@gigadrive/sdk 0.1.2 → 0.2.0

package/dist/index.js

@@ -1,10 +1,2153 @@
 "use strict";
-
-// src/test.ts
-var test = () => {
-  console.log("asd");
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
-test();
+var src_exports = {};
+__export(src_exports, {
+  AiGatewayAudioResource: () => AiGatewayAudioResource,
+  AiGatewayBudgetsResource: () => AiGatewayBudgetsResource,
+  AiGatewayPoliciesResource: () => AiGatewayPoliciesResource,
+  AiGatewayResource: () => AiGatewayResource,
+  AiGatewayUsageResource: () => AiGatewayUsageResource,
+  AiGatewayVideosResource: () => AiGatewayVideosResource,
+  ApiError: () => ApiError,
+  ApplicationEnvVarsResource: () => ApplicationEnvVarsResource,
+  ApplicationRequestsResource: () => ApplicationRequestsResource,
+  ApplicationStorageResource: () => ApplicationStorageResource,
+  ApplicationsResource: () => ApplicationsResource,
+  AuthenticationError: () => AuthenticationError,
+  DeploymentsResource: () => DeploymentsResource,
+  GigadriveClient: () => GigadriveClient,
+  GigadriveError: () => GigadriveError,
+  OrganizationAiGatewayResource: () => OrganizationAiGatewayResource,
+  OrganizationEnvVarsResource: () => OrganizationEnvVarsResource,
+  OrganizationsResource: () => OrganizationsResource,
+  StorageBucketsResource: () => StorageBucketsResource,
+  StorageObjectsResource: () => StorageObjectsResource,
+  StorageUploadSessionsResource: () => StorageUploadSessionsResource,
+  UploadError: () => UploadError,
+  UploadSessionExpiredError: () => UploadSessionExpiredError,
+  paginate: () => paginate,
+  parseSSEStream: () => parseSSEStream
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/errors.ts
+var GigadriveError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GigadriveError";
+  }
+};
+var AuthenticationError = class extends GigadriveError {
+  constructor(message) {
+    super(message);
+    this.name = "AuthenticationError";
+  }
+};
+var ApiError = class extends GigadriveError {
+  /** The HTTP status code of the failed response (e.g. 404, 500). */
+  status;
+  /** An optional machine-readable error code from the API response body. */
+  code;
+  constructor(message, status, code) {
+    super(message);
+    this.name = "ApiError";
+    this.status = status;
+    this.code = code;
+  }
+};
+var UploadError = class extends GigadriveError {
+  /** The underlying error that caused the upload to fail, if any. */
+  cause;
+  constructor(message, cause) {
+    super(message);
+    this.name = "UploadError";
+    this.cause = cause;
+  }
+};
+var UploadSessionExpiredError = class extends UploadError {
+  constructor(message = "The upload session expired before the upload completed. Start a new upload to retry.", cause) {
+    super(message, cause);
+    this.name = "UploadSessionExpiredError";
+  }
+};
+
+// src/auth/credential-provider.ts
+var DEFAULT_SCOPE = "offline_access openid profile email";
+var TOKEN_EXPIRY_MARGIN_SECONDS = 30;
+var computeExpiresAt = (expiresInSeconds) => {
+  const ttl = expiresInSeconds ?? 3600;
+  const margin = Math.min(TOKEN_EXPIRY_MARGIN_SECONDS, ttl / 2);
+  return Date.now() + (ttl - margin) * 1e3;
+};
+var readEnv = (name) => {
+  if (typeof process === "undefined" || !process.env) return void 0;
+  return process.env[name];
+};
+var parseTokenResponse = (payload) => {
+  const data = payload;
+  if (typeof data.access_token !== "string" || data.access_token.length === 0) {
+    throw new AuthenticationError("Token endpoint returned no access_token");
+  }
+  return {
+    access_token: data.access_token,
+    refresh_token: typeof data.refresh_token === "string" ? data.refresh_token : void 0,
+    expires_in: typeof data.expires_in === "number" ? data.expires_in : void 0
+  };
+};
+var discoverOidc = async (issuerUrl, fetchFn) => {
+  const discoveryUrl = `${issuerUrl.replace(/\/$/, "")}/.well-known/openid-configuration`;
+  const response = await fetchFn(discoveryUrl);
+  if (!response.ok) {
+    throw new AuthenticationError(`OIDC discovery failed: ${response.status} ${response.statusText}`);
+  }
+  return await response.json();
+};
+var base64UrlEncode = (buffer) => {
+  let binary = "";
+  for (let i = 0; i < buffer.byteLength; i++) {
+    binary += String.fromCharCode(buffer[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+};
+var generatePkce = async () => {
+  const randomBytes = new Uint8Array(64);
+  crypto.getRandomValues(randomBytes);
+  const codeVerifier = base64UrlEncode(randomBytes);
+  const encoder = new TextEncoder();
+  const data = encoder.encode(codeVerifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  const codeChallenge = base64UrlEncode(new Uint8Array(digest));
+  return { codeVerifier, codeChallenge };
+};
+var generateState = () => {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+};
+var OAuth2ClientCredentialProvider = class {
+  constructor(clientId, clientSecret, tokenUrl, fetchFn) {
+    this.clientId = clientId;
+    this.clientSecret = clientSecret;
+    this.tokenUrl = tokenUrl;
+    this.fetchFn = fetchFn;
+  }
+  clientId;
+  clientSecret;
+  tokenUrl;
+  fetchFn;
+  type = "oauth2-client-credentials";
+  async getToken() {
+    const credentials = btoa(`${this.clientId}:${this.clientSecret}`);
+    const response = await this.fetchFn(this.tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Authorization: `Basic ${credentials}`
+      },
+      body: new URLSearchParams({ grant_type: "client_credentials" }).toString()
+    });
+    if (!response.ok) {
+      const body = await response.text().catch(() => "");
+      throw new AuthenticationError(`OAuth2 token request failed (${response.status}): ${body}`);
+    }
+    const data = parseTokenResponse(await response.json());
+    return {
+      accessToken: data.access_token,
+      expiresAt: computeExpiresAt(data.expires_in)
+    };
+  }
+};
+var OAuth2AuthorizationCodeProvider = class {
+  constructor(clientId, issuerUrl, redirectUri, onAuthorizationUrl, fetchFn, scope = DEFAULT_SCOPE) {
+    this.clientId = clientId;
+    this.issuerUrl = issuerUrl;
+    this.redirectUri = redirectUri;
+    this.onAuthorizationUrl = onAuthorizationUrl;
+    this.fetchFn = fetchFn;
+    this.scope = scope;
+  }
+  clientId;
+  issuerUrl;
+  redirectUri;
+  onAuthorizationUrl;
+  fetchFn;
+  scope;
+  type = "oauth2-authorization-code";
+  currentRefreshToken = null;
+  async getToken() {
+    const oidc = await discoverOidc(this.issuerUrl, this.fetchFn);
+    if (!oidc.token_endpoint) {
+      throw new AuthenticationError("OIDC discovery returned no token endpoint");
+    }
+    if (this.currentRefreshToken) {
+      const refreshed = await this.tryRefresh(oidc.token_endpoint, this.currentRefreshToken);
+      if (refreshed) return refreshed;
+      this.currentRefreshToken = null;
+    }
+    if (!oidc.authorization_endpoint) {
+      throw new AuthenticationError("OIDC discovery returned incomplete endpoints");
+    }
+    const { codeVerifier, codeChallenge } = await generatePkce();
+    const state = generateState();
+    const authUrl = new URL(oidc.authorization_endpoint);
+    authUrl.searchParams.set("client_id", this.clientId);
+    authUrl.searchParams.set("redirect_uri", this.redirectUri);
+    authUrl.searchParams.set("response_type", "code");
+    authUrl.searchParams.set("scope", this.scope);
+    authUrl.searchParams.set("code_challenge", codeChallenge);
+    authUrl.searchParams.set("code_challenge_method", "S256");
+    authUrl.searchParams.set("state", state);
+    const result = await this.onAuthorizationUrl(authUrl.toString());
+    let code;
+    let returnedState = null;
+    try {
+      const callbackUrl = new URL(result);
+      code = callbackUrl.searchParams.get("code") ?? "";
+      returnedState = callbackUrl.searchParams.get("state");
+      const error = callbackUrl.searchParams.get("error");
+      if (error) {
+        const description = callbackUrl.searchParams.get("error_description") ?? error;
+        throw new AuthenticationError(`Authorization failed: ${description}`);
+      }
+    } catch (e) {
+      if (e instanceof AuthenticationError) throw e;
+      code = result;
+    }
+    if (!code) {
+      throw new AuthenticationError("No authorization code received");
+    }
+    if (returnedState !== null && returnedState !== state) {
+      throw new AuthenticationError("State mismatch \u2014 possible CSRF attack");
+    }
+    const response = await this.fetchFn(oidc.token_endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: this.clientId,
+        code,
+        redirect_uri: this.redirectUri,
+        code_verifier: codeVerifier
+      }).toString()
+    });
+    if (!response.ok) {
+      const body = await response.text().catch(() => "");
+      throw new AuthenticationError(`Token exchange failed (${response.status}): ${body}`);
+    }
+    const data = parseTokenResponse(await response.json());
+    this.currentRefreshToken = data.refresh_token ?? null;
+    return {
+      accessToken: data.access_token,
+      expiresAt: computeExpiresAt(data.expires_in),
+      refreshToken: data.refresh_token
+    };
+  }
+  /**
+   * Try to exchange the stored refresh token for a new access token. Returns the
+   * token on success, `null` when the refresh token is definitively rejected
+   * (a 4xx — caller should re-authenticate), and throws on transient failures.
+   */
+  async tryRefresh(tokenEndpoint, refreshToken) {
+    const response = await this.fetchFn(tokenEndpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: this.clientId,
+        refresh_token: refreshToken
+      }).toString()
+    });
+    if (!response.ok) {
+      if (response.status >= 400 && response.status < 500) return null;
+      const body = await response.text().catch(() => "");
+      throw new AuthenticationError(`Token refresh failed (${response.status}): ${body}`);
+    }
+    const data = parseTokenResponse(await response.json());
+    if (data.refresh_token) {
+      this.currentRefreshToken = data.refresh_token;
+    }
+    return {
+      accessToken: data.access_token,
+      expiresAt: computeExpiresAt(data.expires_in),
+      refreshToken: data.refresh_token ?? this.currentRefreshToken ?? void 0
+    };
+  }
+};
+var OAuth2RefreshTokenProvider = class {
+  constructor(clientId, refreshToken, issuerUrl, fetchFn) {
+    this.clientId = clientId;
+    this.issuerUrl = issuerUrl;
+    this.fetchFn = fetchFn;
+    this.currentRefreshToken = refreshToken;
+  }
+  clientId;
+  issuerUrl;
+  fetchFn;
+  type = "oauth2-refresh-token";
+  currentRefreshToken;
+  async getToken() {
+    const oidc = await discoverOidc(this.issuerUrl, this.fetchFn);
+    if (!oidc.token_endpoint) {
+      throw new AuthenticationError("OIDC discovery returned no token endpoint");
+    }
+    const response = await this.fetchFn(oidc.token_endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: this.clientId,
+        refresh_token: this.currentRefreshToken
+      }).toString()
+    });
+    if (!response.ok) {
+      const body = await response.text().catch(() => "");
+      if (response.status === 400) {
+        throw new AuthenticationError("Refresh token is invalid or expired. Please re-authenticate.");
+      }
+      throw new AuthenticationError(`Token refresh failed (${response.status}): ${body}`);
+    }
+    const data = parseTokenResponse(await response.json());
+    if (data.refresh_token) {
+      this.currentRefreshToken = data.refresh_token;
+    }
+    return {
+      accessToken: data.access_token,
+      expiresAt: computeExpiresAt(data.expires_in),
+      refreshToken: data.refresh_token ?? this.currentRefreshToken
+    };
+  }
+};
+var BearerTokenProvider = class {
+  constructor(token) {
+    this.token = token;
+  }
+  token;
+  type = "bearer";
+  getToken() {
+    return Promise.resolve({ accessToken: this.token, expiresAt: null });
+  }
+};
+var DEFAULT_IDP_ISSUER_URL = "https://idp.gigadrive.de";
+var DEFAULT_BASE_URL = "https://api.gigadrive.network";
+var resolveCredentialProvider = (config) => {
+  const fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
+  const baseUrl = config.baseUrl ?? readEnv("GIGADRIVE_API_BASE_URL") ?? DEFAULT_BASE_URL;
+  const idpIssuerUrl = config.idpIssuerUrl ?? readEnv("GIGADRIVE_IDP_ISSUER_URL") ?? DEFAULT_IDP_ISSUER_URL;
+  const tokenUrl = `${baseUrl}/oauth2/token`;
+  if (config.bearerToken) {
+    return new BearerTokenProvider(config.bearerToken);
+  }
+  if (config.clientId && config.clientSecret) {
+    return new OAuth2ClientCredentialProvider(config.clientId, config.clientSecret, tokenUrl, fetchFn);
+  }
+  if (config.refreshToken && config.clientId) {
+    return new OAuth2RefreshTokenProvider(config.clientId, config.refreshToken, idpIssuerUrl, fetchFn);
+  }
+  if (config.onAuthorizationUrl && config.clientId) {
+    const redirectUri = config.redirectUri ?? "urn:ietf:wg:oauth:2.0:oob";
+    const scope = config.scopes && config.scopes.length > 0 ? config.scopes.join(" ") : DEFAULT_SCOPE;
+    return new OAuth2AuthorizationCodeProvider(
+      config.clientId,
+      idpIssuerUrl,
+      redirectUri,
+      config.onAuthorizationUrl,
+      fetchFn,
+      scope
+    );
+  }
+  const envBearerToken = readEnv("GIGADRIVE_BEARER_TOKEN");
+  if (envBearerToken) {
+    return new BearerTokenProvider(envBearerToken);
+  }
+  const envClientId = readEnv("GIGADRIVE_CLIENT_ID");
+  const envClientSecret = readEnv("GIGADRIVE_CLIENT_SECRET");
+  if (envClientId && envClientSecret) {
+    return new OAuth2ClientCredentialProvider(envClientId, envClientSecret, tokenUrl, fetchFn);
+  }
+  const envRefreshToken = readEnv("GIGADRIVE_REFRESH_TOKEN");
+  if (envRefreshToken && envClientId) {
+    return new OAuth2RefreshTokenProvider(envClientId, envRefreshToken, idpIssuerUrl, fetchFn);
+  }
+  throw new AuthenticationError(
+    "No credentials provided. Set one of:\n  - GIGADRIVE_BEARER_TOKEN\n  - GIGADRIVE_CLIENT_ID + GIGADRIVE_CLIENT_SECRET\n  - GIGADRIVE_REFRESH_TOKEN + GIGADRIVE_CLIENT_ID\nOr pass credentials directly to the GigadriveClient constructor."
+  );
+};
+
+// src/auth/token-manager.ts
+var TokenManager = class {
+  constructor(provider) {
+    this.provider = provider;
+  }
+  provider;
+  cachedToken = null;
+  expiresAt = null;
+  pendingRefresh = null;
+  /**
+   * Returns a valid access token. Uses the cached token if still valid,
+   * otherwise fetches a new one from the credential provider.
+   *
+   * Concurrent calls are deduplicated — only one refresh runs at a time.
+   */
+  async getToken() {
+    if (this.cachedToken && (this.expiresAt === null || Date.now() < this.expiresAt)) {
+      return this.cachedToken;
+    }
+    if (this.pendingRefresh) {
+      return this.pendingRefresh;
+    }
+    this.pendingRefresh = this.refresh();
+    try {
+      return await this.pendingRefresh;
+    } finally {
+      this.pendingRefresh = null;
+    }
+  }
+  /**
+   * Invalidates the cached token. The next `getToken()` call will trigger a refresh.
+   */
+  invalidate() {
+    this.cachedToken = null;
+    this.expiresAt = null;
+  }
+  async refresh() {
+    const result = await this.provider.getToken();
+    this.cachedToken = result.accessToken;
+    this.expiresAt = result.expiresAt;
+    return result.accessToken;
+  }
+};
+
+// src/http-client.ts
+var isRawBody = (body) => typeof body === "string" || body instanceof ArrayBuffer || typeof Uint8Array !== "undefined" && body instanceof Uint8Array || typeof Blob !== "undefined" && body instanceof Blob || typeof FormData !== "undefined" && body instanceof FormData || typeof ReadableStream !== "undefined" && body instanceof ReadableStream;
+var hasHeader = (headers, name) => Object.keys(headers).some((key) => key.toLowerCase() === name.toLowerCase());
+var HttpClient = class {
+  constructor(baseUrl, tokenManager, fetchFn) {
+    this.baseUrl = baseUrl;
+    this.tokenManager = tokenManager;
+    this.fetchFn = fetchFn;
+  }
+  baseUrl;
+  tokenManager;
+  fetchFn;
+  /** @internal */
+  async get(path, options) {
+    return this.request("GET", path, options);
+  }
+  /** @internal */
+  async post(path, body, options) {
+    return this.request("POST", path, { body, ...options });
+  }
+  /** @internal */
+  async put(path, body, options) {
+    return this.request("PUT", path, { body, ...options });
+  }
+  /** @internal */
+  async patch(path, body, options) {
+    return this.request("PATCH", path, { body, ...options });
+  }
+  /** @internal */
+  async delete(path, options) {
+    return this.request("DELETE", path, options);
+  }
+  /** @internal */
+  async postRaw(path, body, headers) {
+    return this.request("POST", path, { body, headers });
+  }
+  /**
+   * Make an authenticated request and return the raw `Response` without parsing
+   * the body. Used for streamed (SSE) and binary responses.
+   *
+   * @throws {@link ApiError} if the response status is not OK.
+   * @internal
+   */
+  async requestStream(method, path, options) {
+    const response = await this.fetchWithAuth(method, path, options);
+    if (!response.ok) {
+      throw await this.toApiError(response);
+    }
+    return response;
+  }
+  /**
+   * Make a raw fetch request to an arbitrary URL (e.g. presigned upload URLs
+   * or resumable upload endpoints). No auth header is injected and the base URL
+   * is not prepended.
+   *
+   * @param url - The full URL to fetch.
+   * @param init - Standard `RequestInit` options.
+   * @returns The raw `Response` object.
+   * @throws {@link ApiError} if the response status is not OK.
+   *
+   * @internal
+   */
+  async fetchRaw(url, init) {
+    const response = await this.fetchFn(url, init);
+    if (!response.ok) {
+      throw new ApiError(response.statusText, response.status);
+    }
+    return response;
+  }
+  async request(method, path, options) {
+    const response = await this.fetchWithAuth(method, path, options);
+    return this.handleResponse(response);
+  }
+  /** Perform the request with auth injection and a single 401 refresh-retry. */
+  async fetchWithAuth(method, path, options) {
+    const url = this.buildUrl(path, options?.query);
+    const token = await this.tokenManager.getToken();
+    const headers = {
+      Authorization: `Bearer ${token}`,
+      ...options?.headers
+    };
+    let requestBody = null;
+    if (options?.body !== void 0) {
+      if (isRawBody(options.body)) {
+        requestBody = options.body;
+      } else {
+        requestBody = JSON.stringify(options.body);
+        if (!hasHeader(headers, "Content-Type")) {
+          headers["Content-Type"] = "application/json";
+        }
+      }
+    }
+    const signal = options?.signal;
+    const response = await this.fetchFn(url, { method, headers, body: requestBody, signal });
+    const bodyIsOneShot = typeof ReadableStream !== "undefined" && requestBody instanceof ReadableStream;
+    if (response.status === 401 && !bodyIsOneShot) {
+      this.tokenManager.invalidate();
+      const retryToken = await this.tokenManager.getToken();
+      headers.Authorization = `Bearer ${retryToken}`;
+      const retryResponse = await this.fetchFn(url, { method, headers, body: requestBody, signal });
+      if (retryResponse.status === 401) {
+        throw new AuthenticationError("Authentication failed after token refresh");
+      }
+      return retryResponse;
+    }
+    return response;
+  }
+  async handleResponse(response) {
+    if (response.ok) {
+      if (response.status === 204) {
+        return void 0;
+      }
+      const text = await response.text();
+      if (!text) {
+        return void 0;
+      }
+      return JSON.parse(text);
+    }
+    throw await this.toApiError(response);
+  }
+  async toApiError(response) {
+    let message;
+    let code;
+    try {
+      const body = await response.json();
+      if (typeof body.error === "string") {
+        message = body.error;
+      } else if (body.error && typeof body.error === "object") {
+        message = body.error.message ?? response.statusText;
+        code = body.error.code;
+      } else {
+        message = response.statusText;
+      }
+    } catch {
+      message = response.statusText;
+    }
+    return new ApiError(message, response.status, code);
+  }
+  buildUrl(path, query) {
+    const url = `${this.baseUrl}${path}`;
+    if (!query) return url;
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(query)) {
+      if (value !== void 0) {
+        params.set(key, String(value));
+      }
+    }
+    const qs = params.toString();
+    return qs ? `${url}?${qs}` : url;
+  }
+};
+
+// src/streaming.ts
+var extractData = (rawEvent) => {
+  const dataLines = rawEvent.split("\n").filter((line) => line.startsWith("data:")).map((line) => line.slice("data:".length).replace(/^ /, ""));
+  if (dataLines.length === 0) return null;
+  const joined = dataLines.join("\n");
+  return joined.trim().length === 0 ? null : joined;
+};
+var parseEvent = (data) => {
+  try {
+    return JSON.parse(data);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Failed to parse streamed SSE data as JSON: ${message}`);
+  }
+};
+async function* parseSSEStream(response) {
+  const body = response.body;
+  if (!body) {
+    throw new Error("The response has no readable body to stream.");
+  }
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  const drain = function* (flush) {
+    let separator = buffer.indexOf("\n\n");
+    while (separator !== -1) {
+      const rawEvent = buffer.slice(0, separator);
+      buffer = buffer.slice(separator + 2);
+      const data = extractData(rawEvent);
+      if (data !== null && data !== "[DONE]") {
+        yield parseEvent(data);
+      }
+      separator = buffer.indexOf("\n\n");
+    }
+    if (flush) {
+      const data = extractData(buffer);
+      buffer = "";
+      if (data !== null && data !== "[DONE]") {
+        yield parseEvent(data);
+      }
+    }
+  };
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buffer = (buffer + decoder.decode(value, { stream: true })).replace(/\r\n/g, "\n");
+      yield* drain(false);
+    }
+    yield* drain(true);
+  } finally {
+    await reader.cancel().catch(() => void 0);
+  }
+}
+
+// src/resources/base-resource.ts
+var BaseResource = class {
+  constructor(httpClient) {
+    this.httpClient = httpClient;
+  }
+  httpClient;
+};
+
+// src/resources/ai-gateway/index.ts
+var BASE = "/ai/v1";
+var toBlob = (file) => {
+  if (file instanceof Uint8Array) return new Blob([file]);
+  if (typeof Blob !== "undefined" && file instanceof Blob) return file;
+  return new Blob([new Uint8Array(file)]);
+};
+var AiGatewayAudioResource = class extends BaseResource {
+  /**
+   * Synthesize speech from text. Returns the raw audio bytes.
+   *
+   * @returns The audio content as an `ArrayBuffer` (format per `response_format`).
+   */
+  async speech(data, options) {
+    const response = await this.httpClient.requestStream("POST", `${BASE}/audio/speech`, {
+      body: data,
+      headers: options?.headers
+    });
+    return response.arrayBuffer();
+  }
+  /**
+   * Transcribe an audio file to text. The file is sent as multipart form data.
+   */
+  async transcriptions(data, options) {
+    const form = new FormData();
+    const { file, filename, ...rest } = data;
+    form.set("file", toBlob(file), filename ?? "audio");
+    for (const [key, value] of Object.entries(rest)) {
+      if (value === void 0 || value === null) continue;
+      form.set(key, typeof value === "object" ? JSON.stringify(value) : String(value));
+    }
+    return this.httpClient.postRaw(`${BASE}/audio/transcriptions`, form, options?.headers);
+  }
+};
+var AiGatewayVideosResource = class extends BaseResource {
+  /** Generate a video from a prompt. */
+  async generations(data, options) {
+    return this.httpClient.post(`${BASE}/videos`, data, { headers: options?.headers });
+  }
+  /** List the video models available through the gateway. */
+  async listModels() {
+    return this.httpClient.get(`${BASE}/videos/models`);
+  }
+};
+var AiGatewayResource = class extends BaseResource {
+  /** Text-to-speech and speech-to-text. */
+  audio;
+  /** Video generation. */
+  videos;
+  constructor(httpClient) {
+    super(httpClient);
+    this.audio = new AiGatewayAudioResource(httpClient);
+    this.videos = new AiGatewayVideosResource(httpClient);
+  }
+  /**
+   * Create a chat completion using the OpenAI-compatible endpoint.
+   *
+   * @param data - The chat completion request (model, messages, options, provider routing).
+   * @param options - Custom headers (e.g. `X-Gigadrive-Application-Id`).
+   */
+  async chatCompletions(data, options) {
+    return this.httpClient.post(`${BASE}/chat/completions`, { ...data, stream: false }, { headers: options?.headers });
+  }
+  /**
+   * Like {@link chatCompletions}, but also returns the raw response and the
+   * gateway request-id / cost headers.
+   */
+  async chatCompletionsWithResponse(data, options) {
+    const response = await this.httpClient.requestStream("POST", `${BASE}/chat/completions`, {
+      body: { ...data, stream: false },
+      headers: options?.headers
+    });
+    const body = await response.json();
+    const cost = response.headers.get("X-Gigadrive-Cost-Micros");
+    const costMicros = cost !== null ? Number(cost) : NaN;
+    return {
+      data: body,
+      response,
+      requestId: response.headers.get("X-Gigadrive-Request-Id") ?? void 0,
+      costMicros: Number.isFinite(costMicros) ? costMicros : void 0
+    };
+  }
+  /**
+   * Stream a chat completion as Server-Sent Events. Yields each chunk as it
+   * arrives and ends when the gateway closes the stream.
+   */
+  async *chatCompletionsStream(data, options) {
+    const response = await this.httpClient.requestStream("POST", `${BASE}/chat/completions`, {
+      body: { ...data, stream: true },
+      headers: options?.headers
+    });
+    yield* parseSSEStream(response);
+  }
+  /**
+   * Create a response using the Open Responses-compatible endpoint.
+   */
+  async responses(data, options) {
+    return this.httpClient.post(`${BASE}/responses`, { ...data, stream: false }, { headers: options?.headers });
+  }
+  /**
+   * Stream a response using the Open Responses-compatible endpoint.
+   */
+  async *responsesStream(data, options) {
+    const response = await this.httpClient.requestStream("POST", `${BASE}/responses`, {
+      body: { ...data, stream: true },
+      headers: options?.headers
+    });
+    yield* parseSSEStream(response);
+  }
+  /**
+   * List all AI models available through the gateway.
+   */
+  async listModels() {
+    return this.httpClient.get(`${BASE}/models`);
+  }
+  /**
+   * Get details for a specific AI model by its ID.
+   *
+   * @param modelId - The model identifier (e.g. `"openai/gpt-4o"`).
+   */
+  async getModel(modelId) {
+    return this.httpClient.get(`${BASE}/models/${encodeURIComponent(modelId)}`);
+  }
+};
+
+// src/resources/application-env-vars.ts
+var ApplicationEnvVarsResource = class extends BaseResource {
+  /**
+   * List all environment variables for an application.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @returns A paginated list of environment variables.
+   *
+   * @example
+   * ```ts
+   * const { items } = await client.applications.envVars.list('app-id');
+   * for (const v of items) {
+   *   console.log(`${v.key}=${v.sensitive ? '***' : v.value}`);
+   * }
+   * ```
+   */
+  async list(applicationId, query) {
+    return this.httpClient.get(`/applications/${applicationId}/env-vars`, {
+      query
+    });
+  }
+  /**
+   * Create a new environment variable for an application.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param data - The variable key, value, and optional settings.
+   * @returns The newly created environment variable.
+   *
+   * @example
+   * ```ts
+   * const envVar = await client.applications.envVars.create('app-id', {
+   *   key: 'DATABASE_URL',
+   *   value: 'postgres://...',
+   *   sensitive: true,
+   * });
+   * ```
+   */
+  async create(applicationId, data) {
+    return this.httpClient.post(`/applications/${applicationId}/env-vars`, data);
+  }
+  /**
+   * Update an existing environment variable. Only the fields you provide
+   * will be changed; omitted fields are left unchanged.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param envVarId - The environment variable ID (UUID).
+   * @param data - The fields to update.
+   * @returns The updated environment variable.
+   *
+   * @example
+   * ```ts
+   * await client.applications.envVars.update('app-id', 'var-id', {
+   *   value: 'postgres://new-host/db',
+   * });
+   * ```
+   */
+  async update(applicationId, envVarId, data) {
+    return this.httpClient.patch(`/applications/${applicationId}/env-vars/${envVarId}`, data);
+  }
+  /**
+   * Permanently delete an environment variable.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param envVarId - The environment variable ID (UUID).
+   *
+   * @example
+   * ```ts
+   * await client.applications.envVars.delete('app-id', 'var-id');
+   * ```
+   */
+  async delete(applicationId, envVarId) {
+    return this.httpClient.delete(`/applications/${applicationId}/env-vars/${envVarId}`);
+  }
+};
+
+// src/resources/application-requests.ts
+var ApplicationRequestsResource = class extends BaseResource {
+  /**
+   * List requests for an application, with rich filtering and cursor pagination.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param query - Optional filters and pagination.
+   * @returns A page of request summaries.
+   */
+  async list(applicationId, query) {
+    return this.httpClient.get(`/applications/${applicationId}/requests`, {
+      query
+    });
+  }
+  /**
+   * Get a single request by ID, including sanitized request/response headers.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param requestId - The request record ID (UUID).
+   * @returns The full request record.
+   */
+  async get(applicationId, requestId) {
+    return this.httpClient.get(`/applications/${applicationId}/requests/${requestId}`);
+  }
+};
+
+// src/upload/checksum.ts
+var toHex = (buffer) => {
+  const bytes = new Uint8Array(buffer);
+  let hex = "";
+  for (let i = 0; i < bytes.length; i++) {
+    hex += bytes[i].toString(16).padStart(2, "0");
+  }
+  return hex;
+};
+var subtleDigest = async (algorithm, bytes) => toHex(await crypto.subtle.digest(algorithm, bytes));
+var importNodeCrypto = async () => {
+  if (typeof process === "undefined" || !process.versions?.node) return null;
+  try {
+    return await import("crypto");
+  } catch {
+    return null;
+  }
+};
+var md5Hex = async (bytes) => {
+  const nodeCrypto = await importNodeCrypto();
+  if (!nodeCrypto) {
+    throw new Error("MD5 checksums are only supported in Node.js. Provide checksumMd5 explicitly in the browser.");
+  }
+  return nodeCrypto.createHash("md5").update(bytes).digest("hex");
+};
+var computeChecksums = async (bytes, request = {}) => {
+  const checksums = { sha256: await subtleDigest("SHA-256", bytes) };
+  if (request.sha1) checksums.sha1 = await subtleDigest("SHA-1", bytes);
+  if (request.md5) checksums.md5 = await md5Hex(bytes);
+  return checksums;
+};
+var hashNodeFile = async (path, request = {}) => {
+  const [fs, nodeCrypto] = await Promise.all([import("fs"), import("crypto")]);
+  const sha256 = nodeCrypto.createHash("sha256");
+  const sha1 = request.sha1 ? nodeCrypto.createHash("sha1") : null;
+  const md5 = request.md5 ? nodeCrypto.createHash("md5") : null;
+  await new Promise((resolve, reject) => {
+    const stream = fs.createReadStream(path);
+    stream.on("data", (chunk) => {
+      sha256.update(chunk);
+      sha1?.update(chunk);
+      md5?.update(chunk);
+    });
+    stream.on("end", () => resolve());
+    stream.on("error", reject);
+  });
+  const checksums = { sha256: sha256.digest("hex") };
+  if (sha1) checksums.sha1 = sha1.digest("hex");
+  if (md5) checksums.md5 = md5.digest("hex");
+  return checksums;
+};
+
+// src/upload/content-type.ts
+var MIME_TYPES = {
+  // Text & code
+  txt: "text/plain",
+  csv: "text/csv",
+  html: "text/html",
+  htm: "text/html",
+  css: "text/css",
+  js: "text/javascript",
+  mjs: "text/javascript",
+  json: "application/json",
+  xml: "application/xml",
+  md: "text/markdown",
+  // Images
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  svg: "image/svg+xml",
+  avif: "image/avif",
+  ico: "image/x-icon",
+  bmp: "image/bmp",
+  tiff: "image/tiff",
+  heic: "image/heic",
+  // Audio
+  mp3: "audio/mpeg",
+  wav: "audio/wav",
+  ogg: "audio/ogg",
+  oga: "audio/ogg",
+  flac: "audio/flac",
+  aac: "audio/aac",
+  m4a: "audio/mp4",
+  // Video
+  mp4: "video/mp4",
+  webm: "video/webm",
+  mov: "video/quicktime",
+  avi: "video/x-msvideo",
+  mkv: "video/x-matroska",
+  // Documents
+  pdf: "application/pdf",
+  doc: "application/msword",
+  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  xls: "application/vnd.ms-excel",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ppt: "application/vnd.ms-powerpoint",
+  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  // Archives & binaries
+  zip: "application/zip",
+  gz: "application/gzip",
+  tar: "application/x-tar",
+  br: "application/x-brotli",
+  wasm: "application/wasm",
+  // Fonts
+  woff: "font/woff",
+  woff2: "font/woff2",
+  ttf: "font/ttf",
+  otf: "font/otf"
+};
+var inferContentType = (nameOrKey) => {
+  const lastDot = nameOrKey.lastIndexOf(".");
+  if (lastDot === -1 || lastDot === nameOrKey.length - 1) return void 0;
+  const ext = nameOrKey.slice(lastDot + 1).toLowerCase();
+  return MIME_TYPES[ext];
+};
+
+// src/upload/source.ts
+var isNode = () => typeof process !== "undefined" && !!process.versions?.node;
+var toBytes = async (data) => {
+  if (typeof Blob !== "undefined" && data instanceof Blob) return new Uint8Array(await data.arrayBuffer());
+  if (data instanceof Uint8Array) return data;
+  if (data instanceof ArrayBuffer) return new Uint8Array(data);
+  throw new Error("Unsupported upload data type. Pass a File, Blob, Buffer, Uint8Array, or ArrayBuffer.");
+};
+var sizeOf = (data) => {
+  if (typeof Blob !== "undefined" && data instanceof Blob) return data.size;
+  if (data instanceof Uint8Array) return data.byteLength;
+  if (data instanceof ArrayBuffer) return data.byteLength;
+  throw new Error("Cannot determine upload size. Pass a File, Blob, Buffer, Uint8Array, or ArrayBuffer.");
+};
+var toTusFile = (data) => {
+  if (data instanceof Uint8Array) return isNode() ? data : new Blob([data]);
+  if (typeof Blob !== "undefined" && data instanceof Blob) return data;
+  const bytes = new Uint8Array(data);
+  return isNode() ? bytes : new Blob([bytes]);
+};
+var buildChecksums = (input, sha256) => {
+  const checksums = { sha256 };
+  if (input.checksumSha1) checksums.sha1 = input.checksumSha1;
+  if (input.checksumMd5) checksums.md5 = input.checksumMd5;
+  return checksums;
+};
+var resolveUploadSource = async (input, options = {}) => {
+  const sourceCount = [input.data !== void 0, input.path !== void 0, input.stream !== void 0].filter(
+    Boolean
+  ).length;
+  if (sourceCount > 1) {
+    throw new Error("Provide only one upload source: data, path, or stream.");
+  }
+  const hash = options.hash !== false;
+  const contentType = input.contentType ?? inferContentType(input.key);
+  if (input.data !== void 0) {
+    const size = input.contentLength ?? sizeOf(input.data);
+    const sha256 = input.checksumSha256 ?? (hash ? (await computeChecksums(await toBytes(input.data))).sha256 : "");
+    return {
+      tusFile: toTusFile(input.data),
+      size,
+      contentType,
+      checksums: buildChecksums(input, sha256),
+      requiresFiniteChunkSize: false
+    };
+  }
+  if (input.path !== void 0) {
+    if (!isNode()) throw new Error("Uploading from a file path is only supported in Node.js.");
+    const fs = await import("fs");
+    const size = input.contentLength ?? fs.statSync(input.path).size;
+    const sha256 = input.checksumSha256 ?? (hash ? (await hashNodeFile(input.path)).sha256 : "");
+    const tusFile = fs.createReadStream(input.path);
+    return { tusFile, size, contentType, checksums: buildChecksums(input, sha256), requiresFiniteChunkSize: true };
+  }
+  if (input.stream !== void 0) {
+    if (input.contentLength === void 0) {
+      throw new Error("Uploading from a stream requires contentLength to be provided.");
+    }
+    if (hash && !input.checksumSha256) {
+      throw new Error("Uploading from a stream requires checksumSha256 to be provided.");
+    }
+    return {
+      tusFile: input.stream,
+      size: input.contentLength,
+      contentType,
+      checksums: buildChecksums(input, input.checksumSha256 ?? ""),
+      requiresFiniteChunkSize: true
+    };
+  }
+  throw new Error("No upload source provided. Pass one of: data, path, or stream.");
+};
+
+// src/upload/transport.ts
+var tus = __toESM(require("tus-js-client"));
+var DEFAULT_STREAM_CHUNK_SIZE = 50 * 1024 * 1024;
+var DEFAULT_RETRY_DELAYS = [0, 1e3, 3e3, 5e3];
+var createAbortError = () => {
+  const error = new Error("The upload was aborted.");
+  error.name = "AbortError";
+  return error;
+};
+var tusUploadTransport = (params) => new Promise((resolve, reject) => {
+  if (params.signal?.aborted) {
+    reject(createAbortError());
+    return;
+  }
+  let settled = false;
+  const cleanup = () => {
+    if (params.signal) params.signal.removeEventListener("abort", onAbort);
+  };
+  const finish = (fn) => {
+    if (settled) return;
+    settled = true;
+    cleanup();
+    fn();
+  };
+  const upload = new tus.Upload(params.data, {
+    uploadUrl: params.uploadUrl,
+    uploadSize: params.uploadSize,
+    headers: params.headers,
+    chunkSize: params.chunkSize ?? Infinity,
+    retryDelays: params.retryDelays === void 0 ? DEFAULT_RETRY_DELAYS : params.retryDelays,
+    storeFingerprintForResuming: params.resume ?? false,
+    removeFingerprintOnSuccess: true,
+    ...params.urlStorage ? { urlStorage: params.urlStorage } : {},
+    onProgress: params.onProgress ?? null,
+    onError: (error) => finish(() => reject(error)),
+    onSuccess: () => finish(() => resolve())
+  });
+  const onAbort = () => {
+    void upload.abort();
+    finish(() => reject(createAbortError()));
+  };
+  if (params.signal) params.signal.addEventListener("abort", onAbort, { once: true });
+  upload.start();
+});
+var runResolvedUpload = (transport, uploadUrl, resolved, options = {}, headers = { "Tus-Resumable": "1.0.0" }) => transport({
+  data: resolved.tusFile,
+  uploadUrl,
+  uploadSize: resolved.size,
+  headers,
+  chunkSize: options.chunkSize ?? (resolved.requiresFiniteChunkSize ? DEFAULT_STREAM_CHUNK_SIZE : void 0),
+  retryDelays: options.retryDelays,
+  onProgress: options.onProgress,
+  signal: options.signal,
+  resume: options.resume,
+  urlStorage: options.urlStorage
+});
+var tusStatus = (error) => {
+  const response = error?.originalResponse;
+  return response ? response.getStatus() : void 0;
+};
+var toUploadError = (error) => {
+  if (error instanceof Error && error.name === "AbortError") throw error;
+  const status = tusStatus(error);
+  if (status === 401 || status === 403 || status === 410) {
+    throw new UploadSessionExpiredError(void 0, error);
+  }
+  throw new UploadError(error instanceof Error ? error.message : "The upload failed.", error);
+};
+
+// src/resources/storage-buckets.ts
+var StorageBucketsResource = class extends BaseResource {
+  /**
+   * List all storage buckets for an application.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param query - Optional pagination parameters.
+   * @returns A paginated list of storage buckets.
+   *
+   * @example
+   * ```ts
+   * const { items, total } = await client.applications.storage.buckets.list('app-id');
+   * console.log(`${total} buckets found`);
+   * ```
+   */
+  async list(applicationId, query) {
+    return this.httpClient.get(`/applications/${applicationId}/storage/buckets`, {
+      query
+    });
+  }
+  /**
+   * Create a new storage bucket.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param data - Bucket name, environment, and optional slug/visibility.
+   * @returns The newly created bucket.
+   *
+   * @example
+   * ```ts
+   * const bucket = await client.applications.storage.buckets.create('app-id', {
+   *   name: 'Assets',
+   *   environmentId: 'env-id',
+   *   visibility: 'public',
+   * });
+   * console.log(`Bucket CDN: https://${bucket.cdnHostname}`);
+   * ```
+   */
+  async create(applicationId, data) {
+    return this.httpClient.post(`/applications/${applicationId}/storage/buckets`, data);
+  }
+  /**
+   * Get a storage bucket by ID.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param bucketId - The bucket ID (UUID).
+   * @returns The bucket details.
+   *
+   * @example
+   * ```ts
+   * const bucket = await client.applications.storage.buckets.get('app-id', 'bucket-id');
+   * console.log(`${bucket.name} (${bucket.visibility})`);
+   * ```
+   */
+  async get(applicationId, bucketId) {
+    return this.httpClient.get(`/applications/${applicationId}/storage/buckets/${bucketId}`);
+  }
+  /**
+   * Permanently delete a storage bucket and all its objects.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param bucketId - The bucket ID (UUID).
+   *
+   * @example
+   * ```ts
+   * await client.applications.storage.buckets.delete('app-id', 'bucket-id');
+   * ```
+   */
+  async delete(applicationId, bucketId) {
+    return this.httpClient.delete(`/applications/${applicationId}/storage/buckets/${bucketId}`);
+  }
+};
+
+// src/resources/storage-objects.ts
+var StorageObjectsResource = class extends BaseResource {
+  /**
+   * List objects in a storage bucket, optionally filtered by key prefix and
+   * grouped into virtual folders by a delimiter.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param bucketId - The bucket ID (UUID).
+   * @param query - Optional prefix/delimiter/cursor/limit parameters.
+   * @returns A page of objects plus any common (folder) prefixes and a `nextCursor`.
+   *
+   * @example
+   * ```ts
+   * // List the "images/" folder, one level deep
+   * const { items, commonPrefixes, nextCursor } = await client.applications.storage.objects.list(
+   *   'app-id', 'bucket-id', { prefix: 'images/', limit: 100 },
+   * );
+   * ```
+   */
+  async list(applicationId, bucketId, query) {
+    return this.httpClient.get(`/applications/${applicationId}/storage/buckets/${bucketId}/objects`, {
+      query
+    });
+  }
+  /**
+   * Get metadata for a specific object by its object ID.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param bucketId - The bucket ID (UUID).
+   * @param objectId - The object ID (UUID) — not the object key. Use {@link getByKey} to resolve a key.
+   * @returns The object metadata.
+   *
+   * @example
+   * ```ts
+   * const obj = await client.applications.storage.objects.get('app-id', 'bucket-id', 'object-id');
+   * console.log(`${obj.key}: ${obj.contentLength} bytes, type: ${obj.contentType}`);
+   * ```
+   */
+  async get(applicationId, bucketId, objectId) {
+    return this.httpClient.get(`/applications/${applicationId}/storage/buckets/${bucketId}/objects/${objectId}`);
+  }
+  /**
+   * Resolve an object by its key (path) instead of its ID. Convenience over
+   * {@link list} — lists with the key as the prefix and returns the exact match,
+   * paging through results until found, or `null` if no object with that key
+   * exists. (The API has no get-by-key endpoint.)
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param bucketId - The bucket ID (UUID).
+   * @param key - The object key/path (e.g. `"images/photo.jpg"`).
+   * @returns The matching object, or `null` if not found.
+   */
+  async getByKey(applicationId, bucketId, key) {
+    let cursor;
+    do {
+      const page = await this.list(applicationId, bucketId, { prefix: key, delimiter: "", cursor });
+      const match = page.items.find((object) => object.key === key);
+      if (match) return match;
+      cursor = page.nextCursor;
+    } while (cursor);
+    return null;
+  }
+  /**
+   * Permanently delete an object from a storage bucket.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param bucketId - The bucket ID (UUID).
+   * @param objectId - The object ID (UUID) — not the object key.
+   *
+   * @example
+   * ```ts
+   * await client.applications.storage.objects.delete('app-id', 'bucket-id', 'object-id');
+   * ```
+   */
+  async delete(applicationId, bucketId, objectId) {
+    return this.httpClient.delete(`/applications/${applicationId}/storage/buckets/${bucketId}/objects/${objectId}`);
+  }
+  /**
+   * Get an access URL for a storage object. For objects in public buckets,
+   * returns a stable CDN URL. For private buckets, returns a time-limited
+   * signed URL.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param bucketId - The bucket ID (UUID).
+   * @param objectId - The object ID (UUID) — not the object key.
+   * @param options - Optional `expiresInSeconds` for signed URLs (60–86400).
+   * @returns The access URL and its type/expiry.
+   *
+   * @example
+   * ```ts
+   * const access = await client.applications.storage.objects.getAccessUrl('app-id', 'bucket-id', 'object-id', {
+   *   expiresInSeconds: 3600,
+   * });
+   * if (access.accessType === 'signed') {
+   *   console.log(`Signed URL expires at ${access.expiresAt}`);
+   * }
+   * console.log(`Download: ${access.url}`);
+   * ```
+   */
+  async getAccessUrl(applicationId, bucketId, objectId, options) {
+    return this.httpClient.get(
+      `/applications/${applicationId}/storage/buckets/${bucketId}/objects/${objectId}/access-url`,
+      { query: { expiresInSeconds: options?.expiresInSeconds } }
+    );
+  }
+};
+
+// src/resources/storage-upload-sessions.ts
+var StorageUploadSessionsResource = class extends BaseResource {
+  constructor(httpClient, transport = tusUploadTransport) {
+    super(httpClient);
+    this.transport = transport;
+  }
+  transport;
+  /**
+   * List upload sessions for a bucket.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param bucketId - The bucket ID (UUID).
+   * @param query - Optional pagination parameters.
+   * @returns A paginated list of upload sessions.
+   */
+  async list(applicationId, bucketId, query) {
+    return this.httpClient.get(`/applications/${applicationId}/storage/buckets/${bucketId}/uploads`, {
+      query
+    });
+  }
+  /**
+   * Create an upload session. Returns the session metadata and a signed upload
+   * URL for sending file data. This is the low-level method — for most use
+   * cases prefer `client.applications.storage.upload()` which also computes the
+   * required SHA-256 checksum for you.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param bucketId - The bucket ID (UUID).
+   * @param data - Object key, content length, SHA-256 checksum, and optional content type / extra checksums.
+   * @returns The session and resumable upload instructions (URL, method, headers).
+   */
+  async create(applicationId, bucketId, data) {
+    return this.httpClient.post(`/applications/${applicationId}/storage/buckets/${bucketId}/uploads`, data);
+  }
+  /**
+   * Get an upload session by ID. Use this to track server-side processing after
+   * an upload (poll until `state === 'completed'`).
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param bucketId - The bucket ID (UUID).
+   * @param sessionId - The upload session ID (UUID).
+   * @returns The current session state.
+   */
+  async get(applicationId, bucketId, sessionId) {
+    return this.httpClient.get(`/applications/${applicationId}/storage/buckets/${bucketId}/uploads/${sessionId}`);
+  }
+  /**
+   * Upload bytes directly to a pre-existing signed upload URL — for example, a
+   * URL returned by {@link create} or handed to your client by a backend. Skips
+   * session creation and checksum computation.
+   *
+   * @param url - A signed upload URL.
+   * @param source - The bytes to upload.
+   * @param options - Chunk size, retry config, progress, abort signal, resume,
+   *   and any required `headers` returned with the upload session.
+   * @throws {@link UploadError} if the upload fails after all retries.
+   */
+  async uploadToUrl(url, source, options) {
+    const resolved = await resolveUploadSource({ key: "", ...source }, { hash: false });
+    const headers = { "Tus-Resumable": "1.0.0", ...options?.headers };
+    await runResolvedUpload(this.transport, url, resolved, options, headers).catch(toUploadError);
+  }
+  /**
+   * Resume an interrupted upload to a previously issued signed upload URL. The
+   * resumable protocol negotiates the current offset and continues from there.
+   *
+   * @param url - The signed upload URL from the original {@link create} call.
+   * @param source - The full bytes to upload (the same content as the original).
+   * @param options - Chunk size, retry config, progress, abort signal.
+   */
+  async resumeFromUrl(url, source, options) {
+    return this.uploadToUrl(url, source, { ...options, resume: true });
+  }
+};
+
+// src/resources/application-storage.ts
+var delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var ApplicationStorageResource = class {
+  /** Create, list, get, and delete storage buckets. */
+  buckets;
+  /** List, get, delete objects, and generate access URLs. */
+  objects;
+  /** Low-level upload sessions and direct-to-URL byte uploads. */
+  uploadSessions;
+  transport;
+  constructor(httpClient, transport = tusUploadTransport) {
+    this.transport = transport;
+    this.buckets = new StorageBucketsResource(httpClient);
+    this.objects = new StorageObjectsResource(httpClient);
+    this.uploadSessions = new StorageUploadSessionsResource(httpClient, transport);
+  }
+  /**
+   * Upload a file to a storage bucket. Handles the full flow: computes the
+   * required SHA-256 checksum, creates an upload session, uploads the bytes with
+   * automatic retries (and optional progress/abort/resume), and returns the
+   * public URL.
+   *
+   * Accepts browser `File`/`Blob`, Node `Buffer`/`Uint8Array`/`ArrayBuffer`, a
+   * Node filesystem `path`, or a Node readable `stream` (with `contentLength`
+   * and `checksumSha256`). The content type is inferred from `key` when omitted.
+   *
+   * @param input - What and where to upload, plus optional transfer options.
+   * @returns The upload session and public object URL (and the finalized object when `waitForCompletion` is set).
+   * @throws {@link UploadError} if the byte upload fails.
+   * @throws {@link UploadSessionExpiredError} if the session expires mid-upload.
+   *
+   * @example
+   * ```ts
+   * const { session, url, object } = await client.applications.storage.upload({
+   *   applicationId, bucketId, key: 'reports/q1.pdf', path: './q1.pdf',
+   *   waitForCompletion: true,
+   * });
+   * console.log(object?.contentLength, 'bytes available at', url);
+   * ```
+   */
+  async upload(input) {
+    const resolved = await resolveUploadSource({
+      key: input.key,
+      data: input.data,
+      path: input.path,
+      stream: input.stream,
+      contentType: input.contentType,
+      contentLength: input.contentLength,
+      checksumSha256: input.checksumSha256,
+      checksumSha1: input.checksumSha1,
+      checksumMd5: input.checksumMd5
+    });
+    const { session, upload } = await this.uploadSessions.create(input.applicationId, input.bucketId, {
+      key: input.key,
+      contentLength: resolved.size,
+      checksumSha256: resolved.checksums.sha256,
+      contentType: resolved.contentType,
+      checksumSha1: resolved.checksums.sha1,
+      checksumMd5: resolved.checksums.md5
+    });
+    await runResolvedUpload(
+      this.transport,
+      upload.url,
+      resolved,
+      {
+        chunkSize: input.chunkSize,
+        retryDelays: input.retryDelays,
+        onProgress: input.onProgress,
+        signal: input.signal,
+        resume: input.resume,
+        urlStorage: input.urlStorage
+      },
+      // Forward any required headers the API issued with the session.
+      { "Tus-Resumable": "1.0.0", ...upload.headers }
+    ).catch(toUploadError);
+    if (input.waitForCompletion) {
+      const options = typeof input.waitForCompletion === "object" ? input.waitForCompletion : void 0;
+      const completed = await this.waitForCompletion(input.applicationId, input.bucketId, session.id, options);
+      const object = await this.objects.getByKey(input.applicationId, input.bucketId, input.key) ?? void 0;
+      return { session: completed, url: upload.publicObjectUrl, object };
+    }
+    return { session, url: upload.publicObjectUrl };
+  }
+  /**
+   * Upload many files concurrently. Each file is uploaded independently; a
+   * failure for one file does not abort the others — inspect each item's
+   * `error`/`result`.
+   *
+   * @param inputs - The files to upload.
+   * @param options - Concurrency limit and an aggregated progress callback.
+   * @returns One result per input, in the same order.
+   *
+   * @example
+   * ```ts
+   * const results = await client.applications.storage.uploadBatch(
+   *   files.map((f) => ({ applicationId, bucketId, key: `uploads/${f.name}`, data: f })),
+   *   { concurrency: 6, onProgress: (done, total) => console.log(`${done}/${total}`) },
+   * );
+   * const failed = results.filter((r) => r.error);
+   * ```
+   */
+  async uploadBatch(inputs, options) {
+    const concurrency = Math.max(1, options?.concurrency ?? 4);
+    const results = new Array(inputs.length);
+    let completed = 0;
+    let next = 0;
+    const worker = async () => {
+      for (; ; ) {
+        const index = next++;
+        if (index >= inputs.length) return;
+        try {
+          results[index] = { input: inputs[index], result: await this.upload(inputs[index]) };
+        } catch (error) {
+          results[index] = { input: inputs[index], error };
+        }
+        completed++;
+        options?.onProgress?.(completed, inputs.length);
+      }
+    };
+    await Promise.all(Array.from({ length: Math.min(concurrency, inputs.length) }, () => worker()));
+    return results;
+  }
+  /**
+   * Poll an upload session until the object is finalized server-side.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param bucketId - The bucket ID (UUID).
+   * @param sessionId - The upload session ID (UUID).
+   * @param options - Timeout and polling interval.
+   * @returns The completed session.
+   * @throws {@link UploadError} if the session fails, expires, or the timeout elapses.
+   */
+  async waitForCompletion(applicationId, bucketId, sessionId, options) {
+    const timeoutMs = options?.timeoutMs ?? 6e4;
+    const pollIntervalMs = options?.pollIntervalMs ?? 1e3;
+    const deadline = Date.now() + timeoutMs;
+    for (; ; ) {
+      const session = await this.uploadSessions.get(applicationId, bucketId, sessionId);
+      if (session.state === "completed") return session;
+      if (session.state === "failed" || session.state === "expired") {
+        throw new UploadError(`Upload session ${session.state}.`);
+      }
+      if (Date.now() >= deadline) {
+        throw new UploadError("Timed out waiting for the upload to complete.");
+      }
+      await delay(pollIntervalMs);
+    }
+  }
+};
+
+// src/resources/applications.ts
+var ApplicationsResource = class extends BaseResource {
+  /**
+   * Manage environment variables scoped to an application.
+   *
+   * @example
+   * ```ts
+   * await client.applications.envVars.create('app-id', {
+   *   key: 'DATABASE_URL',
+   *   value: 'postgres://...',
+   *   sensitive: true,
+   * });
+   * ```
+   */
+  envVars;
+  /**
+   * Manage storage buckets, objects, and file uploads for an application.
+   *
+   * @example
+   * ```ts
+   * // Upload a file
+   * const { url } = await client.applications.storage.upload({
+   *   applicationId: 'app-id',
+   *   bucketId: 'bucket-id',
+   *   key: 'images/logo.png',
+   *   data: fileData,
+   * });
+   *
+   * // List objects in a bucket
+   * const { items } = await client.applications.storage.objects.list('app-id', 'bucket-id');
+   * ```
+   */
+  storage;
+  /**
+   * Read observed traffic (request logs) for an application.
+   *
+   * @example
+   * ```ts
+   * const { items } = await client.applications.requests.list('app-id', { statusFamily: 5 });
+   * ```
+   */
+  requests;
+  constructor(...args) {
+    super(...args);
+    this.envVars = new ApplicationEnvVarsResource(this.httpClient);
+    this.storage = new ApplicationStorageResource(this.httpClient);
+    this.requests = new ApplicationRequestsResource(this.httpClient);
+  }
+  /**
+   * List applications the authenticated actor has access to.
+   *
+   * Requires the `network:applications:read` scope.
+   *
+   * @param query - Optional organization filter and pagination.
+   * @returns A paginated list of applications.
+   *
+   * @example
+   * ```ts
+   * const { items, total } = await client.applications.list({ organizationId: 'org-id' });
+   * console.log(`Found ${total} applications`);
+   * ```
+   */
+  async list(query) {
+    return this.httpClient.get("/applications", {
+      query
+    });
+  }
+  /**
+   * List the `*.gigadrive.app` hostnames for an application (production alias
+   * and per-branch aliases).
+   *
+   * @param applicationId - The application ID (UUID).
+   * @returns The hostnames plus the production hostname `label`.
+   *
+   * @example
+   * ```ts
+   * const { items, label } = await client.applications.hostnames('app-id');
+   * console.log(`Production: ${label}.gigadrive.app`);
+   * ```
+   */
+  async hostnames(applicationId) {
+    return this.httpClient.get(`/applications/${applicationId}/hostnames`);
+  }
+  /**
+   * Check whether a candidate production hostname label is allowed and globally
+   * available before setting it with {@link setProductionHostname}.
+   *
+   * Requires the `network:applications:read` scope.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param label - The candidate production hostname label (e.g. `"my-app"`).
+   * @returns Whether the label is available, plus a `reason` when it is not.
+   *
+   * @example
+   * ```ts
+   * const { available, reason } = await client.applications.checkHostnameAvailability('app-id', 'my-app');
+   * if (!available) console.log(`Unavailable: ${reason}`);
+   * ```
+   */
+  async checkHostnameAvailability(applicationId, label) {
+    return this.httpClient.get(`/applications/${applicationId}/hostname/availability`, {
+      query: { label }
+    });
+  }
+  /**
+   * Set the application's production hostname. The production alias
+   * `{label}.gigadrive.app` is re-pointed to the latest production deployment.
+   *
+   * Requires the `network:applications:write` scope. Deployment- and
+   * function-scoped tokens cannot change the production hostname.
+   *
+   * @param applicationId - The application ID (UUID).
+   * @param label - The production hostname label (e.g. `"my-app"`). It is
+   *   normalized (slugified) server-side.
+   * @returns The saved label, the resulting hostname, and whether it is live yet.
+   *
+   * @example
+   * ```ts
+   * const { hostname, live } = await client.applications.setProductionHostname('app-id', 'my-app');
+   * console.log(live ? `Live at ${hostname}` : `Reserved ${hostname} (deploy to go live)`);
+   * ```
+   */
+  async setProductionHostname(applicationId, label) {
+    return this.httpClient.put(`/applications/${applicationId}/hostname`, { label });
+  }
+};
+
+// src/resources/deployments.ts
+var DeploymentsResource = class extends BaseResource {
+  /**
+   * List deployments, optionally filtered by organization, application, or status.
+   *
+   * Requires the `network:deployments:read` scope.
+   *
+   * @param query - Optional filters.
+   * @returns A paginated list of deployments.
+   *
+   * @example
+   * ```ts
+   * // All deployments for an application
+   * const { items } = await client.deployments.list({ applicationId: 'app-id' });
+   *
+   * // Only active deployments
+   * const { items } = await client.deployments.list({ status: 'ACTIVE' });
+   * ```
+   */
+  async list(query) {
+    return this.httpClient.get("/deployments", {
+      query
+    });
+  }
+  /**
+   * Get a deployment by ID, including its current status.
+   *
+   * @param deploymentId - The deployment ID (UUID).
+   * @returns The deployment with its current status.
+   *
+   * @example
+   * ```ts
+   * const deployment = await client.deployments.get('deployment-id');
+   * if (deployment.status === 'ACTIVE') {
+   *   console.log('Deployment is live!');
+   * }
+   * ```
+   */
+  async get(deploymentId) {
+    return this.httpClient.get(`/deployments/${deploymentId}`);
+  }
+  /**
+   * Create a new deployment. The deployment starts in `"PENDING"` status,
+   * waiting for artifact upload. Use the multipart upload methods
+   * ({@link startUpload}, {@link getPresignedUrl}, {@link uploadPart},
+   * {@link completeUpload}) to upload build artifacts.
+   *
+   * Requires the `network:deployments:trigger` scope.
+   *
+   * @param data - The application ID and optional git source.
+   * @returns The newly created deployment.
+   *
+   * @example
+   * ```ts
+   * const deployment = await client.deployments.create({
+   *   applicationId: 'app-id',
+   * });
+   * console.log(`Created deployment ${deployment.id} (${deployment.status})`);
+   * ```
+   */
+  async create(data) {
+    return this.httpClient.post("/deployments", data);
+  }
+  /**
+   * Start a multipart upload for deployment artifacts. This initiates a new
+   * multipart upload and returns an upload ID for subsequent part uploads.
+   *
+   * The deployment must be in `"PENDING"` status.
+   *
+   * @param deploymentId - The deployment ID (UUID).
+   * @returns An object containing the `uploadId` for subsequent calls.
+   *
+   * @example
+   * ```ts
+   * const { uploadId } = await client.deployments.startUpload('deployment-id');
+   * ```
+   */
+  async startUpload(deploymentId) {
+    return this.httpClient.post(`/deployments/${deploymentId}/upload/start`);
+  }
+  /**
+   * Get a presigned URL for uploading a single part of a multipart upload.
+   * The URL is temporary and should be used immediately with {@link uploadPart}.
+   *
+   * @param deploymentId - The deployment ID (UUID).
+   * @param uploadId - The multipart upload ID from {@link startUpload}.
+   * @param partNumber - The 1-based part number.
+   * @returns An object containing the presigned `url` to PUT the part data to.
+   *
+   * @example
+   * ```ts
+   * const { url } = await client.deployments.getPresignedUrl(
+   *   'deployment-id', uploadId, 1,
+   * );
+   * ```
+   */
+  async getPresignedUrl(deploymentId, uploadId, partNumber) {
+    if (!Number.isInteger(partNumber) || partNumber < 1) {
+      throw new Error(`partNumber must be a positive integer, received ${partNumber}`);
+    }
+    return this.httpClient.post(`/deployments/${deploymentId}/upload/part`, { uploadId, partNumber });
+  }
+  /**
+   * Upload a part to a presigned URL obtained from {@link getPresignedUrl}.
+   * This sends the chunk data directly to the backend storage service, not
+   * to the Gigadrive API. The returned `etag` is needed for
+   * {@link completeUpload}.
+   *
+   * @param presignedUrl - The presigned URL from {@link getPresignedUrl}.
+   * @param data - The chunk data to upload.
+   * @param partNumber - The 1-based part number (used for error messages).
+   * @returns The part number and ETag. Collect these for {@link completeUpload}.
+   * @throws {@link ApiError} if the PUT request fails.
+   * @throws Error if the storage provider does not return an ETag header.
+   *
+   * @example
+   * ```ts
+   * const chunk = fileBuffer.subarray(0, 10 * 1024 * 1024); // 10 MB
+   * const part = await client.deployments.uploadPart(presignedUrl, chunk, 1);
+   * // part = { partNumber: 1, etag: '"abc123..."' }
+   * ```
+   */
+  async uploadPart(presignedUrl, data, partNumber) {
+    if (!Number.isInteger(partNumber) || partNumber < 1) {
+      throw new Error(`partNumber must be a positive integer, received ${partNumber}`);
+    }
+    const response = await this.httpClient.fetchRaw(presignedUrl, {
+      method: "PUT",
+      headers: {
+        // Deployment artifacts are always ZIP archives.
+        "Content-Type": "application/zip",
+        "Content-Length": String(data instanceof Blob ? data.size : data.byteLength)
+      },
+      body: data
+    });
+    const etag = response.headers.get("ETag");
+    if (!etag) {
+      throw new Error(`No ETag received for part ${partNumber}`);
+    }
+    return { partNumber, etag };
+  }
+  /**
+   * Complete a multipart upload after all parts have been uploaded via
+   * {@link uploadPart}. This signals the storage provider to assemble the
+   * parts into a single object and triggers the deployment build pipeline.
+   *
+   * @param deploymentId - The deployment ID (UUID).
+   * @param uploadId - The multipart upload ID from {@link startUpload}.
+   * @param parts - Array of `{ partNumber, etag }` from each {@link uploadPart} call.
+   *
+   * @example
+   * ```ts
+   * await client.deployments.completeUpload(deploymentId, uploadId, [
+   *   { partNumber: 1, etag: '"abc..."' },
+   *   { partNumber: 2, etag: '"def..."' },
+   * ]);
+   * ```
+   */
+  async completeUpload(deploymentId, uploadId, parts) {
+    return this.httpClient.post(`/deployments/${deploymentId}/upload/complete`, { uploadId, parts });
+  }
+  /**
+   * Fetch deployment logs. Supports pagination and filtering by timestamp
+   * for incremental log tailing.
+   *
+   * @param deploymentId - The deployment ID (UUID).
+   * @param query - Optional pagination and filter parameters.
+   * @returns A page of log entries with total count.
+   *
+   * @example
+   * ```ts
+   * // Get the first page of logs
+   * const page = await client.deployments.getLogs('deployment-id', {
+   *   offset: 0,
+   *   limit: 100,
+   * });
+   *
+   * for (const entry of page.items) {
+   *   const prefix = entry.type === 'ERROR' ? 'ERR' : entry.type === 'WARN' ? 'WRN' : 'INF';
+   *   console.log(`[${prefix}] ${entry.message}`);
+   * }
+   *
+   * // Tail new logs since last fetch
+   * const newLogs = await client.deployments.getLogs('deployment-id', {
+   *   'createdAt[gt]': lastEntry.createdAt,
+   * });
+   * ```
+   */
+  async getLogs(deploymentId, query) {
+    return this.httpClient.get(`/deployments/${deploymentId}/logs`, {
+      query
+    });
+  }
+  /**
+   * List the immutable `*.gigadrive.app` hostnames assigned to a deployment.
+   *
+   * @param deploymentId - The deployment ID (UUID).
+   * @returns A paginated list of hostnames.
+   *
+   * @example
+   * ```ts
+   * const { items } = await client.deployments.getHostnames('deployment-id');
+   * console.log(items.map((h) => h.hostname));
+   * ```
+   */
+  async getHostnames(deploymentId) {
+    return this.httpClient.get(`/deployments/${deploymentId}/hostnames`);
+  }
+};
+
+// src/resources/organization-ai-gateway.ts
+var AiGatewayUsageResource = class extends BaseResource {
+  /** Get an aggregated usage summary with breakdowns by model, provider, and user. */
+  async summary(organizationId, query) {
+    return this.httpClient.get(`/organizations/${organizationId}/ai-gateway/usage/summary`, {
+      query
+    });
+  }
+  /** List request-level usage events. */
+  async requests(organizationId, query) {
+    return this.httpClient.get(`/organizations/${organizationId}/ai-gateway/usage/requests`, {
+      query
+    });
+  }
+  /** Export request-level usage events as CSV text. */
+  async export(organizationId, query) {
+    const response = await this.httpClient.requestStream(
+      "GET",
+      `/organizations/${organizationId}/ai-gateway/usage/export`,
+      { query }
+    );
+    return response.text();
+  }
+};
+var AiGatewayBudgetsResource = class extends BaseResource {
+  /** List all budgets for an organization. */
+  async list(organizationId) {
+    return this.httpClient.get(`/organizations/${organizationId}/ai-gateway/budgets`);
+  }
+  /**
+   * Replace the organization's entire budget set. Pass an empty array to clear
+   * all budgets.
+   */
+  async replace(organizationId, budgets) {
+    return this.httpClient.put(`/organizations/${organizationId}/ai-gateway/budgets`, { budgets });
+  }
+};
+var AiGatewayPoliciesResource = class extends BaseResource {
+  /**
+   * Get the governance policy for an organization, or for a specific
+   * application when `applicationId` is provided. Returns `null` if no policy is set.
+   */
+  async get(organizationId, options) {
+    const { policy } = await this.httpClient.get(
+      `/organizations/${organizationId}/ai-gateway/policies`,
+      { query: { applicationId: options?.applicationId } }
+    );
+    return policy;
+  }
+  /** Create or update an AI Gateway policy. */
+  async put(organizationId, data) {
+    const { policy } = await this.httpClient.put(
+      `/organizations/${organizationId}/ai-gateway/policies`,
+      data
+    );
+    return policy;
+  }
+};
+var OrganizationAiGatewayResource = class {
+  /** Usage analytics (summary, request log, CSV export). */
+  usage;
+  /** Spend/usage budgets. */
+  budgets;
+  /** Model/provider governance policies. */
+  policies;
+  constructor(httpClient) {
+    this.usage = new AiGatewayUsageResource(httpClient);
+    this.budgets = new AiGatewayBudgetsResource(httpClient);
+    this.policies = new AiGatewayPoliciesResource(httpClient);
+  }
+};
+
+// src/resources/organization-env-vars.ts
+var OrganizationEnvVarsResource = class extends BaseResource {
+  /**
+   * List all environment variables for an organization.
+   *
+   * @param organizationId - The organization ID (UUID).
+   * @returns A paginated list of environment variables.
+   *
+   * @example
+   * ```ts
+   * const { items } = await client.organizations.envVars.list('org-id');
+   * for (const v of items) {
+   *   console.log(`${v.key}=${v.sensitive ? '***' : v.value}`);
+   * }
+   * ```
+   */
+  async list(organizationId, query) {
+    return this.httpClient.get(`/organizations/${organizationId}/env-vars`, {
+      query
+    });
+  }
+  /**
+   * Create a new environment variable for an organization.
+   *
+   * @param organizationId - The organization ID (UUID).
+   * @param data - The variable key, value, and optional settings.
+   * @returns The newly created environment variable.
+   *
+   * @example
+   * ```ts
+   * const envVar = await client.organizations.envVars.create('org-id', {
+   *   key: 'STRIPE_SECRET',
+   *   value: 'sk_live_...',
+   *   sensitive: true,
+   * });
+   * ```
+   */
+  async create(organizationId, data) {
+    return this.httpClient.post(`/organizations/${organizationId}/env-vars`, data);
+  }
+  /**
+   * Update an existing environment variable. Only the fields you provide
+   * will be changed; omitted fields are left unchanged.
+   *
+   * @param organizationId - The organization ID (UUID).
+   * @param envVarId - The environment variable ID (UUID).
+   * @param data - The fields to update.
+   * @returns The updated environment variable.
+   *
+   * @example
+   * ```ts
+   * await client.organizations.envVars.update('org-id', 'var-id', {
+   *   value: 'new-value',
+   * });
+   * ```
+   */
+  async update(organizationId, envVarId, data) {
+    return this.httpClient.patch(`/organizations/${organizationId}/env-vars/${envVarId}`, data);
+  }
+  /**
+   * Permanently delete an environment variable.
+   *
+   * @param organizationId - The organization ID (UUID).
+   * @param envVarId - The environment variable ID (UUID).
+   *
+   * @example
+   * ```ts
+   * await client.organizations.envVars.delete('org-id', 'var-id');
+   * ```
+   */
+  async delete(organizationId, envVarId) {
+    return this.httpClient.delete(`/organizations/${organizationId}/env-vars/${envVarId}`);
+  }
+};
+
+// src/resources/organizations.ts
+var OrganizationsResource = class extends BaseResource {
+  /**
+   * Manage environment variables scoped to an organization.
+   *
+   * @example
+   * ```ts
+   * // List all env vars for an organization
+   * const { items } = await client.organizations.envVars.list('org-id');
+   *
+   * // Create a new env var
+   * await client.organizations.envVars.create('org-id', {
+   *   key: 'ANALYTICS_KEY',
+   *   value: 'ak_live_...',
+   *   sensitive: true,
+   * });
+   * ```
+   */
+  envVars;
+  /**
+   * AI Gateway governance for an organization: usage analytics, budgets, and
+   * model/provider policies.
+   *
+   * @example
+   * ```ts
+   * const usage = await client.organizations.aiGateway.usage.summary('org-id', { from: '2026-06-01' });
+   * console.log(usage.summary.totalTokens);
+   * ```
+   */
+  aiGateway;
+  constructor(...args) {
+    super(...args);
+    this.envVars = new OrganizationEnvVarsResource(this.httpClient);
+    this.aiGateway = new OrganizationAiGatewayResource(this.httpClient);
+  }
+  /**
+   * List organizations the authenticated actor has access to.
+   *
+   * @param query - Optional pagination.
+   * @returns A paginated list of organizations.
+   *
+   * @example
+   * ```ts
+   * const { items, total } = await client.organizations.list();
+   * console.log(`Found ${total} organizations`);
+   * ```
+   */
+  async list(query) {
+    return this.httpClient.get("/organizations", {
+      query
+    });
+  }
+};
+
+// src/client.ts
+var DEFAULT_BASE_URL2 = "https://api.gigadrive.network";
+var GigadriveClient = class {
+  /** Organization management (list, environment variables). */
+  organizations;
+  /** Application management (list, environment variables, storage). */
+  applications;
+  /** Deployment lifecycle (create, upload, status, logs). */
+  deployments;
+  /** AI Gateway — OpenAI-compatible chat completions and model listing. */
+  aiGateway;
+  constructor(config = {}) {
+    const baseUrl = config.baseUrl ?? readEnv("GIGADRIVE_API_BASE_URL") ?? DEFAULT_BASE_URL2;
+    const fetchFn = config.fetch ?? globalThis.fetch.bind(globalThis);
+    const credentialProvider = resolveCredentialProvider({ ...config, baseUrl, fetch: fetchFn });
+    const tokenManager = new TokenManager(credentialProvider);
+    const httpClient = new HttpClient(baseUrl, tokenManager, fetchFn);
+    this.organizations = new OrganizationsResource(httpClient);
+    this.applications = new ApplicationsResource(httpClient);
+    this.deployments = new DeploymentsResource(httpClient);
+    this.aiGateway = new AiGatewayResource(httpClient);
+  }
+};
+
+// src/pagination.ts
+async function* paginate(fetchPage) {
+  let cursor;
+  do {
+    const page = await fetchPage(cursor);
+    for (const item of page.items) {
+      yield item;
+    }
+    cursor = page.nextCursor;
+  } while (cursor);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AiGatewayAudioResource,
+  AiGatewayBudgetsResource,
+  AiGatewayPoliciesResource,
+  AiGatewayResource,
+  AiGatewayUsageResource,
+  AiGatewayVideosResource,
+  ApiError,
+  ApplicationEnvVarsResource,
+  ApplicationRequestsResource,
+  ApplicationStorageResource,
+  ApplicationsResource,
+  AuthenticationError,
+  DeploymentsResource,
+  GigadriveClient,
+  GigadriveError,
+  OrganizationAiGatewayResource,
+  OrganizationEnvVarsResource,
+  OrganizationsResource,
+  StorageBucketsResource,
+  StorageObjectsResource,
+  StorageUploadSessionsResource,
+  UploadError,
+  UploadSessionExpiredError,
+  paginate,
+  parseSSEStream
+});
 //# sourceMappingURL=index.js.map