@struktoai/mirage-core/dist/vfs/box/config.js

A Unified Virtual Filesystem For AI Agents

// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
import { timeoutShape } from "../../core/api/config.js";
import { FIELD_NORMALIZERS, secretSchema, secretStr, z } from "../secrets.js";
export const BoxConfig = z
    .object({
    ...timeoutShape,
    endpoint: z
        .string()
        .optional()
        .describe("Base URL that replaces Box's API, upload and OAuth token hosts, such as a test server. Unset uses Box's hosts."),
    rootFolderId: z.string().optional().meta({
        description: "Box folder ID the mount uses as its root, from the folder's web URL (`box.com/folder/<id>`); unlike a path it survives renames and moves. `0` is the account root.",
        default: '0',
    }),
    clientId: z
        .string()
        .optional()
        .describe('Box app client ID. Required with `refreshToken` (OAuth) or with `clientSecret` and `enterpriseId` (client credentials).'),
    clientSecret: secretStr()
        .optional()
        .describe('Box app client secret. Required for client credentials; the OAuth refresh sends it when set, so a PKCE client can omit it.'),
    refreshToken: secretStr()
        .optional()
        .describe('OAuth refresh token; needs `clientId`. Box rotates it on every refresh, so persist the new one with `onRefreshTokenRotated`.'),
    enterpriseId: z
        .string()
        .optional()
        .describe("Box enterprise ID for the client-credentials grant. With `clientId` and `clientSecret`, tokens are minted for the app's service account and no refresh token is involved."),
    accessToken: secretStr()
        .optional()
        .describe('Box developer token, used as is with no refresh flow; it expires after about 60 minutes. It wins over every other credential. Also accepted as `developer_token`.'),
    // The callbacks are declared so parse keeps them, and marked secret so
    // no snapshot carries them.
    refreshFn: secretSchema(z.custom((value) => typeof value === 'function'))
        .optional()
        .describe("Function that takes the current refresh token and returns `{ accessToken, refreshToken, expiresIn }`, called instead of Box's token endpoint. Needs `clientId` and `refreshToken`."),
    onRefreshTokenRotated: secretSchema(z.custom((value) => typeof value === 'function'))
        .optional()
        .describe('Function (sync or async) given the new refresh token whenever a refresh rotates it, to persist it; the token it replaces stops working after its first use.'),
})
    .register(FIELD_NORMALIZERS, { rename: { developer_token: 'accessToken' } });
//# sourceMappingURL=config.js.map