@visulima/storage 1.0.9 → 1.0.10

package/dist/storage/azure/index.d.ts

@@ -1,4 +1,4 @@
-import { F as File, k as MetaStorageOptions, L as LocalMetaStorageOptions, l as BaseStorageOptions, M as MetaStorage, R as RetryConfig, d as FileInit, O as OperationOptions, f as FileQuery, o as BatchOperationResponse, e as FilePart, g as FileReturn, B as BaseStorage } from "../../packem_shared/storage.d-CEM1upWM.js";
+import { F as File, k as MetaStorageOptions, L as LocalMetaStorageOptions, l as BaseStorageOptions, M as MetaStorage, R as RetryConfig, d as FileInit, O as OperationOptions, f as FileQuery, o as BatchOperationResponse, e as FilePart, g as FileReturn, B as BaseStorage } from "../../packem_shared/storage.d-DIav_lF1.js";
 import 'node:stream';
 import { TokenCredential } from '@azure/core-auth';
 import { BlobServiceClient } from '@azure/storage-blob';
@@ -11,58 +11,58 @@ declare class AzureFile extends File {
 }
 interface ClientConfig {
   /**
-  * Azure account key. Resolved from `AZURE_STORAGE_ACCOUNT_KEY` when omitted.
-  */
+   * Azure account key. Resolved from `AZURE_STORAGE_ACCOUNT_KEY` when omitted.
+   */
   accountKey?: string;
   /**
-  * Azure account name. Resolved from `AZURE_STORAGE_ACCOUNT` when omitted.
-  */
+   * Azure account name. Resolved from `AZURE_STORAGE_ACCOUNT` when omitted.
+   */
   accountName?: string;
   /**
-  * Azure container name.
-  */
+   * Azure container name.
+   */
   containerName: string;
   /**
-  * Microsoft Entra credential for Azure AD / Managed Identity workloads
-  * (e.g. `DefaultAzureCredential` from `@azure/identity`). When supplied
-  * without a shared key, SDK operations use token auth and signed URLs are
-  * minted via User Delegation SAS.
-  *
-  * The principal must be allowed to access blob data and to call
-  * `Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action`
-  * (for example via Storage Blob Data Contributor + Storage Blob Delegator).
-  */
+   * Microsoft Entra credential for Azure AD / Managed Identity workloads
+   * (e.g. `DefaultAzureCredential` from `@azure/identity`). When supplied
+   * without a shared key, SDK operations use token auth and signed URLs are
+   * minted via User Delegation SAS.
+   *
+   * The principal must be allowed to access blob data and to call
+   * `Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action`
+   * (for example via Storage Blob Data Contributor + Storage Blob Delegator).
+   */
   credential?: TokenCredential;
   /**
-  * Azure endpoint.
-  */
+   * Azure endpoint.
+   */
   endpoint?: string;
   /**
-  * Azure root path.
-  */
+   * Azure root path.
+   */
   root?: string;
   /**
-  * Pre-issued SAS token (with or without a leading `?`). Resolved from
-  * `AZURE_STORAGE_SAS_TOKEN` when omitted. SAS-token adapters can use their
-  * configured access but cannot mint fresh signed URLs.
-  */
+   * Pre-issued SAS token (with or without a leading `?`). Resolved from
+   * `AZURE_STORAGE_SAS_TOKEN` when omitted. SAS-token adapters can use their
+   * configured access but cannot mint fresh signed URLs.
+   */
   sasToken?: string;
   /**
-  * Controls whether a `credential`-backed adapter mints User Delegation SAS
-  * URLs. Defaults to `true` when `credential` is supplied; set `false` for
-  * token-authenticated SDK operations without signed-URL support.
-  */
+   * Controls whether a `credential`-backed adapter mints User Delegation SAS
+   * URLs. Defaults to `true` when `credential` is supplied; set `false` for
+   * token-authenticated SDK operations without signed-URL support.
+   */
   useUserDelegationSas?: boolean;
 }
 interface ClientConfig {
   connectionString?: string;
   /**
-  * Azure container name.
-  */
+   * Azure container name.
+   */
   containerName: string;
   /**
-  * Azure root path.
-  */
+   * Azure root path.
+   */
   root?: string;
 }
 interface AzureMetaStorageOptions extends ClientConfig, MetaStorageOptions {
@@ -70,23 +70,23 @@ interface AzureMetaStorageOptions extends ClientConfig, MetaStorageOptions {
 }
 interface AzureStorageOptions extends BaseStorageOptions, ClientConfig {
   /**
-  * Configure metafiles storage
-  * @example
-  * ```ts
-  * Using local metafiles
-  * const storage = new AzureStorage({
-  *   bucket: 'upload',
-  *   metaStorageConfig: { directory: '/tmp/upload-metafiles' }
-  * })
-  * ```
-  * Using a separate bucket for metafiles
-  * ```ts
-  * const storage = new AzureStorage({
-  *   bucket: 'upload',
-  *   metaStorageConfig: { bucket: 'upload-metafiles' }
-  * })
-  * ```
-  */
+   * Configure metafiles storage
+   * @example
+   * ```ts
+   * Using local metafiles
+   * const storage = new AzureStorage({
+   *   bucket: 'upload',
+   *   metaStorageConfig: { directory: '/tmp/upload-metafiles' }
+   * })
+   * ```
+   * Using a separate bucket for metafiles
+   * ```ts
+   * const storage = new AzureStorage({
+   *   bucket: 'upload',
+   *   metaStorageConfig: { bucket: 'upload-metafiles' }
+   * })
+   * ```
+   */
   metaStorageConfig?: AzureMetaStorageOptions | LocalMetaStorageOptions;
 }
 declare class AzureMetaStorage<T extends File = File> extends MetaStorage<T> {
@@ -101,18 +101,18 @@ declare class AzureMetaStorage<T extends File = File> extends MetaStorage<T> {
   list(): Promise<T[]>;
 }
 /**
-* Azure Blob Storage implementation.
-* @remarks
-* ## Supported Operations
-* - ✅ create, write, delete, get, list, update, copy, move
-* - ✅ Batch operations: deleteBatch (native Blob Batch API, 256/request), copyBatch + moveBatch (inherited from BaseStorage)
-* - ✅ exists: Implemented (checks metadata and Azure blob)
-* - ❌ getStream: Not implemented (use get() for file retrieval)
-* - ✅ getReadUrl / getUploadUrl: service SAS (shared key / connection string) or User Delegation SAS (Microsoft Entra credential). SAS-token adapters append the pre-issued token. Anonymous (public-container) adapters serve unsigned read URLs only — uploads are rejected.
-*
-* ## Authentication
-* Precedence: connection string, then account key + name, then Microsoft Entra `credential` (Azure AD / Managed Identity), then a pre-issued `sasToken`, then anonymous (public-container) access.
-*/
+ * Azure Blob Storage implementation.
+ * @remarks
+ * ## Supported Operations
+ * - ✅ create, write, delete, get, list, update, copy, move
+ * - ✅ Batch operations: deleteBatch (native Blob Batch API, 256/request), copyBatch + moveBatch (inherited from BaseStorage)
+ * - ✅ exists: Implemented (checks metadata and Azure blob)
+ * - ❌ getStream: Not implemented (use get() for file retrieval)
+ * - ✅ getReadUrl / getUploadUrl: service SAS (shared key / connection string) or User Delegation SAS (Microsoft Entra credential). SAS-token adapters append the pre-issued token. Anonymous (public-container) adapters serve unsigned read URLs only — uploads are rejected.
+ *
+ * ## Authentication
+ * Precedence: connection string, then account key + name, then Microsoft Entra `credential` (Azure AD / Managed Identity), then a pre-issued `sasToken`, then anonymous (public-container) access.
+ */
 declare class AzureStorage extends BaseStorage {
   static override readonly name: string;
   override checksumTypes: string[];
@@ -131,105 +131,99 @@ declare class AzureStorage extends BaseStorage {
   protected override getRetryConfig(): RetryConfig;
   create(config: FileInit, options?: OperationOptions): Promise<AzureFile>;
   /**
-  * Deletes an upload and its metadata.
-  * @param query File query containing the file ID to delete.
-  * @param query.id File ID to delete.
-  * @returns Promise resolving to the deleted file object with status: "deleted".
-  * @throws {UploadError} If the file metadata cannot be found.
-  */
-  delete({
-    id
-  }: FileQuery, options?: OperationOptions): Promise<AzureFile>;
-  /**
-  * Deletes many blobs in one round-trip using Azure's native
-  * [Blob Batch API](https://learn.microsoft.com/rest/api/storageservices/blob-batch)
-  * (up to 256 sub-requests per request) instead of issuing one DELETE per key.
-  *
-  * Sidecar metadata removal and the {@link onDelete} hook are still applied per
-  * successfully-deleted id; a 404 sub-response is treated as success to match the
-  * `deleteIfExists` semantics of the single-key {@link delete}. If the batch endpoint
-  * is unavailable (e.g. an Azurite build without batch support) the call transparently
-  * falls back to the per-key base implementation.
-  * @param ids File ids/keys to delete.
-  * @param options Optional per-call signal/timeout/retries.
-  */
+   * Deletes an upload and its metadata.
+   * @param query File query containing the file ID to delete.
+   * @param query.id File ID to delete.
+   * @returns Promise resolving to the deleted file object with status: "deleted".
+   * @throws {UploadError} If the file metadata cannot be found.
+   */
+  delete({ id }: FileQuery, options?: OperationOptions): Promise<AzureFile>;
+  /**
+   * Deletes many blobs in one round-trip using Azure's native
+   * [Blob Batch API](https://learn.microsoft.com/rest/api/storageservices/blob-batch)
+   * (up to 256 sub-requests per request) instead of issuing one DELETE per key.
+   *
+   * Sidecar metadata removal and the {@link onDelete} hook are still applied per
+   * successfully-deleted id; a 404 sub-response is treated as success to match the
+   * `deleteIfExists` semantics of the single-key {@link delete}. If the batch endpoint
+   * is unavailable (e.g. an Azurite build without batch support) the call transparently
+   * falls back to the per-key base implementation.
+   * @param ids File ids/keys to delete.
+   * @param options Optional per-call signal/timeout/retries.
+   */
   override deleteBatch(ids: string[], options?: OperationOptions): Promise<BatchOperationResponse<AzureFile>>;
   /**
-  * Moves an upload file to a new location.
-  * @param name Source file name/ID.
-  * @param destination Destination file name/ID.
-  * @returns Promise resolving to the moved file object.
-  * @throws {UploadError} If the source file cannot be found.
-  */
+   * Moves an upload file to a new location.
+   * @param name Source file name/ID.
+   * @param destination Destination file name/ID.
+   * @returns Promise resolving to the moved file object.
+   * @throws {UploadError} If the source file cannot be found.
+   */
   move(name: string, destination: string, options?: OperationOptions): Promise<AzureFile>;
   write(part: FilePart | FileQuery | AzureFile, options?: OperationOptions): Promise<AzureFile>;
-  get({
-    id
-  }: FileQuery, options?: OperationOptions): Promise<FileReturn>;
-  /**
-  * Checks if a file exists by verifying both metadata and the actual Azure blob.
-  * Returns true only if both the metadata and the blob exist.
-  * @param query File query containing the file ID to check.
-  * @returns Promise resolving to true if both metadata and blob exist, false otherwise.
-  */
-  override exists({
-    id
-  }: FileQuery, options?: OperationOptions): Promise<boolean>;
-  /**
-  * Copies an upload file to a new location.
-  * @param name Source file name/ID.
-  * @param destination Destination file name/ID.
-  * @returns Promise resolving to the copied file object.
-  * @throws {UploadError} If the source file cannot be found.
-  */
+  get({ id }: FileQuery, options?: OperationOptions): Promise<FileReturn>;
+  /**
+   * Checks if a file exists by verifying both metadata and the actual Azure blob.
+   * Returns true only if both the metadata and the blob exist.
+   * @param query File query containing the file ID to check.
+   * @returns Promise resolving to true if both metadata and blob exist, false otherwise.
+   */
+  override exists({ id }: FileQuery, options?: OperationOptions): Promise<boolean>;
+  /**
+   * Copies an upload file to a new location.
+   * @param name Source file name/ID.
+   * @param destination Destination file name/ID.
+   * @returns Promise resolving to the copied file object.
+   * @throws {UploadError} If the source file cannot be found.
+   */
   copy(name: string, destination: string, options?: OperationOptions & {
     storageClass?: string;
   }): Promise<AzureFile>;
   override list(limit?: number, options?: OperationOptions): Promise<AzureFile[]>;
   /**
-  * Returns a download URL for the blob at `key`.
-  *
-  * Shared-key / connection-string and Microsoft Entra adapters mint a fresh
-  * SAS. SAS-token adapters append the pre-issued token. Genuine anonymous
-  * (public-container) adapters return the unsigned blob URL.
-  * @param key Storage key.
-  * @param options Optional expiry and response content overrides. Response
-  * content overrides only apply when the adapter mints a fresh SAS; they are
-  * rejected on the pre-issued `sasToken` and anonymous paths, which have no
-  * signature in which to bind them.
-  * @throws {UploadError} When the adapter has no way to authorise reads, or
-  * when a response content override is supplied on a non-signing path.
-  */
+   * Returns a download URL for the blob at `key`.
+   *
+   * Shared-key / connection-string and Microsoft Entra adapters mint a fresh
+   * SAS. SAS-token adapters append the pre-issued token. Genuine anonymous
+   * (public-container) adapters return the unsigned blob URL.
+   * @param key Storage key.
+   * @param options Optional expiry and response content overrides. Response
+   * content overrides only apply when the adapter mints a fresh SAS; they are
+   * rejected on the pre-issued `sasToken` and anonymous paths, which have no
+   * signature in which to bind them.
+   * @throws {UploadError} When the adapter has no way to authorise reads, or
+   * when a response content override is supplied on a non-signing path.
+   */
   override getReadUrl(key: string, options?: {
     expiresIn?: number;
     responseContentDisposition?: string;
     responseContentType?: string;
   }): Promise<string>;
   /**
-  * Returns an upload URL (HTTP PUT, `x-ms-blob-type: BlockBlob`) for `key`.
-  *
-  * Shared-key / connection-string and Microsoft Entra adapters mint a fresh
-  * SAS. SAS-token adapters append the pre-issued token. Anonymous adapters
-  * cannot upload. The caller must send the desired `x-ms-blob-content-type`
-  * header on the PUT — a SAS cannot pin the stored content type.
-  * @param key Storage key.
-  * @param options Optional expiry. `contentLength` and `contentType` are
-  * rejected: an Azure SAS does not bind the request `Content-Type` into the
-  * signature and has no server-enforced size limit, so accepting them would
-  * hand the caller a guarantee that does not hold.
-  * @throws {UploadError} When the adapter cannot authorise writes, or when an
-  * unenforceable `contentType`/`contentLength` override is supplied.
-  */
+   * Returns an upload URL (HTTP PUT, `x-ms-blob-type: BlockBlob`) for `key`.
+   *
+   * Shared-key / connection-string and Microsoft Entra adapters mint a fresh
+   * SAS. SAS-token adapters append the pre-issued token. Anonymous adapters
+   * cannot upload. The caller must send the desired `x-ms-blob-content-type`
+   * header on the PUT — a SAS cannot pin the stored content type.
+   * @param key Storage key.
+   * @param options Optional expiry. `contentLength` and `contentType` are
+   * rejected: an Azure SAS does not bind the request `Content-Type` into the
+   * signature and has no server-enforced size limit, so accepting them would
+   * hand the caller a guarantee that does not hold.
+   * @throws {UploadError} When the adapter cannot authorise writes, or when an
+   * unenforceable `contentType`/`contentLength` override is supplied.
+   */
   override getUploadUrl(key: string, options?: {
     contentLength?: number;
     contentType?: string;
     expiresIn?: number;
   }): Promise<string>;
   /**
-  * Prefixes the given filePath with the storage root location (assetFolder if configured).
-  * @param filePath Relative file path to prefix.
-  * @returns Full path with asset folder prefix if configured, otherwise returns original path.
-  */
+   * Prefixes the given filePath with the storage root location (assetFolder if configured).
+   * @param filePath Relative file path to prefix.
+   * @returns Full path with asset folder prefix if configured, otherwise returns original path.
+   */
   private getFullPath;
   private accessCheck;
 }

package/dist/storage/azure/index.js

@@ -1 +1 @@
-import{default as a}from"../../packem_shared/AzureFile-DFSaVe25.js";import{c as t}from"../../packem_shared/azure-meta-storage-ClbEsfI4.js";import{default as u}from"../../packem_shared/AzureStorage-1UvDIQZd.js";export{a as AzureFile,t as AzureSMetaStorage,u as AzureStorage};
+import{default as a}from"../../packem_shared/AzureFile-DFSaVe25.js";import{c as t}from"../../packem_shared/azure-meta-storage-ClbEsfI4.js";import{default as u}from"../../packem_shared/AzureStorage-DL-U7qFG.js";export{a as AzureFile,t as AzureSMetaStorage,u as AzureStorage};

package/dist/storage/box/index.d.ts

@@ -1,6 +1,6 @@
-import { F as File, L as LocalMetaStorageOptions, l as BaseStorageOptions, M as MetaStorage, d as FileInit, O as OperationOptions, e as FilePart, f as FileQuery, g as FileReturn, B as BaseStorage } from "../../packem_shared/storage.d-CEM1upWM.js";
+import { F as File, L as LocalMetaStorageOptions, l as BaseStorageOptions, M as MetaStorage, d as FileInit, O as OperationOptions, e as FilePart, f as FileQuery, g as FileReturn, B as BaseStorage } from "../../packem_shared/storage.d-DIav_lF1.js";
 import 'node:stream';
-import { L as LocalMetaStorage } from "../../packem_shared/local-meta-storage.d-D9PBfkn6.js";
+import { L as LocalMetaStorage } from "../../packem_shared/local-meta-storage.d-DuTEzyii.js";
 import { BoxClient } from 'box-typescript-sdk-gen';
 import 'node:crypto';
 import 'node:http';
@@ -15,38 +15,38 @@ declare class BoxMetaStorage extends LocalMetaStorage<BoxFile> {
 }
 interface BoxOAuthOptions {
   /**
-  * Box application client ID.
-  */
+   * Box application client ID.
+   */
   clientId: string;
   /**
-  * Box application client secret.
-  */
+   * Box application client secret.
+   */
   clientSecret: string;
   /**
-  * Long-lived refresh token previously obtained via Box's authorization
-  * code flow. The adapter seeds the SDK's in-memory token storage with
-  * this value; the SDK exchanges it for a fresh access token on first
-  * use and re-refreshes when the access token expires.
-  */
+   * Long-lived refresh token previously obtained via Box's authorization
+   * code flow. The adapter seeds the SDK's in-memory token storage with
+   * this value; the SDK exchanges it for a fresh access token on first
+   * use and re-refreshes when the access token expires.
+   */
   refreshToken: string;
 }
 interface BoxCcgOptions {
   /**
-  * Box application client ID.
-  */
+   * Box application client ID.
+   */
   clientId: string;
   /**
-  * Box application client secret.
-  */
+   * Box application client secret.
+   */
   clientSecret: string;
   /**
-  * Pass `enterpriseId` to authenticate as the service account, or `userId`
-  * to authenticate as a managed/app user. At least one is required.
-  */
+   * Pass `enterpriseId` to authenticate as the service account, or `userId`
+   * to authenticate as a managed/app user. At least one is required.
+   */
   enterpriseId?: string;
   /**
-  * Pass `userId` to authenticate as a managed/app user.
-  */
+   * Pass `userId` to authenticate as a managed/app user.
+   */
   userId?: string;
 }
 type BoxJwtOptions = {
@@ -56,91 +56,91 @@ type BoxJwtOptions = {
 };
 interface BoxStorageOptions extends BaseStorageOptions {
   /**
-  * Server-side Client Credentials Grant. Mutually exclusive with
-  * `developerToken`, `oauth`, and `jwt`.
-  */
+   * Server-side Client Credentials Grant. Mutually exclusive with
+   * `developerToken`, `oauth`, and `jwt`.
+   */
   ccg?: BoxCcgOptions;
   /**
-  * Pre-built `BoxClient`. Escape hatch for callers that already wire
-  * auth themselves (e.g. with a custom `NetworkSession`, proxy config,
-  * or downscoped tokens).
-  */
+   * Pre-built `BoxClient`. Escape hatch for callers that already wire
+   * auth themselves (e.g. with a custom `NetworkSession`, proxy config,
+   * or downscoped tokens).
+   */
   client?: BoxClient;
   /**
-  * Default expiry, in seconds, advertised to callers of `getReadUrl()`.
-  * Box does not document a hard maximum for download URLs (they are
-  * short-lived by API design); this value is forwarded as documentation
-  * only — the actual lifetime is decided by Box. Defaults to 3600.
-  */
+   * Default expiry, in seconds, advertised to callers of `getReadUrl()`.
+   * Box does not document a hard maximum for download URLs (they are
+   * short-lived by API design); this value is forwarded as documentation
+   * only — the actual lifetime is decided by Box. Defaults to 3600.
+   */
   defaultUrlExpiresIn?: number;
   /**
-  * Static developer token from the Box developer console. Useful for
-  * scripts and trying the adapter; production apps should use OAuth,
-  * CCG, or JWT instead. Mutually exclusive with `oauth`, `ccg`, `jwt`.
-  */
+   * Static developer token from the Box developer console. Useful for
+   * scripts and trying the adapter; production apps should use OAuth,
+   * CCG, or JWT instead. Mutually exclusive with `oauth`, `ccg`, `jwt`.
+   */
   developerToken?: string;
   /**
-  * JWT Server Authentication, configured via the JSON blob from Box's
-  * developer console. Mutually exclusive with the other auth modes.
-  */
+   * JWT Server Authentication, configured via the JSON blob from Box's
+   * developer console. Mutually exclusive with the other auth modes.
+   */
   jwt?: BoxJwtOptions;
   /**
-  * Configure metafiles storage. Defaults to local tmp directory.
-  */
+   * Configure metafiles storage. Defaults to local tmp directory.
+   */
   metaStorageConfig?: LocalMetaStorageOptions;
   /**
-  * OAuth2 user-app flow seeded with a refresh token. Mutually exclusive
-  * with `developerToken`, `ccg`, and `jwt`.
-  */
+   * OAuth2 user-app flow seeded with a refresh token. Mutually exclusive
+   * with `developerToken`, `ccg`, and `jwt`.
+   */
   oauth?: BoxOAuthOptions;
   /**
-  * When `true`, `getReadUrl` creates (or reuses) an `open`-access shared
-  * link instead of a short-lived signed download URL. Public shared links
-  * may be restricted on Box Business or Enterprise plans; the adapter
-  * surfaces Box's `access_denied_insufficient_permissions` error
-  * unmodified in that case.
-  */
+   * When `true`, `getReadUrl` creates (or reuses) an `open`-access shared
+   * link instead of a short-lived signed download URL. Public shared links
+   * may be restricted on Box Business or Enterprise plans; the adapter
+   * surfaces Box's `access_denied_insufficient_permissions` error
+   * unmodified in that case.
+   */
   publicByDefault?: boolean;
   /**
-  * Logical "bucket root" — virtual keys live under this Box folder ID.
-  * Use `"0"` (the default) to anchor at the user's root folder. The
-  * folder must already exist; intermediate subfolders are auto-created
-  * on upload.
-  */
+   * Logical "bucket root" — virtual keys live under this Box folder ID.
+   * Use `"0"` (the default) to anchor at the user's root folder. The
+   * folder must already exist; intermediate subfolders are auto-created
+   * on upload.
+   */
   rootFolderId?: string;
 }
 /**
-* Box storage backend.
-*
-* Routes virtual keys onto Box folder/file IDs under `rootFolderId`. Uploads
-* use `uploads.uploadFile` / `uploads.uploadFileVersion` up to 50 MB and
-* switch to the chunked-upload session API above that threshold. Subfolders
-* along a key's path are auto-created on first write.
-*
-* **Auth precedence**:
-* 1. `client` (pre-built `BoxClient`)
-* 2. `developerToken` (static, from Box developer console)
-* 3. `oauth` (refresh-token seeded — `clientId` + `clientSecret` + `refreshToken`)
-* 4. `ccg` (Client Credentials Grant — `clientId` + `clientSecret` + `enterpriseId` or `userId`)
-* 5. `jwt` (JWT Server Auth — `configJsonString` or `configFilePath`)
-* 6. Env fallback: `BOX_DEVELOPER_TOKEN`
-*
-* **Limitations**:
-* - `metadata` is not supported on the unified API — Box exposes file metadata
-*   via classifications and metadata templates. Use `storage.raw.fileMetadata.*`
-*   directly if you need them.
-* - `cacheControl` is not supported (Box does not expose HTTP cache headers
-*   on file content).
-* - `getUploadUrl` is not supported — Box uploads require a multipart `POST`
-*   with both an `attributes` JSON part and the file bytes part, which doesn't
-*   fit the PUT-with-raw-body presigned-URL contract.
-* - `responseContentDisposition` is not supported on signed download URLs.
-* - `write()` buffers the full part body in memory before choosing between
-*   the simple-upload and chunked-upload paths. Each request handler runs
-*   independently, so concurrent multi-GB writes are bounded by the host's
-*   available memory.
-* - ⚠️ Per-operation `signal`/`timeout` are best-effort: the underlying SDK does not support request cancellation, so an in-flight call may complete server-side even after abort. `retries` is honored.
-*/
+ * Box storage backend.
+ *
+ * Routes virtual keys onto Box folder/file IDs under `rootFolderId`. Uploads
+ * use `uploads.uploadFile` / `uploads.uploadFileVersion` up to 50 MB and
+ * switch to the chunked-upload session API above that threshold. Subfolders
+ * along a key's path are auto-created on first write.
+ *
+ * **Auth precedence**:
+ * 1. `client` (pre-built `BoxClient`)
+ * 2. `developerToken` (static, from Box developer console)
+ * 3. `oauth` (refresh-token seeded — `clientId` + `clientSecret` + `refreshToken`)
+ * 4. `ccg` (Client Credentials Grant — `clientId` + `clientSecret` + `enterpriseId` or `userId`)
+ * 5. `jwt` (JWT Server Auth — `configJsonString` or `configFilePath`)
+ * 6. Env fallback: `BOX_DEVELOPER_TOKEN`
+ *
+ * **Limitations**:
+ * - `metadata` is not supported on the unified API — Box exposes file metadata
+ *   via classifications and metadata templates. Use `storage.raw.fileMetadata.*`
+ *   directly if you need them.
+ * - `cacheControl` is not supported (Box does not expose HTTP cache headers
+ *   on file content).
+ * - `getUploadUrl` is not supported — Box uploads require a multipart `POST`
+ *   with both an `attributes` JSON part and the file bytes part, which doesn't
+ *   fit the PUT-with-raw-body presigned-URL contract.
+ * - `responseContentDisposition` is not supported on signed download URLs.
+ * - `write()` buffers the full part body in memory before choosing between
+ *   the simple-upload and chunked-upload paths. Each request handler runs
+ *   independently, so concurrent multi-GB writes are bounded by the host's
+ *   available memory.
+ * - ⚠️ Per-operation `signal`/`timeout` are best-effort: the underlying SDK does not support request cancellation, so an in-flight call may complete server-side even after abort. `retries` is honored.
+ */
 declare class BoxStorage extends BaseStorage<BoxFile> {
   static override readonly name: string;
   override checksumTypes: string[];
@@ -155,12 +155,8 @@ declare class BoxStorage extends BaseStorage<BoxFile> {
   override get raw(): BoxClient;
   create(config: FileInit, _options?: OperationOptions): Promise<BoxFile>;
   write(part: FilePart | FileQuery | BoxFile, options?: OperationOptions): Promise<BoxFile>;
-  delete({
-    id
-  }: FileQuery, options?: OperationOptions): Promise<BoxFile>;
-  get({
-    id
-  }: FileQuery, options?: OperationOptions): Promise<FileReturn>;
+  delete({ id }: FileQuery, options?: OperationOptions): Promise<BoxFile>;
+  get({ id }: FileQuery, options?: OperationOptions): Promise<FileReturn>;
   copy(name: string, destination: string, options?: OperationOptions & {
     storageClass?: string;
   }): Promise<BoxFile>;

package/dist/storage/box/index.js

@@ -1 +1 @@
-import{default as a}from"../../packem_shared/BoxFile-CseIoPW1.js";import{default as r}from"../../packem_shared/BoxMetaStorage-BSn6Qfnf.js";import{default as x}from"../../packem_shared/BoxStorage-DbGqBLux.js";export{a as BoxFile,r as BoxMetaStorage,x as BoxStorage};
+import{default as a}from"../../packem_shared/BoxFile-CseIoPW1.js";import{default as r}from"../../packem_shared/BoxMetaStorage-CHWrhgg2.js";import{default as x}from"../../packem_shared/BoxStorage-B8_oCz27.js";export{a as BoxFile,r as BoxMetaStorage,x as BoxStorage};