@astrogate/sdk 0.1.0 → 0.3.0

package/dist/admission.d.ts

@@ -0,0 +1,35 @@
+import type { ManagementOptions } from "./management.js";
+import type { components } from "./wire.gen.js";
+type Schemas = components["schemas"];
+export type AdmissionPolicy = Schemas["AdmissionPolicy"];
+export type AdmissionState = Schemas["AdmissionState"];
+export type AdmissionUsagePage = Schemas["AdmissionUsagePage"];
+export interface UsageQuery {
+    from: string;
+    until: string;
+    limit: number;
+    project?: string;
+    environment?: string;
+    workload?: "application" | "database" | "identity" | "storage" | "jobs" | "builds" | "realtime";
+    subject?: string;
+    after?: string;
+}
+export declare function admissionState(value: unknown): value is AdmissionState;
+export declare function admissionUsage(value: unknown): value is AdmissionUsagePage;
+export declare function admissionClient(options: ManagementOptions, endpoint: URL, base: string): {
+    get: (signal?: AbortSignal) => Promise<{
+        policy: components["schemas"]["AdmissionPolicy"];
+        occupancy: components["schemas"]["AdmissionOccupancy"][];
+        storageCredits: components["schemas"]["TenantStorageCredit"][];
+    }>;
+    assign: (input: Schemas["AssignAdmissionPolicy"], signal?: AbortSignal) => Promise<{
+        revision: number;
+        profile: components["schemas"]["AdmissionProfile"];
+        assignedAt: string;
+    }>;
+    usage: (query: UsageQuery, signal?: AbortSignal) => Promise<{
+        points: components["schemas"]["AdmissionUsagePoint"][];
+        next?: string;
+    }>;
+};
+export {};

package/dist/admission.js

@@ -0,0 +1,112 @@
+import { AstrogateError, object, requestJSON } from "./http.js";
+function count(value) {
+    return Number.isSafeInteger(value) && Number(value) >= 0;
+}
+function date(value) {
+    return typeof value === "string" && Number.isFinite(Date.parse(value));
+}
+function positive(value) {
+    return count(value) && value > 0;
+}
+function rule(value) {
+    return (object(value) &&
+        typeof value.requestsPerSecond === "number" &&
+        Number.isFinite(value.requestsPerSecond) &&
+        value.requestsPerSecond > 0 &&
+        ["burst", "concurrent", "executionMs"].every((key) => positive(value[key])) &&
+        ["pending", "pendingBytes", "waitMs"].every((key) => count(value[key])));
+}
+function validRetention(value) {
+    return (object(value) &&
+        positive(value.rawLogsSeconds) &&
+        positive(value.usageSeconds) &&
+        count(value.subjectSeconds) &&
+        value.subjectSeconds <= value.usageSeconds);
+}
+function policy(value) {
+    if (!object(value) ||
+        !positive(value.revision) ||
+        !date(value.assignedAt) ||
+        !object(value.profile))
+        return false;
+    const p = value.profile;
+    return (typeof p.id === "string" &&
+        p.id.length > 0 &&
+        typeof p.evidence === "string" &&
+        p.evidence.length > 0 &&
+        positive(p.durableBytes) &&
+        validRetention(p.retention) &&
+        object(p.rules) &&
+        object(p.rules.all) &&
+        Object.entries(p.rules).every(([kind, value]) => [
+            "all",
+            "application",
+            "database",
+            "identity",
+            "storage",
+            "jobs",
+            "builds",
+            "realtime",
+        ].includes(kind) &&
+            object(value) &&
+            rule(value.tenant) &&
+            rule(value.application)));
+}
+export function admissionState(value) {
+    return (object(value) &&
+        policy(value.policy) &&
+        Array.isArray(value.occupancy) &&
+        value.occupancy.every((o) => object(o) &&
+            typeof o.projectId === "string" &&
+            typeof o.workload === "string" &&
+            ["running", "unacknowledged", "pending", "pendingBytes"].every((key) => count(o[key])) &&
+            (o.oldest === undefined || date(o.oldest))) &&
+        Array.isArray(value.storageCredits) &&
+        value.storageCredits.every((c) => object(c) &&
+            ["projectId", "environmentId", "block", "owner"].every((key) => typeof c[key] === "string") &&
+            count(c.bytes) &&
+            count(c.epoch)));
+}
+export function admissionUsage(value) {
+    return (object(value) &&
+        (value.next === undefined || date(value.next)) &&
+        Array.isArray(value.points) &&
+        value.points.every((p) => object(p) &&
+            date(p.hour) &&
+            typeof p.workload === "string" &&
+            typeof p.outcome === "string" &&
+            ["requests", "bytes", "elapsedMs"].every((key) => count(p[key]))));
+}
+// This namespace uses the same authority and transport as the management client.
+// A profile reference is the only writable entitlement, never arbitrary limits.
+export function admissionClient(options, endpoint, base) {
+    const headers = { authorization: `Bearer ${options.token}` };
+    return {
+        get: (signal) => requestJSON(new URL(base + "/admission", endpoint), options, { headers }, admissionState, signal),
+        assign: (input, signal) => {
+            if (!input.profileId || !count(input.expectedRevision))
+                throw new AstrogateError("invalid_policy_assignment", 0, "", false);
+            // A lost response to CAS needs a read/reconciliation, not a blind replay.
+            return requestJSON(new URL(base + "/admission", endpoint), { ...options, maxAttempts: 1 }, {
+                method: "POST",
+                headers: { ...headers, "content-type": "application/json" },
+                body: JSON.stringify(input),
+            }, policy, signal);
+        },
+        usage: (query, signal) => {
+            if (!date(query.from) ||
+                !date(query.until) ||
+                Date.parse(query.from) >= Date.parse(query.until) ||
+                !count(query.limit) ||
+                query.limit === 0 ||
+                (query.environment && !query.project) ||
+                (query.after && !date(query.after)))
+                throw new AstrogateError("invalid_usage_query", 0, "", false);
+            const url = new URL(base + "/usage", endpoint);
+            for (const [key, value] of Object.entries(query))
+                if (value !== undefined)
+                    url.searchParams.set(key, String(value));
+            return requestJSON(url, options, { headers }, admissionUsage, signal);
+        },
+    };
+}

package/dist/http.d.ts

@@ -1,9 +1,12 @@
+import type { components } from "./wire.gen.js";
+export type FailureDetails = Pick<components["schemas"]["Error"], "message" | "scope" | "dimension" | "reason">;
 export declare class AstrogateError extends Error {
     readonly code: string;
     readonly status: number;
     readonly requestId: string;
     readonly retryable: boolean;
-    constructor(code: string, status: number, requestId: string, retryable: boolean);
+    readonly details?: Partial<FailureDetails> | undefined;
+    constructor(code: string, status: number, requestId: string, retryable: boolean, details?: Partial<FailureDetails> | undefined);
 }
 export interface TransportBudget {
     deadlineMs: number;

package/dist/http.js

@@ -1,42 +1,85 @@
-// Shared owned HTTP behavior. Native database/auth clients retain their own
-// return values and transport semantics.
 export class AstrogateError extends Error {
     code;
     status;
     requestId;
     retryable;
-    constructor(code, status, requestId, retryable) {
-        super(code);
+    details;
+    constructor(code, status, requestId, retryable, details) {
+        super(details?.message ?? code);
         this.code = code;
         this.status = status;
         this.requestId = requestId;
         this.retryable = retryable;
+        this.details = details;
         this.name = "AstrogateError";
     }
 }
-export function object(value) { return typeof value === "object" && value !== null && !Array.isArray(value); }
-export function identifier(value) { if (!/^[A-Za-z0-9_-]+$/.test(value))
-    throw new AstrogateError("invalid_resource_reference", 0, "", false); return value; }
-export function validateBudget(options) { if (!Number.isSafeInteger(options.deadlineMs) || options.deadlineMs <= 0 || !Number.isSafeInteger(options.maxAttempts) || options.maxAttempts < 1)
-    throw new AstrogateError("explicit_transport_budget_required", 0, "", false); }
-function delay(ms, signal) { return new Promise((resolve, reject) => { if (signal.aborted) {
-    reject(signal.reason);
-    return;
-} const abort = () => { clearTimeout(timer); reject(signal.reason); }; const timer = setTimeout(() => { signal.removeEventListener("abort", abort); resolve(); }, ms); signal.addEventListener("abort", abort, { once: true }); }); }
+export function object(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function identifier(value) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value))
+        throw new AstrogateError("invalid_resource_reference", 0, "", false);
+    return value;
+}
+export function validateBudget(options) {
+    if (!Number.isSafeInteger(options.deadlineMs) ||
+        options.deadlineMs <= 0 ||
+        options.deadlineMs > timerMaximumMs ||
+        !Number.isSafeInteger(options.maxAttempts) ||
+        options.maxAttempts < 1)
+        throw new AstrogateError("explicit_transport_budget_required", 0, "", false);
+}
+// Native browser/Node timers use signed 32-bit millisecond delays. Durable
+// operations outlive transport calls and are polled instead of held for days.
+const timerMaximumMs = 2 ** 31 - 1;
+function optionalText(value, key) {
+    const field = value[key];
+    if (field !== undefined && typeof field !== "string")
+        throw new AstrogateError("invalid_error_response", 0, "", false);
+    return field;
+}
+function delay(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal.aborted) {
+            reject(signal.reason);
+            return;
+        }
+        const abort = () => {
+            clearTimeout(timer);
+            reject(signal.reason);
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener("abort", abort);
+            resolve();
+        }, ms);
+        signal.addEventListener("abort", abort, { once: true });
+    });
+}
 export async function requestResponse(url, options, input, signal) {
     validateBudget(options);
-    const combined = signal ? AbortSignal.any([AbortSignal.timeout(options.deadlineMs), signal]) : AbortSignal.timeout(options.deadlineMs);
+    const combined = signal
+        ? AbortSignal.any([AbortSignal.timeout(options.deadlineMs), signal])
+        : AbortSignal.timeout(options.deadlineMs);
     let last;
     for (let attempt = 0; attempt < options.maxAttempts; attempt++) {
         let retryAfter = 0;
         try {
-            const response = await fetch(url, { ...input, signal: combined, redirect: "error", cache: "no-store" });
+            const response = await fetch(url, {
+                ...input,
+                signal: combined,
+                redirect: "error",
+                cache: "no-store",
+            });
             if (response.ok)
                 return response;
             const after = response.headers.get("retry-after");
             if (after) {
                 const seconds = Number(after);
-                retryAfter = Number.isFinite(seconds) ? Math.max(0, seconds * 1000) : Math.max(0, Date.parse(after) - Date.now());
+                const parsed = Number.isFinite(seconds)
+                    ? seconds * 1000
+                    : Date.parse(after) - Date.now();
+                retryAfter = Number.isFinite(parsed) ? Math.max(0, parsed) : 0;
             }
             let value;
             try {
@@ -45,9 +88,17 @@ export async function requestResponse(url, options, input, signal) {
             catch {
                 throw new AstrogateError("invalid_error_response", response.status, "", false);
             }
-            if (!object(value) || typeof value.code !== "string" || typeof value.requestId !== "string" || typeof value.retryable !== "boolean")
+            if (!object(value) ||
+                typeof value.code !== "string" ||
+                typeof value.requestId !== "string" ||
+                typeof value.retryable !== "boolean")
                 throw new AstrogateError("invalid_error_response", response.status, "", false);
-            throw new AstrogateError(value.code, response.status, value.requestId, value.retryable);
+            throw new AstrogateError(value.code, response.status, value.requestId, value.retryable, {
+                message: optionalText(value, "message"),
+                scope: optionalText(value, "scope"),
+                dimension: optionalText(value, "dimension"),
+                reason: optionalText(value, "reason"),
+            });
         }
         catch (error) {
             if (combined.aborted)
@@ -57,7 +108,7 @@ export async function requestResponse(url, options, input, signal) {
                 throw error;
             if (attempt + 1 === options.maxAttempts)
                 break;
-            await delay(Math.max(retryAfter, 100 * 2 ** attempt * (0.5 + Math.random())), combined);
+            await delay(Math.min(options.deadlineMs, Math.max(retryAfter, 100 * 2 ** attempt * (0.5 + Math.random()))), combined);
         }
     }
     if (last instanceof AstrogateError)
@@ -83,7 +134,14 @@ export function managementAuthority(options) {
     if (typeof window !== "undefined")
         throw new AstrogateError("server_only_entrypoint", 0, "", false);
     const endpoint = new URL(options.endpoint);
-    if ((endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && ["127.0.0.1", "[::1]", "localhost"].includes(endpoint.hostname))) || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.pathname !== "/")
+    if ((endpoint.protocol !== "https:" &&
+        !(endpoint.protocol === "http:" &&
+            ["127.0.0.1", "[::1]", "localhost"].includes(endpoint.hostname))) ||
+        endpoint.username ||
+        endpoint.password ||
+        endpoint.search ||
+        endpoint.hash ||
+        endpoint.pathname !== "/")
         throw new AstrogateError("unsafe_management_authority", 0, "", false);
     validateBudget(options);
     if (!options.token)

package/dist/inventory.js

@@ -6,6 +6,8 @@ export function listQuery(options) {
             throw new AstrogateError("invalid_page_limit", 0, "", false);
         query.set("limit", String(options.limit));
     }
+    if (options.search !== undefined)
+        query.set("search", options.search);
     if (options.cursor !== undefined)
         query.set("cursor", options.cursor);
     return query.size ? `?${query}` : "";

package/dist/management.d.ts

@@ -1,4 +1,5 @@
 import { type PageOptions } from "./inventory.js";
+export type { AdmissionPolicy, AdmissionState, AdmissionUsagePage, UsageQuery } from "./admission.js";
 export { AstrogateError } from "./http.js";
 import type { components } from "./wire.gen.js";
 type Schemas = components["schemas"];
@@ -47,6 +48,25 @@ export interface ManagementOptions {
     maxAttempts: number;
 }
 export declare function createManagement(options: ManagementOptions): {
+    admission: {
+        get: (signal?: AbortSignal) => Promise<{
+            policy: components["schemas"]["AdmissionPolicy"];
+            occupancy: components["schemas"]["AdmissionOccupancy"][];
+            storageCredits: components["schemas"]["TenantStorageCredit"][];
+        }>;
+        assign: (input: {
+            profileId: string;
+            expectedRevision: number;
+        }, signal?: AbortSignal) => Promise<{
+            revision: number;
+            profile: components["schemas"]["AdmissionProfile"];
+            assignedAt: string;
+        }>;
+        usage: (query: import("./admission.js").UsageQuery, signal?: AbortSignal) => Promise<{
+            points: components["schemas"]["AdmissionUsagePoint"][];
+            next?: string;
+        }>;
+    };
     projects: {
         create: (input: CreateProject, controls: RequestOptions) => Promise<{
             operationId: string;
@@ -272,6 +292,11 @@ export declare function createManagement(options: ManagementOptions): {
         }>;
     };
     environments: {
+        create: (project: string, input: Schemas["CreateEnvironment"], controls: RequestOptions) => Promise<{
+            operationId: string;
+            resourceId: string;
+            statusUrl: string;
+        }>;
         list: (project: string, page?: PageOptions, signal?: AbortSignal) => Promise<import("./inventory.js").InventoryPage<{
             id: string;
             projectId: string;

package/dist/management.js

@@ -3,6 +3,7 @@ import { project, environment, placementState, placementLocations, operation, op
 import { listQuery, pageOf } from "./inventory.js";
 import { managementAuthority } from "./http.js";
 import { serviceBindings } from "./services.js";
+import { admissionClient } from "./admission.js";
 export { AstrogateError } from "./http.js";
 function object(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -66,6 +67,7 @@ export function createManagement(options) {
         return requestJSON(new URL(base + path, endpoint), options, { method: method ?? (body === undefined ? "GET" : "POST"), headers, body }, validate, controls?.signal ?? signal);
     }
     return {
+        admission: admissionClient(options, endpoint, base),
         projects: { create: (input, controls) => request(`/projects`, accepted, input, controls), list: (page = {}, signal) => request(`/projects${listQuery(page)}`, pageOf(project), undefined, undefined, signal), get: (resource, signal) => request(`/projects/${id(resource)}`, project, undefined, undefined, signal) },
         repositories: {
             create: (project, input, controls) => request(`/projects/${id(project)}/repository`, accepted, input, controls),
@@ -121,6 +123,7 @@ export function createManagement(options) {
             create: (project, environment, input, controls) => request(`/projects/${id(project)}/environments/${id(environment)}/deployments`, accepted, input, controls),
         },
         environments: {
+            create: (project, input, controls) => request(`/projects/${id(project)}/environments`, accepted, input, controls),
             list: (project, page = {}, signal) => request(`/projects/${id(project)}/environments${listQuery(page)}`, pageOf(environment), undefined, undefined, signal),
             get: (project, resource, signal) => request(`/projects/${id(project)}/environments/${id(resource)}`, environment, undefined, undefined, signal),
             getPlacement: (project, environment, signal) => request(`/projects/${id(project)}/environments/${id(environment)}/placement`, placementState, undefined, undefined, signal),

package/dist/operator-resources.d.ts

@@ -0,0 +1,8 @@
+import type { components } from "./wire.gen.js";
+export type ResourceSummary = components["schemas"]["ResourceSummary"];
+export type ResourceRelationships = components["schemas"]["ResourceRelationships"];
+export type ResourceNode = components["schemas"]["ResourceNode"];
+export type ResourceRelationship = components["schemas"]["ResourceRelationship"];
+export type ResourceSummaryPage = components["schemas"]["ResourceSummaryPage"];
+export declare function resourceSummary(value: unknown): value is ResourceSummary;
+export declare function resourceRelationships(value: unknown): value is ResourceRelationships;

package/dist/operator-resources.js

@@ -0,0 +1,73 @@
+import { object } from "./http.js";
+function strings(value, fields) {
+    return object(value) && fields.every((key) => typeof value[key] === "string");
+}
+export function resourceSummary(value) {
+    return strings(value, [
+        "product",
+        "tenant",
+        "project",
+        "projectName",
+        "environment",
+        "environmentName",
+        "environmentKind",
+        "cell",
+        "location",
+        "phase",
+    ]);
+}
+function dateOrNull(value) {
+    return (value === null ||
+        (typeof value === "string" && Number.isFinite(Date.parse(value))));
+}
+export function resourceRelationships(value) {
+    if (!object(value) ||
+        !resourceSummary(value.resource) ||
+        !Number.isSafeInteger(value.epoch) ||
+        !dateOrNull(value.observedAt) ||
+        !dateOrNull(value.validUntil) ||
+        typeof value.fresh !== "boolean")
+        return false;
+    if (!Array.isArray(value.nodes) ||
+        !value.nodes.every((node) => strings(node, [
+            "id",
+            "kind",
+            "label",
+            "resourceId",
+            "providerId",
+            "cell",
+            "location",
+            "state",
+            "allocation",
+            "evidence",
+            "operationId",
+        ])))
+        return false;
+    const ids = new Set(value.nodes.map((node) => node.id));
+    if (ids.size !== value.nodes.length ||
+        !Array.isArray(value.relationships) ||
+        !value.relationships.every((edge) => strings(edge, ["id", "source", "target", "kind", "evidence"]) &&
+            object(edge) &&
+            ids.has(edge.source) &&
+            ids.has(edge.target)))
+        return false;
+    if (!object(value.recovery) ||
+        !strings(value.recovery, [
+            "protection",
+            "targetCell",
+            "targetLocation",
+            "automaticFailover",
+        ]) ||
+        value.recovery.automaticFailover !== "not-established" ||
+        !dateOrNull(value.recovery.checkpointAt))
+        return false;
+    const test = value.recovery.latestTest;
+    if (test !== null &&
+        (!strings(test, ["operationId", "state", "recordedAt"]) ||
+            !object(test) ||
+            typeof test.recordedAt !== "string" ||
+            !Number.isFinite(Date.parse(test.recordedAt))))
+        return false;
+    return (Array.isArray(value.notes) &&
+        value.notes.every((note) => typeof note === "string"));
+}

package/dist/operator.d.ts

@@ -1,4 +1,7 @@
 import { type TransportBudget } from "./http.js";
+import { type UsageQuery } from "./admission.js";
+export type { AdmissionState, AdmissionPolicy, AdmissionUsagePage, UsageQuery } from "./admission.js";
+export type { ResourceSummary, ResourceRelationships, ResourceNode, ResourceRelationship, ResourceSummaryPage } from "./operator-resources.js";
 import { type PageOptions } from "./inventory.js";
 import type { components } from "./wire.gen.js";
 export { AstrogateError } from "./http.js";
@@ -9,6 +12,54 @@ export type OperatorOptions = TransportBudget & {
 export type { PageOptions } from "./inventory.js";
 type EnvironmentTopology = components["schemas"]["EnvironmentTopology"];
 export declare function createOperator(options: OperatorOptions): {
+    admission: {
+        get: (product: string, tenant: string, signal?: AbortSignal) => Promise<{
+            policy: components["schemas"]["AdmissionPolicy"];
+            occupancy: components["schemas"]["AdmissionOccupancy"][];
+            storageCredits: components["schemas"]["TenantStorageCredit"][];
+        }>;
+        usage: (product: string, tenant: string, query: UsageQuery, signal?: AbortSignal) => Promise<{
+            points: components["schemas"]["AdmissionUsagePoint"][];
+            next?: string;
+        }>;
+    };
+    resources: {
+        list: (product: string, tenant: string, page?: PageOptions, signal?: AbortSignal) => Promise<import("./inventory.js").InventoryPage<{
+            product: string;
+            tenant: string;
+            project: string;
+            projectName: string;
+            environment: string;
+            environmentName: string;
+            environmentKind: string;
+            cell: string;
+            location: string;
+            phase: string;
+        }>>;
+        relationships: (product: string, tenant: string, project: string, environment: string, signal?: AbortSignal) => Promise<{
+            resource: components["schemas"]["ResourceSummary"];
+            epoch: number;
+            observedAt: string | null;
+            validUntil: string | null;
+            fresh: boolean;
+            nodes: components["schemas"]["ResourceNode"][];
+            relationships: components["schemas"]["ResourceRelationship"][];
+            recovery: components["schemas"]["ResourceRecovery"];
+            notes: string[];
+        }>;
+        forHost: (providerId: string, page?: PageOptions, signal?: AbortSignal) => Promise<import("./inventory.js").InventoryPage<{
+            product: string;
+            tenant: string;
+            project: string;
+            projectName: string;
+            environment: string;
+            environmentName: string;
+            environmentKind: string;
+            cell: string;
+            location: string;
+            phase: string;
+        }>>;
+    };
     products: {
         list: (page?: PageOptions, signal?: AbortSignal) => Promise<import("./inventory.js").InventoryPage<{
             id: string;

package/dist/operator.js

@@ -2,6 +2,8 @@
 // authenticate here. Issuance and mutation remain installation-owned.
 import { identifier, managementAuthority, object, requestJSON, } from "./http.js";
 import { project, environment, placementState, operation, operationLog, operatorOperationDetail, buildingBlock, hostnameBinding } from "./management-read.js";
+import { admissionState, admissionUsage } from "./admission.js";
+import { resourceSummary, resourceRelationships } from "./operator-resources.js";
 import { listQuery, pageOf } from "./inventory.js";
 export { AstrogateError } from "./http.js";
 function catalogEntry(value) {
@@ -14,13 +16,32 @@ function environmentTopology(value) {
 }
 export function createOperator(options) {
     const endpoint = managementAuthority(options);
-    function read(path, validate, signal) {
-        return requestJSON(new URL(`/v1/operator/products${path}`, endpoint), options, { method: "GET", headers: { authorization: `Bearer ${options.token}` } }, validate, signal);
+    function read(path, validate, signal, root = "/v1/operator/products") {
+        return requestJSON(new URL(`${root}${path}`, endpoint), options, { method: "GET", headers: { authorization: `Bearer ${options.token}` } }, validate, signal);
     }
     const scope = (product, tenant) => `/${identifier(product)}/tenants/${identifier(tenant)}`;
     const projectPath = (product, tenant, id) => `${scope(product, tenant)}/projects/${identifier(id)}`;
     const environmentPath = (product, tenant, project, id) => `${projectPath(product, tenant, project)}/environments/${identifier(id)}`;
     return {
+        admission: {
+            get: (product, tenant, signal) => read(`${scope(product, tenant)}/admission`, admissionState, signal),
+            usage: (product, tenant, query, signal) => {
+                const parameters = new URLSearchParams();
+                for (const [key, value] of Object.entries(query))
+                    if (value !== undefined)
+                        parameters.set(key, String(value));
+                return read(`${scope(product, tenant)}/usage?${parameters}`, admissionUsage, signal);
+            },
+        },
+        resources: {
+            list: (product, tenant, page = {}, signal) => read(`${scope(product, tenant)}/resources${listQuery(page)}`, pageOf(resourceSummary), signal),
+            relationships: (product, tenant, project, environment, signal) => read(`${environmentPath(product, tenant, project, environment)}/relationships`, resourceRelationships, signal),
+            forHost: (providerId, page = {}, signal) => {
+                const query = new URLSearchParams(listQuery(page));
+                query.set("providerId", providerId);
+                return read(`?${query}`, pageOf(resourceSummary), signal, "/v1/operator/host-environments");
+            },
+        },
         products: {
             list: (page = {}, signal) => read(listQuery(page), pageOf(catalogEntry), signal),
         },