@unofficialbox/box-open-sdk 0.1.0

package/README.md

@@ -0,0 +1,13 @@
+<!-- Generated by box-gantry. DO NOT EDIT. -->
+# Box SDK
+
+A generated TypeScript SDK for the Box API — a dual ESM/CJS package with
+shipped type declarations.
+
+```ts
+import { Client, runtime } from '@unofficialbox/box-open-sdk';
+const client = new Client(runtime.developerToken('DEVELOPER_TOKEN'));
+```
+
+See [`docs/`](./docs/README.md) for the manager reference and the
+authentication, pagination, and errors guides.

package/dist/cjs/auth.js

@@ -0,0 +1,112 @@
+"use strict";
+// Code generated by box-gantry (vendored from runtimes/typescript/gantryruntime/src/auth.ts). DO NOT EDIT.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.developerToken = developerToken;
+exports.clientCredentials = clientCredentials;
+exports.authorizeUrl = authorizeUrl;
+exports.oauth = oauth;
+exports.exchangeCode = exchangeCode;
+// The `fetch`-only Box auth flows, each an `Auth` passed to the runtime
+// `Client`: `developerToken` (a fixed token), `clientCredentials` (CCG), and the
+// OAuth 2.0 authorization-code flow. They exchange credentials at Box's token
+// endpoint and cache the access token (via the shared machinery in `tokens.ts`).
+// JWT server auth lives in `jwt.ts` — the only flow that reaches beyond `fetch`.
+const errors_js_1 = require("./errors.js");
+const tokens_js_1 = require("./tokens.js");
+/** Where a user is sent to grant an OAuth 2.0 app access. */
+const AUTHORIZE_URL = 'https://account.box.com/api/oauth2/authorize';
+/**
+ * The simplest flow: a fixed access token from the Box developer console. A
+ * fixed token cannot be refreshed, so `forceRefresh` returns it unchanged (a
+ * subsequent 401 then surfaces to the caller).
+ */
+function developerToken(token) {
+    return {
+        accessToken: async () => token,
+        forceRefresh: async () => token,
+    };
+}
+/** Build a CCG `Auth`. Requires a subject: `enterpriseId` or `userId`. */
+function clientCredentials(config) {
+    if (!config.userId && !config.enterpriseId) {
+        throw new errors_js_1.BoxApiError('clientCredentials requires a subject: enterpriseId or userId');
+    }
+    const tokenUrl = config.tokenUrl ?? tokens_js_1.DEFAULT_TOKEN_URL;
+    // A `userId` acts as that managed user; otherwise the enterprise service
+    // account. The guard above rules out an empty subject.
+    const subject = config.userId
+        ? { type: 'user', id: config.userId }
+        : { type: 'enterprise', id: config.enterpriseId ?? '' };
+    return new tokens_js_1.CachedToken(() => (0, tokens_js_1.postTokenForm)(tokenUrl, {
+        grant_type: 'client_credentials',
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        box_subject_type: subject.type,
+        box_subject_id: subject.id,
+    }));
+}
+/**
+ * Build the URL to redirect a user to so they can grant access. `state` is
+ * echoed back to the redirect URI for CSRF protection.
+ */
+function authorizeUrl(config, redirectUri, state) {
+    const query = new URLSearchParams({
+        response_type: 'code',
+        client_id: config.clientId,
+        redirect_uri: redirectUri,
+        state,
+    });
+    return `${AUTHORIZE_URL}?${query.toString()}`;
+}
+/**
+ * The refresh exchange for the authorization-code flow: it swaps the current
+ * refresh token for a fresh access token and rotates the refresh token Box
+ * returns (Box invalidates the old one on each exchange), reporting each rotated
+ * token through `config.onRefresh` so a caller can persist it.
+ */
+function refreshTokenExchange(config, tokenUrl, initialRefresh) {
+    let refreshToken = initialRefresh;
+    return async () => {
+        const token = await (0, tokens_js_1.postTokenForm)(tokenUrl, {
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+            client_id: config.clientId,
+            client_secret: config.clientSecret,
+        });
+        if (token.refreshToken) {
+            refreshToken = token.refreshToken;
+            config.onRefresh?.(token.refreshToken);
+        }
+        return token;
+    };
+}
+/**
+ * Resume the authorization-code flow from a previously stored refresh token,
+ * exchanging it for access tokens as needed.
+ */
+function oauth(config, refreshToken) {
+    const tokenUrl = config.tokenUrl ?? tokens_js_1.DEFAULT_TOKEN_URL;
+    return new tokens_js_1.CachedToken(refreshTokenExchange(config, tokenUrl, refreshToken));
+}
+/**
+ * Exchange an authorization code for an `Auth` that refreshes itself thereafter.
+ * The initial refresh token is reported through `config.onRefresh` so it can be
+ * persisted immediately.
+ */
+async function exchangeCode(config, code, redirectUri, signal) {
+    const tokenUrl = config.tokenUrl ?? tokens_js_1.DEFAULT_TOKEN_URL;
+    const token = await (0, tokens_js_1.postTokenForm)(tokenUrl, {
+        grant_type: 'authorization_code',
+        code,
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uri: redirectUri,
+    }, signal);
+    if (!token.refreshToken) {
+        throw new errors_js_1.BoxApiError('authorization-code exchange returned no refresh_token');
+    }
+    config.onRefresh?.(token.refreshToken);
+    // Seed the cache with the access token we just obtained, and refresh via the
+    // rotating refresh token thereafter.
+    return new tokens_js_1.CachedToken(refreshTokenExchange(config, tokenUrl, token.refreshToken), token);
+}

package/dist/cjs/buildinfo.js

@@ -0,0 +1,10 @@
+"use strict";
+// Code generated by box-gantry 0.1.0 (spec ee7d55aedefe2fa0). DO NOT EDIT.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TARGET = exports.SPEC_FINGERPRINT = exports.ENGINE = void 0;
+/** The box-gantry engine version that generated this SDK. */
+exports.ENGINE = "0.1.0";
+/** Fingerprint of the input spec set. */
+exports.SPEC_FINGERPRINT = "ee7d55aedefe2fa0";
+/** The target language key (FR-4). */
+exports.TARGET = "typescript";

package/dist/cjs/client.js

@@ -0,0 +1,268 @@
+"use strict";
+// Code generated by box-gantry. DO NOT EDIT.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Client = void 0;
+const runtime_js_1 = require("./runtime.js");
+const ai_js_1 = require("./managers/ai.js");
+const ai_studio_js_1 = require("./managers/ai_studio.js");
+const app_item_associations_js_1 = require("./managers/app_item_associations.js");
+const archives_js_1 = require("./managers/archives.js");
+const authorization_js_1 = require("./managers/authorization.js");
+const automate_workflows_js_1 = require("./managers/automate_workflows.js");
+const avatars_js_1 = require("./managers/avatars.js");
+const chunked_uploads_js_1 = require("./managers/chunked_uploads.js");
+const classifications_js_1 = require("./managers/classifications.js");
+const collaboration_allowlist_entries_js_1 = require("./managers/collaboration_allowlist_entries.js");
+const collaboration_allowlist_exempt_targets_js_1 = require("./managers/collaboration_allowlist_exempt_targets.js");
+const collections_js_1 = require("./managers/collections.js");
+const comments_js_1 = require("./managers/comments.js");
+const device_pinners_js_1 = require("./managers/device_pinners.js");
+const docgen_js_1 = require("./managers/docgen.js");
+const docgen_template_js_1 = require("./managers/docgen_template.js");
+const downloads_js_1 = require("./managers/downloads.js");
+const email_aliases_js_1 = require("./managers/email_aliases.js");
+const enterprise_configurations_js_1 = require("./managers/enterprise_configurations.js");
+const events_js_1 = require("./managers/events.js");
+const external_users_js_1 = require("./managers/external_users.js");
+const file_classifications_js_1 = require("./managers/file_classifications.js");
+const file_metadata_js_1 = require("./managers/file_metadata.js");
+const file_requests_js_1 = require("./managers/file_requests.js");
+const file_version_legal_holds_js_1 = require("./managers/file_version_legal_holds.js");
+const file_version_retentions_js_1 = require("./managers/file_version_retentions.js");
+const file_versions_js_1 = require("./managers/file_versions.js");
+const file_watermarks_js_1 = require("./managers/file_watermarks.js");
+const files_js_1 = require("./managers/files.js");
+const folder_classifications_js_1 = require("./managers/folder_classifications.js");
+const folder_locks_js_1 = require("./managers/folder_locks.js");
+const folder_metadata_js_1 = require("./managers/folder_metadata.js");
+const folder_watermarks_js_1 = require("./managers/folder_watermarks.js");
+const folders_js_1 = require("./managers/folders.js");
+const groups_js_1 = require("./managers/groups.js");
+const hub_collaborations_js_1 = require("./managers/hub_collaborations.js");
+const hub_document_js_1 = require("./managers/hub_document.js");
+const hub_items_js_1 = require("./managers/hub_items.js");
+const hubs_js_1 = require("./managers/hubs.js");
+const integration_mappings_js_1 = require("./managers/integration_mappings.js");
+const invites_js_1 = require("./managers/invites.js");
+const legal_hold_policies_js_1 = require("./managers/legal_hold_policies.js");
+const legal_hold_policy_assignments_js_1 = require("./managers/legal_hold_policy_assignments.js");
+const list_collaborations_js_1 = require("./managers/list_collaborations.js");
+const memberships_js_1 = require("./managers/memberships.js");
+const metadata_cascade_policies_js_1 = require("./managers/metadata_cascade_policies.js");
+const metadata_taxonomies_js_1 = require("./managers/metadata_taxonomies.js");
+const metadata_templates_js_1 = require("./managers/metadata_templates.js");
+const notes_js_1 = require("./managers/notes.js");
+const recent_items_js_1 = require("./managers/recent_items.js");
+const retention_policies_js_1 = require("./managers/retention_policies.js");
+const retention_policy_assignments_js_1 = require("./managers/retention_policy_assignments.js");
+const search_js_1 = require("./managers/search.js");
+const session_termination_js_1 = require("./managers/session_termination.js");
+const shared_links_app_items_js_1 = require("./managers/shared_links_app_items.js");
+const shared_links_files_js_1 = require("./managers/shared_links_files.js");
+const shared_links_folders_js_1 = require("./managers/shared_links_folders.js");
+const shared_links_web_links_js_1 = require("./managers/shared_links_web_links.js");
+const shield_information_barrier_reports_js_1 = require("./managers/shield_information_barrier_reports.js");
+const shield_information_barrier_segment_members_js_1 = require("./managers/shield_information_barrier_segment_members.js");
+const shield_information_barrier_segment_restrictions_js_1 = require("./managers/shield_information_barrier_segment_restrictions.js");
+const shield_information_barrier_segments_js_1 = require("./managers/shield_information_barrier_segments.js");
+const shield_information_barriers_js_1 = require("./managers/shield_information_barriers.js");
+const shield_lists_js_1 = require("./managers/shield_lists.js");
+const sign_requests_js_1 = require("./managers/sign_requests.js");
+const sign_templates_js_1 = require("./managers/sign_templates.js");
+const skills_js_1 = require("./managers/skills.js");
+const storage_policies_js_1 = require("./managers/storage_policies.js");
+const storage_policy_assignments_js_1 = require("./managers/storage_policy_assignments.js");
+const task_assignments_js_1 = require("./managers/task_assignments.js");
+const tasks_js_1 = require("./managers/tasks.js");
+const terms_of_service_user_statuses_js_1 = require("./managers/terms_of_service_user_statuses.js");
+const terms_of_services_js_1 = require("./managers/terms_of_services.js");
+const transfer_js_1 = require("./managers/transfer.js");
+const trashed_files_js_1 = require("./managers/trashed_files.js");
+const trashed_folders_js_1 = require("./managers/trashed_folders.js");
+const trashed_items_js_1 = require("./managers/trashed_items.js");
+const trashed_web_links_js_1 = require("./managers/trashed_web_links.js");
+const uploads_js_1 = require("./managers/uploads.js");
+const user_collaborations_js_1 = require("./managers/user_collaborations.js");
+const users_js_1 = require("./managers/users.js");
+const web_links_js_1 = require("./managers/web_links.js");
+const webhooks_js_1 = require("./managers/webhooks.js");
+const workflows_js_1 = require("./managers/workflows.js");
+const zip_downloads_js_1 = require("./managers/zip_downloads.js");
+/** The Box SDK client: one manager per API area over a shared session. */
+class Client {
+    ai;
+    aiStudio;
+    appItemAssociations;
+    archives;
+    authorization;
+    automateWorkflows;
+    avatars;
+    chunkedUploads;
+    classifications;
+    collaborationAllowlistEntries;
+    collaborationAllowlistExemptTargets;
+    collections;
+    comments;
+    devicePinners;
+    docgen;
+    docgenTemplate;
+    downloads;
+    emailAliases;
+    enterpriseConfigurations;
+    events;
+    externalUsers;
+    fileClassifications;
+    fileMetadata;
+    fileRequests;
+    fileVersionLegalHolds;
+    fileVersionRetentions;
+    fileVersions;
+    fileWatermarks;
+    files;
+    folderClassifications;
+    folderLocks;
+    folderMetadata;
+    folderWatermarks;
+    folders;
+    groups;
+    hubCollaborations;
+    hubDocument;
+    hubItems;
+    hubs;
+    integrationMappings;
+    invites;
+    legalHoldPolicies;
+    legalHoldPolicyAssignments;
+    listCollaborations;
+    memberships;
+    metadataCascadePolicies;
+    metadataTaxonomies;
+    metadataTemplates;
+    notes;
+    recentItems;
+    retentionPolicies;
+    retentionPolicyAssignments;
+    search;
+    sessionTermination;
+    sharedLinksAppItems;
+    sharedLinksFiles;
+    sharedLinksFolders;
+    sharedLinksWebLinks;
+    shieldInformationBarrierReports;
+    shieldInformationBarrierSegmentMembers;
+    shieldInformationBarrierSegmentRestrictions;
+    shieldInformationBarrierSegments;
+    shieldInformationBarriers;
+    shieldLists;
+    signRequests;
+    signTemplates;
+    skills;
+    storagePolicies;
+    storagePolicyAssignments;
+    taskAssignments;
+    tasks;
+    termsOfServiceUserStatuses;
+    termsOfServices;
+    transfer;
+    trashedFiles;
+    trashedFolders;
+    trashedItems;
+    trashedWebLinks;
+    uploads;
+    userCollaborations;
+    users;
+    webLinks;
+    webhooks;
+    workflows;
+    zipDownloads;
+    /** Build a client for an authentication flow. */
+    constructor(auth) {
+        const session = new runtime_js_1.Client(auth);
+        this.ai = new ai_js_1.AiManager(session);
+        this.aiStudio = new ai_studio_js_1.AiStudioManager(session);
+        this.appItemAssociations = new app_item_associations_js_1.AppItemAssociationsManager(session);
+        this.archives = new archives_js_1.ArchivesManager(session);
+        this.authorization = new authorization_js_1.AuthorizationManager(session);
+        this.automateWorkflows = new automate_workflows_js_1.AutomateWorkflowsManager(session);
+        this.avatars = new avatars_js_1.AvatarsManager(session);
+        this.chunkedUploads = new chunked_uploads_js_1.ChunkedUploadsManager(session);
+        this.classifications = new classifications_js_1.ClassificationsManager(session);
+        this.collaborationAllowlistEntries = new collaboration_allowlist_entries_js_1.CollaborationAllowlistEntriesManager(session);
+        this.collaborationAllowlistExemptTargets = new collaboration_allowlist_exempt_targets_js_1.CollaborationAllowlistExemptTargetsManager(session);
+        this.collections = new collections_js_1.CollectionsManager(session);
+        this.comments = new comments_js_1.CommentsManager(session);
+        this.devicePinners = new device_pinners_js_1.DevicePinnersManager(session);
+        this.docgen = new docgen_js_1.DocgenManager(session);
+        this.docgenTemplate = new docgen_template_js_1.DocgenTemplateManager(session);
+        this.downloads = new downloads_js_1.DownloadsManager(session);
+        this.emailAliases = new email_aliases_js_1.EmailAliasesManager(session);
+        this.enterpriseConfigurations = new enterprise_configurations_js_1.EnterpriseConfigurationsManager(session);
+        this.events = new events_js_1.EventsManager(session);
+        this.externalUsers = new external_users_js_1.ExternalUsersManager(session);
+        this.fileClassifications = new file_classifications_js_1.FileClassificationsManager(session);
+        this.fileMetadata = new file_metadata_js_1.FileMetadataManager(session);
+        this.fileRequests = new file_requests_js_1.FileRequestsManager(session);
+        this.fileVersionLegalHolds = new file_version_legal_holds_js_1.FileVersionLegalHoldsManager(session);
+        this.fileVersionRetentions = new file_version_retentions_js_1.FileVersionRetentionsManager(session);
+        this.fileVersions = new file_versions_js_1.FileVersionsManager(session);
+        this.fileWatermarks = new file_watermarks_js_1.FileWatermarksManager(session);
+        this.files = new files_js_1.FilesManager(session);
+        this.folderClassifications = new folder_classifications_js_1.FolderClassificationsManager(session);
+        this.folderLocks = new folder_locks_js_1.FolderLocksManager(session);
+        this.folderMetadata = new folder_metadata_js_1.FolderMetadataManager(session);
+        this.folderWatermarks = new folder_watermarks_js_1.FolderWatermarksManager(session);
+        this.folders = new folders_js_1.FoldersManager(session);
+        this.groups = new groups_js_1.GroupsManager(session);
+        this.hubCollaborations = new hub_collaborations_js_1.HubCollaborationsManager(session);
+        this.hubDocument = new hub_document_js_1.HubDocumentManager(session);
+        this.hubItems = new hub_items_js_1.HubItemsManager(session);
+        this.hubs = new hubs_js_1.HubsManager(session);
+        this.integrationMappings = new integration_mappings_js_1.IntegrationMappingsManager(session);
+        this.invites = new invites_js_1.InvitesManager(session);
+        this.legalHoldPolicies = new legal_hold_policies_js_1.LegalHoldPoliciesManager(session);
+        this.legalHoldPolicyAssignments = new legal_hold_policy_assignments_js_1.LegalHoldPolicyAssignmentsManager(session);
+        this.listCollaborations = new list_collaborations_js_1.ListCollaborationsManager(session);
+        this.memberships = new memberships_js_1.MembershipsManager(session);
+        this.metadataCascadePolicies = new metadata_cascade_policies_js_1.MetadataCascadePoliciesManager(session);
+        this.metadataTaxonomies = new metadata_taxonomies_js_1.MetadataTaxonomiesManager(session);
+        this.metadataTemplates = new metadata_templates_js_1.MetadataTemplatesManager(session);
+        this.notes = new notes_js_1.NotesManager(session);
+        this.recentItems = new recent_items_js_1.RecentItemsManager(session);
+        this.retentionPolicies = new retention_policies_js_1.RetentionPoliciesManager(session);
+        this.retentionPolicyAssignments = new retention_policy_assignments_js_1.RetentionPolicyAssignmentsManager(session);
+        this.search = new search_js_1.SearchManager(session);
+        this.sessionTermination = new session_termination_js_1.SessionTerminationManager(session);
+        this.sharedLinksAppItems = new shared_links_app_items_js_1.SharedLinksAppItemsManager(session);
+        this.sharedLinksFiles = new shared_links_files_js_1.SharedLinksFilesManager(session);
+        this.sharedLinksFolders = new shared_links_folders_js_1.SharedLinksFoldersManager(session);
+        this.sharedLinksWebLinks = new shared_links_web_links_js_1.SharedLinksWebLinksManager(session);
+        this.shieldInformationBarrierReports = new shield_information_barrier_reports_js_1.ShieldInformationBarrierReportsManager(session);
+        this.shieldInformationBarrierSegmentMembers = new shield_information_barrier_segment_members_js_1.ShieldInformationBarrierSegmentMembersManager(session);
+        this.shieldInformationBarrierSegmentRestrictions = new shield_information_barrier_segment_restrictions_js_1.ShieldInformationBarrierSegmentRestrictionsManager(session);
+        this.shieldInformationBarrierSegments = new shield_information_barrier_segments_js_1.ShieldInformationBarrierSegmentsManager(session);
+        this.shieldInformationBarriers = new shield_information_barriers_js_1.ShieldInformationBarriersManager(session);
+        this.shieldLists = new shield_lists_js_1.ShieldListsManager(session);
+        this.signRequests = new sign_requests_js_1.SignRequestsManager(session);
+        this.signTemplates = new sign_templates_js_1.SignTemplatesManager(session);
+        this.skills = new skills_js_1.SkillsManager(session);
+        this.storagePolicies = new storage_policies_js_1.StoragePoliciesManager(session);
+        this.storagePolicyAssignments = new storage_policy_assignments_js_1.StoragePolicyAssignmentsManager(session);
+        this.taskAssignments = new task_assignments_js_1.TaskAssignmentsManager(session);
+        this.tasks = new tasks_js_1.TasksManager(session);
+        this.termsOfServiceUserStatuses = new terms_of_service_user_statuses_js_1.TermsOfServiceUserStatusesManager(session);
+        this.termsOfServices = new terms_of_services_js_1.TermsOfServicesManager(session);
+        this.transfer = new transfer_js_1.TransferManager(session);
+        this.trashedFiles = new trashed_files_js_1.TrashedFilesManager(session);
+        this.trashedFolders = new trashed_folders_js_1.TrashedFoldersManager(session);
+        this.trashedItems = new trashed_items_js_1.TrashedItemsManager(session);
+        this.trashedWebLinks = new trashed_web_links_js_1.TrashedWebLinksManager(session);
+        this.uploads = new uploads_js_1.UploadsManager(session);
+        this.userCollaborations = new user_collaborations_js_1.UserCollaborationsManager(session);
+        this.users = new users_js_1.UsersManager(session);
+        this.webLinks = new web_links_js_1.WebLinksManager(session);
+        this.webhooks = new webhooks_js_1.WebhooksManager(session);
+        this.workflows = new workflows_js_1.WorkflowsManager(session);
+        this.zipDownloads = new zip_downloads_js_1.ZipDownloadsManager(session);
+    }
+}
+exports.Client = Client;

package/dist/cjs/errors.js

@@ -0,0 +1,20 @@
+"use strict";
+// Code generated by box-gantry (vendored from runtimes/typescript/gantryruntime/src/errors.ts). DO NOT EDIT.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BoxApiError = void 0;
+/**
+ * A runtime error: a failed request, auth acquisition, or body decode. The
+ * generated SDK's exceptions model (TR-TS.3) surfaces every failure as a thrown
+ * `BoxApiError` — the TypeScript analogue of Go's `error` return and Rust's
+ * `Result::Err`.
+ */
+class BoxApiError extends Error {
+    /** The HTTP status, when the error carries a response. */
+    status;
+    constructor(message, options = {}) {
+        super(message, options.cause !== undefined ? { cause: options.cause } : undefined);
+        this.name = 'BoxApiError';
+        this.status = options.status;
+    }
+}
+exports.BoxApiError = BoxApiError;

package/dist/cjs/index.js

@@ -0,0 +1,43 @@
+"use strict";
+// Code generated by box-gantry. DO NOT EDIT.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildinfo = exports.runtime = exports.managers = exports.models = exports.Client = void 0;
+var client_js_1 = require("./client.js");
+Object.defineProperty(exports, "Client", { enumerable: true, get: function () { return client_js_1.Client; } });
+exports.models = __importStar(require("./models/index.js"));
+exports.managers = __importStar(require("./managers/index.js"));
+exports.runtime = __importStar(require("./runtime.js"));
+exports.buildinfo = __importStar(require("./buildinfo.js"));

package/dist/cjs/internal.js

@@ -0,0 +1,37 @@
+"use strict";
+// Code generated by box-gantry. DO NOT EDIT.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.join = join;
+exports.pathEscape = pathEscape;
+exports.formEncode = formEncode;
+/** Comma-join a list into a query value, converting each element with `f`. */
+function join(items, f) {
+    return items.map(f).join(',');
+}
+/** Percent-encode a value, leaving RFC 3986 unreserved characters as-is. */
+function pathEscape(value) {
+    let out = '';
+    for (const byte of new TextEncoder().encode(value)) {
+        const unreserved = (byte >= 0x41 && byte <= 0x5a) || // A-Z
+            (byte >= 0x61 && byte <= 0x7a) || // a-z
+            (byte >= 0x30 && byte <= 0x39) || // 0-9
+            byte === 0x2d || // -
+            byte === 0x2e || // .
+            byte === 0x5f || // _
+            byte === 0x7e; //  ~
+        if (unreserved) {
+            out += String.fromCharCode(byte);
+        }
+        else {
+            out += '%' + byte.toString(16).toUpperCase().padStart(2, '0');
+        }
+    }
+    return out;
+}
+/**
+ * An application/x-www-form-urlencoded body from key/value pairs (the OAuth2
+ * token endpoints): each key and value percent-encoded, joined by `&`.
+ */
+function formEncode(pairs) {
+    return pairs.map(([key, value]) => `${pathEscape(key)}=${pathEscape(value)}`).join('&');
+}

package/dist/cjs/jwt.js

@@ -0,0 +1,122 @@
+"use strict";
+// Code generated by box-gantry (vendored from runtimes/typescript/gantryruntime/src/jwt.ts). DO NOT EDIT.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jwtAuth = jwtAuth;
+// JWT server auth — the fourth Box auth flow (TR-TS.5 parity with Go/Rust).
+//
+// Unlike the other three flows, this one needs an RSA signing key, so it uses
+// `node:crypto` and runs only on Node-like runtimes. It is a leaf module — not
+// re-exported by `runtime.ts` — and imports `node:crypto` lazily, so importing
+// the core runtime or the `fetch`-only flows never pulls in a Node dependency.
+// Reach it via the package's `./jwt` export.
+const errors_js_1 = require("./errors.js");
+const tokens_js_1 = require("./tokens.js");
+/**
+ * Build a JWT-assertion `Auth`, parsing (and if needed decrypting) the RSA
+ * private key up front so a bad key fails loudly here rather than on the first
+ * request. Returns a promise because it imports `node:crypto` on demand.
+ */
+async function jwtAuth(config) {
+    if (!config.userId && !config.enterpriseId) {
+        throw new errors_js_1.BoxApiError('jwtAuth requires a subject: enterpriseId or userId');
+    }
+    const crypto = await Promise.resolve().then(() => __importStar(require('node:crypto')));
+    let privateKey;
+    try {
+        privateKey = crypto.createPrivateKey(config.passphrase !== undefined
+            ? { key: config.privateKeyPem, passphrase: config.passphrase }
+            : { key: config.privateKeyPem });
+    }
+    catch (err) {
+        throw new errors_js_1.BoxApiError('failed to parse the JWT private key', { cause: err });
+    }
+    // The assertion is RS256-signed, so a non-RSA key would fail confusingly at
+    // sign time — reject it up front (parity with the Go/Rust runtimes).
+    if (privateKey.asymmetricKeyType !== 'rsa') {
+        throw new errors_js_1.BoxApiError(`JWT auth requires an RSA private key, got ${privateKey.asymmetricKeyType ?? 'an unrecognized key type'}`);
+    }
+    const tokenUrl = config.tokenUrl ?? tokens_js_1.DEFAULT_TOKEN_URL;
+    const subject = config.userId
+        ? { type: 'user', id: config.userId }
+        : { type: 'enterprise', id: config.enterpriseId ?? '' };
+    return new tokens_js_1.CachedToken(async () => {
+        const assertion = signAssertion(crypto, config, privateKey, subject, tokenUrl);
+        return (0, tokens_js_1.postTokenForm)(tokenUrl, {
+            grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+            assertion,
+            client_id: config.clientId,
+            client_secret: config.clientSecret,
+        });
+    });
+}
+/**
+ * Build and RS256-sign the JWT bearer assertion Box's jwt-bearer grant expects.
+ * The claim set is single-use: a random `jti` and a short (45s) expiry.
+ */
+function signAssertion(crypto, config, privateKey, subject, audience) {
+    const header = { alg: 'RS256', typ: 'JWT', kid: config.publicKeyId };
+    const claims = {
+        iss: config.clientId,
+        sub: subject.id,
+        box_sub_type: subject.type,
+        aud: audience,
+        jti: hex(crypto.randomBytes(16)),
+        exp: Math.floor(Date.now() / 1000) + 45,
+    };
+    const signingInput = `${base64urlJson(header)}.${base64urlJson(claims)}`;
+    const signature = crypto.sign('RSA-SHA256', new TextEncoder().encode(signingInput), privateKey);
+    return `${signingInput}.${base64url(signature)}`;
+}
+/** Base64url-encode a JSON value's UTF-8 bytes (no padding). */
+function base64urlJson(value) {
+    return base64url(new TextEncoder().encode(JSON.stringify(value)));
+}
+/** Base64url-encode bytes (RFC 7515 §2: base64 with `+/` → `-_`, no padding). */
+function base64url(bytes) {
+    let binary = '';
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** Lowercase hex of bytes, for the assertion `jti`. */
+function hex(bytes) {
+    let out = '';
+    for (const byte of bytes) {
+        out += byte.toString(16).padStart(2, '0');
+    }
+    return out;
+}