source-package.json — Data Room Toolkit

{"schema_version":1,"runtimes":[{"name":"python","versions":["3.10"]}],"dependencies":[],"operations":[{"kind":"read","description":"Read the target drive identity, existing selected destination and planned items beneath it during dry run and live revalidation; refuse a missing destination and never inspect ancestors above it.","target_restrictions":["Only the configured drive or site default drive","Only destination paths and destination folders of selected files below the configured destination path"]},{"kind":"read","description":"Read file metadata while recursively inventorying the configured SharePoint document library subtree.","target_restrictions":["Only the configured drive or site and optional root path"]},{"kind":"list","description":"List files in the configured library subtree with names, paths, sizes, modification dates, and optional modifier display names.","target_restrictions":["Only files below the configured library root path"]},{"kind":"search","description":"Rank inventory results by user-supplied name and path keywords and optionally run Microsoft Graph content searches for those keywords.","target_restrictions":["Only user-supplied keywords within the configured library subtree"]},{"kind":"read","description":"Read current metadata and paginated version history for each user-supplied file path.","target_restrictions":["Only user-supplied file paths below the configured library root path"]},{"kind":"upload","description":"Upload selected local files by direct PUT or chunked upload session as a create that fails if an item already exists, and optionally re-download them for verification.","target_restrictions":["Only selected source-relative file paths below the configured destination path","Only files whose approved plan action is create, enforced with conflictBehavior fail"]},{"kind":"modify","description":"Replace the content of an existing destination file at the same path during a live mirror, only when the approved plan lists that file as a replacement.","target_restrictions":["Only destination files listed as replace in the approved dry-run plan","Every replacement uses an upload session created with If-Match carrying the approved eTag; a fresh item eTag GET precedes the final byte range","Changes before session creation are refused (documented), or before the final range (tool check); the check-to-commit window has no documented guarantee. Empty replacements are counted as dry-run failures and refused before approval."]},{"kind":"create","description":"Create the missing destination folders listed in the approved dry-run plan to preserve selected source-relative paths during a live mirror.","target_restrictions":["Only folders listed as folders to create in the approved dry-run plan, below the configured destination path"]},{"kind":"read","description":"Read selected local source files, configuration and approved plan files.","target_restrictions":["Only caller-selected files and selected source-relative paths"]},{"kind":"create","description":"Create new local --out, dry-run --plan-file and --audit-log files (0600); nothing is overwritten or appended. Audit is reserved before remote writes and records partial failures.","target_restrictions":["Caller-selected paths in existing non-symlink parents; no local folders created"]},{"kind":"read","description":"Data Room Toolkit 0.1.5 reads config/CLI chunks before requests: default 5242880 bytes; positive integer multiples of 327680, strictly below 62914560 (60 MiB); final range may be shorter.","target_restrictions":["Caller-supplied configuration and CLI options only"]}],"authorization":{"mode":"oauth_application","scopes":["Sites.Read.All","Sites.ReadWrite.All","Sites.Selected"],"credential_requirements":["GRAPH_TENANT_ID environment variable","GRAPH_CLIENT_ID environment variable","GRAPH_CLIENT_SECRET environment variable"]},"network":{"domains":["graph.microsoft.com","login.microsoftonline.com"],"destinations":["OAuth token requests to the Microsoft identity platform","Microsoft Graph endpoints for the configured SharePoint document library","Read-only drive and destination-item lookups for the dry-run plan and live revalidation","Direct PUT requests for selected files below the configured destination path","Chunk requests to Microsoft Graph-issued upload session URLs","Best-effort DELETE to a Graph-issued upload session URL to cancel the session when local bytes or the replacement eTag change before the final range","Graph-issued upload-session URLs and content-download redirects only on graph.microsoft.com, <tenant>.sharepoint.com or <tenant>-my.sharepoint.com, where <tenant> is exactly one DNS label","Every Graph-issued URL and redirect hop must be HTTPS on the default port without user information; other hosts are refused before any request","Sovereign-cloud SharePoint hosts are not supported; the tenant content host is chosen by Microsoft Graph and never configured by this package","Folder creation requests only for folders listed in the approved plan, below the configured destination path","If the user sets HTTPS_PROXY or https_proxy (NO_PROXY/no_proxy exempt hosts), or a macOS or Windows system proxy, requests tunnel through that user-chosen proxy; TLS still terminates at the declared hosts with verified certificates"]},"safety":{"read_only_by_default":true,"dry_run_supported":true,"consequential_writes_require_authorization":true,"validation_controls":["Dry-run sends only read requests and writes nothing to SharePoint; local --plan-file and --audit-log create new files only in existing non-symlink parents","Dry run resolves drive/site identity, lists folders to create, and records create/replace/refusal actions with existing item id and eTag; unsupported empty replacements are counted as failures","The dry run prints the complete per-file action list and names every existing destination file that would be replaced","The plan digest binds drive id, site id, destination path, options, the folders to create, and each file's path, size, SHA-256, upload method and target action","Live mode creates only folders listed in the approved plan and refuses to create any other folder","The --dry-run and --live options are mutually exclusive","Live mode requires an approved plan digest or a plan file from a prior dry run","Before any write, including folder creation, live mode re-resolves the drive and remote state and refuses if the recomputed digest differs","Creates never replace existing items (documented); every replace uses an If-Match upload session and a fresh eTag check before the final range; changes in the short check-to-commit window have no documented guarantee","Each local file is re-hashed and its size and SHA-256 compared with the approved plan before any request for that file, including folder creation","Local bytes are checked against the approved SHA-256 before a direct upload and before the final chunk of an upload session; a mid-session change cancels the upload session instead of sending the final chunk","Human-readable output escapes line breaks and control characters in untrusted paths, names, ids and error text so they cannot forge output lines","Graph-issued URLs and every redirect hop are limited to HTTPS default-port graph.microsoft.com, <tenant>.sharepoint.com or <tenant>-my.sharepoint.com with a single-label <tenant>","Writes retry only on 429 or 503 with Retry-After; final replacement ranges never retry. Other 5xx, transport failures, or 409/412 after an earlier attempt report outcome unknown.","Live mode requires interactive confirmation unless --yes is supplied; non-interactive live mode aborts without --yes","SHA-256 verification re-downloads uploaded content and compares it with the local file by default","The selected destination must already exist; no folder above it is inspected or created, and only approved folders beneath it are created","Local outputs create new mode-0600 files only in existing no-symlink parents; refuse existing files, symlinks and missing parents; never append or create local folders; unsupported directory-descriptor platforms fail closed","Every paginated collection refuses repeated nextLink URLs or more than 1000 pages","Content hits lacking parent paths use one drive/item GET selecting parentReference/name; unresolved or unsafe hits are counted with reasons and mark incomplete (exit 2 unless --allow-partial)"],"target_restrictions":["Uploads are limited to source-relative paths below the configured destination path tree","Root and remote paths are validated before requests: reject dot/empty segments, absolute or drive-qualified paths, backslashes, controls and traversal after one percent decode; resolve validated relative paths beneath root","Symbolic links in the local source tree are not uploaded","Optional --include and --exclude glob patterns bound the upload plan","Existing destination files are replaced only when the approved plan lists them as replace","root_path normalizes one leading and one trailing slash before validation; repeated slashes remain invalid"]},"tests":{"files":["tests/test_dataroom_search.py","tests/test_file_history.py","tests/test_graph_client.py","tests/test_mirror_dataroom.py","tests/test_no_leaked_terms.py"],"fixtures":"synthetic_only","provenance":"creator","evidence":["Creator-authored standard-library unittest suites exercise the command-line tools and shared Graph client","Subprocess tests use synthetic fake Graph HTTP response fixtures and make no live network calls","In-process write-path tests replace the Graph request function with a local recorder and fail if a real network request is attempted","The fake transport prints a warning banner confirming that no real Microsoft Graph network call is made"]}}

License: MIT (read it).

Back to the listing