@gigadrive/sdk 0.8.5 → 0.9.0

package/dist/index.js

@@ -38,6 +38,7 @@ __export(src_exports, {
   AiGatewayVideosResource: () => AiGatewayVideosResource,
   ApiError: () => ApiError,
   ApiKeysResource: () => ApiKeysResource,
+  ApplicationDomainsResource: () => ApplicationDomainsResource,
   ApplicationEnvVarsResource: () => ApplicationEnvVarsResource,
   ApplicationRequestsResource: () => ApplicationRequestsResource,
   ApplicationStorageResource: () => ApplicationStorageResource,
@@ -45,14 +46,25 @@ __export(src_exports, {
   AuthenticationError: () => AuthenticationError,
   ConfigurationError: () => ConfigurationError,
   DeploymentsResource: () => DeploymentsResource,
+  DomainNotActiveError: () => DomainNotActiveError,
   GigadriveClient: () => GigadriveClient,
   GigadriveError: () => GigadriveError,
   ImageOptimizationResource: () => ImageOptimizationResource,
+  NonRetryableError: () => NonRetryableError,
   OrganizationAiGatewayResource: () => OrganizationAiGatewayResource,
+  OrganizationDomainsResource: () => OrganizationDomainsResource,
   OrganizationEnvVarsResource: () => OrganizationEnvVarsResource,
   OrganizationMembersResource: () => OrganizationMembersResource,
   OrganizationProductsResource: () => OrganizationProductsResource,
   OrganizationsResource: () => OrganizationsResource,
+  QUEUE_DELIVERY_HEADERS: () => QUEUE_DELIVERY_HEADERS,
+  QUEUE_RESPONSE_HEADERS: () => QUEUE_RESPONSE_HEADERS,
+  QUEUE_SIGNATURE_HEADER: () => QUEUE_SIGNATURE_HEADER,
+  QUEUE_SIGNATURE_TOLERANCE_MS: () => QUEUE_SIGNATURE_TOLERANCE_MS,
+  QUEUE_SIGNING_SECRET_ENV: () => QUEUE_SIGNING_SECRET_ENV,
+  Queue: () => Queue,
+  QueuesResource: () => QueuesResource,
+  RetryLaterError: () => RetryLaterError,
   StickySessionsResource: () => StickySessionsResource,
   StorageBucketsResource: () => StorageBucketsResource,
   StorageObjectsResource: () => StorageObjectsResource,
@@ -60,9 +72,17 @@ __export(src_exports, {
   StorageUploadSessionsResource: () => StorageUploadSessionsResource,
   UploadError: () => UploadError,
   UploadSessionExpiredError: () => UploadSessionExpiredError,
+  WORKFLOW_CONSUMER_PATH: () => WORKFLOW_CONSUMER_PATH,
+  WORKFLOW_QUEUE_NAME_HEADER: () => WORKFLOW_QUEUE_NAME_HEADER,
   createManagedImageUrl: () => createManagedImageUrl,
+  createWorkflowQueue: () => createWorkflowQueue,
+  defaultQueueCodec: () => defaultQueueCodec,
+  durationToSeconds: () => durationToSeconds,
   paginate: () => paginate,
-  parseSSEStream: () => parseSSEStream
+  parseSSEStream: () => parseSSEStream,
+  queue: () => queue,
+  signQueueDelivery: () => signQueueDelivery,
+  verifyQueueSignature: () => verifyQueueSignature
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -90,11 +110,17 @@ var ApiError = class extends GigadriveError {
   status;
   /** An optional machine-readable error code from the API response body. */
   code;
-  constructor(message, status, code) {
+  /**
+   * An optional finer-grained reason next to {@link code}, for example `daily_add_limit` with
+   * `quota_exceeded`, or `other_organization` with `domain_in_use`.
+   */
+  reason;
+  constructor(message, status, code, reason) {
     super(message);
     this.name = "ApiError";
     this.status = status;
     this.code = code;
+    this.reason = reason;
   }
 };
 var UploadError = class extends GigadriveError {
@@ -582,10 +608,13 @@ var HttpClient = class {
   async toApiError(response) {
     let message;
     let code;
+    let reason;
     try {
       const body = await response.json();
       if (typeof body.error === "string") {
         message = body.error;
+        if (typeof body.code === "string") code = body.code;
+        if (typeof body.reason === "string") reason = body.reason;
       } else if (body.error && typeof body.error === "object") {
         message = body.error.message ?? response.statusText;
         code = body.error.code;
@@ -595,7 +624,7 @@ var HttpClient = class {
     } catch {
       message = response.statusText;
     }
-    return new ApiError(message, response.status, code);
+    return new ApiError(message, response.status, code, reason);
   }
   buildUrl(path, query) {
     const url = `${this.baseUrl}${path}`;
@@ -955,6 +984,7 @@ var ApplicationRequestsResource = class extends BaseResource {
 };
 
 // src/upload/checksum.ts
+var EMPTY_SHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
 var toHex = (buffer) => {
   const bytes = new Uint8Array(buffer);
   let hex = "";
@@ -1073,6 +1103,8 @@ var inferContentType = (nameOrKey) => {
 };
 
 // src/upload/source.ts
+var noop = () => {
+};
 var isNode = () => typeof process !== "undefined" && !!process.versions?.node;
 var toBytes = async (data) => {
   if (typeof Blob !== "undefined" && data instanceof Blob) return new Uint8Array(await data.arrayBuffer());
@@ -1119,7 +1151,8 @@ var resolveUploadSource = async (input, options = {}) => {
       size,
       contentType,
       checksums: buildChecksums(input, sha256),
-      requiresFiniteChunkSize: false
+      requiresFiniteChunkSize: false,
+      release: noop
     };
   }
   if (input.path !== void 0) {
@@ -1127,22 +1160,34 @@ var resolveUploadSource = async (input, options = {}) => {
     const fs = await import("fs");
     const size = input.contentLength ?? fs.statSync(input.path).size;
     const sha256 = input.checksumSha256 ?? (hash ? (await hashNodeFile(input.path)).sha256 : "");
-    const tusFile = fs.createReadStream(input.path);
-    return { tusFile, size, contentType, checksums: buildChecksums(input, sha256), requiresFiniteChunkSize: true };
+    const stream = fs.createReadStream(input.path);
+    return {
+      tusFile: stream,
+      size,
+      contentType,
+      checksums: buildChecksums(input, sha256),
+      requiresFiniteChunkSize: true,
+      release: () => {
+        stream.on("error", noop);
+        stream.destroy();
+      }
+    };
   }
   if (input.stream !== void 0) {
     if (input.contentLength === void 0) {
       throw new Error("Uploading from a stream requires contentLength to be provided.");
     }
-    if (hash && !input.checksumSha256) {
+    const sha256 = input.checksumSha256 ?? (input.contentLength === 0 ? EMPTY_SHA256 : void 0);
+    if (hash && !sha256) {
       throw new Error("Uploading from a stream requires checksumSha256 to be provided.");
     }
     return {
       tusFile: input.stream,
       size: input.contentLength,
       contentType,
-      checksums: buildChecksums(input, input.checksumSha256 ?? ""),
-      requiresFiniteChunkSize: true
+      checksums: buildChecksums(input, sha256 ?? ""),
+      requiresFiniteChunkSize: true,
+      release: noop
     };
   }
   throw new Error("No upload source provided. Pass one of: data, path, or stream.");
@@ -1515,7 +1560,7 @@ var StorageUploadSessionsResource = class extends BaseResource {
   async uploadToUrl(url, source, options) {
     const resolved = await resolveUploadSource({ key: "", ...source }, { hash: false });
     const headers = { "Tus-Resumable": "1.0.0", ...options?.headers };
-    await runResolvedUpload(this.transport, url, resolved, options, headers).catch(toUploadError);
+    await runResolvedUpload(this.transport, url, resolved, options, headers).catch(toUploadError).finally(resolved.release);
   }
   /**
    * Resume an interrupted upload to a previously issued signed upload URL. The
@@ -1532,6 +1577,7 @@ var StorageUploadSessionsResource = class extends BaseResource {
 
 // src/resources/application-storage.ts
 var delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var buildStorageObjectUrl = (cdnHostname, key) => `https://${cdnHostname}/${encodeURIComponent(key).replace(/%2F/g, "/")}`;
 var ApplicationStorageResource = class {
   constructor(httpClient, transport = tusUploadTransport, defaultApplicationId) {
     this.defaultApplicationId = defaultApplicationId;
@@ -1561,6 +1607,10 @@ var ApplicationStorageResource = class {
    * Node filesystem `path`, or a Node readable `stream` (with `contentLength`
    * and `checksumSha256`). The content type is inferred from `key` when omitted.
    *
+   * Empty (zero-byte) files are supported for every input kind. The API stores
+   * them during session creation, so no bytes are transferred, `onProgress` is
+   * not called, `waitForCompletion` does not poll, and `object` is always set.
+   *
    * @param input - What and where to upload, plus optional transfer options.
    * @returns The upload session and public object URL (and the finalized object when `waitForCompletion` is set).
    * @throws {@link UploadError} if the byte upload fails.
@@ -1591,19 +1641,42 @@ var ApplicationStorageResource = class {
       checksumSha1: input.checksumSha1,
       checksumMd5: input.checksumMd5
     });
-    const { session, upload } = await this.uploadSessions.create(
-      applicationId,
-      bucketRef,
-      {
-        key: input.key,
-        contentLength: resolved.size,
-        checksumSha256: resolved.checksums.sha256,
-        contentType: resolved.contentType,
-        checksumSha1: resolved.checksums.sha1,
-        checksumMd5: resolved.checksums.md5
-      },
-      { environment }
-    );
+    if (input.signal?.aborted) {
+      resolved.release();
+      throw createAbortError();
+    }
+    let created;
+    try {
+      created = await this.uploadSessions.create(
+        applicationId,
+        bucketRef,
+        {
+          key: input.key,
+          contentLength: resolved.size,
+          checksumSha256: resolved.checksums.sha256,
+          contentType: resolved.contentType,
+          checksumSha1: resolved.checksums.sha1,
+          checksumMd5: resolved.checksums.md5
+        },
+        { environment }
+      );
+    } catch (error) {
+      resolved.release();
+      throw error;
+    }
+    const { session, upload } = created;
+    if (upload === null) {
+      resolved.release();
+      const object = created.object;
+      if (!object) {
+        throw new UploadError("The upload session completed without returning the stored object.");
+      }
+      const url = created.publicObjectUrl ?? buildStorageObjectUrl(
+        (await this.buckets.get(applicationId, bucketRef, { environment })).cdnHostname,
+        object.key
+      );
+      return { session, url, object };
+    }
     await runResolvedUpload(
       this.transport,
       upload.url,
@@ -1618,7 +1691,7 @@ var ApplicationStorageResource = class {
       },
       // Forward any required headers the API issued with the session.
       { "Tus-Resumable": "1.0.0", ...upload.headers }
-    ).catch(toUploadError);
+    ).catch(toUploadError).finally(resolved.release);
     if (input.waitForCompletion) {
       const options = completionOptions ?? {};
       const completed = await this.waitForCompletion(applicationId, bucketRef, session.id, {
@@ -1697,6 +1770,201 @@ var ApplicationStorageResource = class {
   }
 };
 
+// src/resources/domains.ts
+var DomainNotActiveError = class extends GigadriveError {
+  /** The domain as of the last successful check. */
+  domain;
+  /** `timeout` when the wait ran out, `removing` when the domain was removed, otherwise the state that ended it. */
+  reason;
+  constructor(domain, reason) {
+    const detail = domain.error ? `: ${domain.error.message}` : "";
+    super(
+      reason === "timeout" ? `${domain.unicodeHostname} is not active yet (state: ${domain.state})${detail}` : `${domain.unicodeHostname} is ${reason}${detail}`
+    );
+    this.name = "DomainNotActiveError";
+    this.domain = domain;
+    this.reason = reason;
+  }
+};
+var SERVING_STATES = /* @__PURE__ */ new Set(["active", "degraded"]);
+var isTransient = (error) => error instanceof ApiError ? error.status === 429 || error.status >= 500 : error instanceof TypeError;
+var pollSignal = (ms, signal) => {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(new DOMException("The operation timed out.", "TimeoutError")), ms);
+  const onAbort = () => controller.abort(signal?.reason);
+  if (signal?.aborted) onAbort();
+  else signal?.addEventListener("abort", onAbort, { once: true });
+  return {
+    signal: controller.signal,
+    dispose: () => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+    }
+  };
+};
+var sleep = (ms, signal) => new Promise((resolve, reject) => {
+  if (signal?.aborted) {
+    reject(signal.reason instanceof Error ? signal.reason : new GigadriveError("Aborted"));
+    return;
+  }
+  const timer = setTimeout(() => {
+    signal?.removeEventListener("abort", onAbort);
+    resolve();
+  }, ms);
+  const onAbort = () => {
+    clearTimeout(timer);
+    reject(signal?.reason instanceof Error ? signal.reason : new GigadriveError("Aborted"));
+  };
+  signal?.addEventListener("abort", onAbort, { once: true });
+});
+var ApplicationDomainsResource = class extends BaseResource {
+  /**
+   * List the custom domains of an application.
+   *
+   * @example
+   * ```ts
+   * const { items } = await client.applications.domains.list('app-id');
+   * for (const domain of items) console.log(domain.hostname, domain.state);
+   * ```
+   */
+  async list(applicationId, query) {
+    return this.httpClient.get(`/applications/${applicationId}/domains`, {
+      query
+    });
+  }
+  /**
+   * Attach a hostname to an application.
+   *
+   * @returns The new domain, including the `requiredRecords` to publish at your DNS provider.
+   *
+   * @example
+   * ```ts
+   * const domain = await client.applications.domains.add('app-id', { hostname: 'shop.example.com' });
+   * for (const record of domain.requiredRecords) console.log(record.type, record.host, record.value);
+   * ```
+   */
+  async add(applicationId, data) {
+    return this.httpClient.post(`/applications/${applicationId}/domains`, data);
+  }
+  /** Get one custom domain with its current state. */
+  async get(applicationId, domainId, options) {
+    const path = `/applications/${applicationId}/domains/${domainId}`;
+    return options?.signal ? this.httpClient.get(path, { signal: options.signal }) : this.httpClient.get(path);
+  }
+  /**
+   * Change what a domain serves, or make it the primary domain.
+   *
+   * @example
+   * ```ts
+   * await client.applications.domains.update('app-id', 'domain-id', {
+   *   target: { type: 'redirect', to: 'www.example.com' },
+   * });
+   * ```
+   */
+  async update(applicationId, domainId, data) {
+    return this.httpClient.patch(`/applications/${applicationId}/domains/${domainId}`, data);
+  }
+  /** Check the domain now instead of waiting for the next scheduled check. Rate limited. */
+  async refresh(applicationId, domainId) {
+    return this.httpClient.post(`/applications/${applicationId}/domains/${domainId}/refresh`);
+  }
+  /** Stop serving the domain and remove it. */
+  async remove(applicationId, domainId) {
+    return this.httpClient.delete(`/applications/${applicationId}/domains/${domainId}`);
+  }
+  /**
+   * Move a hostname another organization attached to this application. Verify the domain for your
+   * organization first and keep its TXT record published: the claim checks the record again.
+   */
+  async claim(applicationId, hostname) {
+    return this.httpClient.post(`/applications/${applicationId}/domains/claim`, { hostname });
+  }
+  /**
+   * Poll a domain until it serves traffic.
+   *
+   * Rate limits, server errors and network failures do not end the wait; the next poll retries until
+   * the timeout. Aborting the signal or reaching the timeout also cancels a request in flight.
+   *
+   * @returns The domain once it is `active` (or `degraded`, which also serves).
+   * @throws {DomainNotActiveError} When it fails, is suspended or removed, or the timeout runs out.
+   *
+   * @example
+   * ```ts
+   * const domain = await client.applications.domains.add('app-id', { hostname: 'shop.example.com' });
+   * await client.applications.domains.waitUntilActive('app-id', domain.id, {
+   *   onState: (current) => console.log(current.state),
+   * });
+   * ```
+   */
+  async waitUntilActive(applicationId, domainId, options = {}) {
+    const { timeoutMs = 10 * 6e4, intervalMs = 5e3, signal, onState } = options;
+    const deadline = Date.now() + timeoutMs;
+    let last;
+    for (; ; ) {
+      const poll = pollSignal(Math.max(deadline - Date.now(), 1), signal);
+      let domain;
+      try {
+        domain = await this.get(applicationId, domainId, { signal: poll.signal });
+      } catch (error) {
+        if (signal?.aborted) throw error;
+        if (last && error instanceof ApiError && error.status === 404) throw new DomainNotActiveError(last, "removing");
+        if (!poll.signal.aborted && !isTransient(error)) throw error;
+        if (Date.now() >= deadline && !last) throw error;
+      } finally {
+        poll.dispose();
+      }
+      if (domain) {
+        if (domain.state !== last?.state) onState?.(domain);
+        last = domain;
+        if (SERVING_STATES.has(domain.state)) return domain;
+        if (domain.state === "failed" || domain.state === "suspended" || domain.state === "removing") {
+          throw new DomainNotActiveError(domain, domain.state);
+        }
+      }
+      const untilDeadline = deadline - Date.now();
+      if (untilDeadline <= 0) {
+        if (last) throw new DomainNotActiveError(last, "timeout");
+        throw new GigadriveError("Timed out before the domain could be read");
+      }
+      await sleep(Math.min(intervalMs, untilDeadline), signal);
+    }
+  }
+};
+var OrganizationDomainsResource = class extends BaseResource {
+  /** List the organization's claimed and verified domains. */
+  async list(organizationId, query) {
+    return this.httpClient.get(`/organizations/${organizationId}/domains`, {
+      query
+    });
+  }
+  /**
+   * Claim a domain for verification.
+   *
+   * @returns The claim, including the TXT `record` to publish.
+   *
+   * @example
+   * ```ts
+   * const claim = await client.organizations.domains.add('org-id', 'example.com');
+   * console.log(claim.record.host, claim.record.value);
+   * ```
+   */
+  async add(organizationId, name) {
+    return this.httpClient.post(`/organizations/${organizationId}/domains`, { name });
+  }
+  /** Get one claimed or verified domain. */
+  async get(organizationId, domainId) {
+    return this.httpClient.get(`/organizations/${organizationId}/domains/${domainId}`);
+  }
+  /** Check the TXT record now. Rate limited. */
+  async verify(organizationId, domainId) {
+    return this.httpClient.post(`/organizations/${organizationId}/domains/${domainId}/verify`);
+  }
+  /** Remove a domain. Refused while custom domains still rely on it. */
+  async remove(organizationId, domainId) {
+    return this.httpClient.delete(`/organizations/${organizationId}/domains/${domainId}`);
+  }
+};
+
 // src/resources/applications.ts
 var ApplicationsResource = class extends BaseResource {
   /**
@@ -1738,11 +2006,22 @@ var ApplicationsResource = class extends BaseResource {
    * ```
    */
   requests;
+  /**
+   * Custom domains attached to the application.
+   *
+   * @example
+   * ```ts
+   * const domain = await client.applications.domains.add('app-id', { hostname: 'shop.example.com' });
+   * await client.applications.domains.waitUntilActive('app-id', domain.id);
+   * ```
+   */
+  domains;
   constructor(httpClient, defaultApplicationId) {
     super(httpClient);
     this.envVars = new ApplicationEnvVarsResource(this.httpClient);
     this.storage = new ApplicationStorageResource(this.httpClient, void 0, defaultApplicationId);
     this.requests = new ApplicationRequestsResource(this.httpClient);
+    this.domains = new ApplicationDomainsResource(this.httpClient);
   }
   /**
    * List applications the authenticated actor has access to.
@@ -2368,12 +2647,23 @@ var OrganizationsResource = class extends BaseResource {
    * ```
    */
   products;
+  /**
+   * Domains the organization verified. A verified domain lets every application attach hostnames
+   * below it without another TXT record.
+   *
+   * @example
+   * ```ts
+   * const claim = await client.organizations.domains.add('org-id', 'example.com');
+   * ```
+   */
+  domains;
   constructor(...args) {
     super(...args);
     this.envVars = new OrganizationEnvVarsResource(this.httpClient);
     this.aiGateway = new OrganizationAiGatewayResource(this.httpClient);
     this.members = new OrganizationMembersResource(this.httpClient);
     this.products = new OrganizationProductsResource(this.httpClient);
+    this.domains = new OrganizationDomainsResource(this.httpClient);
   }
   /**
    * List organizations the authenticated actor has access to.
@@ -2427,6 +2717,783 @@ var OrganizationsResource = class extends BaseResource {
   }
 };
 
+// src/queues/encoding.ts
+var DURATION_PATTERN = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)$/;
+var UNIT_SECONDS = { ms: 1e-3, s: 1, m: 60, h: 3600, d: 86400 };
+var durationToSeconds = (value) => {
+  let seconds;
+  if (typeof value === "number") {
+    seconds = value;
+  } else {
+    const match = DURATION_PATTERN.exec(value.trim());
+    if (!match) throw new Error(`Invalid duration "${value}". Use seconds or a string such as 30s, 10m, 12h or 7d.`);
+    seconds = Number(match[1]) * UNIT_SECONDS[match[2]];
+  }
+  if (!Number.isFinite(seconds) || seconds < 0) throw new Error(`Invalid duration "${String(value)}"`);
+  return Math.ceil(seconds);
+};
+var textEncoder = new TextEncoder();
+var textDecoder = new TextDecoder();
+var utf8Encode = (value) => textEncoder.encode(value);
+var utf8Decode = (bytes) => textDecoder.decode(bytes);
+var bytesToBase64 = (bytes) => {
+  let binary = "";
+  for (let index = 0; index < bytes.length; index += 32768) {
+    binary += String.fromCharCode(...bytes.subarray(index, index + 32768));
+  }
+  return btoa(binary);
+};
+var base64ToBytes = (value) => {
+  const binary = atob(value);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index++) bytes[index] = binary.charCodeAt(index);
+  return bytes;
+};
+var toHex2 = (buffer) => Array.from(new Uint8Array(buffer), (byte) => byte.toString(16).padStart(2, "0")).join("");
+var toArrayBuffer = (bytes) => {
+  const copy = new ArrayBuffer(bytes.byteLength);
+  new Uint8Array(copy).set(bytes);
+  return copy;
+};
+
+// src/queues/errors.ts
+var RetryLaterError = class extends GigadriveError {
+  /** Seconds until the next delivery. */
+  delaySeconds;
+  constructor(delay2, message = "Message deferred") {
+    super(message);
+    this.name = "RetryLaterError";
+    this.delaySeconds = durationToSeconds(delay2);
+  }
+};
+var NonRetryableError = class extends GigadriveError {
+  constructor(message) {
+    super(message);
+    this.name = "NonRetryableError";
+  }
+};
+
+// src/queues/signature.ts
+var QUEUE_SIGNATURE_HEADER = "x-gigadrive-queue-signature";
+var QUEUE_SIGNATURE_TOLERANCE_MS = 5 * 6e4;
+var QUEUE_SIGNING_SECRET_ENV = "GIGADRIVE_QUEUE_SIGNING_SECRET";
+var hmacSha256Hex = async (secret, payload) => {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    toArrayBuffer(utf8Encode(secret)),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return toHex2(await crypto.subtle.sign("HMAC", key, toArrayBuffer(utf8Encode(payload))));
+};
+var signedPayload = async (input, timestamp) => {
+  const body = typeof input.body === "string" ? utf8Encode(input.body) : input.body;
+  const bodyHash = toHex2(await crypto.subtle.digest("SHA-256", toArrayBuffer(body)));
+  return `${String(timestamp)}.${input.queue}.${input.messageId}.${String(input.attempt)}.${bodyHash}`;
+};
+var safeEqual = (left, right) => {
+  if (left.length !== right.length) return false;
+  let difference = 0;
+  for (let index = 0; index < left.length; index++) difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
+  return difference === 0;
+};
+async function signQueueDelivery(input, timestamp = Date.now()) {
+  return `t=${String(timestamp)},v1=${await hmacSha256Hex(input.secret, await signedPayload(input, timestamp))}`;
+}
+async function verifyQueueSignature(header, input, now = Date.now()) {
+  if (!header || !input.secret) return false;
+  const fields = /* @__PURE__ */ new Map();
+  for (const part of header.split(",")) {
+    const separator = part.indexOf("=");
+    if (separator > 0) fields.set(part.slice(0, separator).trim(), part.slice(separator + 1).trim());
+  }
+  const timestamp = Number(fields.get("t"));
+  const signature = fields.get("v1");
+  if (!Number.isSafeInteger(timestamp) || !signature || Math.abs(now - timestamp) > QUEUE_SIGNATURE_TOLERANCE_MS) {
+    return false;
+  }
+  const expected = await hmacSha256Hex(input.secret, await signedPayload(input, timestamp));
+  return safeEqual(signature.toLowerCase(), expected);
+}
+
+// src/queues/queue.ts
+var QUEUE_DELIVERY_HEADERS = {
+  name: "x-gigadrive-queue-name",
+  messageId: "x-gigadrive-queue-message-id",
+  attempt: "x-gigadrive-queue-attempt",
+  createdAt: "x-gigadrive-queue-created-at",
+  expiresAt: "x-gigadrive-queue-expires-at",
+  deadline: "x-gigadrive-queue-deadline",
+  groupKey: "x-gigadrive-queue-group-key",
+  deduplicationKey: "x-gigadrive-queue-deduplication-key",
+  deploymentId: "x-gigadrive-queue-deployment-id",
+  deploymentFallback: "x-gigadrive-queue-deployment-fallback",
+  signature: QUEUE_SIGNATURE_HEADER
+};
+var QUEUE_RESPONSE_HEADERS = {
+  /** On a 2xx: deliver again after this many seconds without spending an attempt. */
+  retryAfter: "x-gigadrive-queue-retry-after",
+  /** `dead-letter`: stop retrying now, whatever the status. */
+  action: "x-gigadrive-queue-action",
+  /**
+   * Reason recorded on the message. Read only together with `action:
+   * dead-letter`; for any other failure the platform records `HTTP <status>`
+   * and the first 512 bytes of the response body.
+   */
+  error: "x-gigadrive-queue-error"
+};
+var isJsonContentType = (contentType) => /^application\/(?:[\w.+-]+\+)?json\b/i.test(contentType);
+var defaultQueueCodec = {
+  encode(payload) {
+    if (payload instanceof Uint8Array || payload instanceof ArrayBuffer) {
+      const bytes = payload instanceof Uint8Array ? payload : new Uint8Array(payload);
+      return { body: bytesToBase64(bytes), encoding: "base64", contentType: "application/octet-stream" };
+    }
+    const json = JSON.stringify(payload);
+    if (json === void 0) throw new TypeError("Queue payloads must be JSON-serializable or binary");
+    return { body: json, encoding: "utf8", contentType: "application/json" };
+  },
+  decode(body, contentType) {
+    if (isJsonContentType(contentType)) return body.length === 0 ? null : JSON.parse(utf8Decode(body));
+    if (/^text\//i.test(contentType)) return utf8Decode(body);
+    return body;
+  }
+};
+var errorText = (error) => (error instanceof Error ? error.message : String(error)).slice(0, 2e3);
+var headerText = (text) => text.replace(/[^\x20-\x7e]/g, " ").trim().slice(0, 500);
+var toDate = (value) => {
+  if (!value) return null;
+  const date = new Date(/^\d+$/.test(value) ? Number(value) : value);
+  return Number.isNaN(date.getTime()) ? null : date;
+};
+var BATCH_LIMIT = 100;
+var ACK_FLUSH_MS = 25;
+var ACK_RETRY_DELAYS_MS = [200, 1e3];
+var EMPTY_POLL_MIN_MS = 1e3;
+var EMPTY_POLL_MAX_MS = 5e3;
+var sleep2 = (ms, signal) => new Promise((resolve) => {
+  if (signal?.aborted) return resolve();
+  const timer = setTimeout(done, ms);
+  function done() {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", done);
+    resolve();
+  }
+  signal?.addEventListener("abort", done, { once: true });
+});
+var Queue = class {
+  constructor(name, resource, options = {}) {
+    this.name = name;
+    this.resource = resource;
+    this.options = options;
+    this.codec = options.codec ?? defaultQueueCodec;
+  }
+  name;
+  resource;
+  options;
+  codec;
+  get scope() {
+    return { applicationId: this.options.applicationId, environment: this.options.environment };
+  }
+  toMessage(payload, options = {}) {
+    const encoded = this.codec.encode(payload);
+    const at = options.at === void 0 ? void 0 : new Date(options.at);
+    if (at && Number.isNaN(at.getTime())) throw new ConfigurationError("Invalid `at` time for a queue message");
+    return {
+      body: encoded.body,
+      encoding: encoded.encoding,
+      contentType: encoded.contentType,
+      ...options.headers ? { headers: options.headers } : {},
+      ...at ? { deliverAt: at.toISOString() } : {},
+      ...options.delay !== void 0 && !at ? { delaySeconds: durationToSeconds(options.delay) } : {},
+      ...options.groupKey ? { groupKey: options.groupKey } : {},
+      ...options.deduplicationKey ? { deduplicationKey: options.deduplicationKey } : {},
+      ...options.deploymentId ? { deploymentId: options.deploymentId } : {}
+    };
+  }
+  decode(body, contentType) {
+    const decoded = this.codec.decode(body, contentType);
+    return this.options.validate ? this.options.validate(decoded) : decoded;
+  }
+  /**
+   * Sends one message.
+   *
+   * @example
+   * ```ts
+   * await emails.send({ to: 'jane@example.com' });
+   * await emails.send({ to: 'jane@example.com' }, { delay: '10m' });
+   * await emails.send(reminder, { at: new Date('2027-01-01T09:00:00Z'), deduplicationKey: `reminder:${id}` });
+   * ```
+   *
+   * @throws {@link ApiError} when the message is refused, for example with
+   *   `code: 'backlog_full'` when your organization's queued storage is full.
+   *   Its `status` is 429 when sending again later may succeed and 400 when it
+   *   will not, so retry logic that keys on the status stays correct.
+   */
+  async send(payload, options) {
+    const result = await this.resource().send(this.name, this.toMessage(payload, options), {
+      ...this.scope,
+      autoCreate: this.options.autoCreate
+    });
+    if (result.messageId === null) throw new ApiError(result.error, result.retryable ? 429 : 400, result.code);
+    return { messageId: result.messageId, deduplicated: result.deduplicated, deliverAt: new Date(result.deliverAt) };
+  }
+  /**
+   * Sends many messages, 100 per request. Results come back in input order;
+   * a refused message does not fail the rest; its error carries status 429
+   * when it may be sent again later and 400 when it may not. Chunks are split by count only:
+   * a request whose message bodies exceed 4 MiB in total is refused whole.
+   */
+  async sendBatch(messages) {
+    const results = [];
+    for (let index = 0; index < messages.length; index += BATCH_LIMIT) {
+      const chunk = messages.slice(index, index + BATCH_LIMIT);
+      const sent = await this.resource().sendBatch(
+        this.name,
+        chunk.map(({ payload, ...options }) => this.toMessage(payload, options)),
+        { ...this.scope, autoCreate: this.options.autoCreate }
+      );
+      for (const result of sent) {
+        results.push(
+          result.messageId === null ? { messageId: null, error: new ApiError(result.error, result.retryable ? 429 : 400, result.code) } : { messageId: result.messageId, deduplicated: result.deduplicated, deliverAt: new Date(result.deliverAt) }
+        );
+      }
+    }
+    return results;
+  }
+  /** Deletes a message that has not been processed yet, such as a scheduled send. */
+  async cancel(messageId) {
+    await this.resource().deleteMessage(this.name, messageId, this.scope);
+  }
+  /**
+   * Leases messages from a pull queue. Waits up to `wait` (at most 20
+   * seconds) for the first message, then returns what is available.
+   */
+  async receive(options = {}) {
+    const records = await this.resource().receive(
+      this.name,
+      {
+        maxMessages: options.maxMessages ?? 1,
+        ...options.wait === void 0 ? {} : { waitSeconds: Math.min(durationToSeconds(options.wait), 20) },
+        ...options.visibilityTimeout === void 0 ? {} : { visibilityTimeoutSeconds: durationToSeconds(options.visibilityTimeout) }
+      },
+      { ...this.scope, signal: options.signal }
+    );
+    return records.map((record) => this.toReceived(record));
+  }
+  toReceived(record) {
+    const resource = this.resource();
+    const receipt = record.receipt ?? "";
+    const bytes = record.encoding === "base64" ? base64ToBytes(record.body) : utf8Encode(record.body);
+    const nack = (request) => resource.nack(this.name, record.id, { receipt, ...request }, this.scope).then(() => void 0);
+    let payload;
+    let decodeError;
+    try {
+      payload = this.decode(bytes, record.contentType);
+    } catch (error) {
+      decodeError = error;
+    }
+    return {
+      messageId: record.id,
+      queue: this.name,
+      attempt: record.attempts,
+      createdAt: toDate(record.createdAt),
+      groupKey: record.groupKey,
+      deduplicationKey: record.deduplicationKey,
+      deploymentId: record.deploymentId,
+      headers: record.headers,
+      receipt,
+      leaseExpiresAt: toDate(record.leaseExpiresAt),
+      get payload() {
+        if (decodeError !== void 0) throw new NonRetryableError(`Undecodable payload: ${errorText(decodeError)}`);
+        return payload;
+      },
+      ack: () => resource.ack(this.name, record.id, receipt, this.scope).then(() => void 0),
+      retry: (options = {}) => nack({
+        ...options.delay === void 0 ? {} : { delaySeconds: durationToSeconds(options.delay) },
+        ...options.error ? { error: options.error } : {}
+      }),
+      defer: (delay2) => nack({ delaySeconds: durationToSeconds(delay2), countAttempt: false }),
+      deadLetter: (reason) => nack({ deadLetter: true, ...reason ? { error: reason } : {} }),
+      extendLease: (duration) => resource.extend(this.name, record.id, receipt, durationToSeconds(duration), this.scope).then(() => void 0)
+    };
+  }
+  /**
+   * Receives and processes messages until `signal` aborts, or until the queue
+   * is empty with `stopWhenEmpty`. A handler that returns acknowledges the
+   * message; {@link RetryLaterError} defers it, {@link NonRetryableError}
+   * dead-letters it, and any other error retries it with backoff.
+   *
+   * @example
+   * ```ts
+   * const controller = new AbortController();
+   * await jobs.consume(async (job) => processJob(job), { maxMessages: 10, signal: controller.signal });
+   * ```
+   */
+  async consume(handler, options = {}) {
+    const wait = options.wait ?? (options.stopWhenEmpty ? 0 : 20);
+    const waitMs = Math.min(durationToSeconds(wait), 20) * 1e3;
+    const pending = [];
+    let timer;
+    const sendAcks = async (batch) => {
+      const resource = this.resource();
+      for (let attempt = 0; ; attempt += 1) {
+        try {
+          const { results } = await resource.ackBatch(
+            this.name,
+            batch.map((message) => ({ messageId: message.messageId, receipt: message.receipt })),
+            this.scope
+          );
+          return batch.map((_message, index) => {
+            const result = results[index];
+            if (result?.acknowledged || attempt > 0 && result?.code === "message_not_found") return void 0;
+            const code = result?.code ?? "no_result";
+            return new ApiError(
+              `Acknowledging message failed: ${code}`,
+              code === "message_not_found" ? 404 : 409,
+              code
+            );
+          });
+        } catch (error) {
+          if (error instanceof ApiError && error.status === 404 && error.code !== "queue_not_found") {
+            const settled = await Promise.allSettled(
+              batch.map((message) => resource.ack(this.name, message.messageId, message.receipt, this.scope))
+            );
+            return settled.map(
+              (outcome) => outcome.status === "fulfilled" ? void 0 : outcome.reason instanceof Error ? outcome.reason : new Error(errorText(outcome.reason))
+            );
+          }
+          const retryable = !(error instanceof ApiError) || error.status >= 500 || error.status === 429;
+          const delay2 = ACK_RETRY_DELAYS_MS[attempt];
+          if (!retryable || delay2 === void 0) throw error;
+          await sleep2(delay2, void 0);
+        }
+      }
+    };
+    const flush = () => {
+      clearTimeout(timer);
+      timer = void 0;
+      const batch = pending.splice(0, BATCH_LIMIT);
+      if (pending.length > 0) timer = setTimeout(flush, 0);
+      if (batch.length === 0) return;
+      sendAcks(batch.map(({ message }) => message)).then((errors) => batch.forEach(({ settled }, index) => settled(errors[index]))).catch((error) => batch.forEach(({ settled }) => settled(error)));
+    };
+    const acknowledge = (message) => new Promise((resolve, reject) => {
+      pending.push({
+        message,
+        settled: (error) => {
+          if (error === void 0) resolve();
+          else reject(error instanceof Error ? error : new Error(errorText(error)));
+        }
+      });
+      if (pending.length >= BATCH_LIMIT) flush();
+      else timer ??= setTimeout(flush, ACK_FLUSH_MS);
+    });
+    while (!options.signal?.aborted) {
+      let messages;
+      const started = Date.now();
+      try {
+        messages = await this.receive({
+          maxMessages: options.maxMessages ?? 10,
+          wait,
+          visibilityTimeout: options.visibilityTimeout,
+          signal: options.signal
+        });
+      } catch (error) {
+        if (options.signal?.aborted) return;
+        throw error;
+      }
+      if (messages.length === 0) {
+        if (options.stopWhenEmpty) return;
+        const remaining = Math.max(waitMs, EMPTY_POLL_MIN_MS) - (Date.now() - started);
+        if (remaining > 0) await sleep2(Math.min(remaining, EMPTY_POLL_MAX_MS), options.signal);
+        continue;
+      }
+      await Promise.all(
+        messages.map(async (message) => {
+          let outcome;
+          try {
+            await handler(message.payload, message);
+            outcome = acknowledge(message);
+          } catch (error) {
+            outcome = error instanceof RetryLaterError ? message.defer(error.delaySeconds) : error instanceof NonRetryableError ? message.deadLetter(error.message) : message.retry({ error: errorText(error) });
+          }
+          try {
+            await outcome;
+          } catch (settleError) {
+            options.onError?.(settleError);
+          }
+        })
+      );
+    }
+  }
+  /**
+   * Builds a push consumer: a `(request: Request) => Promise<Response>`
+   * function for the queue's consumer path, such as a Next.js route handler.
+   *
+   * It verifies the delivery signature, decodes the payload and calls
+   * `handler`. Returning acknowledges the message. Throw
+   * {@link RetryLaterError} to defer it without spending an attempt,
+   * {@link NonRetryableError} to dead-letter it, or anything else to retry
+   * with backoff.
+   *
+   * @example
+   * ```ts
+   * // app/api/queues/emails/route.ts
+   * export const POST = emails.handler(async (email, { attempt }) => {
+   *   await sendEmail(email);
+   * });
+   * ```
+   */
+  handler(handler) {
+    return async (request) => {
+      const header = (name) => request.headers.get(name);
+      const messageId = header(QUEUE_DELIVERY_HEADERS.messageId);
+      const queueName = header(QUEUE_DELIVERY_HEADERS.name);
+      const attempt = Number(header(QUEUE_DELIVERY_HEADERS.attempt) ?? "1");
+      if (!messageId || !queueName) {
+        return Response.json({ error: "Not a queue delivery" }, { status: 400 });
+      }
+      if (queueName !== this.name) {
+        console.error(`[gigadrive] Rejected a delivery for queue "${queueName}" at the handler of "${this.name}"`);
+        return Response.json({ error: `This endpoint consumes queue "${this.name}"` }, { status: 400 });
+      }
+      const body = new Uint8Array(await request.arrayBuffer());
+      if (!this.options.allowUnsigned) {
+        const secret = this.options.signingSecret ?? readSigningSecret();
+        if (!secret) {
+          console.error(
+            `[gigadrive] Rejected a queue delivery: ${QUEUE_SIGNING_SECRET_ENV} is not set. Deployments receive it automatically; set allowUnsigned for local development.`
+          );
+          return Response.json({ error: "Queue signing secret is not configured" }, { status: 500 });
+        }
+        const valid = await verifyQueueSignature(header(QUEUE_SIGNATURE_HEADER), {
+          secret,
+          queue: queueName,
+          messageId,
+          attempt,
+          body
+        });
+        if (!valid) return Response.json({ error: "Invalid queue signature" }, { status: 401 });
+      }
+      const meta = {
+        messageId,
+        queue: queueName,
+        attempt,
+        createdAt: toDate(header(QUEUE_DELIVERY_HEADERS.createdAt)),
+        groupKey: header(QUEUE_DELIVERY_HEADERS.groupKey),
+        deduplicationKey: header(QUEUE_DELIVERY_HEADERS.deduplicationKey),
+        deploymentId: header(QUEUE_DELIVERY_HEADERS.deploymentId),
+        headers: Object.fromEntries(
+          [...request.headers.entries()].filter(([name]) => !name.startsWith("x-gigadrive-queue-"))
+        )
+      };
+      let payload;
+      try {
+        payload = this.decode(body, header("content-type") ?? "application/octet-stream");
+      } catch (error) {
+        return deadLetterResponse(`Undecodable payload: ${errorText(error)}`);
+      }
+      try {
+        await handler(payload, meta);
+        return Response.json({ ok: true });
+      } catch (error) {
+        if (error instanceof RetryLaterError) {
+          return Response.json(
+            { ok: true, retryAfter: error.delaySeconds },
+            { headers: { [QUEUE_RESPONSE_HEADERS.retryAfter]: String(error.delaySeconds) } }
+          );
+        }
+        if (error instanceof NonRetryableError) return deadLetterResponse(error.message);
+        console.error(`[gigadrive] Queue handler for "${queueName}" failed (attempt ${String(attempt)})`, error);
+        return Response.json({ error: errorText(error) }, { status: 500 });
+      }
+    };
+  }
+  /** Creates the queue, or applies `settings` to it. Use it to make a push queue from code. */
+  async ensure(settings = {}) {
+    return this.resource().ensure(this.name, settings, this.scope);
+  }
+  /** The queue's settings and live depth. */
+  async info() {
+    return this.resource().get(this.name, this.scope);
+  }
+  /** Stops deliveries until {@link resume}. Sends are still accepted. */
+  async pause() {
+    await this.resource().pause(this.name, this.scope);
+  }
+  async resume() {
+    await this.resource().resume(this.name, this.scope);
+  }
+  /** Deletes every message, or only the dead letters. */
+  async purge(scope = "all") {
+    return (await this.resource().purge(this.name, scope, this.scope)).purgedMessages;
+  }
+  /** Moves dead letters back for another round of attempts. */
+  async redrive(messageIds) {
+    return (await this.resource().redrive(this.name, messageIds, this.scope)).redrivenMessages;
+  }
+  /**
+   * Creates or updates a cron schedule that sends `payload` into this queue.
+   *
+   * @example
+   * ```ts
+   * await digests.schedule('weekday-digest', { cron: '0 8 * * MON-FRI', timezone: 'Europe/Berlin', payload: { kind: 'digest' } });
+   * ```
+   */
+  async schedule(name, schedule) {
+    const encoded = schedule.payload === void 0 ? void 0 : this.codec.encode(schedule.payload);
+    if (encoded?.encoding === "base64") throw new ConfigurationError("Scheduled payloads must be text or JSON");
+    const input = {
+      cron: schedule.cron,
+      ...schedule.timezone ? { timezone: schedule.timezone } : {},
+      ...encoded ? { body: encoded.body, contentType: encoded.contentType } : {},
+      ...schedule.headers ? { headers: schedule.headers } : {},
+      ...schedule.enabled === void 0 ? {} : { enabled: schedule.enabled }
+    };
+    try {
+      return await this.resource().createSchedule(this.name, name, input, this.scope);
+    } catch (error) {
+      if (error instanceof ApiError && error.code === "schedule_exists") {
+        return this.resource().updateSchedule(this.name, name, input, this.scope);
+      }
+      throw error;
+    }
+  }
+  /** Deletes a schedule. */
+  async unschedule(name) {
+    await this.resource().deleteSchedule(this.name, name, this.scope);
+  }
+};
+var deadLetterResponse = (reason) => Response.json(
+  { error: reason },
+  {
+    status: 422,
+    headers: { [QUEUE_RESPONSE_HEADERS.action]: "dead-letter", [QUEUE_RESPONSE_HEADERS.error]: headerText(reason) }
+  }
+);
+var readSigningSecret = () => {
+  const env = globalThis.process?.env;
+  return env?.[QUEUE_SIGNING_SECRET_ENV] || void 0;
+};
+
+// src/resources/queues.ts
+var QueuesResource = class extends BaseResource {
+  constructor(httpClient, defaultApplicationId) {
+    super(httpClient);
+    this.defaultApplicationId = defaultApplicationId;
+  }
+  defaultApplicationId;
+  /**
+   * Returns a typed handle for one queue. Nothing is sent until you call a
+   * method on it, and the queue does not need to exist: the first send
+   * creates a pull queue with default settings.
+   *
+   * @typeParam T - The payload type sent and received through this queue.
+   * @param name - Queue name, unique in the environment and case-sensitive.
+   * @param options - Scope, codec and default send options.
+   */
+  queue(name, options = {}) {
+    return new Queue(name, () => this, options);
+  }
+  base(options) {
+    return `/applications/${encodeURIComponent(
+      resolveStorageApplicationId(this.defaultApplicationId, options?.applicationId)
+    )}/queues`;
+  }
+  path(name, options, suffix = "") {
+    return `${this.base(options)}/${encodeURIComponent(name)}${suffix}`;
+  }
+  /** Lists the environment's queues with their live depth. */
+  async list(options) {
+    return this.httpClient.get(this.base(options), { query: { environment: options?.environment } });
+  }
+  /** Fetches one queue with its live depth. */
+  async get(name, options) {
+    return this.httpClient.get(this.path(name, options), { query: { environment: options?.environment } });
+  }
+  /**
+   * Creates a queue. Fails with `queue_exists` when the name is taken; use
+   * {@link ensure} for create-or-update.
+   */
+  async create(name, settings = {}, options) {
+    return this.httpClient.post(this.base(options), { name, environment: options?.environment, ...settings });
+  }
+  /** Creates the queue, or applies `settings` to the existing one. */
+  async ensure(name, settings = {}, options) {
+    return this.httpClient.put(this.path(name, options), { environment: options?.environment, ...settings });
+  }
+  /** Changes a queue's settings. Messages already queued keep flowing. */
+  async update(name, settings, options) {
+    return this.httpClient.patch(this.path(name, options), { environment: options?.environment, ...settings });
+  }
+  /** Deletes a queue, its messages and its schedules. */
+  async delete(name, options) {
+    return this.httpClient.delete(this.path(name, options), { query: { environment: options?.environment } });
+  }
+  /** Stops deliveries. Sends are still accepted and wait until you resume. */
+  async pause(name, options) {
+    return this.httpClient.post(this.path(name, options, "/pause"), { environment: options?.environment });
+  }
+  /** Restarts deliveries after {@link pause}. */
+  async resume(name, options) {
+    return this.httpClient.post(this.path(name, options, "/resume"), { environment: options?.environment });
+  }
+  /** Deletes every message, or only the dead letters. */
+  async purge(name, scope = "all", options) {
+    return this.httpClient.post(this.path(name, options, "/purge"), { environment: options?.environment, scope });
+  }
+  /** Moves dead letters back to the queue with fresh attempts: all of them, or the given ids. */
+  async redrive(name, messageIds, options) {
+    return this.httpClient.post(this.path(name, options, "/redrive"), {
+      environment: options?.environment,
+      ...messageIds ? { messageIds } : {}
+    });
+  }
+  /**
+   * Sends one message.
+   *
+   * @param autoCreate - Create a pull queue with default settings when the name is new. Default `true`.
+   */
+  async send(name, message, options) {
+    return this.httpClient.post(this.path(name, options, "/messages"), {
+      environment: options?.environment,
+      autoCreate: options?.autoCreate,
+      ...message
+    });
+  }
+  /**
+   * Sends up to 100 messages in one request. Results come back in input
+   * order; one rejected message does not fail the others.
+   */
+  async sendBatch(name, messages, options) {
+    const { results } = await this.httpClient.post(
+      this.path(name, options, "/messages"),
+      { environment: options?.environment, autoCreate: options?.autoCreate, messages }
+    );
+    return results;
+  }
+  /** Lists messages in one state without leasing them. Bodies are cut to a preview. */
+  async listMessages(name, query = {}, options) {
+    return this.httpClient.get(this.path(name, options, "/messages"), {
+      query: { environment: options?.environment, ...query }
+    });
+  }
+  /** Fetches one message without leasing it. */
+  async getMessage(name, messageId, options) {
+    return this.httpClient.get(this.path(name, options, `/messages/${encodeURIComponent(messageId)}`), {
+      query: { environment: options?.environment }
+    });
+  }
+  /**
+   * Cancels a message that has not been delivered yet, such as a scheduled
+   * send you no longer want. A message being delivered or dead-lettered
+   * answers 400 `invalid_request`; settle it from its consumer, or purge or
+   * redrive dead letters.
+   */
+  async deleteMessage(name, messageId, options) {
+    return this.httpClient.delete(this.path(name, options, `/messages/${encodeURIComponent(messageId)}`), {
+      query: { environment: options?.environment }
+    });
+  }
+  /**
+   * Leases up to `maxMessages` messages from a pull queue, waiting up to
+   * `waitSeconds` (at most 20) for the first one. Each must be acknowledged
+   * with its receipt before the lease ends, or it is delivered again.
+   */
+  async receive(name, request = {}, options) {
+    const { messages } = await this.httpClient.post(
+      this.path(name, options, "/messages/receive"),
+      { environment: options?.environment, ...request },
+      { signal: options?.signal }
+    );
+    return messages;
+  }
+  /** Acknowledges a received message, deleting it. */
+  async ack(name, messageId, receipt, options) {
+    return this.httpClient.post(this.path(name, options, `/messages/${encodeURIComponent(messageId)}/ack`), {
+      environment: options?.environment,
+      receipt
+    });
+  }
+  /**
+   * Acknowledges up to 100 received messages in one request. Each settles on
+   * its own: `results` reports, in order, which were acknowledged and why any
+   * were not (`message_not_found`, `receipt_mismatch`). A batch counts one
+   * operation per started ten acknowledged messages.
+   */
+  async ackBatch(name, messages, options) {
+    return this.httpClient.post(this.path(name, options, "/messages/ack"), {
+      environment: options?.environment,
+      messages
+    });
+  }
+  /**
+   * Releases a received message: retry with backoff (or after `delaySeconds`),
+   * or dead-letter it now with `deadLetter: true`. `countAttempt: false`
+   * reschedules without spending an attempt.
+   */
+  async nack(name, messageId, request, options) {
+    return this.httpClient.post(this.path(name, options, `/messages/${encodeURIComponent(messageId)}/nack`), {
+      environment: options?.environment,
+      ...request
+    });
+  }
+  /** Extends a received message's lease to `visibilityTimeoutSeconds` from now. */
+  async extend(name, messageId, receipt, visibilityTimeoutSeconds, options) {
+    return this.httpClient.post(this.path(name, options, `/messages/${encodeURIComponent(messageId)}/extend`), {
+      environment: options?.environment,
+      receipt,
+      visibilityTimeoutSeconds
+    });
+  }
+  /** Lists a queue's schedules. */
+  async listSchedules(name, options) {
+    return this.httpClient.get(this.path(name, options, "/schedules"), {
+      query: { environment: options?.environment }
+    });
+  }
+  /**
+   * Creates a schedule that sends a message into the queue on a cron.
+   *
+   * @example
+   * ```ts
+   * await client.queues.createSchedule('emails', 'daily-digest', {
+   *   cron: '0 8 * * MON-FRI',
+   *   timezone: 'Europe/Berlin',
+   *   json: { kind: 'digest' },
+   * });
+   * ```
+   */
+  async createSchedule(name, schedule, input, options) {
+    return this.httpClient.post(this.path(name, options, "/schedules"), {
+      environment: options?.environment,
+      name: schedule,
+      ...input
+    });
+  }
+  /** Changes a schedule. Its next run is recomputed when the cron or time zone changes. */
+  async updateSchedule(name, schedule, input, options) {
+    return this.httpClient.patch(this.path(name, options, `/schedules/${encodeURIComponent(schedule)}`), {
+      environment: options?.environment,
+      ...input
+    });
+  }
+  /** Deletes a schedule. Messages it already sent stay queued. */
+  async deleteSchedule(name, schedule, options) {
+    return this.httpClient.delete(this.path(name, options, `/schedules/${encodeURIComponent(schedule)}`), {
+      query: { environment: options?.environment }
+    });
+  }
+  /** Sends the schedule's message now, outside its cron. */
+  async triggerSchedule(name, schedule, options) {
+    return this.httpClient.post(this.path(name, options, `/schedules/${encodeURIComponent(schedule)}/trigger`), {
+      environment: options?.environment
+    });
+  }
+};
+
 // src/resources/sticky-sessions.ts
 var StickySessionsResource = class extends BaseResource {
   /**
@@ -2470,6 +3537,12 @@ var GigadriveClient = class {
   stickySessions;
   /** Managed image optimization inspection and cache purge operations. */
   imageOptimization;
+  /**
+   * Network Queues: manage queues and schedules, send, receive and
+   * acknowledge messages. `client.queues.queue<T>(name)` returns a typed
+   * handle bound to one queue.
+   */
+  queues;
   constructor(config = {}) {
     const baseUrl = config.baseUrl ?? readEnv("GIGADRIVE_API_BASE_URL") ?? DEFAULT_BASE_URL2;
     const applicationId = config.applicationId ?? readEnv("GIGADRIVE_APPLICATION_ID");
@@ -2485,6 +3558,7 @@ var GigadriveClient = class {
     this.apiKeys = new ApiKeysResource(httpClient);
     this.stickySessions = new StickySessionsResource(httpClient);
     this.imageOptimization = new ImageOptimizationResource(httpClient);
+    this.queues = new QueuesResource(httpClient, applicationId);
   }
 };
 
@@ -2499,6 +3573,161 @@ async function* paginate(fetchPage) {
     cursor = page.nextCursor;
   } while (cursor);
 }
+
+// src/queues/default-client.ts
+var defaultClient;
+var defaultQueuesResource = () => {
+  defaultClient ??= new GigadriveClient();
+  return defaultClient.queues;
+};
+function queue(name, options = {}) {
+  const { client, ...queueOptions } = options;
+  return new Queue(name, () => client?.queues ?? defaultQueuesResource(), queueOptions);
+}
+
+// src/queues/workflow.ts
+var WORKFLOW_CONSUMER_PATH = "/.well-known/workflow/v1/flow";
+var WORKFLOW_QUEUE_NAME_HEADER = "x-workflow-queue-name";
+var WORKFLOW_PREFIX = /^__(?:[a-z][a-z0-9]*_)?wkf_workflow_/;
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var RESERVED_HEADER = /^(host|content-length|content-type|connection|transfer-encoding|te|upgrade|keep-alive|proxy-.*|authorization|cookie|x-gigadrive-.*|x-nebula-.*|x-substrate-.*|x-vercel-.*|x-forwarded-.*|x-bunny-.*|x-real-ip|true-client-ip|forwarded)$/i;
+var encodeWorkflowMessage = (message) => JSON.stringify(
+  message,
+  (_key, value) => value instanceof Uint8Array ? { __type: "Uint8Array", data: bytesToBase64(value) } : value
+);
+var decodeWorkflowMessage = (text) => JSON.parse(text, (_key, value) => {
+  if (typeof value === "object" && value !== null && value.__type === "Uint8Array" && typeof value.data === "string") {
+    return base64ToBytes(value.data);
+  }
+  return value;
+});
+var readEnv2 = (name) => globalThis.process?.env?.[name] || void 0;
+var deduplicationKeyFor = async (idempotencyKey) => idempotencyKey.length <= 256 ? idempotencyKey : `wkf:sha256:${toHex2(await crypto.subtle.digest("SHA-256", toArrayBuffer(utf8Encode(idempotencyKey))))}`;
+function createWorkflowQueue(options = {}) {
+  const resource = () => options.client?.queues ?? defaultQueuesResource();
+  const scope = { applicationId: options.applicationId, environment: options.environment };
+  const ensured = /* @__PURE__ */ new Map();
+  const physicalQueue = async (queueName) => {
+    const prefix = WORKFLOW_PREFIX.exec(queueName)?.[0];
+    if (!prefix) throw new Error(`"${queueName}" is not a Workflow SDK queue name`);
+    let ready = ensured.get(prefix);
+    if (!ready) {
+      const consumerPath = options.consumerPath ?? WORKFLOW_CONSUMER_PATH;
+      ready = options.queueSettings ? resource().ensure(prefix, { ...options.queueSettings, consumerPath }, scope) : (
+        // Create-only: a queue that exists keeps the settings someone gave it in the console.
+        resource().create(prefix, { maxAttempts: 100, visibilityTimeoutSeconds: 900, deadLetter: true, consumerPath }, scope).catch((error) => {
+          if (error instanceof ApiError && error.code === "queue_exists") return void 0;
+          throw error;
+        })
+      );
+      ensured.set(prefix, ready);
+      ready.catch(() => ensured.delete(prefix));
+    }
+    await ready;
+    return prefix;
+  };
+  const toMessage = async (queueName, message, opts = {}) => {
+    const headers = Object.fromEntries(
+      Object.entries(opts.headers ?? {}).filter(([name]) => !RESERVED_HEADER.test(name))
+    );
+    headers[WORKFLOW_QUEUE_NAME_HEADER] = queueName;
+    const pin = opts.deploymentId ?? options.deploymentId ?? readEnv2("GIGADRIVE_DEPLOYMENT_ID");
+    return {
+      body: encodeWorkflowMessage(message),
+      contentType: "application/json",
+      headers,
+      ...opts.delaySeconds && opts.delaySeconds > 0 ? { delaySeconds: Math.ceil(opts.delaySeconds) } : {},
+      ...opts.idempotencyKey ? { deduplicationKey: await deduplicationKeyFor(opts.idempotencyKey) } : {},
+      ...pin && UUID.test(pin) ? { deploymentId: pin } : {}
+    };
+  };
+  return {
+    getDeploymentId: () => Promise.resolve(options.deploymentId ?? readEnv2("GIGADRIVE_DEPLOYMENT_ID") ?? "local"),
+    async queue(queueName, message, opts) {
+      const physical = await physicalQueue(queueName);
+      const result = await resource().send(physical, await toMessage(queueName, message, opts), {
+        ...scope,
+        autoCreate: false
+      });
+      if (result.messageId === null) throw new Error(`Workflow message was refused: ${result.error}`);
+      return { messageId: result.messageId };
+    },
+    async queueBatch(queueName, messages) {
+      const physical = await physicalQueue(queueName);
+      const results = [];
+      for (let index = 0; index < messages.length; index += 100) {
+        const chunk = messages.slice(index, index + 100);
+        const sent = await resource().sendBatch(
+          physical,
+          await Promise.all(chunk.map(({ message, opts }) => toMessage(queueName, message, opts))),
+          { ...scope, autoCreate: false }
+        );
+        for (const result of sent) {
+          results.push(
+            result.messageId === null ? { messageId: null, error: result.error, retryable: result.retryable } : { messageId: result.messageId }
+          );
+        }
+      }
+      return results;
+    },
+    createQueueHandler(queueNamePrefix, handler) {
+      return async (request) => {
+        const messageId = request.headers.get(QUEUE_DELIVERY_HEADERS.messageId);
+        const physicalName = request.headers.get(QUEUE_DELIVERY_HEADERS.name);
+        const attempt = Number(request.headers.get(QUEUE_DELIVERY_HEADERS.attempt) ?? "1");
+        const queueName = request.headers.get(WORKFLOW_QUEUE_NAME_HEADER);
+        if (!messageId || !physicalName || !queueName) {
+          return Response.json({ error: "Missing required headers" }, { status: 400 });
+        }
+        const body = new Uint8Array(await request.arrayBuffer());
+        if (!options.allowUnsigned) {
+          const secret = options.signingSecret ?? readSigningSecret();
+          const valid = secret !== void 0 && await verifyQueueSignature(request.headers.get(QUEUE_SIGNATURE_HEADER), {
+            secret,
+            queue: physicalName,
+            messageId,
+            attempt,
+            body
+          });
+          if (!valid) return Response.json({ error: "Invalid queue signature" }, { status: 401 });
+        }
+        if (physicalName !== queueNamePrefix || !queueName.startsWith(queueNamePrefix)) {
+          return Response.json({ error: "Unhandled queue" }, { status: 400 });
+        }
+        let message;
+        try {
+          message = decodeWorkflowMessage(utf8Decode(body));
+        } catch {
+          return Response.json(
+            { error: "Malformed workflow message" },
+            { status: 422, headers: { [QUEUE_RESPONSE_HEADERS.action]: "dead-letter" } }
+          );
+        }
+        try {
+          const result = await handler(message, {
+            attempt,
+            queueName,
+            messageId,
+            requestId: request.headers.get("x-request-id") ?? void 0
+          });
+          if (typeof message === "object" && message !== null && message.invoke === true) {
+            return Response.json({ result });
+          }
+          const timeoutSeconds = typeof result === "object" && result !== null ? result.timeoutSeconds : void 0;
+          if (typeof timeoutSeconds === "number" && Number.isFinite(timeoutSeconds) && timeoutSeconds >= 0) {
+            return Response.json(
+              { timeoutSeconds },
+              { headers: { [QUEUE_RESPONSE_HEADERS.retryAfter]: String(Math.ceil(timeoutSeconds)) } }
+            );
+          }
+          return Response.json({ ok: true });
+        } catch (error) {
+          return Response.json(String(error), { status: 500 });
+        }
+      };
+    }
+  };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AiGatewayAudioResource,
@@ -2509,6 +3738,7 @@ async function* paginate(fetchPage) {
   AiGatewayVideosResource,
   ApiError,
   ApiKeysResource,
+  ApplicationDomainsResource,
   ApplicationEnvVarsResource,
   ApplicationRequestsResource,
   ApplicationStorageResource,
@@ -2516,14 +3746,25 @@ async function* paginate(fetchPage) {
   AuthenticationError,
   ConfigurationError,
   DeploymentsResource,
+  DomainNotActiveError,
   GigadriveClient,
   GigadriveError,
   ImageOptimizationResource,
+  NonRetryableError,
   OrganizationAiGatewayResource,
+  OrganizationDomainsResource,
   OrganizationEnvVarsResource,
   OrganizationMembersResource,
   OrganizationProductsResource,
   OrganizationsResource,
+  QUEUE_DELIVERY_HEADERS,
+  QUEUE_RESPONSE_HEADERS,
+  QUEUE_SIGNATURE_HEADER,
+  QUEUE_SIGNATURE_TOLERANCE_MS,
+  QUEUE_SIGNING_SECRET_ENV,
+  Queue,
+  QueuesResource,
+  RetryLaterError,
   StickySessionsResource,
   StorageBucketsResource,
   StorageObjectsResource,
@@ -2531,8 +3772,16 @@ async function* paginate(fetchPage) {
   StorageUploadSessionsResource,
   UploadError,
   UploadSessionExpiredError,
+  WORKFLOW_CONSUMER_PATH,
+  WORKFLOW_QUEUE_NAME_HEADER,
   createManagedImageUrl,
+  createWorkflowQueue,
+  defaultQueueCodec,
+  durationToSeconds,
   paginate,
-  parseSSEStream
+  parseSSEStream,
+  queue,
+  signQueueDelivery,
+  verifyQueueSignature
 });
 //# sourceMappingURL=index.js.map