@finueva/drive 0.23.0 → 0.25.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @finueva/drive
 
+## 0.25.0
+
+### Minor Changes
+
+- 33e693a: Add explicit authenticated personal storage setup through `ensurePersonalWorkspace`, using canonical server policy and current user authority.
+
+## 0.24.0
+
+### Minor Changes
+
+- e26c07a: Breaking change for the 0.x client: replace upload session and multipart/version upload APIs with the current verified-transfer protocol. Remove createUpload, getUploadStatus, createUploadPartDescriptor, recordUploadPart, completeUpload, abortUpload, createFileVersionUpload, commitFileVersion, uploadFile and uploadFileVersion. Use prepareVerifiedTransfer, recoverVerifiedTransfer, publishVerifiedTransfer and uploadVerifiedFile with bounded operation-key validity instead. Read, access-context, editing, sharing and visitor interfaces remain available.
+
+  Upgrade the client and service together or isolate existing clients and pending legacy operations before activating the current namespace. Publishing this client alone does not qualify the service or migrate old operations.
+
+- cdce13c: Add authenticated current-user file storage usage, separate from permission-gated workspace aggregate quota accounting.
+- 21a19fb: Add authenticated immutable verified transfers and a bounded three-request browser upload that verifies the full provider checksum and returns complete published file metadata without polling or readback. Preserve scoped credentials, conditional version writes and exact provider capabilities.
+
 ## 0.23.0
 
 ### Minor Changes

package/README.md

@@ -31,7 +31,7 @@ Grants expire within 30 days, challenges within 24 hours and sessions within sev
 Approved ecosystem servers can separately use `createDriveProvisioningClient` from `/server` to call `provisionWorkspace(command)`. Configure an exact environment and `getProvisioningCredential` provider using Auth service credentials, not User credentials. Commands require a stable provisioning ID, exact workspace reference, and explicit versioned storage entitlement. The client does not infer quotas, follow redirects, or retry. See [Workspace Provisioning](../../apps/developer/docs/sdk/provisioning.md) for ownership and recovery boundaries.
 
 ```ts
-import { createDriveClient } from "@finueva/drive";
+import { createDriveClient, createVerifiedOperationKey } from "@finueva/drive";
 
 const drive = createDriveClient({
   baseUrl: "https://drive.example.com",
@@ -57,13 +57,13 @@ const matches = await drive.searchWorkspaceItems({
 });
 
 const completionIdempotencyKey = crypto.randomUUID();
-const uploaded = await drive.uploadFile({
+const uploaded = await drive.uploadVerifiedFile({
   workspaceId: workspace.workspaceId,
-  parentItemId: workspace.rootItemId,
+  target: { type: "create", parentItemId: workspace.rootItemId, name: file.name },
   source: file, // Blob; File is supported without being required
-  displayFilename: file.name,
   mediaType: file.type || "application/octet-stream",
-  idempotencyKey: crypto.randomUUID(),
+  protectionClassification: "ordinary",
+  idempotencyKey: createVerifiedOperationKey(),
   completionIdempotencyKey,
   onProgress: ({ phase, confirmedByteLength, totalByteLength }) => {
     renderProgress(phase, confirmedByteLength, totalByteLength);
@@ -90,7 +90,7 @@ const drive = createDriveServerClient({
 
 Create a client per request when using user authority. A fixed `credential` string is accepted for an explicitly scoped credential, but the SDK does not create, refresh, persist, or infer sessions, cookies, provider tokens, or service authority.
 
-The server client exposes all 27 normal-user Native Drive operations plus streaming `downloadItem`, but intentionally has no Blob-only `uploadFile` method. The package root and browser client add `uploadFile`, for 29 methods total.
+The server client exposes the current API operations and streaming `downloadItem`. Browser and user clients additionally expose Blob-based `uploadVerifiedFile`. The server client accepts explicit prepare, recover and publish commands rather than Blob orchestration.
 
 ## Workspace Discovery
 
@@ -117,12 +117,31 @@ These source additions require backend migration `0010`, deployment and SDK rele
 
 ## Operations
 
-Methods use the Native API operation IDs:
-
+Methods use the current API operation IDs; `downloadItem` and `uploadVerifiedFile` are transport helpers:
+
+- `createVisitorGrant`
+- `getVisitorGrant`
+- `listVisitorGrants`
+- `revokeVisitorGrant`
+- `getFileAccessContext`
+- `createEditingSession`
+- `renewEditingSession`
+- `closeEditingSession`
+- `revokeEditingSession`
+- `listOwnedItems`
+- `transferItemOwnership`
+- `archiveItem`
+- `getWorkspaceSharingPolicy`
+- `updateWorkspaceSharingPolicy`
+- `registerItemRecipient`
+- `listItemSharingPeople`
+- `listIncomingShares`
 - `getCurrentWorkspace`
-- `getCurrentWorkspaceSources`
+- `ensureOrganizationWorkspaceAccess`
 - `listWorkspaceItems`
+- `getCurrentUserWorkspaceUsage`
 - `getWorkspaceUsage`
+- `getCurrentWorkspaceSources`
 - `getItem`
 - `searchWorkspaceItems`
 - `listFolderChildren`
@@ -135,19 +154,18 @@ Methods use the Native API operation IDs:
 - `getItemVersion`
 - `restoreItemVersion`
 - `createDownload`
-- `downloadItem` (high-level direct streaming)
+- `downloadItem`
 - `listItemPermissions`
 - `readEffectiveItemPermissions`
 - `createItemPermission`
+- `createInternalItemPermission`
 - `updateItemPermission`
 - `revokeItemPermission`
-- `createUpload`
-- `getUploadStatus`
-- `createUploadPartDescriptor`
-- `recordUploadPart`
-- `completeUpload`
-- `abortUpload`
-- `uploadFile` (high-level orchestration)
+- `revokeInternalItemPermission`
+- `prepareVerifiedTransfer`
+- `publishVerifiedTransfer`
+- `recoverVerifiedTransfer`
+- `uploadVerifiedFile`
 
 `getCurrentWorkspace` maps the credential's selected Auth context to the provisioned Drive workspace and canonical managed root. It accepts only an optional `{ signal }` input, never provisions as a side effect, and returns no entitlement, credential, or private persistence fields.
 
@@ -176,21 +194,21 @@ changed evidence discards the preview. These are content validators, not item li
 ETags. Visitors remain viewer-only and cannot query private permissions or restore
 cold content.
 
-The six low-level upload methods map directly to the Native API. `createUpload` accepts a caller-declared whole-file `sha256:{64 lowercase hex}` digest. Portable S3 is the only supported upload transport, with no profile selector. Descriptor requests require `contentMd5` (canonical base64 MD5), and return a required `content-md5` header. Part SHA-256 declarations and opaque provider ETags remain separate callback fields; MD5 is transport error detection, not content identity.
+## Verified transfers
 
-Publication independently verifies archive bytes against both whole-file and part SHA-256 declarations. `getUploadStatus` exposes bounded confirmed-part pages and read-only verification progress once verification is admitted. `completeUpload` and `uploadFile` return `DriveOperationResult<UploadCompletion, 200 | 202>`: inspect `data.state` for `ready` versus `verifying`. A `202` is not publication. Retain its `uploadId` and the original completion idempotency key, inspect status, then call `completeUpload` again with that key when appropriate. The SDK does not start an unbounded polling loop. To cancel after a pending result, call `abortUpload({ workspaceId, uploadId })`, which returns bodyless `204`.
+See [the coordinated SDK cutover](../../apps/developer/docs/sdk/verified-transfers.md) for consumer and qualification boundaries.
 
-After service support, its migration and the actual archive provider have been qualified, `uploadFile` and `uploadFileVersion` can opt in with `singleIntegrity: "sha256"`. Nonempty files up to 8 MiB then use a signed full SHA256 instead of the transport MD5 header, plus stored `cache-control: no-store, no-transform`. Drive authenticates the exact immutable object's full-checksum HEAD receipt and seals it before the normal fresh-authority publication checks; it does not trust the caller's digest or PUT response as proof. The SDK rejects unsigned checksum/cache-control/length requirements, wrong checksums and a downgrade to the legacy tuple. Archive CORS must allow `x-amz-checksum-sha256` and `cache-control` alongside the existing media type, create-only and encryption headers. Omit the option for an older service; zero-byte and larger multipart uploads retain bounded byte verification.
+`uploadVerifiedFile` prepares one immutable whole-object transfer, streams the exact Blob directly to its signed provider URL, and publishes only after Drive independently verifies the retained provider receipt. The ordinary path is prepare → PUT → publish; it does not poll an upload job or read metadata back. The final `published` result includes current item/version identity, exact bytes, full SHA-256, media type, protection classification and provider ETag.
 
-`uploadFile` is the browser-safe direct-byte path for a Web `Blob` or `File`. It accepts zero-byte input, hashes the empty input correctly, accepts the server-mediated zero-byte mode, skips part transfer, and completes normally. Nonempty input is incrementally hashed in slices no larger than 32 MiB and is never materialized as a complete `ArrayBuffer`, Blob copy, base64 string, or SDK request body. The fixed policy permits at most 10,000 parts and 312.5 GiB.
+A create target is `{ type: "create", parentItemId, name }`. A replacement is `{ type: "replace", itemId, currentVersionId }`; the explicit current version is the write precondition. Editing clients use the same replacement protocol with their scoped editing credential and audience. `getFileAccessContext` remains available for current file access and editing context.
 
-Each nonempty slice is sent directly to the exact descriptor URL. The SDK computes MD5 with the maintained Noble public API on the same bounded slice as SHA-256. Requests include only descriptor-required headers and use `credentials: "omit"`, `cache: "no-store"`, `redirect: "error"`, and `referrerPolicy: "no-referrer"`. Archive CORS must allow `content-md5` and expose `ETag`; no provider SHA response header is required, and ETags are never interpreted as hashes. If a Content-MD5 response header is exposed, it must match the request. Drive credentials, cookies and file metadata never enter the archive request.
+Generate the prepare key with `createVerifiedOperationKey()`, then retain that key, the completion key and the exact source/intent for retry. The key has a fixed 24-hour replay deadline; new keys permit bounded client clock skew. Retired, expired or incorrectly issued keys return actionable closed reasons. They never authorize silently creating a new operation. An interrupted prepare or publication permits at most one immediate retry for network errors/timeouts. A lost PUT response or immutable create-only `412` proceeds to publication without a caller ETag; Drive must independently prove the exact retained object. A published prepare replay performs no provider PUT. Recovery returns only the current capability for that original admitted operation.
 
-Repeating `uploadFile` with the same creation and completion keys explicitly resumes the retained session when replay remains available. Status reads are bounded to 100 pages of 100 parts. The SDK checks session identity, policy, lifecycle, revisions and checksums, skips confirmed parts and never re-uploads a part merely because its callback response was lost. `completing`, `provider-completed` and `verifying` resume completion; failed/aborted/recovery-required states do not pretend to resume. After receiving pending, using its upload ID with low-level status/complete avoids re-hashing the source. Both normal and empty uploads may return pending, and progress observers can receive the `verifying` phase.
+The generic helper supports zero through 1 GiB and incrementally hashes in 256 KiB windows. It does not materialize the whole source as an ArrayBuffer or base64 string. Signed provider headers require whole SHA-256, exact content type and length, `cache-control: no-store, no-transform`, immutable `if-none-match: *`, and the complete encryption tuple when present. Requests omit user authority, cookies and referrers; redirects are refused. The SDK validates the returned canonical receipt against the source and requested classification. An ETag is provider identity, not a substitute for the checksum.
 
-There is no automatic network or provider retry. If a part-record callback response may have been lost, the SDK performs one bounded status reconciliation before either accepting the confirmed part or recording the same provider evidence once more; it never blindly re-uploads the bytes. If a completion response may have been lost, one status reconciliation returns success only when `ready` is proven. Other transient failures preserve the session for an explicit repeat until server expiry.
+Progress callbacks are immutable and isolated from the operation. Uploading all bytes enters `completing`; success requires the canonical `published` result. Caller cancellation stops further orchestration and reports `aborted`. It does not call a retired abort route or release a capacity hold: the service's bounded retention worker reconciles the original immutable operation.
 
-Progress values are frozen and limited to `preparing`, `uploading`, and `completing`, with truthful server-confirmed bytes and part counts, including resumed parts. Observer exceptions are isolated from transfer state. Reaching all confirmed bytes enters `completing`; only a resolved or status-proven `ready` result is success. Caller cancellation after session creation makes one bounded best-effort abort with fresh control-plane authority. Ordinary API or archive failures do not auto-abort.
+The old multipart/session write and control API is intentionally absent: `createUpload`, `getUploadStatus`, `createUploadPartDescriptor`, `recordUploadPart`, `completeUpload`, `abortUpload`, `createFileVersionUpload`, `commitFileVersion`, `uploadFile` and `uploadFileVersion`. This is a coordinated breaking cutover. Deploy only with the matching current service and upgraded consumers or an isolated v2 deployment. Historical reads, downloads, editing, grants, visitor access and immutable version metadata remain available; absence of a new accounting authority is never treated as permission to adopt legacy data.
 
 ## Errors
 
@@ -203,7 +221,7 @@ Failures throw `DriveError`. Known canonical API envelopes preserve their closed
 - `aborted`
 - `invalid_response`
 
-Messages are fixed. `details` is empty or carries exactly one `reason` from the closed `DRIVE_API_ERROR_REASONS` set — `upload_admission_saturated`, `upload_admission_stalled`, or `unspecified` — read as the typed `error.details.reason`. A refused upload creation uses it to say whether admission clears on its own: `upload_admission_saturated` drains as the retained uploads fall due, so settling or aborting your own uploads and retrying works, while `upload_admission_stalled` is held by retained state that cannot clear on its own, so retrying will not help and an operator is needed. The reason never says which internal state is holding it. Any other details key, or a reason outside that set, is `invalid_response`. Every operation input is runtime-validated before credential lookup or Fetch. Response bodies, URLs, credentials, provider exceptions, submitted values, and raw thrown values are never included. JSON response reads have byte, chunk, and elapsed-time bounds and are cancelled when rejected.
+Messages are fixed. `details` is empty or contains exactly one `reason` from `DRIVE_API_ERROR_REASONS`, read through typed `error.details.reason`. Transfer replay failures distinguish `transfer_operation_retired`, `transfer_operation_expired` and `transfer_operation_clock_skew`; callers must not substitute a new key automatically. Unknown details or reasons are `invalid_response`. Every operation validates input before credential lookup or Fetch. Error output never includes response bodies, URLs, credentials, provider exceptions or submitted values. JSON reads have byte, chunk and deadline bounds and are cancelled when rejected.
 
 ## Base URL
 

package/dist/client.d.ts

@@ -1,7 +1,7 @@
-import { $ as ItemOwnershipTransfer, At as RestoreItemInput, Bt as UploadCompletion, C as DriveClientConfig, D as DriveEditingClientConfig, Dt as RecordUploadPartInput, E as DriveEditingClient, Et as ReadyUpload, F as DriveVisitorClientConfig, Ft as TransferItemOwnershipInput, G as GetCurrentWorkspaceInput, Gt as UploadFileProgressCallback, H as FileAccessContext, Ht as UploadFileInput, It as TrashItemInput, J as GetUploadStatusInput, Jt as UploadPartResult, K as GetItemInput, Kt as UploadFileVersionInput, Lt as UpdateItemInput, Nt as RevokeVisitorGrantInput, Ot as RegisterItemRecipientInput, P as DriveVisitorClient, Pt as SearchWorkspaceItemsInput, Q as IncomingSharePage, Qt as VisitorChildren, R as EditingSession, S as DriveClient, T as DriveCredentialProvider, U as FolderItem, Ut as UploadFilePhase, Vt as UploadConfirmedPart, W as FolderPage, Wt as UploadFileProgress, X as GetWorkspaceUsageInput, Xt as UploadStatus, Y as GetVisitorGrantInput, Yt as UploadSession, Z as IncomingShareContext, Zt as UploadVerificationMode, _ as CreateVisitorGrantInput, _t as OwnedItemPage, a as CollectOwnedItemsInput, an as VisitorItem, at as ListItemVersionsInput, b as DeleteItemInput, c as CompleteUploadInput, cn as WorkspaceDiscoveryItem, ct as ManagedDownloadDescriptor, d as CreateFileVersionUploadInput, dn as WorkspaceItemSearchPage, dt as ManagedItemVersion, et as ItemSharingPeoplePage, fn as WorkspaceSharingPolicy, ft as ManagedItemVersionPage, gt as OwnedItem, h as CreateUploadPartDescriptorInput, ht as ManagedLifecycleItem, i as ChangeEditingSessionInput, in as VisitorGrantPage, it as ListItemSharingPeopleInput, jt as RestoreItemVersionInput, kt as RegisteredRecipientDisplay, l as CreateDownloadInput, ln as WorkspaceDiscoveryPage, lt as ManagedDownloadRestorePending, m as CreateUploadInput, mt as ManagedItemVersionRestoreResult, n as ArchiveItemInput, nn as VisitorGrant, nt as ListIncomingSharesInput, o as CollectedOwnedItems, ot as ListOwnedItemsInput, pn as WorkspaceUsage, pt as ManagedItemVersionResource, q as GetItemVersionInput, qt as UploadPartDescriptor, r as ArchivedItem, rn as VisitorGrantCreation, s as CommitFileVersionInput, sn as VisitorSession, st as ListWorkspaceItemsInput, t as AbortUploadInput, tt as ListFolderChildrenInput, u as CreateEditingSessionInput, un as WorkspaceItemSearchItem, ut as ManagedItemMetadata, v as CurrentWorkspace, vt as PendingUpload, wt as ProtectionClassification, x as DownloadItemResult, y as CurrentWorkspaceSources, z as EditingSessionCreation, zt as UpdateWorkspaceSharingPolicyInput } from "./contract.js";
+import { $ as ListOwnedItemsInput, $t as WorkspaceItemSearchPage, A as DriveVisitorClient, At as TransferItemOwnershipInput, B as GetItemInput, Bt as VisitorChildren, C as DriveEditingClientConfig, Ct as RegisterItemRecipientInput, Et as RestoreItemVersionInput, Ft as UploadFilePhase, G as IncomingSharePage, Gt as VisitorGrantCreation, H as GetVisitorGrantInput, I as FileAccessContext, It as UploadFileProgress, J as ListFolderChildrenInput, K as ItemOwnershipTransfer, Kt as VisitorGrantPage, L as FolderItem, Lt as UploadFileProgressCallback, M as EditingSession, Mt as UpdateItemInput, N as EditingSessionCreation, Ot as RevokeVisitorGrantInput, Pt as UpdateWorkspaceSharingPolicyInput, Q as ListItemVersionsInput, Qt as WorkspaceItemSearchItem, R as FolderPage, Rt as UploadVerifiedFileInput, S as DriveEditingClient, St as RecoverVerifiedTransferInput, Tt as RestoreItemInput, U as GetWorkspaceUsageInput, V as GetItemVersionInput, W as IncomingShareContext, Wt as VisitorGrant, Xt as WorkspaceDiscoveryItem, Y as ListIncomingSharesInput, Yt as VisitorSession, Z as ListItemSharingPeopleInput, Zt as WorkspaceDiscoveryPage, _ as DownloadItemResult, _t as PreparedVerifiedTransfer, a as CollectOwnedItemsInput, at as ManagedItemVersionPage, bt as PublishedVerifiedTransfer, c as CreateEditingSessionInput, ct as ManagedLifecycleItem, en as WorkspaceSharingPolicy, et as ListWorkspaceItemsInput, f as CreateVisitorGrantInput, g as DeleteItemInput, gt as PrepareVerifiedTransferInput, h as CurrentWorkspaceSources, i as ChangeEditingSessionInput, it as ManagedItemVersion, j as DriveVisitorClientConfig, jt as TrashItemInput, kt as SearchWorkspaceItemsInput, lt as OwnedItem, m as CurrentWorkspace, n as ArchiveItemInput, nt as ManagedDownloadRestorePending, o as CollectedOwnedItems, ot as ManagedItemVersionResource, q as ItemSharingPeoplePage, qt as VisitorItem, r as ArchivedItem, rt as ManagedItemMetadata, s as CreateDownloadInput, st as ManagedItemVersionRestoreResult, t as AdmittedVerifiedTransfer, tn as WorkspaceUsage, tt as ManagedDownloadDescriptor, ut as OwnedItemPage, v as DriveClient, vt as ProtectionClassification, wt as RegisteredRecipientDisplay, x as DriveCredentialProvider, y as DriveClientConfig, yt as PublishVerifiedTransferInput, z as GetCurrentWorkspaceInput, zt as VerifiedTransferOperations } from "./contract.js";
 import { n as createDriveVisitorClient, r as createVisitorSessionToken, t as collectOwnedItems } from "./contract2.js";
 //#region src/client.d.ts
 declare function createDriveEditingClient(config: DriveEditingClientConfig): DriveEditingClient;
 declare function createDriveClient(config: DriveClientConfig): DriveClient;
 //#endregion
-export { type AbortUploadInput, type ArchiveItemInput, type ArchivedItem, type ChangeEditingSessionInput, type CollectOwnedItemsInput, type CollectedOwnedItems, type CommitFileVersionInput, type CompleteUploadInput, type CreateDownloadInput, type CreateEditingSessionInput, type CreateFileVersionUploadInput, type CreateUploadInput, type CreateUploadPartDescriptorInput, type CreateVisitorGrantInput, type CurrentWorkspace, type CurrentWorkspaceSources, type DeleteItemInput, type DownloadItemResult, type DriveClient, type DriveClientConfig, type DriveCredentialProvider, type DriveEditingClient, type DriveEditingClientConfig, type DriveVisitorClient, type DriveVisitorClientConfig, type EditingSession, type EditingSessionCreation, type FileAccessContext, type FolderItem, type FolderPage, type GetCurrentWorkspaceInput, type GetItemInput, type GetItemVersionInput, type GetUploadStatusInput, type GetVisitorGrantInput, type GetWorkspaceUsageInput, type IncomingShareContext, type IncomingSharePage, type ItemOwnershipTransfer, type ItemSharingPeoplePage, type ListFolderChildrenInput, type ListIncomingSharesInput, type ListItemSharingPeopleInput, type ListItemVersionsInput, type ListOwnedItemsInput, type ListWorkspaceItemsInput, type ManagedDownloadDescriptor, type ManagedDownloadRestorePending, type ManagedItemMetadata, type ManagedItemVersion, type ManagedItemVersionPage, type ManagedItemVersionResource, type ManagedItemVersionRestoreResult, type ManagedLifecycleItem, type OwnedItem, type OwnedItemPage, type PendingUpload, type ProtectionClassification, type ReadyUpload, type RecordUploadPartInput, type RegisterItemRecipientInput, type RegisteredRecipientDisplay, type RestoreItemInput, type RestoreItemVersionInput, type RevokeVisitorGrantInput, type SearchWorkspaceItemsInput, type TransferItemOwnershipInput, type TrashItemInput, type UpdateItemInput, type UpdateWorkspaceSharingPolicyInput, type UploadCompletion, type UploadConfirmedPart, type UploadFileInput, type UploadFilePhase, type UploadFileProgress, type UploadFileProgressCallback, type UploadFileVersionInput, type UploadPartDescriptor, type UploadPartResult, type UploadSession, type UploadStatus, type UploadVerificationMode, type VisitorChildren, type VisitorGrant, type VisitorGrantCreation, type VisitorGrantPage, type VisitorItem, type VisitorSession, type WorkspaceDiscoveryItem, type WorkspaceDiscoveryPage, type WorkspaceItemSearchItem, type WorkspaceItemSearchPage, type WorkspaceSharingPolicy, type WorkspaceUsage, collectOwnedItems, createDriveClient, createDriveEditingClient, createDriveVisitorClient, createVisitorSessionToken };
+export { type AdmittedVerifiedTransfer, type ArchiveItemInput, type ArchivedItem, type ChangeEditingSessionInput, type CollectOwnedItemsInput, type CollectedOwnedItems, type CreateDownloadInput, type CreateEditingSessionInput, type CreateVisitorGrantInput, type CurrentWorkspace, type CurrentWorkspaceSources, type DeleteItemInput, type DownloadItemResult, type DriveClient, type DriveClientConfig, type DriveCredentialProvider, type DriveEditingClient, type DriveEditingClientConfig, type DriveVisitorClient, type DriveVisitorClientConfig, type EditingSession, type EditingSessionCreation, type FileAccessContext, type FolderItem, type FolderPage, type GetCurrentWorkspaceInput, type GetItemInput, type GetItemVersionInput, type GetVisitorGrantInput, type GetWorkspaceUsageInput, type IncomingShareContext, type IncomingSharePage, type ItemOwnershipTransfer, type ItemSharingPeoplePage, type ListFolderChildrenInput, type ListIncomingSharesInput, type ListItemSharingPeopleInput, type ListItemVersionsInput, type ListOwnedItemsInput, type ListWorkspaceItemsInput, type ManagedDownloadDescriptor, type ManagedDownloadRestorePending, type ManagedItemMetadata, type ManagedItemVersion, type ManagedItemVersionPage, type ManagedItemVersionResource, type ManagedItemVersionRestoreResult, type ManagedLifecycleItem, type OwnedItem, type OwnedItemPage, type PrepareVerifiedTransferInput, type PreparedVerifiedTransfer, type ProtectionClassification, type PublishVerifiedTransferInput, type PublishedVerifiedTransfer, type RecoverVerifiedTransferInput, type RegisterItemRecipientInput, type RegisteredRecipientDisplay, type RestoreItemInput, type RestoreItemVersionInput, type RevokeVisitorGrantInput, type SearchWorkspaceItemsInput, type TransferItemOwnershipInput, type TrashItemInput, type UpdateItemInput, type UpdateWorkspaceSharingPolicyInput, type UploadFilePhase, type UploadFileProgress, type UploadFileProgressCallback, type UploadVerifiedFileInput, type VerifiedTransferOperations, type VisitorChildren, type VisitorGrant, type VisitorGrantCreation, type VisitorGrantPage, type VisitorItem, type VisitorSession, type WorkspaceDiscoveryItem, type WorkspaceDiscoveryPage, type WorkspaceItemSearchItem, type WorkspaceItemSearchPage, type WorkspaceSharingPolicy, type WorkspaceUsage, collectOwnedItems, createDriveClient, createDriveEditingClient, createDriveVisitorClient, createVisitorSessionToken };