hfs 3.1.5 → 3.2.0-beta2

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "hfs",
-  "version": "3.1.5",
+  "version": "3.2.0-beta2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hfs",
-      "version": "3.1.5",
+      "version": "3.2.0-beta2",
       "license": "GPL-3.0",
       "dependencies": {
         "@gregoranders/csv": "^0.0.13",
@@ -21,7 +21,6 @@
         "fs-x-attributes": "^1.0.2",
         "fswin": "^3.24.829",
         "iconv-lite": "^0.7.0",
-        "immer": "^10.1.3",
         "ip2location-nodejs": "^9.7.0",
         "koa": "^3.1.2",
         "koa-compress": "^5.2.0",
@@ -35,10 +34,11 @@
         "open": "^8.4.0",
         "picomatch": "^4.0.3",
         "tssrp6a": "^3.0.0",
-        "unzip-stream": "^0.3.4",
+        "unzipper": "^0.12.3",
         "valtio": "^1.13.2",
         "xxhashjs": "^0.2.2",
-        "yaml": "^2.8.1"
+        "yaml": "^2.8.1",
+        "yazl": "^3.3.1"
       },
       "bin": {
         "hfs": "src/index.js"
@@ -404,18 +404,11 @@
       ],
       "license": "MIT"
     },
-    "node_modules/binary": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/binary/-/binary-0.3.0.tgz",
-      "integrity": "sha512-D4H1y5KYwpJgK8wk1Cue5LLPgmwHKYSChkbspQg5JtVuR5ulGckxfR62H3AE9UDkdMC8yyXlqYihuz3Aqg2XZg==",
-      "license": "MIT",
-      "dependencies": {
-        "buffers": "~0.1.1",
-        "chainsaw": "~0.1.0"
-      },
-      "engines": {
-        "node": "*"
-      }
+    "node_modules/bluebird": {
+      "version": "3.7.2",
+      "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz",
+      "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==",
+      "license": "MIT"
     },
     "node_modules/braces": {
       "version": "3.0.3",
@@ -453,12 +446,13 @@
         "ieee754": "^1.1.13"
       }
     },
-    "node_modules/buffers": {
-      "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/buffers/-/buffers-0.1.1.tgz",
-      "integrity": "sha512-9q/rDEGSb/Qsvv2qvzIzdluL5k7AaJOTrw23z9reQthrbF7is4CtlT0DXyO1oei2DCp4uojjzQ7igaSHp1kAEQ==",
+    "node_modules/buffer-crc32": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-1.0.0.tgz",
+      "integrity": "sha512-Db1SbgBS/fg/392AblrMJk97KggmvYhr4pB5ZIMTWtaivCPMWLkmb7m21cJvpvgK+J3nsU2CmmixNBZx4vFj/w==",
+      "license": "MIT",
       "engines": {
-        "node": ">=0.2.0"
+        "node": ">=8.0.0"
       }
     },
     "node_modules/busboy": {
@@ -494,18 +488,6 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/chainsaw": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/chainsaw/-/chainsaw-0.1.0.tgz",
-      "integrity": "sha512-75kWfWt6MEKNC8xYXIdRpDehRYY/tNSgwKaJq+dbbDcxORuVrrQ+SEHoWsniVn9XPYfP4gmdWIeDk/4YNp1rNQ==",
-      "license": "MIT/X11",
-      "dependencies": {
-        "traverse": ">=0.3.0 <0.4"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
     "node_modules/chalk": {
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
@@ -608,6 +590,12 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/core-util-is": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
+      "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
+      "license": "MIT"
+    },
     "node_modules/crc": {
       "version": "3.8.0",
       "resolved": "https://registry.npmjs.org/crc/-/crc-3.8.0.tgz",
@@ -736,6 +724,15 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/duplexer2": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/duplexer2/-/duplexer2-0.1.4.tgz",
+      "integrity": "sha512-asLFVfWWtJ90ZyOUHMqk7/S2w2guQKxUI2itj3d92ADHhxUSbCMGi1f1cBcJ7xM1To+pE/Khbwo1yuNbMEPKeA==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "readable-stream": "^2.0.2"
+      }
+    },
     "node_modules/ee-first": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
@@ -957,6 +954,20 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/fs-extra": {
+      "version": "11.3.5",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.5.tgz",
+      "integrity": "sha512-eKpRKAovdpZtR1WopLHxlBWvAgPny3c4gX1G5Jhwmmw4XJj0ifSD5qB5TOo8hmA0wlRKDAOAhEE1yVPgs6Fgcg==",
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^6.0.1",
+        "universalify": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=14.14"
+      }
+    },
     "node_modules/fs-x-attributes": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/fs-x-attributes/-/fs-x-attributes-1.0.2.tgz",
@@ -1042,6 +1053,12 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/graceful-fs": {
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "license": "ISC"
+    },
     "node_modules/has-flag": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
@@ -1206,16 +1223,6 @@
       ],
       "license": "BSD-3-Clause"
     },
-    "node_modules/immer": {
-      "version": "10.2.0",
-      "resolved": "https://registry.npmjs.org/immer/-/immer-10.2.0.tgz",
-      "integrity": "sha512-d/+XTN3zfODyjr89gM3mPq1WNX2B8pYsu7eORitdwyA2sBubnTl3laYlBk4sXY5FUa5qTZGBDPJICVbvqzjlbw==",
-      "license": "MIT",
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/immer"
-      }
-    },
     "node_modules/inherits": {
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
@@ -1294,6 +1301,12 @@
         "node": ">=8"
       }
     },
+    "node_modules/isarray": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
+      "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
+      "license": "MIT"
+    },
     "node_modules/js-tokens": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
@@ -1301,6 +1314,18 @@
       "license": "MIT",
       "peer": true
     },
+    "node_modules/jsonfile": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
+      "license": "MIT",
+      "dependencies": {
+        "universalify": "^2.0.0"
+      },
+      "optionalDependencies": {
+        "graceful-fs": "^4.1.6"
+      }
+    },
     "node_modules/keygrip": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/keygrip/-/keygrip-1.1.0.tgz",
@@ -1530,18 +1555,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/mkdirp": {
-      "version": "0.5.6",
-      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
-      "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
-      "license": "MIT",
-      "dependencies": {
-        "minimist": "^1.2.6"
-      },
-      "bin": {
-        "mkdirp": "bin/cmd.js"
-      }
-    },
     "node_modules/ms": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
@@ -1566,6 +1579,12 @@
         "node": ">= 6.13.0"
       }
     },
+    "node_modules/node-int64": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz",
+      "integrity": "sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==",
+      "license": "MIT"
+    },
     "node_modules/on-finished": {
       "version": "2.4.1",
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
@@ -1631,6 +1650,12 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/process-nextick-args": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
+      "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
+      "license": "MIT"
+    },
     "node_modules/proxy-compare": {
       "version": "2.6.0",
       "resolved": "https://registry.npmjs.org/proxy-compare/-/proxy-compare-2.6.0.tgz",
@@ -1697,6 +1722,21 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/readable-stream": {
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
+      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
+      "license": "MIT",
+      "dependencies": {
+        "core-util-is": "~1.0.0",
+        "inherits": "~2.0.3",
+        "isarray": "~1.0.0",
+        "process-nextick-args": "~2.0.0",
+        "safe-buffer": "~5.1.1",
+        "string_decoder": "~1.1.1",
+        "util-deprecate": "~1.0.1"
+      }
+    },
     "node_modules/reflect-metadata": {
       "version": "0.2.2",
       "resolved": "https://registry.npmjs.org/reflect-metadata/-/reflect-metadata-0.2.2.tgz",
@@ -1736,6 +1776,12 @@
         "queue-microtask": "^1.2.2"
       }
     },
+    "node_modules/safe-buffer": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
+      "license": "MIT"
+    },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
@@ -1765,6 +1811,15 @@
         "node": ">=10.0.0"
       }
     },
+    "node_modules/string_decoder": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.1.0"
+      }
+    },
     "node_modules/strnum": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.3.0.tgz",
@@ -1810,15 +1865,6 @@
         "node": ">=0.6"
       }
     },
-    "node_modules/traverse": {
-      "version": "0.3.9",
-      "resolved": "https://registry.npmjs.org/traverse/-/traverse-0.3.9.tgz",
-      "integrity": "sha512-iawgk0hLP3SxGKDfnDJf8wTz4p2qImnyihM5Hh/sGvQ3K37dPi/w8sRhdNIxYA1TwFwc5mDhIJq+O0RsvXBKdQ==",
-      "license": "MIT/X11",
-      "engines": {
-        "node": "*"
-      }
-    },
     "node_modules/tslib": {
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
@@ -1889,14 +1935,26 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/unzip-stream": {
-      "version": "0.3.4",
-      "resolved": "https://registry.npmjs.org/unzip-stream/-/unzip-stream-0.3.4.tgz",
-      "integrity": "sha512-PyofABPVv+d7fL7GOpusx7eRT9YETY2X04PhwbSipdj6bMxVCFJrr+nm0Mxqbf9hUiTin/UsnuFWBXlDZFy0Cw==",
+    "node_modules/universalify": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
+      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 10.0.0"
+      }
+    },
+    "node_modules/unzipper": {
+      "version": "0.12.3",
+      "resolved": "https://registry.npmjs.org/unzipper/-/unzipper-0.12.3.tgz",
+      "integrity": "sha512-PZ8hTS+AqcGxsaQntl3IRBw65QrBI6lxzqDEL7IAo/XCEqRTKGfOX56Vea5TH9SZczRVxuzk1re04z/YjuYCJA==",
       "license": "MIT",
       "dependencies": {
-        "binary": "^0.3.0",
-        "mkdirp": "^0.5.1"
+        "bluebird": "~3.7.2",
+        "duplexer2": "~0.1.4",
+        "fs-extra": "^11.2.0",
+        "graceful-fs": "^4.2.2",
+        "node-int64": "^0.4.0"
       }
     },
     "node_modules/use-sync-external-store": {
@@ -1908,6 +1966,12 @@
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0"
       }
     },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "license": "MIT"
+    },
     "node_modules/valtio": {
       "version": "1.13.2",
       "resolved": "https://registry.npmjs.org/valtio/-/valtio-1.13.2.tgz",
@@ -1982,6 +2046,15 @@
         "url": "https://github.com/sponsors/eemeli"
       }
     },
+    "node_modules/yazl": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/yazl/-/yazl-3.3.1.tgz",
+      "integrity": "sha512-BbETDVWG+VcMUle37k5Fqp//7SDOK2/1+T7X8TD96M3D9G8jK5VLUdQVdVjGi8im7FGkazX7kk5hkU8X4L5Bng==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer-crc32": "^1.0.0"
+      }
+    },
     "node_modules/zod": {
       "version": "3.25.76",
       "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hfs",
-  "version": "3.1.5",
+  "version": "3.2.0-beta2",
   "description": "HTTP File Server",
   "keywords": [
     "file server",
@@ -19,10 +19,10 @@
     "build-server": "rm -rf dist/src dist/plugins && npm i && tsc && touch package.json && cp -v -r package.json central.json README* LICENSE* hfs.ico plugins dist && find dist -name .DS_Store -o -name storage -exec rm -rf {} + && node scripts/afterbuild.js",
     "build-frontend": "npm run build --workspace=frontend",
     "build-admin": "npm run build --workspace=admin",
-    "server-for-test": "node dist/src --cwd tests/work --config tests --debug",
+    "server-for-test": "mkdir -p tests/work && cp tests/config.yaml tests/work/config.yaml && node dist/src --cwd tests/work --config tests/work/config.yaml --debug",
     "server-for-test-dev": "cross-env DEV=1 FRONTEND_PROXY=3005 ADMIN_PROXY=3006 nodemon --ignore tests/ --watch src -e ts,tsx --exec tsx src -- --cwd tests/work --config tests",
-    "test": "node --import tsx --test tests/test.ts",
-    "test-with-server": "sh -c 'npm run port-is-free && tsc && rm -rf tests/work tests/tmp && (node dist/src --cwd tests/work --config tests & echo $! > .server_pid) && sleep 2 && node --import tsx --test \"$@\" tests/test.ts; _exit=$?; if [ -f ./.server_pid ]; then SERVER_PID=$(cat ./.server_pid); kill \"$SERVER_PID\" 2>/dev/null || true; rm -f ./.server_pid; fi; exit $_exit' --",
+    "test": "sh -c 'npm run port-is-free >/dev/null && { echo \"no server\"; exit 1; }; node --import tsx --test \"$@\" tests/test.ts' --",
+    "test-with-server": "sh -c 'npm run port-is-free && tsc && rm -rf tests/work tests/tmp && mkdir -p tests/work && cp tests/config.yaml tests/work/config.yaml && (node dist/src --cwd tests/work --config tests/work/config.yaml & echo $! > .server_pid) && sleep 2 && node --import tsx --test \"$@\" tests/test.ts; _exit=$?; if [ -f ./.server_pid ]; then SERVER_PID=$(cat ./.server_pid); kill \"$SERVER_PID\" 2>/dev/null || true; rm -f ./.server_pid; fi; exit $_exit' --",
     "port-is-free": "node -e \"const port=process.argv[1]||8081;process.exit(await fetch('http://localhost:'+port).then(() => console.log('BUSY')||1, () => 0))\" --",
     "test-ui": "npm run port-is-free -- 8081 && rm -rf tests/work tests/work2 && npx playwright test frontend && npx playwright test serial && npx playwright test admin-vfs",
     "test-with-ui": "sh -c 'npm run port-is-free -- 3005 && npm run start-frontend & npm run port-is-free -- 3006 && npm run start-admin & cross-env TEST_WITH_UI=1 npx playwright test --ui \"$@\"' --",
@@ -30,7 +30,7 @@
     "dist": "STASHED=; if ! git diff-index --quiet HEAD --; then git stash push -m 'dist' && STASHED=1; fi; CI=1 FORCE_COLOR=1 npm run dist-uncommitted || (EXIT_CODE=$?; [ -n \"$STASHED\" ] && git stash pop; exit $EXIT_CODE); [ -n \"$STASHED\" ] && git stash pop",
     "dist-uncommitted": "npm audit --omit=dev --audit-level=moderate && rm -rf dist && npm run build-server && npm run test-with-server && (npm run build-frontend & npm run build-admin) && npm run test-ui && npm run dist-bin",
     "dist-bin": "npm run dist-modules && npm run dist-bin-win && npm run dist-bin-linux && npm run dist-bin-linux-arm && npm run dist-bin-mac && npm run dist-bin-mac-arm",
-    "dist-modules": "cp package.json central.json README.md dist && cd dist && npm pkg delete devDependencies workspaces && rm -rf node_modules && npm install --omit=dev && npm shrinkwrap && cd .. && node scripts/prune_modules.js",
+    "dist-modules": "cp package.json central.json README.md dist && cd dist && npm pkg delete devDependencies workspaces scripts.postinstall && rm -rf node_modules && npm install --omit=dev && npm shrinkwrap && cd .. && node scripts/prune_modules.js",
     "dist-bin-win": "cd dist && pkg . --public -C gzip -t node20-win-x64 && npx resedit-cli --in hfs.exe --icon 1,../hfs.ico --out hfs.exe && zip hfs-windows-x64-$(jq -r .version ../package.json).zip hfs.exe -r plugins && cd ..",
     "dist-bin-mac-arm": "cd dist && pkg . --public -C gzip -t node20-macos-arm64 && zip hfs-mac-arm64-$(jq -r .version ../package.json).zip hfs -r plugins && cd ..",
     "dist-bin-mac": "cd dist && pkg . --public -C gzip -t node20-macos-x64 && zip hfs-mac-x64-$(jq -r .version ../package.json).zip hfs -r plugins && cd ..",
@@ -70,7 +70,7 @@
       "**/node_modules/axios/dist/node/*",
       "**/node_modules/buffers/**",
       "**/node_modules/binary/**",
-      "**/node_modules/unzip-stream/**"
+      "**/node_modules/unzipper/**"
     ],
     "targets": [
       "node20-win-x64",
@@ -93,7 +93,6 @@
     "fs-x-attributes": "^1.0.2",
     "fswin": "^3.24.829",
     "iconv-lite": "^0.7.0",
-    "immer": "^10.1.3",
     "ip2location-nodejs": "^9.7.0",
     "koa": "^3.1.2",
     "koa-compress": "^5.2.0",
@@ -107,9 +106,10 @@
     "open": "^8.4.0",
     "picomatch": "^4.0.3",
     "tssrp6a": "^3.0.0",
-    "unzip-stream": "^0.3.4",
+    "unzipper": "^0.12.3",
     "valtio": "^1.13.2",
     "xxhashjs": "^0.2.2",
-    "yaml": "^2.8.1"
+    "yaml": "^2.8.1",
+    "yazl": "^3.3.1"
   }
 }

package/plugins/antibrute/plugin.js

@@ -1,4 +1,4 @@
-exports.version = 3.1
+exports.version = 3.2
 exports.description = "Introduce increasing delays between login attempts."
 exports.apiRequired = 9.6 // addBlock
 
@@ -8,42 +8,173 @@ exports.config = {
     blockAfter: { type: 'number', xs: 6, min: 1, max: 9999, defaultValue: 100, label: "Block IP after", unit: "attempts", helperText: "localhost excluded" },
     blockForHours: { type: 'number', xs: 6, min: 0, defaultValue: 24, label: "Block for", unit: "hours" },
     exclude: { type: 'string', defaultValue: '', label: "Exclude IPs", helperText: "Net mask syntax" },
+    maxQueuePerIp: { type: 'number', min: 1, max: 9999, defaultValue: 32, label: "Max queued per IP" },
+    maxQueuePerAccount: { type: 'number', min: 1, max: 9999, defaultValue: 16, label: "Max queued per account" },
+    maxQueueGlobal: { type: 'number', min: 1, max: 999999, defaultValue: 512, label: "Max queued globally" },
 }
 exports.configDialog = {
     maxWidth: 'xs',
 }
 
 const byIp = {}
+const byAccount = {}
+const laneByIp = {}
+const laneByAccount = {}
+const UNKNOWN_ACCOUNT = 'unknown\t'
 
 exports.init = api => {
     const { isLocalHost, HOUR, netMatches } = api.misc
+    const { makeQ } = api.require('./makeQ')
+    const gateQ = makeQ(1)
+    let waitingGlobal = 0
+    const QUEUE_FULL = Symbol('queue_full')
     api.events.multi({
-        async attemptingLogin({ ctx }) {
+        async attemptingLogin({ ctx, username }) {
             const { ip } = ctx
-            const now = new Date
-            const rec = byIp[ip] ||= { attempts: 0, next: now }
-            const max = api.getConfig('max') * 1000
-            const delay = Math.min(max, 1000 * api.getConfig('increment') * ++rec.attempts)
-            const wait = rec.next - now
-            rec.next = new Date(+rec.next + delay)
-            if (rec.attempts > api.getConfig('blockAfter') && !isLocalHost(ctx) && !isExcluded(ip)) {
-                const hours = api.getConfig('blockForHours')
-                api.addBlock({ ip, comment: "From antibrute plugin", expire: hours ? new Date(now.getTime() + hours * HOUR) : undefined })
+            const account = getAccountKey(username)
+            const ipRec = getRecord(byIp, ip)
+            const accountRec = getRecord(byAccount, account)
+            let admitted = false
+            try {
+                await runGate(() => {
+                    if (ipRec.waiting >= api.getConfig('maxQueuePerIp')
+                    || accountRec.waiting >= api.getConfig('maxQueuePerAccount')
+                    || waitingGlobal >= api.getConfig('maxQueueGlobal'))
+                        throw QUEUE_FULL
+                    // reserve all buckets atomically so we never exceed limits due to parallel requests
+                    ipRec.waiting++
+                    accountRec.waiting++
+                    waitingGlobal++
+                    admitted = true
+                })
+                // serialize waits per ip and per account so parallel bursts can't consume the same penalty window
+                await runInLane(getLane(laneByIp, ip), () =>
+                    runInLane(getLane(laneByAccount, account), async () => {
+                        const now = Date.now()
+                        const wait = Math.max(0, ipRec.next - now, accountRec.next - now)
+                        if (wait <= 0) return
+                        api.log('delaying', ip, 'for', Math.round(wait / 1000))
+                        ctx.set('x-anti-brute-force', wait)
+                        await new Promise(resolve => setTimeout(resolve, wait))
+                    }))
+            }
+            catch (e) {
+                if (e === QUEUE_FULL) {
+                    ctx.status = 429
+                        return api.events.stop
+                }
+                throw e
             }
-            clearTimeout(rec.timer)
-            if (wait > 0) {
-                api.log('delaying', ip, 'for', Math.round(wait / 1000))
-                ctx.set('x-anti-brute-force', wait)
-                await new Promise(resolve => setTimeout(resolve, wait))
+            finally {
+                if (admitted) {
+                    ipRec.waiting--
+                    accountRec.waiting--
+                    waitingGlobal--
+                }
+                armCleanup(byIp, ip, ipRec)
+                armCleanup(byAccount, account, accountRec)
+                dropLaneIfIdle(laneByIp, ip)
+                dropLaneIfIdle(laneByAccount, account)
             }
-            rec.timer = setTimeout(() => delete byIp[ip], 24 * HOUR) // no memory leak
+        },
+        failedLogin({ ctx, username }) {
+            const { ip } = ctx
+            const account = getAccountKey(username)
+            const now = Date.now()
+            const ipRec = getRecord(byIp, ip)
+            const accountRec = getRecord(byAccount, account)
+            const ipAttempts = increasePenalty(ipRec, now)
+            increasePenalty(accountRec, now)
+            if (ipAttempts > api.getConfig('blockAfter') && !isLocalHost(ctx) && !isExcluded(ip)) {
+                const hours = api.getConfig('blockForHours')
+                api.addBlock({ ip, comment: "From antibrute plugin", expire: hours ? new Date(now + hours * HOUR) : undefined })
+            }
+            armCleanup(byIp, ip, ipRec)
+            armCleanup(byAccount, account, accountRec)
+            dropLaneIfIdle(laneByIp, ip)
+            dropLaneIfIdle(laneByAccount, account)
         },
         login(ctx) {
-            if (ctx.state.account)
-                delete byIp[ctx.ip] // reset if login was successful
+            if (ctx.state.account) {
+                const { ip } = ctx
+                const account = getAccountKey(ctx.state.account.username)
+                resetRecord(byIp, ip)
+                resetRecord(byAccount, account)
+                dropLaneIfIdle(laneByIp, ip)
+                dropLaneIfIdle(laneByAccount, account)
+            }
         }
     })
 
+    function getRecord(container, key) {
+        return container[key] ||= { failures: 0, next: 0, waiting: 0 }
+    }
+
+    function increasePenalty(rec, now) {
+        const attempts = ++rec.failures
+        const max = api.getConfig('max') * 1000
+        const delay = Math.min(max, attempts * api.getConfig('increment') * 1000)
+        rec.next = Math.max(now, rec.next) + delay
+        return attempts
+    }
+
+    function armCleanup(records, key, rec) {
+        clearTimeout(rec.timer)
+        rec.timer = setTimeout(() => {
+            // keep records while there are in-flight admissions, otherwise later releases may touch deleted state
+            if (rec.waiting)
+                return armCleanup(records, key, rec)
+            delete records[key]
+        }, 24 * HOUR) // no memory leak
+    }
+
+    function runGate(job) {
+        return new Promise((resolve, reject) => {
+            gateQ.add(async () => {
+                try { resolve(await job()) }
+                catch (e) { reject(e) }
+            })
+        })
+    }
+
+    function getLane(container, key) {
+        return container[key] ||= makeQ(1)
+    }
+
+    function runInLane(q, job) {
+        return new Promise((resolve, reject) => {
+            q.add(async () => {
+                try { resolve(await job()) }
+                catch (e) { reject(e) }
+            })
+        })
+    }
+
+    function dropLaneIfIdle(container, key) {
+        const q = container[key]
+        if (q?.isWorking() || q?.queueSize()) return
+        delete container[key]
+    }
+
+    function resetRecord(container, key) {
+        const rec = container[key]
+        if (!rec) return
+        if (rec.waiting) {
+            // successful login must clear penalties without dropping admission counters still needed by concurrent requests
+            rec.failures = 0
+            rec.next = 0
+            return
+        }
+        delete container[key]
+    }
+
+    function getAccountKey(username) {
+        // fold unknown usernames together to avoid unbounded memory growth from random names
+        if (!username || !api.getAccount(String(username)))
+            return UNKNOWN_ACCOUNT
+        return String(username).toLowerCase()
+    }
+
     function isExcluded(ip) {
         const mask = api.getConfig('exclude')
         if (!mask) return false

package/plugins/list-uploader/public/main.js

@@ -6,7 +6,7 @@
         HFS.h(Uploader, entry))
 
     function Uploader({ uri }) {
-        const { data } = HFS.useBatch(getDetails, uri)
+        const { data } = HFS.useBatch(getDetails, uri, { depend: HFS.state.isAdmin })
         const text = React.useMemo(() => {
             if (!data || data === true) return ''
             const { upload: x } = data