@finueva/drive 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @finueva/drive
 
+## 0.6.0
+
+### Minor Changes
+
+- 5f0a6b1: Add a separate server-entry-point workspace provisioning client with explicit environment and entitlement validation, bounded service credential transport, and strict replay response checks.
+
+## 0.5.1
+
+### Patch Changes
+
+- b54eff9: Bind the default Fetch implementation to its global receiver so browser requests do not fail with an illegal invocation. Custom Fetch implementations and request policies are unchanged.
+
 ## 0.5.0
 
 ### Minor Changes

package/README.md

@@ -6,22 +6,29 @@ The package is ESM-only. Node.js 22 is the exact minimum; package CI qualifies N
 
 ## Exports
 
-| Import                  | Runtime                                                                |
-| ----------------------- | ---------------------------------------------------------------------- |
-| `@finueva/drive`        | Browser-safe client factory, errors, and curated types                 |
-| `@finueva/drive/client` | Browser-safe client factory                                            |
-| `@finueva/drive/server` | Request-scoped Worker and Node low-level client factory                |
-| `@finueva/drive/core`   | Reviewed error values only                                             |
-| `@finueva/drive/types`  | Curated workspace, search, item, version, permission, and upload types |
+| Import                  | Runtime                              |
+| ----------------------- | ------------------------------------ |
+| `@finueva/drive`        | Browser client, errors, types        |
+| `@finueva/drive/client` | Browser client                       |
+| `@finueva/drive/server` | Worker/Node user and service clients |
+| `@finueva/drive/core`   | Error values                         |
+| `@finueva/drive/types`  | Public operation types               |
 
 ## Browser
 
+Approved ecosystem servers can separately use `createDriveProvisioningClient` from `/server` to call `provisionWorkspace(command)`. Configure an exact environment and `getProvisioningCredential` provider using Auth service credentials, not User credentials. Commands require a stable provisioning ID, exact workspace reference, and explicit versioned storage entitlement. The client does not infer quotas, follow redirects, or retry. See [Workspace Provisioning](../../apps/developer/docs/sdk/provisioning.md) for ownership and recovery boundaries.
+
 ```ts
 import { createDriveClient } from "@finueva/drive";
 
 const drive = createDriveClient({
   baseUrl: "https://drive.example.com",
-  getCredential: ({ signal }) => auth.getDriveCredential({ signal }),
+  getCredential: async ({ signal }) => {
+    signal.throwIfAborted();
+    const credential = await auth.getDriveCredential({ workspace: { type: "personal" } });
+    signal.throwIfAborted();
+    return credential.token;
+  },
   timeoutMilliseconds: 30_000,
 });
 
@@ -53,6 +60,10 @@ const uploaded = await drive.uploadFile({
 
 The provider runs once for every request. The SDK sends its result only as `Authorization: Bearer`, always sets `credentials: "omit"` and `cache: "no-store"`, and never reads cookies. Configuration does not accept default headers. Credential acquisition, Fetch, and response handling share one bounded request deadline: 30 seconds by default, configurable from 1 millisecond through 120 seconds.
 
+`auth` is a configured `@finueva/auth` client. Select the exact personal or organization workspace. Native Fetch needs no wrapper.
+
+Approve the exact application origin in Drive's `DRIVE_BROWSER_ORIGINS` policy and configure archive CORS separately. API responses must expose `X-Request-ID` and `ETag`. See [browser setup](https://github.com/Ifkafin/drive/blob/main/apps/developer/docs/architecture/configuration.md#native-api-browser-origins).
+
 ## Worker And Node
 
 ```ts
@@ -101,9 +112,9 @@ Methods use the Native API operation IDs:
 
 `getCurrentWorkspace` maps the credential's selected Auth context to the provisioned Drive workspace and canonical managed root. It accepts only an optional `{ signal }` input, never provisions as a side effect, and returns no entitlement, credential, or private persistence fields.
 
-`getItem` reads one active managed item under exact `items:metadata:read` authority. It conceals absent, cross-workspace, unauthorized, tombstoned, ancestor-tombstoned, and unpublished file items as not found. Results expose exact `workspaceId`, `itemId`, nullable `parentId`, `type`, `name`, `lifecycleState`, `revision`, and `currentVersion`. Folder metadata returns `currentVersion: null`; published files return only the current immutable version ID, state, byte length, untrusted media type, and untrusted protection classification. The strong item ETag matches the returned item revision. Digests, archive/cache state, provider keys, upload state, and content authority are not exposed.
+`getItem` requires `items:metadata:read`. Absent, unauthorized, tombstoned, or unpublished items are concealed. Folders have `currentVersion: null`; files expose their current version. The strong ETag matches the item revision. Media type and protection classification are untrusted metadata, not content authority. Internal storage/provider state is never exposed.
 
-`searchWorkspaceItems` searches active managed metadata in one workspace by a required NFC, case-sensitive name prefix. The prefix is 1 through 64 Unicode code points, at most 255 UTF-8 bytes, and excludes C0/C1 controls plus U+2028/U+2029. Results are exact frozen `{ items, nextCursor }` pages of at most the requested limit or 50 by default, in binary name then item-ID order. Each item adds exact `volumeId` and `provider: "managed"` fields to the `getItem` metadata shape; folders require `currentVersion: null` and files require current-version metadata. Cursors use the existing opaque syntax and an empty page cannot carry a continuation.
+`searchWorkspaceItems` matches NFC, case-sensitive name prefixes: 1-64 Unicode code points, at most 255 UTF-8 bytes, without C0/C1 controls or U+2028/U+2029. Frozen `{ items, nextCursor }` pages default to 50 rows ordered by binary name then item ID. Results add `volumeId` and `provider: "managed"` to item metadata. An empty page cannot have a cursor.
 
 Every mutation requires the API's explicit idempotency key when the operation defines one. Item lifecycle mutations also require the current strong item ETag as `ifMatch`; grant mutations use their documented collection or grant precondition. Mutations are never retried automatically. Sparse updates omit `undefined` properties and preserve explicit `null` expiry.
 
@@ -111,7 +122,7 @@ Successful calls return `{ data, status, requestId, validators }`. A successful
 
 `updateItem` renames and moves one stable item ID. A move immediately changes inherited-grant ancestry; Drive does not copy grants to the item. `trashItem` retains a 30-day tombstone, `restoreItem` requires the original parent to remain active, and `deleteItem` starts permanent archive cleanup only after retention expires and no hold applies. Permanent deletion is currently bounded to at most 25 subtree items and 25 total versions; larger trees fail unavailable until a durable workflow exists. Exact retries resume retained deletion checkpoints and never trigger blind provider duplication.
 
-`listItemVersions` returns only immutable `current` and `superseded` managed version projections in pages of at most 50 using an opaque encrypted cursor. `getItemVersion` returns a strict frozen `ManagedItemVersionResource` containing the requested `workspaceId`, `itemId`, and `versionId` plus those version fields; all three response IDs must match the request. It conceals clean absence, valid wrong-item identity, unpublished history, and deleting or deleted history, while malformed retained state is unavailable. `restoreItemVersion` atomically makes one selected superseded version current, demotes the previous current version, advances the item revision, and never copies or overwrites archive bytes.
+`listItemVersions` pages immutable current/superseded versions, at most 50 per page. `getItemVersion` verifies all three workspace/item/version IDs and conceals unavailable history. Malformed retained state fails unavailable. `restoreItemVersion` atomically changes the current version and item revision without copying or overwriting archive bytes.
 
 `createDownload` returns a short-lived archive descriptor for the current or an explicit immutable version, one visible `restore-pending` result for cold content, or a no-body `304` operation result whose validators retain the source ETag. Full, closed, open, and suffix ranges use the selected archive object's strong ETag; malformed or multiple ranges are served as full representations, while valid non-overlapping ranges fail with `range_not_satisfiable`. `downloadItem` follows a descriptor with no Drive credential, ambient browser credentials, or referrer and returns the provider body as a backpressured `Response`; it preserves the same `304` and cold-restore results without a provider request. It validates exact status, ETag, identity encoding, length, and `Content-Range`, cancels malformed upstream bodies, and keeps caller cancellation/deadline authority active until the stream closes or is cancelled. It never returns Blob, ArrayBuffer, text, or base64 whole-file convenience values.
 

package/dist/client.js

@@ -1780,7 +1780,7 @@ function createClientRuntime(config) {
 	try {
 		runtime = Object.freeze({
 			baseUrl: parseBaseUrl(config.baseUrl),
-			fetchImplementation: config.fetch ?? globalThis.fetch,
+			fetchImplementation: config.fetch ?? globalThis.fetch.bind(globalThis),
 			getCredential: config.getCredential,
 			timeoutMilliseconds: parseTimeoutMilliseconds(config.timeoutMilliseconds)
 		});

package/dist/contract.d.ts

@@ -1,5 +1,228 @@
 //#region src/generated/openapi.d.ts
 interface operations {
+  provisionManagedWorkspace: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        "application/json": {
+          entitlement: {
+            managedStorageByteLimit: number;
+            managedStorageEnabled: boolean;
+            version: number;
+          } & ({
+            /** @constant */
+            managedStorageByteLimit?: 0;
+            /** @constant */
+            managedStorageEnabled?: false;
+          } | {
+            managedStorageByteLimit?: number;
+            /** @constant */
+            managedStorageEnabled?: true;
+          });
+          /** @enum {string} */
+          environment: "local" | "development" | "staging" | "production";
+          provisioningId: string;
+          /** @constant */
+          version: 1;
+          workspaceReference: {
+            /** @enum {string} */
+            type: "personal";
+            userId: string;
+          } | {
+            organizationId: string;
+            /** @enum {string} */
+            type: "organization";
+          };
+        };
+      };
+    };
+    responses: {
+      /** @description The exact request replayed or was superseded by a later entitlement. */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": {
+            /** @enum {string} */
+            outcome: "replayed" | "superseded";
+            workspace: {
+              entitlement: {
+                managedStorageByteLimit: number;
+                managedStorageEnabled: boolean;
+                version: number;
+              } & ({
+                /** @constant */
+                managedStorageByteLimit?: 0;
+                /** @constant */
+                managedStorageEnabled?: false;
+              } | {
+                managedStorageByteLimit?: number;
+                /** @constant */
+                managedStorageEnabled?: true;
+              });
+              rootItemId: string;
+              rootVolumeId: string;
+              workspaceId: string;
+              workspaceReference: {
+                /** @enum {string} */
+                type: "personal";
+                userId: string;
+              } | {
+                organizationId: string;
+                /** @enum {string} */
+                type: "organization";
+              };
+            };
+          };
+        };
+      };
+      /** @description The provisioning state was committed. */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": {
+            /** @enum {string} */
+            outcome: "committed";
+            workspace: {
+              entitlement: {
+                managedStorageByteLimit: number;
+                managedStorageEnabled: boolean;
+                version: number;
+              } & ({
+                /** @constant */
+                managedStorageByteLimit?: 0;
+                /** @constant */
+                managedStorageEnabled?: false;
+              } | {
+                managedStorageByteLimit?: number;
+                /** @constant */
+                managedStorageEnabled?: true;
+              });
+              rootItemId: string;
+              rootVolumeId: string;
+              workspaceId: string;
+              workspaceReference: {
+                /** @enum {string} */
+                type: "personal";
+                userId: string;
+              } | {
+                organizationId: string;
+                /** @enum {string} */
+                type: "organization";
+              };
+            };
+          };
+        };
+      };
+      /** @description A valid ecosystem provisioning bearer credential is required. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": {
+            error: {
+              /** @enum {string} */
+              code: "authentication_required";
+              details: Record<string, never>;
+              /** @enum {string} */
+              message: "Authentication is required.";
+              requestId: string;
+            };
+          };
+        };
+      };
+      /** @description The verified principal lacks the exact provisioning capability. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": {
+            error: {
+              /** @enum {string} */
+              code: "permission_denied";
+              details: Record<string, never>;
+              /** @enum {string} */
+              message: "The requested action is not permitted.";
+              requestId: string;
+            };
+          };
+        };
+      };
+      /** @description The provisioning identity conflicts with retained state. */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": {
+            error: {
+              /** @enum {string} */
+              code: "idempotency_conflict";
+              details: Record<string, never>;
+              /** @enum {string} */
+              message: "The idempotency key conflicts with an earlier request.";
+              requestId: string;
+            };
+          };
+        };
+      };
+      /** @description The strict provisioning request is invalid. */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": {
+            error: {
+              /** @enum {string} */
+              code: "invalid_request";
+              details: Record<string, never>;
+              /** @enum {string} */
+              message: "The request is invalid.";
+              requestId: string;
+            };
+          };
+        };
+      };
+      /** @description Auth authority, D1, or trusted capacity evidence is unavailable. */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": {
+            error: {
+              /** @enum {string} */
+              code: "identity_authority_unavailable";
+              details: Record<string, never>;
+              /** @enum {string} */
+              message: "Authentication is temporarily unavailable.";
+              requestId: string;
+            };
+          } | {
+            error: {
+              /** @enum {string} */
+              code: "service_unavailable";
+              details: Record<string, never>;
+              /** @enum {string} */
+              message: "The service is temporarily unavailable.";
+              requestId: string;
+            };
+          };
+        };
+      };
+    };
+  };
   getCurrentWorkspace: {
     parameters: {
       query?: never;
@@ -4596,4 +4819,4 @@ interface DriveClient extends DriveOperations {
   uploadFile(input: UploadFileInput): Promise<DriveOperationResult<ReadyUpload, 200>>;
 }
 //#endregion
-export { UpdateItemInput as $, ListItemVersionsInput as A, PermissionGrant as B, FolderPage as C, GetUploadStatusInput as D, GetItemVersionInput as E, ManagedItemVersionPage as F, ReadEffectiveItemPermissionsInput as G, PermissionMutation as H, ManagedItemVersionResource as I, RestoreItemInput as J, ReadyUpload as K, ManagedItemVersionRestoreResult as L, ManagedDownloadRestorePending as M, ManagedItemMetadata as N, ListFolderChildrenInput as O, ManagedItemVersion as P, TrashItemInput as Q, ManagedLifecycleItem as R, FolderItem as S, GetItemInput as T, PermissionPage as U, PermissionGrantee as V, ProtectionClassification as W, RevokeItemPermissionInput as X, RestoreItemVersionInput as Y, SearchWorkspaceItemsInput as Z, DriveResponseValidators as _, CreateItemPermissionInput as a, UploadFileProgressCallback as at, EffectivePermissionAction as b, CurrentWorkspace as c, UploadSession as ct, DriveClient as d, WorkspaceItemSearchPage as dt, UpdateItemPermissionInput as et, DriveClientConfig as f, DriveOperations as g, DriveOperationResult as h, CreateFolderInput as i, UploadFileProgress as it, ManagedDownloadDescriptor as j, ListItemPermissionsInput as k, DeleteItemInput as l, UploadStatus as lt, DriveCredentialProvider as m, CompleteUploadInput as n, UploadFileInput as nt, CreateUploadInput as o, UploadPartDescriptor as ot, DriveCredentialContext as p, RecordUploadPartInput as q, CreateDownloadInput as r, UploadFilePhase as rt, CreateUploadPartDescriptorInput as s, UploadPartResult as st, AbortUploadInput as t, UploadConfirmedPart as tt, DownloadItemResult as u, WorkspaceItemSearchItem as ut, DriveServerClient as v, GetCurrentWorkspaceInput as w, EffectivePermissionResponse as x, DriveServerClientConfig as y, PermissionAction as z };
+export { UpdateItemInput as $, ListItemVersionsInput as A, PermissionGrant as B, FolderPage as C, GetUploadStatusInput as D, GetItemVersionInput as E, ManagedItemVersionPage as F, ReadEffectiveItemPermissionsInput as G, PermissionMutation as H, ManagedItemVersionResource as I, RestoreItemInput as J, ReadyUpload as K, ManagedItemVersionRestoreResult as L, ManagedDownloadRestorePending as M, ManagedItemMetadata as N, ListFolderChildrenInput as O, ManagedItemVersion as P, TrashItemInput as Q, ManagedLifecycleItem as R, FolderItem as S, GetItemInput as T, PermissionPage as U, PermissionGrantee as V, ProtectionClassification as W, RevokeItemPermissionInput as X, RestoreItemVersionInput as Y, SearchWorkspaceItemsInput as Z, DriveResponseValidators as _, CreateItemPermissionInput as a, UploadFileProgressCallback as at, EffectivePermissionAction as b, CurrentWorkspace as c, UploadSession as ct, DriveClient as d, WorkspaceItemSearchPage as dt, UpdateItemPermissionInput as et, DriveClientConfig as f, operations as ft, DriveOperations as g, DriveOperationResult as h, CreateFolderInput as i, UploadFileProgress as it, ManagedDownloadDescriptor as j, ListItemPermissionsInput as k, DeleteItemInput as l, UploadStatus as lt, DriveCredentialProvider as m, CompleteUploadInput as n, UploadFileInput as nt, CreateUploadInput as o, UploadPartDescriptor as ot, DriveCredentialContext as p, RecordUploadPartInput as q, CreateDownloadInput as r, UploadFilePhase as rt, CreateUploadPartDescriptorInput as s, UploadPartResult as st, AbortUploadInput as t, UploadConfirmedPart as tt, DownloadItemResult as u, WorkspaceItemSearchItem as ut, DriveServerClient as v, GetCurrentWorkspaceInput as w, EffectivePermissionResponse as x, DriveServerClientConfig as y, PermissionAction as z };

package/dist/index.js

@@ -1780,7 +1780,7 @@ function createClientRuntime(config) {
 	try {
 		runtime = Object.freeze({
 			baseUrl: parseBaseUrl(config.baseUrl),
-			fetchImplementation: config.fetch ?? globalThis.fetch,
+			fetchImplementation: config.fetch ?? globalThis.fetch.bind(globalThis),
 			getCredential: config.getCredential,
 			timeoutMilliseconds: parseTimeoutMilliseconds(config.timeoutMilliseconds)
 		});

package/dist/server.d.ts

@@ -1,5 +1,23 @@
-import { $ as UpdateItemInput, A as ListItemVersionsInput, C as FolderPage, D as GetUploadStatusInput, E as GetItemVersionInput, F as ManagedItemVersionPage, I as ManagedItemVersionResource, J as RestoreItemInput, K as ReadyUpload, L as ManagedItemVersionRestoreResult, M as ManagedDownloadRestorePending, N as ManagedItemMetadata, O as ListFolderChildrenInput, P as ManagedItemVersion, Q as TrashItemInput, R as ManagedLifecycleItem, S as FolderItem, T as GetItemInput, W as ProtectionClassification, Y as RestoreItemVersionInput, Z as SearchWorkspaceItemsInput, c as CurrentWorkspace, ct as UploadSession, dt as WorkspaceItemSearchPage, j as ManagedDownloadDescriptor, l as DeleteItemInput, lt as UploadStatus, n as CompleteUploadInput, o as CreateUploadInput, ot as UploadPartDescriptor, q as RecordUploadPartInput, r as CreateDownloadInput, s as CreateUploadPartDescriptorInput, st as UploadPartResult, t as AbortUploadInput, tt as UploadConfirmedPart, u as DownloadItemResult, ut as WorkspaceItemSearchItem, v as DriveServerClient, w as GetCurrentWorkspaceInput, y as DriveServerClientConfig } from "./contract.js";
+import { $ as UpdateItemInput, A as ListItemVersionsInput, C as FolderPage, D as GetUploadStatusInput, E as GetItemVersionInput, F as ManagedItemVersionPage, I as ManagedItemVersionResource, J as RestoreItemInput, K as ReadyUpload, L as ManagedItemVersionRestoreResult, M as ManagedDownloadRestorePending, N as ManagedItemMetadata, O as ListFolderChildrenInput, P as ManagedItemVersion, Q as TrashItemInput, R as ManagedLifecycleItem, S as FolderItem, T as GetItemInput, W as ProtectionClassification, Y as RestoreItemVersionInput, Z as SearchWorkspaceItemsInput, c as CurrentWorkspace, ct as UploadSession, dt as WorkspaceItemSearchPage, ft as operations, h as DriveOperationResult, j as ManagedDownloadDescriptor, l as DeleteItemInput, lt as UploadStatus, m as DriveCredentialProvider, n as CompleteUploadInput, o as CreateUploadInput, ot as UploadPartDescriptor, q as RecordUploadPartInput, r as CreateDownloadInput, s as CreateUploadPartDescriptorInput, st as UploadPartResult, t as AbortUploadInput, tt as UploadConfirmedPart, u as DownloadItemResult, ut as WorkspaceItemSearchItem, v as DriveServerClient, w as GetCurrentWorkspaceInput, y as DriveServerClientConfig } from "./contract.js";
+//#region src/internal/provisioning.d.ts
+type Operation = operations["provisionManagedWorkspace"];
+type ProvisionWorkspaceCommand = Operation["requestBody"]["content"]["application/json"];
+type ProvisionWorkspaceResult = Operation["responses"][200]["content"]["application/json"] | Operation["responses"][201]["content"]["application/json"];
+interface DriveProvisioningClientConfig {
+  baseUrl: string;
+  environment: ProvisionWorkspaceCommand["environment"];
+  getProvisioningCredential: DriveCredentialProvider;
+  fetch?: typeof globalThis.fetch;
+  timeoutMilliseconds?: number;
+}
+interface DriveProvisioningClient {
+  provisionWorkspace(command: ProvisionWorkspaceCommand, options?: {
+    signal?: AbortSignal;
+  }): Promise<DriveOperationResult<ProvisionWorkspaceResult, 200 | 201>>;
+}
+declare function createDriveProvisioningClient(config: DriveProvisioningClientConfig): DriveProvisioningClient;
+//#endregion
 //#region src/server.d.ts
 declare function createDriveServerClient(config: DriveServerClientConfig): DriveServerClient;
 //#endregion
-export { type AbortUploadInput, type CompleteUploadInput, type CreateDownloadInput, type CreateUploadInput, type CreateUploadPartDescriptorInput, type CurrentWorkspace, type DeleteItemInput, type DownloadItemResult, type DriveServerClient, type DriveServerClientConfig, type FolderItem, type FolderPage, type GetCurrentWorkspaceInput, type GetItemInput, type GetItemVersionInput, type GetUploadStatusInput, type ListFolderChildrenInput, type ListItemVersionsInput, type ManagedDownloadDescriptor, type ManagedDownloadRestorePending, type ManagedItemMetadata, type ManagedItemVersion, type ManagedItemVersionPage, type ManagedItemVersionResource, type ManagedItemVersionRestoreResult, type ManagedLifecycleItem, type ProtectionClassification, type ReadyUpload, type RecordUploadPartInput, type RestoreItemInput, type RestoreItemVersionInput, type SearchWorkspaceItemsInput, type TrashItemInput, type UpdateItemInput, type UploadConfirmedPart, type UploadPartDescriptor, type UploadPartResult, type UploadSession, type UploadStatus, type WorkspaceItemSearchItem, type WorkspaceItemSearchPage, createDriveServerClient };
+export { type AbortUploadInput, type CompleteUploadInput, type CreateDownloadInput, type CreateUploadInput, type CreateUploadPartDescriptorInput, type CurrentWorkspace, type DeleteItemInput, type DownloadItemResult, type DriveProvisioningClient, type DriveProvisioningClientConfig, type DriveServerClient, type DriveServerClientConfig, type FolderItem, type FolderPage, type GetCurrentWorkspaceInput, type GetItemInput, type GetItemVersionInput, type GetUploadStatusInput, type ListFolderChildrenInput, type ListItemVersionsInput, type ManagedDownloadDescriptor, type ManagedDownloadRestorePending, type ManagedItemMetadata, type ManagedItemVersion, type ManagedItemVersionPage, type ManagedItemVersionResource, type ManagedItemVersionRestoreResult, type ManagedLifecycleItem, type ProtectionClassification, type ProvisionWorkspaceCommand, type ProvisionWorkspaceResult, type ReadyUpload, type RecordUploadPartInput, type RestoreItemInput, type RestoreItemVersionInput, type SearchWorkspaceItemsInput, type TrashItemInput, type UpdateItemInput, type UploadConfirmedPart, type UploadPartDescriptor, type UploadPartResult, type UploadSession, type UploadStatus, type WorkspaceItemSearchItem, type WorkspaceItemSearchPage, createDriveProvisioningClient, createDriveServerClient };

package/dist/server.js

@@ -1738,7 +1738,7 @@ function createClientRuntime(config) {
 	try {
 		runtime = Object.freeze({
 			baseUrl: parseBaseUrl(config.baseUrl),
-			fetchImplementation: config.fetch ?? globalThis.fetch,
+			fetchImplementation: config.fetch ?? globalThis.fetch.bind(globalThis),
 			getCredential: config.getCredential,
 			timeoutMilliseconds: parseTimeoutMilliseconds(config.timeoutMilliseconds)
 		});
@@ -2459,6 +2459,81 @@ async function abortUpload(runtime, input) {
 	}), [204], null, false, TRANSFER_ERROR_CODES);
 }
 //#endregion
+//#region src/internal/provisioning.ts
+const environments = [
+	"local",
+	"development",
+	"staging",
+	"production"
+];
+const identifier = /^[A-Za-z0-9_-]{1,128}$/;
+function createDriveProvisioningClient(config) {
+	if (!config || !environments.includes(config.environment)) throw new DriveError("invalid_input");
+	const environment = config.environment;
+	const runtime = createClientRuntime({
+		baseUrl: config.baseUrl,
+		getCredential: config.getProvisioningCredential,
+		...config.fetch === void 0 ? {} : { fetch: config.fetch },
+		...config.timeoutMilliseconds === void 0 ? {} : { timeoutMilliseconds: config.timeoutMilliseconds }
+	});
+	return Object.freeze({ async provisionWorkspace(command, options) {
+		if (!exact(command, [
+			"version",
+			"environment",
+			"provisioningId",
+			"workspaceReference",
+			"entitlement"
+		]) || command.version !== 1 || command.environment !== environment || typeof command.provisioningId !== "string" || !identifier.test(command.provisioningId) || !reference(command.workspaceReference) || !entitlement(command.entitlement)) throw new DriveError("invalid_input");
+		const body = {
+			version: command.version,
+			environment: command.environment,
+			provisioningId: command.provisioningId,
+			workspaceReference: { ...command.workspaceReference },
+			entitlement: { ...command.entitlement }
+		};
+		return execute(runtime, options?.signal, null, (api, boundary) => api.POST("/api/v1/platform/workspaces/provision", {
+			...boundary,
+			redirect: "manual",
+			body
+		}), [200, 201], (value, status) => validResult(value, status, body), false, [
+			"authentication_required",
+			"permission_denied",
+			"idempotency_conflict",
+			"invalid_request",
+			"identity_authority_unavailable",
+			"service_unavailable"
+		]);
+	} });
+}
+function exact(value, keys) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function reference(value) {
+	return exact(value, ["type", "userId"]) && value.type === "personal" && typeof value.userId === "string" && identifier.test(value.userId) || exact(value, ["type", "organizationId"]) && value.type === "organization" && typeof value.organizationId === "string" && identifier.test(value.organizationId);
+}
+function entitlement(value) {
+	return exact(value, [
+		"version",
+		"managedStorageEnabled",
+		"managedStorageByteLimit"
+	]) && typeof value.version === "number" && Number.isSafeInteger(value.version) && value.version >= 0 && typeof value.managedStorageByteLimit === "number" && Number.isSafeInteger(value.managedStorageByteLimit) && (value.managedStorageEnabled === true && value.managedStorageByteLimit > 0 || value.managedStorageEnabled === false && value.managedStorageByteLimit === 0);
+}
+function validResult(value, status, command) {
+	if (!exact(value, ["outcome", "workspace"]) || (status === 201 ? value.outcome !== "committed" : value.outcome !== "replayed" && value.outcome !== "superseded") || !exact(value.workspace, [
+		"workspaceId",
+		"rootVolumeId",
+		"rootItemId",
+		"workspaceReference",
+		"entitlement"
+	])) return false;
+	const { entitlement: current, ...workspace } = value.workspace;
+	if (!isCurrentWorkspace(workspace) || !entitlement(current)) return false;
+	const actual = workspace.workspaceReference;
+	const expected = command.workspaceReference;
+	if (!(actual.type === "personal" && expected.type === "personal" && actual.userId === expected.userId) && !(actual.type === "organization" && expected.type === "organization" && actual.organizationId === expected.organizationId)) return false;
+	return value.outcome === "superseded" ? current.version > command.entitlement.version : current.version === command.entitlement.version && current.managedStorageEnabled === command.entitlement.managedStorageEnabled && current.managedStorageByteLimit === command.entitlement.managedStorageByteLimit;
+}
+//#endregion
 //#region src/server.ts
 function createDriveServerClient(config) {
 	const credential = config.credential;
@@ -2471,4 +2546,4 @@ function createDriveServerClient(config) {
 	});
 }
 //#endregion
-export { createDriveServerClient };
+export { createDriveProvisioningClient, createDriveServerClient };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/drive",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Public browser, Worker, and Node client for Finueva Drive",
   "type": "module",
   "types": "./dist/index.d.ts",
@@ -65,6 +65,7 @@
     "openapi-fetch": "0.17.0",
     "openapi-typescript": "7.13.0",
     "playwright": "1.62.1",
+    "prettier": "^3.9.6",
     "rolldown": "1.2.0",
     "rolldown-plugin-dts": "0.27.14",
     "typescript": "5.9.3",