feat(webdav): an RFC 4918 class-1/2/3 WebDAV server

[pi0x]

mountx/webdav serves an FsDriver over WebDAV — the second transport that is not a mount, and the one whose client produces a mountpoint anyway, with no root on the server side and no native code at all.

RFC 4918 classes 1, 2 and 3, and the DAV header says so because each class is answered rather than claimed: OPTIONS, HEAD, GET, PUT, DELETE, MKCOL, COPY, MOVE, PROPFIND, PROPPATCH, LOCK, UNLOCK, with the If header enforcing the locks and RFC 9110's conditionals on GET/HEAD/PUT. Loopback-only without credentials, HTTP Basic with them; streaming bodies both ways; one reply per request with a dev-mode assertion behind it. Outside mountx/auto, for the same reason mountx/s3 is.

import { createWebdavServer } from "mountx/webdav";

await using server = await createWebdavServer(driver).listen();
// sudo mount -t davfs $url /mnt/point

The shape

file
constants.ts	the errno → HTTP status table, typed total over ErrnoCode, the protocol's literals, the propstat reason phrases
protocol.ts	pure: target ↔ href, Depth/Overwrite/Destination/Timeout/Lock-Token/If, the three grammars, multistatus/error/lock documents
locks.ts	the write-lock table — pure, synchronous and clockless: now is an argument, never a call
session.ts	method semantics over one driver
server.ts	the socket, and the only file here importing node:http

Locking is the real thing: both scopes and both kinds, §9.10.5's compatibility table checked up and down the tree, urn:uuid: tokens, lazy lease expiry, refresh, §7.3's locked empty resource, a MAX_LOCKS cap answering 503, and §7.6's rule that a lock never follows its resource. The If header implements §10.4.2 in full, with §10.4.1's two purposes kept apart, so (Not <DAV:no-lock>) submits a token from a list that was never true.

Decisions worth a reviewer's attention

• src/http.ts. HTTP-date, Range, ETag quoting and the conditional-request rules are RFC 9110, not S3, and both HTTP transports need them — so they moved out of src/s3/protocol.ts, which re-exports every symbol under its old name. mountx/s3's surface and its 629 tests are untouched.
• webdav/protocol.ts imports s3/xml.ts — the second deliberate cross-transport dependency after 9P → fuse/flags.ts — rather than hardening a second bounded XML parser. The cost is namespaces (that parser reports local names), documented at the file header and left in the roadmap: fixing it means changing the parser and the encoder that mountx/s3 depends on, for a bounded cosmetic deviation inside a 404 propstat.
• Two RFC ambiguities, resolved and flagged in the source: an overwriting MOVE/COPY onto a locked destination keeps the destination's lock (§7.6 is more specific than §6.1's unmapping rule); entity-tag comparison inside If is weak, because §10.4.9's own example carries W/"A weak ETag" and expects a match. If-Match/If-None-Match keep RFC 9110's strong/weak split.

Three bugs caught in review, each with a test that fails without the fix

• COPY of a symlink to an ancestor never terminated — the top-level source was stated, so a link to a collection answered isDirectory() and was walked; isPathInside compares text and never saw it. Unbounded work from one request.
• DELETE on a link to a collection would have emptied what it points at rather than removing the link (a stat where an lstat belongs).
• COPY descending into a link inside the tree — same non-termination, one level down.

Tests

pnpm test: 3209 passed, 326 skipped, green at every commit. src/webdav/ at 97% statements / 95% branches. Four layers: the wire alone, the session in-process, the server over real sockets, and two oracles — rclone/curl at the protocol level, and a real kernel mount through davfs2 (test/webdav/mount.test.ts, sudo-gated, skips clean without mount.davfs).

That last one is new and is the strongest evidence here: an ordinary filesystem workload — write, read back, rename, unlink, non-ASCII names, a 1 MiB file — carried by the kernel, verified on the driver's own side with node:fs. It also pins the class-2 interop: davfs2 reads DAV: 1, 2, 3 and takes a lock per write, asserted rather than described, and re-advertising class 1 fails that case and no other. (Against class 1 davfs2 warns and writes anyway — measured, and kept in .agents/environment.md, because it is the evidence that macOS's mount_webdav is a different client with a different rule.)

macOS and Windows are expected to work against a class-2 share and neither was run — this host is Linux. The docs state that separation rather than promising it.

Still open, recorded in the roadmap: the namespace fix above, a WebDAV conformance-matrix column, and the duplicated drain mechanics between the two HTTP servers.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mountx	Ready	Preview	Jul 31, 2026 10:57pm