@unofficialbox/box-open-sdk 0.2.0 → 0.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kyle @ Unofficial Box
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -3,9 +3,11 @@
 
 # @unofficialbox/box-open-sdk
 
+[![release](https://img.shields.io/github/v/release/unofficialbox/box-open-ts-sdk?sort=semver)](https://github.com/unofficialbox/box-open-ts-sdk/releases/latest)
 [![npm](https://img.shields.io/npm/v/@unofficialbox/box-open-sdk.svg)](https://www.npmjs.com/package/@unofficialbox/box-open-sdk)
+[![license](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
-A **community, unofficial** Box API client for TypeScript — fully typed models
+An **open source, community-built** Box API client for TypeScript — fully typed models
 for the whole Box surface, one manager per API area behind a single `Client`,
 and a `fetch`-based runtime with retry, backoff, and token refresh. Ships as a
 **dual ESM/CJS** package with bundled `.d.ts` declarations; no runtime

package/dist/cjs/auth.js

@@ -43,7 +43,7 @@ function clientCredentials(config) {
         client_secret: config.clientSecret,
         box_subject_type: subject.type,
         box_subject_id: subject.id,
-    }));
+    }, undefined, config.fetch));
 }
 /**
  * Build the URL to redirect a user to so they can grant access. `state` is
@@ -72,7 +72,7 @@ function refreshTokenExchange(config, tokenUrl, initialRefresh) {
             refresh_token: refreshToken,
             client_id: config.clientId,
             client_secret: config.clientSecret,
-        });
+        }, undefined, config.fetch);
         if (token.refreshToken) {
             refreshToken = token.refreshToken;
             config.onRefresh?.(token.refreshToken);
@@ -101,7 +101,7 @@ async function exchangeCode(config, code, redirectUri, signal) {
         client_id: config.clientId,
         client_secret: config.clientSecret,
         redirect_uri: redirectUri,
-    }, signal);
+    }, signal, config.fetch);
     if (!token.refreshToken) {
         throw new errors_js_1.BoxApiError('authorization-code exchange returned no refresh_token');
     }

package/dist/cjs/buildinfo.js

@@ -1,10 +1,10 @@
 "use strict";
-// Code generated by box-gantry 0.1.0 (spec ee7d55aedefe2fa0). DO NOT EDIT.
+// Code generated by box-gantry 0.1.0 (spec 3fb3510fe12f2f80). DO NOT EDIT.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TARGET = exports.SPEC_FINGERPRINT = exports.ENGINE = void 0;
 /** The box-gantry engine version that generated this SDK. */
 exports.ENGINE = "0.1.0";
 /** Fingerprint of the input spec set. */
-exports.SPEC_FINGERPRINT = "ee7d55aedefe2fa0";
+exports.SPEC_FINGERPRINT = "3fb3510fe12f2f80";
 /** The target language key (FR-4). */
 exports.TARGET = "typescript";

package/dist/cjs/chunked_upload.js

@@ -0,0 +1,108 @@
+"use strict";
+// Code generated by box-gantry. DO NOT EDIT.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChunkedUpload = void 0;
+/**
+ * ChunkedUpload orchestrates a Box chunked (multipart) upload over a Client: it
+ * creates an upload session, uploads the content's parts with bounded
+ * concurrency, and commits — for a new file (upload) or a new version of an
+ * existing file (uploadVersion). Box requires chunked upload for files at or
+ * above its minimum session size; smaller files use the single-shot endpoints.
+ */
+class ChunkedUpload {
+    client;
+    /** Bounds parts in flight, capping peak memory. */
+    maxConcurrent = 4;
+    constructor(client) {
+        this.client = client;
+    }
+    /** Upload content as a new file named fileName into folderId. */
+    async upload(content, fileName, folderId) {
+        const session = await this.client.chunkedUploads.createFileUploadSession({
+            folder_id: folderId,
+            file_size: content.length,
+            file_name: fileName,
+        });
+        return this.finish(session, content);
+    }
+    /** Upload content as a new version of the existing file fileId. */
+    async uploadVersion(content, fileName, fileId) {
+        const session = await this.client.chunkedUploads.createFileVersionUploadSession(fileId, {
+            file_size: content.length,
+            file_name: fileName,
+        });
+        return this.finish(session, content);
+    }
+    async finish(session, content) {
+        if (session.id === undefined) {
+            throw new Error('gantry: upload session returned no id');
+        }
+        if (session.part_size === undefined || session.part_size <= 0) {
+            throw new Error('gantry: upload session returned a non-positive part_size');
+        }
+        const id = session.id;
+        const partSize = session.part_size;
+        const total = content.length;
+        const offsets = [];
+        for (let off = 0; off < total; off += partSize) {
+            offsets.push(off);
+        }
+        const parts = new Array(offsets.length);
+        // A bounded worker pool: each of maxConcurrent workers claims the next
+        // offset (the `next++` read is atomic between awaits on a single thread).
+        // Once any part fails, `failed` stops the others from starting new parts,
+        // so a failure early in a large upload doesn't push every remaining part.
+        let next = 0;
+        let failed = false;
+        const worker = async () => {
+            for (;;) {
+                if (failed) {
+                    return;
+                }
+                const i = next++;
+                if (i >= offsets.length) {
+                    return;
+                }
+                const start = offsets[i];
+                const end = Math.min(start + partSize, total);
+                try {
+                    parts[i] = await this.uploadPart(id, content, start, end, total);
+                }
+                catch (err) {
+                    failed = true;
+                    throw err;
+                }
+            }
+        };
+        const workerCount = Math.min(this.maxConcurrent, offsets.length);
+        await Promise.all(Array.from({ length: workerCount }, () => worker()));
+        const digest = 'sha=' + (await sha1Base64(content));
+        return this.client.chunkedUploads.commitFileUploadSession(id, digest, { parts });
+    }
+    async uploadPart(id, content, start, end, total) {
+        const slice = content.subarray(start, end);
+        const digest = 'sha=' + (await sha1Base64(slice));
+        const contentRange = `bytes ${start}-${end - 1}/${total}`;
+        // The `as BlobPart` cast bridges the `Uint8Array<ArrayBufferLike>` vs
+        // `BufferSource` (ArrayBuffer-only) generic gap in the DOM lib, exactly as
+        // the runtime casts its `fetch` body; a plain `Uint8Array` is a valid part.
+        const uploaded = await this.client.chunkedUploads.updateFileUploadSession(id, digest, contentRange, new Blob([slice]));
+        if (uploaded.part === undefined) {
+            throw new Error('gantry: upload part returned no part');
+        }
+        return uploaded.part;
+    }
+}
+exports.ChunkedUpload = ChunkedUpload;
+/** Base64 of the SHA-1 of data — the Box `Digest: sha=…` header value. Uses Web
+ *  Crypto (browser and Node 18+), so it adds no dependency. */
+async function sha1Base64(data) {
+    // `as BufferSource` bridges the `Uint8Array<ArrayBufferLike>` vs ArrayBuffer-only
+    // generic gap in the DOM lib (as the runtime does for its `fetch` body).
+    const digest = new Uint8Array(await crypto.subtle.digest('SHA-1', data));
+    let binary = '';
+    for (const byte of digest) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary);
+}

package/dist/cjs/client.js

@@ -52,6 +52,7 @@ const metadata_cascade_policies_js_1 = require("./managers/metadata_cascade_poli
 const metadata_taxonomies_js_1 = require("./managers/metadata_taxonomies.js");
 const metadata_templates_js_1 = require("./managers/metadata_templates.js");
 const notes_js_1 = require("./managers/notes.js");
+const query_js_1 = require("./managers/query.js");
 const recent_items_js_1 = require("./managers/recent_items.js");
 const retention_policies_js_1 = require("./managers/retention_policies.js");
 const retention_policy_assignments_js_1 = require("./managers/retention_policy_assignments.js");
@@ -139,6 +140,7 @@ class Client {
     metadataTaxonomies;
     metadataTemplates;
     notes;
+    query;
     recentItems;
     retentionPolicies;
     retentionPolicyAssignments;
@@ -227,6 +229,7 @@ class Client {
         this.metadataTaxonomies = new metadata_taxonomies_js_1.MetadataTaxonomiesManager(session);
         this.metadataTemplates = new metadata_templates_js_1.MetadataTemplatesManager(session);
         this.notes = new notes_js_1.NotesManager(session);
+        this.query = new query_js_1.QueryManager(session);
         this.recentItems = new recent_items_js_1.RecentItemsManager(session);
         this.retentionPolicies = new retention_policies_js_1.RetentionPoliciesManager(session);
         this.retentionPolicyAssignments = new retention_policy_assignments_js_1.RetentionPolicyAssignmentsManager(session);

package/dist/cjs/index.js

@@ -34,7 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildinfo = exports.auth = exports.runtime = exports.managers = exports.models = exports.Client = void 0;
+exports.ChunkedUpload = exports.buildinfo = exports.auth = exports.runtime = exports.managers = exports.models = exports.Client = void 0;
 var client_js_1 = require("./client.js");
 Object.defineProperty(exports, "Client", { enumerable: true, get: function () { return client_js_1.Client; } });
 exports.models = __importStar(require("./models/index.js"));
@@ -42,3 +42,5 @@ exports.managers = __importStar(require("./managers/index.js"));
 exports.runtime = __importStar(require("./runtime.js"));
 exports.auth = __importStar(require("./auth.js"));
 exports.buildinfo = __importStar(require("./buildinfo.js"));
+var chunked_upload_js_1 = require("./chunked_upload.js");
+Object.defineProperty(exports, "ChunkedUpload", { enumerable: true, get: function () { return chunked_upload_js_1.ChunkedUpload; } });

package/dist/cjs/jwt.js

@@ -79,7 +79,7 @@ async function jwtAuth(config) {
             assertion,
             client_id: config.clientId,
             client_secret: config.clientSecret,
-        });
+        }, undefined, config.fetch);
     });
 }
 /**

package/dist/cjs/managers/chunked_uploads.js

@@ -43,7 +43,7 @@ class ChunkedUploadsManager {
     constructor(session) {
         this.session = session;
     }
-    async createFileUploadSessions(body) {
+    async createFileUploadSession(body) {
         let url = this.session.baseUrl("upload");
         url += "/files";
         url += "/upload_sessions";
@@ -54,7 +54,7 @@ class ChunkedUploadsManager {
         const data = runtime.responseBytes(resp);
         return JSON.parse(new TextDecoder().decode(data));
     }
-    async createFileByIdUploadSessions(fileId, body) {
+    async createFileVersionUploadSession(fileId, body) {
         let url = this.session.baseUrl("upload");
         url += "/files";
         url += '/' + (0, internal_js_1.pathEscape)(fileId);
@@ -84,8 +84,8 @@ class ChunkedUploadsManager {
         let req = this.session.newRequest("PUT", url);
         req = runtime.withHeader(req, "digest", digest);
         req = runtime.withHeader(req, "content-range", contentRange);
-        void body;
-        req = runtime.withStreamBody(req, runtime.Stream.empty(), 'application/octet-stream');
+        const fileBytes = new Uint8Array(await body.arrayBuffer());
+        req = runtime.withStreamBody(req, new runtime.Stream(fileBytes), 'application/octet-stream');
         const resp = await this.session.fetch(req);
         const data = runtime.responseBytes(resp);
         return JSON.parse(new TextDecoder().decode(data));

package/dist/cjs/managers/collaboration_allowlist_entries.js

@@ -44,10 +44,10 @@ class CollaborationAllowlistEntriesManager {
         this.session = session;
     }
     /** Iterate every `models.schemas.CollaborationAllowlistEntry` across pages, threading the marker cursor. */
-    async *listCollaborationWhitelistEntries(opts) {
+    async *list(opts) {
         const options = { ...opts };
         for (;;) {
-            const page = await this.listCollaborationWhitelistEntriesPage(options);
+            const page = await this.listPage(options);
             const items = page.entries ?? [];
             for (const item of items) {
                 yield item;
@@ -59,7 +59,7 @@ class CollaborationAllowlistEntriesManager {
             options.marker = cursor;
         }
     }
-    async listCollaborationWhitelistEntriesPage(opts) {
+    async listPage(opts) {
         let url = this.session.baseUrl("api");
         url += "/collaboration_whitelist_entries";
         let req = this.session.newRequest("GET", url);
@@ -74,7 +74,7 @@ class CollaborationAllowlistEntriesManager {
         const data = runtime.responseBytes(resp);
         return JSON.parse(new TextDecoder().decode(data));
     }
-    async createCollaborationWhitelistEntries(body) {
+    async create(body) {
         let url = this.session.baseUrl("api");
         url += "/collaboration_whitelist_entries";
         let req = this.session.newRequest("POST", url);
@@ -84,7 +84,7 @@ class CollaborationAllowlistEntriesManager {
         const data = runtime.responseBytes(resp);
         return JSON.parse(new TextDecoder().decode(data));
     }
-    async getCollaborationWhitelistEntry(collaborationWhitelistEntryId) {
+    async get(collaborationWhitelistEntryId) {
         let url = this.session.baseUrl("api");
         url += "/collaboration_whitelist_entries";
         url += '/' + (0, internal_js_1.pathEscape)(collaborationWhitelistEntryId);
@@ -93,7 +93,7 @@ class CollaborationAllowlistEntriesManager {
         const data = runtime.responseBytes(resp);
         return JSON.parse(new TextDecoder().decode(data));
     }
-    async deleteCollaborationWhitelistEntry(collaborationWhitelistEntryId) {
+    async delete_(collaborationWhitelistEntryId) {
         let url = this.session.baseUrl("api");
         url += "/collaboration_whitelist_entries";
         url += '/' + (0, internal_js_1.pathEscape)(collaborationWhitelistEntryId);

package/dist/cjs/managers/collaboration_allowlist_exempt_targets.js

@@ -44,10 +44,10 @@ class CollaborationAllowlistExemptTargetsManager {
         this.session = session;
     }
     /** Iterate every `models.schemas.CollaborationAllowlistExemptTarget` across pages, threading the marker cursor. */
-    async *listCollaborationWhitelistExemptTargets(opts) {
+    async *list(opts) {
         const options = { ...opts };
         for (;;) {
-            const page = await this.listCollaborationWhitelistExemptTargetsPage(options);
+            const page = await this.listPage(options);
             const items = page.entries ?? [];
             for (const item of items) {
                 yield item;
@@ -59,7 +59,7 @@ class CollaborationAllowlistExemptTargetsManager {
             options.marker = cursor;
         }
     }
-    async listCollaborationWhitelistExemptTargetsPage(opts) {
+    async listPage(opts) {
         let url = this.session.baseUrl("api");
         url += "/collaboration_whitelist_exempt_targets";
         let req = this.session.newRequest("GET", url);
@@ -74,7 +74,7 @@ class CollaborationAllowlistExemptTargetsManager {
         const data = runtime.responseBytes(resp);
         return JSON.parse(new TextDecoder().decode(data));
     }
-    async createCollaborationWhitelistExemptTargets(body) {
+    async create(body) {
         let url = this.session.baseUrl("api");
         url += "/collaboration_whitelist_exempt_targets";
         let req = this.session.newRequest("POST", url);
@@ -84,7 +84,7 @@ class CollaborationAllowlistExemptTargetsManager {
         const data = runtime.responseBytes(resp);
         return JSON.parse(new TextDecoder().decode(data));
     }
-    async getCollaborationWhitelistExemptTarget(collaborationWhitelistExemptTargetId) {
+    async get(collaborationWhitelistExemptTargetId) {
         let url = this.session.baseUrl("api");
         url += "/collaboration_whitelist_exempt_targets";
         url += '/' + (0, internal_js_1.pathEscape)(collaborationWhitelistExemptTargetId);
@@ -93,7 +93,7 @@ class CollaborationAllowlistExemptTargetsManager {
         const data = runtime.responseBytes(resp);
         return JSON.parse(new TextDecoder().decode(data));
     }
-    async deleteCollaborationWhitelistExemptTarget(collaborationWhitelistExemptTargetId) {
+    async delete_(collaborationWhitelistExemptTargetId) {
         let url = this.session.baseUrl("api");
         url += "/collaboration_whitelist_exempt_targets";
         url += '/' + (0, internal_js_1.pathEscape)(collaborationWhitelistExemptTargetId);

package/dist/cjs/managers/index.js

@@ -64,6 +64,7 @@ __exportStar(require("./metadata_cascade_policies.js"), exports);
 __exportStar(require("./metadata_taxonomies.js"), exports);
 __exportStar(require("./metadata_templates.js"), exports);
 __exportStar(require("./notes.js"), exports);
+__exportStar(require("./query.js"), exports);
 __exportStar(require("./recent_items.js"), exports);
 __exportStar(require("./retention_policies.js"), exports);
 __exportStar(require("./retention_policy_assignments.js"), exports);

package/dist/cjs/managers/memberships.js

@@ -107,7 +107,7 @@ class MembershipsManager {
         const data = runtime.responseBytes(resp);
         return JSON.parse(new TextDecoder().decode(data));
     }
-    async createGroup(body, opts) {
+    async createGroupMembership(body, opts) {
         let url = this.session.baseUrl("api");
         url += "/group_memberships";
         let req = this.session.newRequest("POST", url);
@@ -121,7 +121,7 @@ class MembershipsManager {
         const data = runtime.responseBytes(resp);
         return JSON.parse(new TextDecoder().decode(data));
     }
-    async getGroup(groupMembershipId, opts) {
+    async getGroupMembership(groupMembershipId, opts) {
         let url = this.session.baseUrl("api");
         url += "/group_memberships";
         url += '/' + (0, internal_js_1.pathEscape)(groupMembershipId);
@@ -134,7 +134,7 @@ class MembershipsManager {
         const data = runtime.responseBytes(resp);
         return JSON.parse(new TextDecoder().decode(data));
     }
-    async updateGroup(groupMembershipId, body, opts) {
+    async updateGroupMembership(groupMembershipId, body, opts) {
         let url = this.session.baseUrl("api");
         url += "/group_memberships";
         url += '/' + (0, internal_js_1.pathEscape)(groupMembershipId);
@@ -149,7 +149,7 @@ class MembershipsManager {
         const data = runtime.responseBytes(resp);
         return JSON.parse(new TextDecoder().decode(data));
     }
-    async deleteGroup(groupMembershipId) {
+    async deleteGroupMembership(groupMembershipId) {
         let url = this.session.baseUrl("api");
         url += "/group_memberships";
         url += '/' + (0, internal_js_1.pathEscape)(groupMembershipId);

package/dist/cjs/managers/query.js

@@ -0,0 +1,68 @@
+"use strict";
+// Code generated by box-gantry. DO NOT EDIT.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QueryManager = void 0;
+const runtime = __importStar(require("../runtime.js"));
+/** Operations for the "query" API area. */
+class QueryManager {
+    session;
+    constructor(session) {
+        this.session = session;
+    }
+    async query(body) {
+        let url = this.session.baseUrl("api");
+        url += "/query";
+        let req = this.session.newRequest("POST", url);
+        req = runtime.withHeader(req, "box-version", "2026.0");
+        const payload = new TextEncoder().encode(JSON.stringify(body));
+        req = runtime.withJsonBody(req, payload);
+        const resp = await this.session.fetch(req);
+        const data = runtime.responseBytes(resp);
+        return JSON.parse(new TextDecoder().decode(data));
+    }
+    async queryInsights(body) {
+        let url = this.session.baseUrl("api");
+        url += "/query_insights";
+        let req = this.session.newRequest("POST", url);
+        req = runtime.withHeader(req, "box-version", "2026.0");
+        const payload = new TextEncoder().encode(JSON.stringify(body));
+        req = runtime.withJsonBody(req, payload);
+        const resp = await this.session.fetch(req);
+        const data = runtime.responseBytes(resp);
+        return JSON.parse(new TextDecoder().decode(data));
+    }
+}
+exports.QueryManager = QueryManager;

package/dist/cjs/models/schemas.js

@@ -1,3 +1,3 @@
 "use strict";
-// Code generated by box-gantry 0.1.0 (spec ee7d55aedefe2fa0) for Box API 2024.0. DO NOT EDIT.
+// Code generated by box-gantry 0.1.0 (spec 3fb3510fe12f2f80) for Box API 2024.0. DO NOT EDIT.
 Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/runtime.js

@@ -86,6 +86,8 @@ class Client {
     auth;
     baseUrls;
     maxRetries;
+    fetchImpl;
+    defaultHeaders;
     constructor(auth, options = {}) {
         this.auth = auth;
         const maxRetries = options.maxRetries ?? 5;
@@ -94,6 +96,8 @@ class Client {
         }
         this.maxRetries = maxRetries;
         this.baseUrls = { ...DEFAULT_BASE_URLS, ...(options.baseUrls ?? {}) };
+        this.fetchImpl = options.fetch ?? fetch;
+        this.defaultHeaders = { ...(options.headers ?? {}) };
     }
     /** The configured base URL for a D-106 class, without a trailing slash. */
     baseUrl(name) {
@@ -124,13 +128,14 @@ class Client {
         let refreshed = false;
         let lastError;
         for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
-            const headers = new Headers(request.headers);
+            const headers = new Headers(this.defaultHeaders);
+            request.headers.forEach((value, name) => headers.set(name, value));
             headers.set('Authorization', `Bearer ${token}`);
             // `httpResponse` is the platform `Response` (via inference — the name is
             // shadowed by this module's `Response` class, so it is never annotated).
             let httpResponse;
             try {
-                httpResponse = await fetch(url, {
+                httpResponse = await this.fetchImpl(url, {
                     method: request.method,
                     headers,
                     // A `Uint8Array` is a valid `BodyInit` at runtime; the cast bridges
@@ -154,7 +159,7 @@ class Client {
             const response = new Response(httpResponse.status, httpResponse.headers, bodyBytes);
             // A single force-refresh on 401: re-acquire past the token cache so the
             // retry doesn't just resend the same rejected token.
-            if (response.status === 401 && !refreshed) {
+            if (response.status === 401 && !refreshed && attempt < this.maxRetries) {
                 refreshed = true;
                 token = await this.auth.forceRefresh(token);
                 continue;

package/dist/cjs/tokens.js

@@ -72,9 +72,11 @@ exports.CachedToken = CachedToken;
  * token acquisition never escapes the runtime's error contract. The optional
  * `signal` cancels an explicit caller-initiated exchange (`exchangeCode`); the
  * cached flows do not thread one, so a shared refresh is never bound to a single
- * request's cancellation.
+ * request's cancellation. `fetchImpl` defaults to the global `fetch`; a caller
+ * building an `Auth` with a custom transport (matching the runtime `Client`'s
+ * own `fetch` override) passes it through so auth traffic is observable too.
  */
-async function postTokenForm(tokenUrl, form, signal) {
+async function postTokenForm(tokenUrl, form, signal, fetchImpl = fetch) {
     // An internal deadline independent of the caller's signal, combined with it
     // when present. It also covers the body read, since the signal aborts an
     // in-progress `fetch` (including body streaming). `AbortSignal.timeout` owns
@@ -84,7 +86,7 @@ async function postTokenForm(tokenUrl, form, signal) {
     let response;
     let text;
     try {
-        response = await fetch(tokenUrl, {
+        response = await fetchImpl(tokenUrl, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/x-www-form-urlencoded',

package/dist/esm/auth.js

@@ -36,7 +36,7 @@ export function clientCredentials(config) {
         client_secret: config.clientSecret,
         box_subject_type: subject.type,
         box_subject_id: subject.id,
-    }));
+    }, undefined, config.fetch));
 }
 /**
  * Build the URL to redirect a user to so they can grant access. `state` is
@@ -65,7 +65,7 @@ function refreshTokenExchange(config, tokenUrl, initialRefresh) {
             refresh_token: refreshToken,
             client_id: config.clientId,
             client_secret: config.clientSecret,
-        });
+        }, undefined, config.fetch);
         if (token.refreshToken) {
             refreshToken = token.refreshToken;
             config.onRefresh?.(token.refreshToken);
@@ -94,7 +94,7 @@ export async function exchangeCode(config, code, redirectUri, signal) {
         client_id: config.clientId,
         client_secret: config.clientSecret,
         redirect_uri: redirectUri,
-    }, signal);
+    }, signal, config.fetch);
     if (!token.refreshToken) {
         throw new BoxApiError('authorization-code exchange returned no refresh_token');
     }

package/dist/esm/buildinfo.js

@@ -1,7 +1,7 @@
-// Code generated by box-gantry 0.1.0 (spec ee7d55aedefe2fa0). DO NOT EDIT.
+// Code generated by box-gantry 0.1.0 (spec 3fb3510fe12f2f80). DO NOT EDIT.
 /** The box-gantry engine version that generated this SDK. */
 export const ENGINE = "0.1.0";
 /** Fingerprint of the input spec set. */
-export const SPEC_FINGERPRINT = "ee7d55aedefe2fa0";
+export const SPEC_FINGERPRINT = "3fb3510fe12f2f80";
 /** The target language key (FR-4). */
 export const TARGET = "typescript";