@gamerdexapp/gamerdex-sync 0.2.1 → 0.3.1

package/CHANGELOG.md

@@ -7,6 +7,26 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.3.1] - 2026-10-18
+
+### Fixed
+
+- `OneDriveProvider` no longer brings back a file that another device removed. OneDrive creates a
+  file when a write with `If-Match` finds none. The provider now removes that file again and reports
+  a version conflict.
+
+## [0.3.0] - 2026-10-18
+
+### Added
+
+- `DropboxProvider` keeps the files in the app folder of the Dropbox of the player. It writes with
+  the revision that was read and fails with a version conflict when the file changed since.
+- `OneDriveProvider` keeps the files in the app folder of the OneDrive of a personal Microsoft
+  account. It writes with the `eTag` that was read and creates a new file only when none exists.
+- `dropboxAuthorizeUrl()` with `DROPBOX_SCOPES`, and `microsoftAuthorizeUrl()` with
+  `ONEDRIVE_FILE_SCOPE` and `ONEDRIVE_SCOPES`, for the two sign in pages.
+- `ProviderError.detail` also reads the summary of a failed Dropbox request.
+
 ## [0.2.1] - 2026-10-18
 
 ### Fixed

package/README.md

@@ -28,7 +28,7 @@ const result = await sync({
   appId: "my-app",
   deviceId: "device-1",
   deviceName: "Laptop",
-  provider: new MemoryProvider(), // GitHubProvider in an app
+  provider: new MemoryProvider(), // GitHubProvider, GoogleDriveProvider, DropboxProvider or OneDriveProvider in an app
   schema,
   local: { chief: { level: 5 } },
   state: null, // the state that the last sync returned, or null on the first sync

package/dist/index.d.mts

@@ -443,4 +443,89 @@ declare const GOOGLE_DRIVE_SCOPE = "https://www.googleapis.com/auth/drive.file";
  */
 declare const googleAuthorizeUrl: (clientId: string, redirectUri: string, state: string) => string;
 
-export { type CallbackResult, type Conflict, type ConflictKind, DATA_FILE, type DeviceRecord, type FirstSyncChoice, GITHUB_APP, GOOGLE_DRIVE_SCOPE, type GitHubOptions, GitHubProvider, type GoogleDriveOptions, GoogleDriveProvider, type InstalledRepository, META_FILE, META_FORMAT, MemoryProvider, type MergeInput, type MergeResult, type ParsedMeta, type Path, type PathStep, ProviderError, type ProviderErrorKind, ROOT_FOLDER, RemoteDataError, type RemoteFile, type RepositoryCheck, type Schema, type Side, type StoredTokens, SyncBusyError, type SyncMeta, type SyncOptions, type SyncProvider, type SyncResult, type SyncState, type TokenResponse, type TokenSourceOptions, VersionConflictError, authorizeUrl, createTokenSource, dataPath, decodeBase64, emptyMeta, encodeBase64, equal, googleAuthorizeUrl, installUrl, isAppId, isObject, listInstalledRepositories, merge, metaPath, newState, parseMeta, parseTokenResponse, readCallback, resolveConflict, restoreCloudValues, sync, toStoredTokens, withChiefRemoved, withChiefRevision, withDevice, withSettingsRevision };
+interface DropboxOptions {
+    /** Returns the token. It may refresh the token first, so it is called for every request. */
+    getToken: () => Promise<string>;
+    fetch?: typeof fetch;
+}
+/**
+ * Keeps the files of an app in the Dropbox of the player. The app should have the App folder
+ * access type with the `files.content.read` and `files.content.write` scopes, so it sees only its
+ * own folder under `Apps`.
+ *
+ * Dropbox writes with an expected revision. An upload in `update` mode with `strict_conflict`
+ * fails when the file changed since, and an upload in `add` mode fails when the file exists.
+ */
+declare class DropboxProvider implements SyncProvider {
+    private readonly options;
+    private readonly send;
+    constructor(options: DropboxOptions);
+    read(path: string): Promise<RemoteFile | null>;
+    write(path: string, content: string, expectedVersion: string | null): Promise<{
+        version: string;
+    }>;
+    remove(path: string, expectedVersion: string): Promise<void>;
+    private request;
+    /**
+     * Reads a failed answer. Dropbox reports a failure that belongs to the call, such as a missing
+     * file or a conflict, with status 409. The caller decides what that means. Every other status
+     * is a failure of the request and is thrown here.
+     */
+    private failure;
+    private unexpected;
+    private invalid;
+}
+
+interface OneDriveOptions {
+    /** Returns the token. It may refresh the token first, so it is called for every request. */
+    getToken: () => Promise<string>;
+    fetch?: typeof fetch;
+}
+/**
+ * Keeps the files of an app in the OneDrive of the player, in the app folder under `Apps`. It
+ * needs only the `Files.ReadWrite.AppFolder` scope, so it sees no other file. The app folder
+ * exists for personal Microsoft accounts.
+ *
+ * A write sends the `eTag` that was read in an `If-Match` header, and a new file is created with
+ * `conflictBehavior=fail`. OneDrive answers 412 and 409 when the file changed or exists.
+ */
+declare class OneDriveProvider implements SyncProvider {
+    private readonly options;
+    private readonly send;
+    constructor(options: OneDriveOptions);
+    read(path: string): Promise<RemoteFile | null>;
+    write(path: string, content: string, expectedVersion: string | null): Promise<{
+        version: string;
+    }>;
+    remove(path: string, expectedVersion: string): Promise<void>;
+    /**
+     * OneDrive creates the file when a write with `If-Match` finds none, which would undo the
+     * removal that another device made. The file that was just created is removed again.
+     */
+    private undoCreate;
+    private itemUrl;
+    private ifMatch;
+    private info;
+    /** The download address is signed, so it must not carry the token. */
+    private fetchContent;
+    private request;
+    private assertOk;
+    private invalid;
+}
+
+/** The scopes that sync asks for. Together with the App folder access type, they reach one folder. */
+declare const DROPBOX_SCOPES: readonly ["files.content.read", "files.content.write"];
+/**
+ * The address of the Dropbox sign in page. `token_access_type=offline` makes Dropbox send a
+ * refresh token, which does not expire until the player removes the access.
+ */
+declare const dropboxAuthorizeUrl: (clientId: string, redirectUri: string, state: string) => string;
+
+/** The file scope that sync asks for. It reaches only the app folder of the player. */
+declare const ONEDRIVE_FILE_SCOPE = "Files.ReadWrite.AppFolder";
+/** The file scope, and `offline_access`, which makes Microsoft send a refresh token. */
+declare const ONEDRIVE_SCOPES: readonly ["Files.ReadWrite.AppFolder", "offline_access"];
+/** The address of the Microsoft sign in page for personal accounts. */
+declare const microsoftAuthorizeUrl: (clientId: string, redirectUri: string, state: string) => string;
+
+export { type CallbackResult, type Conflict, type ConflictKind, DATA_FILE, DROPBOX_SCOPES, type DeviceRecord, type DropboxOptions, DropboxProvider, type FirstSyncChoice, GITHUB_APP, GOOGLE_DRIVE_SCOPE, type GitHubOptions, GitHubProvider, type GoogleDriveOptions, GoogleDriveProvider, type InstalledRepository, META_FILE, META_FORMAT, MemoryProvider, type MergeInput, type MergeResult, ONEDRIVE_FILE_SCOPE, ONEDRIVE_SCOPES, type OneDriveOptions, OneDriveProvider, type ParsedMeta, type Path, type PathStep, ProviderError, type ProviderErrorKind, ROOT_FOLDER, RemoteDataError, type RemoteFile, type RepositoryCheck, type Schema, type Side, type StoredTokens, SyncBusyError, type SyncMeta, type SyncOptions, type SyncProvider, type SyncResult, type SyncState, type TokenResponse, type TokenSourceOptions, VersionConflictError, authorizeUrl, createTokenSource, dataPath, decodeBase64, dropboxAuthorizeUrl, emptyMeta, encodeBase64, equal, googleAuthorizeUrl, installUrl, isAppId, isObject, listInstalledRepositories, merge, metaPath, microsoftAuthorizeUrl, newState, parseMeta, parseTokenResponse, readCallback, resolveConflict, restoreCloudValues, sync, toStoredTokens, withChiefRemoved, withChiefRevision, withDevice, withSettingsRevision };

package/dist/index.d.ts

@@ -443,4 +443,89 @@ declare const GOOGLE_DRIVE_SCOPE = "https://www.googleapis.com/auth/drive.file";
  */
 declare const googleAuthorizeUrl: (clientId: string, redirectUri: string, state: string) => string;
 
-export { type CallbackResult, type Conflict, type ConflictKind, DATA_FILE, type DeviceRecord, type FirstSyncChoice, GITHUB_APP, GOOGLE_DRIVE_SCOPE, type GitHubOptions, GitHubProvider, type GoogleDriveOptions, GoogleDriveProvider, type InstalledRepository, META_FILE, META_FORMAT, MemoryProvider, type MergeInput, type MergeResult, type ParsedMeta, type Path, type PathStep, ProviderError, type ProviderErrorKind, ROOT_FOLDER, RemoteDataError, type RemoteFile, type RepositoryCheck, type Schema, type Side, type StoredTokens, SyncBusyError, type SyncMeta, type SyncOptions, type SyncProvider, type SyncResult, type SyncState, type TokenResponse, type TokenSourceOptions, VersionConflictError, authorizeUrl, createTokenSource, dataPath, decodeBase64, emptyMeta, encodeBase64, equal, googleAuthorizeUrl, installUrl, isAppId, isObject, listInstalledRepositories, merge, metaPath, newState, parseMeta, parseTokenResponse, readCallback, resolveConflict, restoreCloudValues, sync, toStoredTokens, withChiefRemoved, withChiefRevision, withDevice, withSettingsRevision };
+interface DropboxOptions {
+    /** Returns the token. It may refresh the token first, so it is called for every request. */
+    getToken: () => Promise<string>;
+    fetch?: typeof fetch;
+}
+/**
+ * Keeps the files of an app in the Dropbox of the player. The app should have the App folder
+ * access type with the `files.content.read` and `files.content.write` scopes, so it sees only its
+ * own folder under `Apps`.
+ *
+ * Dropbox writes with an expected revision. An upload in `update` mode with `strict_conflict`
+ * fails when the file changed since, and an upload in `add` mode fails when the file exists.
+ */
+declare class DropboxProvider implements SyncProvider {
+    private readonly options;
+    private readonly send;
+    constructor(options: DropboxOptions);
+    read(path: string): Promise<RemoteFile | null>;
+    write(path: string, content: string, expectedVersion: string | null): Promise<{
+        version: string;
+    }>;
+    remove(path: string, expectedVersion: string): Promise<void>;
+    private request;
+    /**
+     * Reads a failed answer. Dropbox reports a failure that belongs to the call, such as a missing
+     * file or a conflict, with status 409. The caller decides what that means. Every other status
+     * is a failure of the request and is thrown here.
+     */
+    private failure;
+    private unexpected;
+    private invalid;
+}
+
+interface OneDriveOptions {
+    /** Returns the token. It may refresh the token first, so it is called for every request. */
+    getToken: () => Promise<string>;
+    fetch?: typeof fetch;
+}
+/**
+ * Keeps the files of an app in the OneDrive of the player, in the app folder under `Apps`. It
+ * needs only the `Files.ReadWrite.AppFolder` scope, so it sees no other file. The app folder
+ * exists for personal Microsoft accounts.
+ *
+ * A write sends the `eTag` that was read in an `If-Match` header, and a new file is created with
+ * `conflictBehavior=fail`. OneDrive answers 412 and 409 when the file changed or exists.
+ */
+declare class OneDriveProvider implements SyncProvider {
+    private readonly options;
+    private readonly send;
+    constructor(options: OneDriveOptions);
+    read(path: string): Promise<RemoteFile | null>;
+    write(path: string, content: string, expectedVersion: string | null): Promise<{
+        version: string;
+    }>;
+    remove(path: string, expectedVersion: string): Promise<void>;
+    /**
+     * OneDrive creates the file when a write with `If-Match` finds none, which would undo the
+     * removal that another device made. The file that was just created is removed again.
+     */
+    private undoCreate;
+    private itemUrl;
+    private ifMatch;
+    private info;
+    /** The download address is signed, so it must not carry the token. */
+    private fetchContent;
+    private request;
+    private assertOk;
+    private invalid;
+}
+
+/** The scopes that sync asks for. Together with the App folder access type, they reach one folder. */
+declare const DROPBOX_SCOPES: readonly ["files.content.read", "files.content.write"];
+/**
+ * The address of the Dropbox sign in page. `token_access_type=offline` makes Dropbox send a
+ * refresh token, which does not expire until the player removes the access.
+ */
+declare const dropboxAuthorizeUrl: (clientId: string, redirectUri: string, state: string) => string;
+
+/** The file scope that sync asks for. It reaches only the app folder of the player. */
+declare const ONEDRIVE_FILE_SCOPE = "Files.ReadWrite.AppFolder";
+/** The file scope, and `offline_access`, which makes Microsoft send a refresh token. */
+declare const ONEDRIVE_SCOPES: readonly ["Files.ReadWrite.AppFolder", "offline_access"];
+/** The address of the Microsoft sign in page for personal accounts. */
+declare const microsoftAuthorizeUrl: (clientId: string, redirectUri: string, state: string) => string;
+
+export { type CallbackResult, type Conflict, type ConflictKind, DATA_FILE, DROPBOX_SCOPES, type DeviceRecord, type DropboxOptions, DropboxProvider, type FirstSyncChoice, GITHUB_APP, GOOGLE_DRIVE_SCOPE, type GitHubOptions, GitHubProvider, type GoogleDriveOptions, GoogleDriveProvider, type InstalledRepository, META_FILE, META_FORMAT, MemoryProvider, type MergeInput, type MergeResult, ONEDRIVE_FILE_SCOPE, ONEDRIVE_SCOPES, type OneDriveOptions, OneDriveProvider, type ParsedMeta, type Path, type PathStep, ProviderError, type ProviderErrorKind, ROOT_FOLDER, RemoteDataError, type RemoteFile, type RepositoryCheck, type Schema, type Side, type StoredTokens, SyncBusyError, type SyncMeta, type SyncOptions, type SyncProvider, type SyncResult, type SyncState, type TokenResponse, type TokenSourceOptions, VersionConflictError, authorizeUrl, createTokenSource, dataPath, decodeBase64, dropboxAuthorizeUrl, emptyMeta, encodeBase64, equal, googleAuthorizeUrl, installUrl, isAppId, isObject, listInstalledRepositories, merge, metaPath, microsoftAuthorizeUrl, newState, parseMeta, parseTokenResponse, readCallback, resolveConflict, restoreCloudValues, sync, toStoredTokens, withChiefRemoved, withChiefRevision, withDevice, withSettingsRevision };

package/dist/index.js

@@ -21,6 +21,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   DATA_FILE: () => DATA_FILE,
+  DROPBOX_SCOPES: () => DROPBOX_SCOPES,
+  DropboxProvider: () => DropboxProvider,
   GITHUB_APP: () => GITHUB_APP,
   GOOGLE_DRIVE_SCOPE: () => GOOGLE_DRIVE_SCOPE,
   GitHubProvider: () => GitHubProvider,
@@ -28,6 +30,9 @@ __export(index_exports, {
   META_FILE: () => META_FILE,
   META_FORMAT: () => META_FORMAT,
   MemoryProvider: () => MemoryProvider,
+  ONEDRIVE_FILE_SCOPE: () => ONEDRIVE_FILE_SCOPE,
+  ONEDRIVE_SCOPES: () => ONEDRIVE_SCOPES,
+  OneDriveProvider: () => OneDriveProvider,
   ProviderError: () => ProviderError,
   ROOT_FOLDER: () => ROOT_FOLDER,
   RemoteDataError: () => RemoteDataError,
@@ -37,6 +42,7 @@ __export(index_exports, {
   createTokenSource: () => createTokenSource,
   dataPath: () => dataPath,
   decodeBase64: () => decodeBase64,
+  dropboxAuthorizeUrl: () => dropboxAuthorizeUrl,
   emptyMeta: () => emptyMeta,
   encodeBase64: () => encodeBase64,
   equal: () => equal,
@@ -47,6 +53,7 @@ __export(index_exports, {
   listInstalledRepositories: () => listInstalledRepositories,
   merge: () => merge,
   metaPath: () => metaPath,
+  microsoftAuthorizeUrl: () => microsoftAuthorizeUrl,
   newState: () => newState,
   parseMeta: () => parseMeta,
   parseTokenResponse: () => parseTokenResponse,
@@ -355,7 +362,8 @@ var isRecord2 = (value) => typeof value === "object" && value !== null && !Array
 var detailOf = async (response) => {
   const body = await response.json().catch(() => null);
   if (!isRecord2(body)) return void 0;
-  const message = isRecord2(body.error) ? body.error.message : body.message;
+  const nested = isRecord2(body.error) ? body.error.message : void 0;
+  const message = nested ?? body.message ?? body.error_summary;
   return typeof message === "string" ? message.slice(0, MAX_DETAIL_LENGTH) : void 0;
 };
 
@@ -1104,9 +1112,355 @@ var googleAuthorizeUrl = (clientId, redirectUri, state) => {
   });
   return `https://accounts.google.com/o/oauth2/v2/auth?${query}`;
 };
+
+// src/provider/dropbox.ts
+var API4 = "https://api.dropboxapi.com/2";
+var CONTENT = "https://content.dropboxapi.com/2";
+var isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var headerJson = (value) => JSON.stringify(value).replace(
+  /[\u007f-￿]/g,
+  (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`
+);
+var tagsOf = (value, found = /* @__PURE__ */ new Set()) => {
+  if (!isRecord7(value)) return found;
+  for (const [key, entry] of Object.entries(value)) {
+    if (key === ".tag" && typeof entry === "string") found.add(entry);
+    else tagsOf(entry, found);
+  }
+  return found;
+};
+var retryAfterOf2 = (response, body) => {
+  const header = response.headers.get("retry-after");
+  if (header !== null && Number.isFinite(Number(header))) return Number(header);
+  const seconds = isRecord7(body) && isRecord7(body.error) ? body.error.retry_after : void 0;
+  return typeof seconds === "number" ? seconds : void 0;
+};
+var DropboxProvider = class {
+  constructor(options) {
+    this.options = options;
+    this.send = options.fetch ?? ((...args) => globalThis.fetch(...args));
+  }
+  options;
+  send;
+  async read(path) {
+    const response = await this.request(`${CONTENT}/files/download`, {
+      "Dropbox-API-Arg": headerJson({ path: `/${path}` })
+    });
+    if (!response.ok) {
+      const failure = await this.failure(response);
+      if (failure.tags.has("not_found")) return null;
+      throw this.unexpected(failure);
+    }
+    const result = JSON.parse(response.headers.get("dropbox-api-result") ?? "null");
+    if (!isRecord7(result) || typeof result.rev !== "string") {
+      throw this.invalid("The file has no version.");
+    }
+    return { content: await response.text(), version: result.rev };
+  }
+  async write(path, content, expectedVersion) {
+    const mode = expectedVersion === null ? { ".tag": "add" } : { ".tag": "update", update: expectedVersion };
+    const response = await this.request(
+      `${CONTENT}/files/upload`,
+      {
+        "Content-Type": "application/octet-stream",
+        "Dropbox-API-Arg": headerJson({
+          path: `/${path}`,
+          mode,
+          autorename: false,
+          mute: true,
+          strict_conflict: true
+        })
+      },
+      content
+    );
+    if (!response.ok) {
+      const failure = await this.failure(response);
+      if (failure.tags.has("conflict")) throw new VersionConflictError(path);
+      throw this.unexpected(failure);
+    }
+    const result = await response.json().catch(() => null);
+    if (!isRecord7(result) || typeof result.rev !== "string") {
+      throw this.invalid("The write returned no version.");
+    }
+    return { version: result.rev };
+  }
+  async remove(path, expectedVersion) {
+    const response = await this.request(
+      `${API4}/files/delete_v2`,
+      { "Content-Type": "application/json" },
+      JSON.stringify({ path: `/${path}`, parent_rev: expectedVersion })
+    );
+    if (response.ok) return;
+    const failure = await this.failure(response);
+    if (failure.tags.has("conflict")) throw new VersionConflictError(path);
+    if (failure.tags.has("not_found")) {
+      if (await this.read(path) !== null) throw new VersionConflictError(path);
+      return;
+    }
+    throw this.unexpected(failure);
+  }
+  async request(url, headers, body) {
+    const token = await this.options.getToken();
+    try {
+      return await this.send(url, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}`, ...headers },
+        body
+      });
+    } catch {
+      throw new ProviderError("network", "Dropbox could not be reached.");
+    }
+  }
+  /**
+   * Reads a failed answer. Dropbox reports a failure that belongs to the call, such as a missing
+   * file or a conflict, with status 409. The caller decides what that means. Every other status
+   * is a failure of the request and is thrown here.
+   */
+  async failure(response) {
+    const { status } = response;
+    const body = await response.clone().json().catch(() => null);
+    const detail = await detailOf(response);
+    if (status === 409) return { status, tags: tagsOf(isRecord7(body) ? body.error : null), detail };
+    if (status === 401) {
+      throw new ProviderError("auth", "The token is not valid.", status, void 0, detail);
+    }
+    if (status === 403) {
+      throw new ProviderError(
+        "auth",
+        "The token has no permission for Dropbox.",
+        status,
+        void 0,
+        detail
+      );
+    }
+    if (status === 429) {
+      throw new ProviderError(
+        "rate-limit",
+        "Dropbox limits the calls.",
+        status,
+        retryAfterOf2(response, body),
+        detail
+      );
+    }
+    if (status >= 500) {
+      throw new ProviderError("server", "Dropbox failed.", status, void 0, detail);
+    }
+    throw this.invalid(`Dropbox answered ${status}.`, status, detail);
+  }
+  unexpected({ status, tags, detail }) {
+    if (tags.has("too_many_write_operations")) {
+      return new ProviderError(
+        "rate-limit",
+        "Dropbox limits the writes.",
+        status,
+        void 0,
+        detail
+      );
+    }
+    if (tags.has("no_write_permission")) {
+      return new ProviderError(
+        "auth",
+        "The token has no permission for Dropbox.",
+        status,
+        void 0,
+        detail
+      );
+    }
+    if (tags.has("insufficient_space")) {
+      return this.invalid("Dropbox has no space left.", status, detail);
+    }
+    return this.invalid(`Dropbox answered ${status}.`, status, detail);
+  }
+  invalid(message, status, detail) {
+    return new ProviderError("invalid", message, status, void 0, detail);
+  }
+};
+
+// src/provider/onedrive.ts
+var APP_FOLDER = "https://graph.microsoft.com/v1.0/me/drive/special/approot";
+var isRecord8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var encodePath2 = (path) => path.split("/").map(encodeURIComponent).join("/");
+var retryAfterOf3 = (response) => {
+  const header = response.headers.get("retry-after");
+  return header !== null && Number.isFinite(Number(header)) ? Number(header) : void 0;
+};
+var OneDriveProvider = class {
+  constructor(options) {
+    this.options = options;
+    this.send = options.fetch ?? ((...args) => globalThis.fetch(...args));
+  }
+  options;
+  send;
+  async read(path) {
+    const info = await this.info(path);
+    if (info === null) return null;
+    const content = await this.fetchContent(info.downloadUrl);
+    return content === null ? null : { content, version: info.eTag };
+  }
+  async write(path, content, expectedVersion) {
+    const url = expectedVersion === null ? `${this.itemUrl(path)}:/content?@microsoft.graph.conflictBehavior=fail` : `${this.itemUrl(path)}:/content`;
+    const response = await this.request(
+      "PUT",
+      url,
+      { "Content-Type": "text/plain", ...this.ifMatch(expectedVersion) },
+      content
+    );
+    const expectedFileIsGone = expectedVersion !== null && response.status === 404;
+    if (response.status === 412 || response.status === 409 || expectedFileIsGone) {
+      throw new VersionConflictError(path);
+    }
+    await this.assertOk(response);
+    const result = await response.json().catch(() => null);
+    if (expectedVersion !== null && response.status === 201) {
+      await this.undoCreate(path, result);
+      throw new VersionConflictError(path);
+    }
+    if (!isRecord8(result) || typeof result.eTag !== "string") {
+      throw this.invalid("The write returned no version.");
+    }
+    return { version: result.eTag };
+  }
+  async remove(path, expectedVersion) {
+    const response = await this.request(
+      "DELETE",
+      this.itemUrl(path),
+      this.ifMatch(expectedVersion)
+    );
+    if (response.status === 404) return;
+    if (response.status === 412) throw new VersionConflictError(path);
+    await this.assertOk(response);
+  }
+  /**
+   * OneDrive creates the file when a write with `If-Match` finds none, which would undo the
+   * removal that another device made. The file that was just created is removed again.
+   */
+  async undoCreate(path, created) {
+    if (!isRecord8(created) || typeof created.eTag !== "string") return;
+    try {
+      await this.remove(path, created.eTag);
+    } catch (error) {
+      if (!(error instanceof VersionConflictError)) throw error;
+    }
+  }
+  itemUrl(path) {
+    return `${APP_FOLDER}:/${encodePath2(path)}`;
+  }
+  ifMatch(version) {
+    return version === null ? {} : { "If-Match": version };
+  }
+  async info(path) {
+    const response = await this.request("GET", this.itemUrl(path));
+    if (response.status === 404) return null;
+    await this.assertOk(response);
+    const body = await response.json().catch(() => null);
+    if (!isRecord8(body) || typeof body.eTag !== "string") {
+      throw this.invalid("The file has no version.");
+    }
+    const url = body["@microsoft.graph.downloadUrl"];
+    if (typeof url !== "string") throw this.invalid("The file has no download address.");
+    return { eTag: body.eTag, downloadUrl: url };
+  }
+  /** The download address is signed, so it must not carry the token. */
+  async fetchContent(url) {
+    let response;
+    try {
+      response = await this.send(url);
+    } catch {
+      throw new ProviderError("network", "OneDrive could not be reached.");
+    }
+    if (response.status === 404) return null;
+    await this.assertOk(response);
+    return response.text();
+  }
+  async request(method, url, headers = {}, body) {
+    const token = await this.options.getToken();
+    try {
+      return await this.send(url, {
+        method,
+        headers: { Authorization: `Bearer ${token}`, ...headers },
+        body
+      });
+    } catch {
+      throw new ProviderError("network", "OneDrive could not be reached.");
+    }
+  }
+  async assertOk(response) {
+    if (response.ok) return;
+    const { status } = response;
+    const detail = await detailOf(response);
+    if (status === 401) {
+      throw new ProviderError("auth", "The token is not valid.", status, void 0, detail);
+    }
+    if (status === 403) {
+      throw new ProviderError(
+        "auth",
+        "The token has no permission for OneDrive.",
+        status,
+        void 0,
+        detail
+      );
+    }
+    if (status === 429 || status === 503 && retryAfterOf3(response) !== void 0) {
+      throw new ProviderError(
+        "rate-limit",
+        "OneDrive limits the calls.",
+        status,
+        retryAfterOf3(response),
+        detail
+      );
+    }
+    if (status === 404) {
+      throw new ProviderError(
+        "not-found",
+        "The app folder was not found.",
+        status,
+        void 0,
+        detail
+      );
+    }
+    if (status >= 500) {
+      throw new ProviderError("server", "OneDrive failed.", status, void 0, detail);
+    }
+    throw this.invalid(`OneDrive answered ${status}.`, status, detail);
+  }
+  invalid(message, status, detail) {
+    return new ProviderError("invalid", message, status, void 0, detail);
+  }
+};
+
+// src/auth/dropbox.ts
+var DROPBOX_SCOPES = ["files.content.read", "files.content.write"];
+var dropboxAuthorizeUrl = (clientId, redirectUri, state) => {
+  const query = new URLSearchParams({
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    response_type: "code",
+    token_access_type: "offline",
+    scope: DROPBOX_SCOPES.join(" "),
+    state
+  });
+  return `https://www.dropbox.com/oauth2/authorize?${query}`;
+};
+
+// src/auth/microsoft.ts
+var ONEDRIVE_FILE_SCOPE = "Files.ReadWrite.AppFolder";
+var ONEDRIVE_SCOPES = [ONEDRIVE_FILE_SCOPE, "offline_access"];
+var microsoftAuthorizeUrl = (clientId, redirectUri, state) => {
+  const query = new URLSearchParams({
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    response_type: "code",
+    response_mode: "query",
+    scope: ONEDRIVE_SCOPES.join(" "),
+    state
+  });
+  return `https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?${query}`;
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DATA_FILE,
+  DROPBOX_SCOPES,
+  DropboxProvider,
   GITHUB_APP,
   GOOGLE_DRIVE_SCOPE,
   GitHubProvider,
@@ -1114,6 +1468,9 @@ var googleAuthorizeUrl = (clientId, redirectUri, state) => {
   META_FILE,
   META_FORMAT,
   MemoryProvider,
+  ONEDRIVE_FILE_SCOPE,
+  ONEDRIVE_SCOPES,
+  OneDriveProvider,
   ProviderError,
   ROOT_FOLDER,
   RemoteDataError,
@@ -1123,6 +1480,7 @@ var googleAuthorizeUrl = (clientId, redirectUri, state) => {
   createTokenSource,
   dataPath,
   decodeBase64,
+  dropboxAuthorizeUrl,
   emptyMeta,
   encodeBase64,
   equal,
@@ -1133,6 +1491,7 @@ var googleAuthorizeUrl = (clientId, redirectUri, state) => {
   listInstalledRepositories,
   merge,
   metaPath,
+  microsoftAuthorizeUrl,
   newState,
   parseMeta,
   parseTokenResponse,