still in progress
     }
 }

package/src/util-files.js

@@ -6,6 +6,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseFileCache = void 0;
 exports.statWithTimeout = statWithTimeout;
+exports.getUncHost = getUncHost;
 exports.isDirectory = isDirectory;
 exports.readFileWithBusyRetry = readFileWithBusyRetry;
 exports.watchDir = watchDir;
@@ -163,7 +164,7 @@ async function createSafeWriteStream(path, options) {
     });
 }
 function isValidFileName(name, acceptUnreadable = false) {
-    return name !== '.' && !(const_1.IS_WINDOWS ? /[/:"*?<>|\\]/ : /\//).test(name) && !hasDirTraversal(name)
+    return name && name !== '.' && !(const_1.IS_WINDOWS ? /[/:"*?<>|\\]/ : /\//).test(name) && !hasDirTraversal(name)
         && (acceptUnreadable || !/[\u0000-\u001F\u007F]/.test(name));
 }
 function exists(path) {

package/src/util-http.js

@@ -112,15 +112,15 @@ function httpStream(url, { body, proxy, jar, noRedirect, httpThrow = true, ...op
                         delete hostJar[k];
                 }
             if (!res.statusCode || httpThrow && res.statusCode >= 400)
-                return reject(new Error(String(res.statusCode), { cause: res }));
+                return reject(Error(String(res.statusCode), { cause: res }));
             let r = res.headers.location;
             if (r && !noRedirect) {
                 const dest = new URL(r, url); // rewrite in case r is just a path, and thus relative to the current url
                 r = dest.toString();
                 const src = new URL(url);
                 const sameOrigin = src.protocol === dest.protocol && src.host === dest.host;
-                return redirected.includes(r) ? reject(new Error('endless http redirection'))
-                    : redirected.length > 20 ? reject(new Error('excessive http redirection'))
+                return redirected.includes(r) ? reject(Error('endless http redirection'))
+                    : redirected.length > 20 ? reject(Error('excessive http redirection'))
                         : resolve(httpStream(r, {
                             httpThrow, jar, proxy,
                             ...lodash_1.default.pick(options, ['agent', 'rejectUnauthorized', 'timeout']),

package/src/vfs.js

@@ -170,10 +170,12 @@ async function getNodeByName(name, parent, assumeMissingToBeFolder = false) {
         return ret;
     }
 }
+const smartUncFolderDetection = (0, config_1.defineConfig)('smart_unc_folder_detection', true);
 async function setIsFolder(node) {
     if (!node.source)
         return;
-    const isFolder = /[\\/]$/.test(node.source) || await nodeStats(node).then(x => x?.isDirectory(), () => undefined);
+    const isFolder = smartUncFolderDetection.get() && (0, misc_1.getUncHost)(node.source) ? !(0, path_1.basename)(node.source).includes('.') // no dot = folder – not very reliable but fast for unreachable unc hosts, and you can opt-out
+        : /[\\/]$/.test(node.source) || await nodeStats(node).then(x => x?.isDirectory(), () => undefined);
     (0, misc_1.setHidden)(node, { isFolder });
     return isFolder;
 }
@@ -328,7 +330,7 @@ async function* walkNode(parent, { ctx, depth = Infinity, prefixPath = '', requi
                             stream.push(null);
                             return null;
                         }
-                        if ((0, comments_1.usingDescriptIon)() && entry.name === comments_1.DESCRIPT_ION)
+                        if ((0, comments_1.usingDescriptIon)() && (entry.name === comments_1.DESCRIPT_ION || entry.name === comments_1.DESCRIPT_ION_ALT))
                             return;
                         const { path } = entry; // this path is not the original deprecated property: we are overwriting/reusing it
                         const isFolder = entry.isDirectory();

package/src/webdav.js

@@ -0,0 +1,297 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handledWebdav = handledWebdav;
+const vfs_1 = require("./vfs");
+const cross_1 = require("./cross");
+const stream_1 = require("stream");
+const promises_1 = require("fs/promises");
+const misc_1 = require("./misc");
+const path_1 = require("path");
+const frontEndApis_1 = require("./frontEndApis");
+const node_crypto_1 = require("node:crypto");
+const const_1 = require("./const");
+const child_process_1 = require("child_process");
+const auth_1 = require("./auth");
+const config_1 = require("./config");
+const expiringCache_1 = require("./expiringCache");
+const forceWebdavLogin = (0, config_1.defineConfig)(cross_1.CFG.force_webdav_login, true, compileWebdavAgentRegex);
+const webdavInitialAuth = (0, config_1.defineConfig)(cross_1.CFG.webdav_initial_auth, 'WebDAVFS', compileWebdavAgentRegex);
+const webdavPrompted = (0, expiringCache_1.expiringCache)(cross_1.DAY);
+const webdavDetectedAgents = new Set();
+const TOKEN_HEADER = 'lock-token';
+const WEBDAV_METHODS = new Set(['PROPFIND', 'PROPPATCH', 'MKCOL', 'MOVE', 'LOCK', 'UNLOCK']);
+const WEBDAV_HINT_HEADERS = ['depth', 'destination', 'overwrite', 'translate', 'if', TOKEN_HEADER, 'x-expected-entity-length'];
+const KNOWN_UA = /webdav|miniredir|davclnt/i;
+const canOverwrite = new Set();
+const locks = new Map();
+function isLocked(path, ctx) {
+    const lock = locks.get(path);
+    if (!lock)
+        return false;
+    const ifHeader = ctx.get('If');
+    const tokenHeader = ctx.get(TOKEN_HEADER);
+    if (hasToken(ifHeader, lock.token) || hasToken(tokenHeader, lock.token))
+        return false;
+    ctx.status = cross_1.HTTP_LOCKED;
+    return true;
+}
+function hasToken(header, token) {
+    if (!header)
+        return false;
+    return header.includes(`<${token}>`) || header.split(/[,;\s]+/).includes(token);
+}
+async function handledWebdav(ctx) {
+    const { path } = ctx;
+    const isWebdavAuthRequest = WEBDAV_METHODS.has(ctx.method) || WEBDAV_HINT_HEADERS.some(h => !!ctx.get(h));
+    const ua = ctx.get('user-agent');
+    if (isWebdavAuthRequest && (0, auth_1.getCurrentUsername)(ctx)) {
+        if (ua)
+            webdavDetectedAgents.add(ua);
+    }
+    if (ctx.path.includes('/._') && ua?.startsWith('WebDAVFS')) { // too much spam from Finder for these files that can contain metas
+        ctx.state.dontLog = true;
+        return ctx.status = cross_1.HTTP_FORBIDDEN;
+    }
+    if (ctx.method === 'OPTIONS') {
+        if (ctx.get('Access-Control-Request-Method'))
+            return; // it's a preflight cors request, not webdav
+        setWebdavHeaders();
+        ctx.body = '';
+        return true;
+    }
+    if (isWebdavAuthRequest && shouldChallengeWebdav())
+        return true;
+    if (ctx.method === 'PUT') {
+        if (isLocked(path, ctx))
+            return true;
+        // Finder first creates an empty file (a test?) then wants to overwrite it, which requires deletion permission, but the user may not have it, causing a renamed upload. To solve, so we give it special permission for a few seconds.
+        const x = ctx.get('x-expected-entity-length'); // field used by Finder's webdav on actual upload, after
+        if (!x && !ctx.length) {
+            canOverwrite.add(path);
+            setTimeout(() => canOverwrite.delete(path), 10_000); // grace period
+        }
+        else if (canOverwrite.has(path)) {
+            canOverwrite.delete(path);
+            const node = await (0, vfs_1.urlToNode)(path, ctx);
+            if (node?.source)
+                await (0, promises_1.rm)(node.source).catch(() => { });
+        }
+        if (x && ctx.length === undefined) // missing length can make PUT fail
+            ctx.req.headers['content-length'] = x;
+        if (KNOWN_UA.test(ua) || webdavDetectedAgents.has(ua))
+            ctx.query.existing ??= 'overwrite'; // with webdav this is our default
+        return; // default handling
+    }
+    if (ctx.method === 'MKCOL') {
+        setWebdavHeaders();
+        if (isLocked(path, ctx))
+            return true;
+        const node = await (0, vfs_1.urlToNode)(path, ctx);
+        if (node)
+            return ctx.status = cross_1.HTTP_METHOD_NOT_ALLOWED;
+        let name = '';
+        const parentNode = await (0, vfs_1.urlToNode)(path, ctx, vfs_1.vfs, v => name = v);
+        if (!parentNode)
+            return ctx.status = cross_1.HTTP_NOT_FOUND;
+        if (!(0, misc_1.isValidFileName)(name))
+            return ctx.status = cross_1.HTTP_BAD_REQUEST;
+        if ((0, vfs_1.statusCodeForMissingPerm)(parentNode, 'can_upload', ctx)) {
+            if (ctx.status === cross_1.HTTP_UNAUTHORIZED)
+                setWebdavHeaders(true);
+            return true;
+        }
+        try {
+            await (0, promises_1.mkdir)((0, path_1.join)(parentNode.source, name));
+            return ctx.status = cross_1.HTTP_CREATED;
+        }
+        catch (e) {
+            return ctx.status = cross_1.HTTP_SERVER_ERROR;
+        }
+    }
+    if (ctx.method === 'MOVE') {
+        setWebdavHeaders();
+        if (isLocked(path, ctx))
+            return true;
+        const node = await (0, vfs_1.urlToNode)(path, ctx);
+        if (!node)
+            return;
+        let dest = ctx.get('destination');
+        const i = dest.indexOf('//');
+        if (i >= 0)
+            dest = dest.slice(dest.indexOf('/', i + 2));
+        if (isLocked(dest, ctx))
+            return true;
+        if ((0, path_1.dirname)(path) === (0, path_1.dirname)(dest)) // rename. `path` is is encoded, so we test before decoding `dest`
+            try {
+                await (0, frontEndApis_1.requestedRename)(node, (0, path_1.basename)(decodeURI(dest)), ctx);
+                return ctx.status = cross_1.HTTP_CREATED;
+            }
+            catch (e) {
+                return ctx.status = e.status || cross_1.HTTP_SERVER_ERROR;
+            }
+        const moveRes = await (0, frontEndApis_1.moveFiles)([path], (0, path_1.dirname)(dest), ctx);
+        if (moveRes instanceof Error)
+            return ctx.status = moveRes.status || cross_1.HTTP_SERVER_ERROR;
+        const err = moveRes?.errors?.[0];
+        return ctx.status = !err ? cross_1.HTTP_CREATED : typeof err === 'number' ? err : cross_1.HTTP_SERVER_ERROR;
+    }
+    if (ctx.method === 'DELETE') {
+        setWebdavHeaders();
+        if (isLocked(path, ctx))
+            return true;
+        return; // allow default handling in serveGuiAndSharedFiles.ts
+    }
+    if (ctx.method === 'UNLOCK') {
+        setWebdavHeaders();
+        const x = ctx.get(TOKEN_HEADER).slice(1, -1);
+        const lock = locks.get(path);
+        if (x !== lock?.token)
+            return ctx.status = cross_1.HTTP_BAD_REQUEST;
+        clearTimeout(lock.timeout);
+        locks.delete(path);
+        ctx.set(TOKEN_HEADER, x);
+        if (const_1.IS_MAC)
+            (0, vfs_1.urlToNode)(path, ctx).then(x => x?.source && dotClean((0, path_1.dirname)(x.source)));
+        return ctx.status = cross_1.HTTP_NO_CONTENT;
+    }
+    if (ctx.method === 'LOCK') {
+        setWebdavHeaders();
+        if (locks.has(path))
+            return ctx.status = 423;
+        const token = 'urn:uuid:' + (0, node_crypto_1.randomUUID)();
+        ctx.set(TOKEN_HEADER, token);
+        const seconds = 3600;
+        const timeout = setTimeout(() => locks.delete(path), seconds * 1000);
+        locks.set(path, { token, timeout });
+        ctx.body = `<?xml version="1.0" encoding="utf-8"?><prop xmlns="DAV:"><lockdiscovery><activelock>
+            <locktype><write/></locktype>
+            <lockscope><exclusive/></lockscope>
+            <locktoken><href>${token}</href></locktoken>
+            <lockroot><href>${path}</href></lockroot>
+            <depth>0</depth>
+            <timeout>Second-${seconds}</timeout>
+        </activelock></lockdiscovery></prop>`;
+        return true;
+    }
+    if (ctx.method === 'PROPFIND') {
+        setWebdavHeaders();
+        const node = await (0, vfs_1.urlToNode)(path, ctx);
+        if (!node)
+            return;
+        let depth = Number(ctx.get('depth'));
+        depth = isNaN(depth) ? Infinity : depth;
+        const isList = depth !== 0;
+        if ((0, vfs_1.statusCodeForMissingPerm)(node, isList ? 'can_list' : 'can_see', ctx)) {
+            if (ctx.status === cross_1.HTTP_UNAUTHORIZED)
+                setWebdavHeaders(true);
+            return true;
+        }
+        ctx.type = 'xml';
+        ctx.status = 207;
+        const pathSlash = (0, cross_1.enforceFinal)('/', path);
+        const res = ctx.body = new stream_1.PassThrough({ encoding: 'utf8' });
+        res.write(`<?xml version="1.0" encoding="utf-8" ?><multistatus xmlns="DAV:">`);
+        await sendEntry(node);
+        if (isList) {
+            depth = Math.max(0, depth - 1);
+            for await (const n of (0, vfs_1.walkNode)(node, { ctx, depth }))
+                await sendEntry(n, true);
+        }
+        res.write(`</multistatus>`);
+        res.end();
+        return true;
+        async function sendEntry(node, append = false) {
+            if ((0, vfs_1.nodeIsLink)(node))
+                return;
+            const name = (0, vfs_1.getNodeName)(node);
+            const isDir = await (0, vfs_1.nodeIsFolder)(node);
+            const st = await (0, vfs_1.nodeStats)(node);
+            res.write(`<response>
+              <href>${pathSlash + (append ? (0, cross_1.pathEncode)(name, true) + (isDir ? '/' : '') : '')}</href>
+              <propstat>
+                <status>HTTP/1.1 200 OK</status>
+                <prop>
+                    ${(0, cross_1.prefix)('<getlastmodified>', st?.mtime?.toGMTString(), '</getlastmodified>')}
+                    ${(0, cross_1.prefix)('<creationdate>', (st?.birthtime || st?.ctime)?.toISOString().replace(/\..*/, '-00:00'), '</creationdate>')}
+                    ${isDir ? '<resourcetype><collection/></resourcetype>'
+                : `<resourcetype/><getcontentlength>${st?.size}</getcontentlength>`}
+                </prop>
+              </propstat>
+              </response>
+            `);
+        }
+    }
+    if (ctx.method === 'PROPPATCH') {
+        setWebdavHeaders();
+        if (isLocked(path, ctx))
+            return true;
+        const node = await (0, vfs_1.urlToNode)(path, ctx);
+        if (!node)
+            return;
+        if ((0, vfs_1.statusCodeForMissingPerm)(node, 'can_see', ctx)) {
+            if (ctx.status === cross_1.HTTP_UNAUTHORIZED)
+                setWebdavHeaders(true);
+            return true;
+        }
+        ctx.type = 'xml';
+        ctx.status = 207;
+        ctx.body = `<?xml version="1.0" encoding="utf-8"?>
+            <multistatus xmlns="DAV:">
+              <response>
+                <href>${path}</href>
+                <propstat>
+                  <status>HTTP/1.1 200 OK</status>
+                  <prop/>
+                </propstat>
+              </response>
+            </multistatus>`;
+        return true;
+    }
+    function setWebdavHeaders(authenticate = false) {
+        ctx.set('DAV', '1,2');
+        ctx.set('MS-Author-Via', 'DAV');
+        ctx.set('Allow', 'PROPFIND,PROPPATCH,OPTIONS,DELETE,MOVE,LOCK,UNLOCK,MKCOL,PUT');
+        if (authenticate)
+            ctx.set('WWW-Authenticate', `Basic realm="HFS WebDAV"`); // keep a dedicated realm for WebDAV so Windows credential cache is isolated from other basic-auth flows
+    }
+    function shouldChallengeWebdav() {
+        if ((0, auth_1.getCurrentUsername)(ctx))
+            return false;
+        if (forceWebdavLogin.compiled()?.test(ua))
+            return challengeWebdav();
+        if (!webdavInitialAuth.compiled()?.test(ua))
+            return false;
+        if (ctx.get('authorization'))
+            return challengeWebdav();
+        const key = `${ctx.ip}|${ctx.host}|${ua || ''}`;
+        if (webdavPrompted.has(key))
+            return false;
+        webdavPrompted.try(key, () => true);
+        return challengeWebdav();
+        function challengeWebdav() {
+            setWebdavHeaders(true);
+            ctx.status = cross_1.HTTP_UNAUTHORIZED;
+            ctx.body = '';
+            return true;
+        }
+    }
+}
+function compileWebdavAgentRegex(v) {
+    return !v ? null : v === true ? /.*/ : new RegExp(v.trim(), 'i');
+}
+// Finder will upload special attributes as files with name ._* that can be merged using system utility "dot_clean"
+const cleaners = {};
+function dotClean(path) {
+    (0, cross_1.getOrSet)(cleaners, path, () => setTimeout(() => {
+        try {
+            (0, child_process_1.exec)('dot_clean .', { cwd: path }, (err, out) => done(err || out));
+        }
+        catch (e) {
+            done(e);
+        }
+        function done(log) {
+            console.debug('dot_clean', path, log);
+            delete cleaners[path];
+        }
+    }, 10_000));
+}