@pawabase/client 0.0.0-stage → 0.1.3

package/src/manage/automation.ts

@@ -0,0 +1,162 @@
+import { Definitions, Service, seg, type Api, type Body } from "./base.js";
+
+/** Flows: graphs of blocks that run on a trigger (HTTP, event, schedule, resource change, webhook, manual). */
+export class Flows extends Definitions {
+  protected override readonly kind = "flows";
+
+  /** Run a flow now as an operator (or `asUser`): `{ status, run_id, result, response, trace }`. `entry` picks a trigger node. */
+  run(name: string, input?: unknown, options: { asUser?: Body; entry?: string } = {}): Promise<Api> {
+    return this.post(seg(this.kind, name, "run"), { input, as_user: options.asUser ?? null, entry: options.entry ?? null });
+  }
+
+  /** Check a flow's graph without saving it: the problems, node by node. */
+  validate(definition: Body): Promise<Api> {
+    return this.project("POST", "/flows/validate", { body: { definition } });
+  }
+
+  /** The catalogue of blocks a flow can use, with their configuration fields. */
+  blocks(): Promise<Api> {
+    return this.project("GET", "/blocks");
+  }
+
+  runs(options: { flow?: string; status?: string; limit?: number; after?: string } = {}): Promise<Api> {
+    return this.get("/flow-runs", options);
+  }
+
+  /** One run with its per-block trace. */
+  runDetail(runId: string): Promise<Api> {
+    return this.get(seg("flow-runs", runId));
+  }
+}
+
+/** Cron and interval schedules that run a flow or function, or emit an event. */
+export class Schedules extends Definitions {
+  protected override readonly kind = "schedules";
+
+  /** Fire a schedule now, exactly as the scheduler would. */
+  run(name: string): Promise<Api> {
+    return this.post(seg(this.kind, name, "run"));
+  }
+}
+
+/** Event subscriptions: which events run which flow or function, or reach which realtime channel. */
+export class Subscriptions extends Definitions {
+  protected override readonly kind = "subscriptions";
+}
+
+/** The event bus: emit, and inspect what happened to each event. */
+export class Events extends Service {
+  /** Publish an event: every subscription, flow and webhook listening for it runs. */
+  emit(name: string, payload?: unknown): Promise<Api> {
+    return this.post("/events", { name, payload });
+  }
+
+  list(options: { name?: string; limit?: number; after?: string } = {}): Promise<Api> {
+    return this.get("/events", options);
+  }
+
+  /** One event with every consumer it reached and how that went. */
+  detail(eventId: string): Promise<Api> {
+    return this.get(seg("events", eventId));
+  }
+
+  /** Which event names exist and who consumes each. */
+  graph(): Promise<Api> {
+    return this.get("/events-graph");
+  }
+}
+
+/** Outbound webhooks: endpoints that receive signed events, with retries. */
+export class Webhooks extends Definitions {
+  protected override readonly kind = "webhooks";
+
+  /** Send one test event to an endpoint (one attempt, not retried). */
+  test(name: string): Promise<Api> {
+    return this.post(seg(this.kind, name, "test"));
+  }
+
+  /** Delivery history. `status`: `pending`, `retrying`, `delivered`, `failed`. */
+  deliveries(options: { status?: string; endpoint?: string; limit?: number } = {}): Promise<Api> {
+    return this.get("/webhook-deliveries", options);
+  }
+
+  redeliver(deliveryId: string): Promise<Api> {
+    return this.post(seg("webhook-deliveries", deliveryId, "redeliver"));
+  }
+
+  /** Send many again: by `ids`, or every delivery matching a filter (up to `limit`, 100 by default). `dryRun` only counts. */
+  redeliverMany(options: { ids?: string[]; status?: string; endpoint?: string; event?: string; sinceMinutes?: number; limit?: number; dryRun?: boolean } = {}): Promise<Api> {
+    return this.post("/webhook-deliveries/redeliver", {
+      ids: options.ids,
+      status: options.status ?? "failed",
+      endpoint: options.endpoint,
+      event: options.event,
+      since_minutes: options.sinceMinutes,
+      limit: options.limit ?? 100,
+      dry_run: options.dryRun ?? false,
+    });
+  }
+}
+
+/** Inbound hooks: URLs other services call (signature-checked), each starting a flow or function. */
+export class InboundHooks extends Definitions {
+  protected override readonly kind = "inbound-hooks";
+
+  /** The public URL to give the sender. */
+  url(slug: string): Promise<Api> {
+    return this.get(seg(this.kind, slug, "url"));
+  }
+}
+
+/** Background work: jobs, failures and replays, queues, workers and how failed work is retried. */
+export class Jobs extends Service {
+  /** `status`: `queued`, `active`, `retrying`, `succeeded`, `failed`. */
+  list(options: { status?: string; queue?: string; limit?: number } = {}): Promise<Api> {
+    return this.get("/jobs", options);
+  }
+
+  detail(jobId: string): Promise<Api> {
+    return this.get(seg("jobs", jobId));
+  }
+
+  retry(jobId: string): Promise<Api> {
+    return this.post(seg("jobs", jobId, "retry"));
+  }
+
+  /** Queue recorded jobs again: named `ids`, or every job matching the filter (failed by default; `limit` 200). `dryRun` only counts. */
+  replay(options: { ids?: string[]; status?: string; queue?: string; job?: string; sinceMinutes?: number; limit?: number; dryRun?: boolean } = {}): Promise<Api> {
+    return this.post("/jobs/replay", {
+      ids: options.ids ?? [],
+      status: options.status ?? "failed",
+      queue: options.queue,
+      job: options.job,
+      since_minutes: options.sinceMinutes,
+      limit: options.limit ?? 200,
+      dry_run: options.dryRun ?? false,
+    });
+  }
+
+  /** Jobs that gave up after their retries. */
+  failed(): Promise<Api> {
+    return this.get("/failed-jobs");
+  }
+
+  dismissFailed(jobId: string): Promise<Api> {
+    return this.del(seg("failed-jobs", jobId));
+  }
+
+  /** Queues with depth and job counts. */
+  queues(): Promise<Api> {
+    return this.get("/queues");
+  }
+
+  /** The processes taking jobs (installation-wide). */
+  workers(): Promise<Api> {
+    return this.project("GET", "/workers");
+  }
+
+  /** How each kind of background work is retried: attempts and the wait before each retry. */
+  retryPolicies(): Promise<Api> {
+    return this.project("GET", "/retry-policies");
+  }
+}

package/src/manage/base.ts

@@ -0,0 +1,83 @@
+import type { HttpClient } from "../http.js";
+import type { QueryValue } from "../util.js";
+
+/** What the management plane answers: a JSON document (lists are `{ data: [...] }`). */
+export type Api = Record<string, any>;
+export type Query = Record<string, QueryValue | QueryValue[]>;
+export type Body = Record<string, unknown>;
+
+/** URL path segments, each encoded: `seg("flows", name, "run")` → `/flows/<name>/run`. */
+export function seg(...parts: Array<string | number>): string {
+  return "/" + parts.map((part) => encodeURIComponent(String(part))).join("/");
+}
+
+/** Everything a management service shares: the environment a call is for, and the five verbs. */
+export class Service {
+  constructor(
+    protected readonly http: HttpClient,
+    private readonly environmentName: string,
+  ) {}
+
+  /** The environment this service manages. */
+  get environment(): string {
+    return this.environmentName;
+  }
+
+  protected path(suffix = ""): string {
+    return `/platform/v1/envs/${encodeURIComponent(this.environmentName)}${suffix}`;
+  }
+
+  protected get<T = Api>(suffix = "", query?: Query): Promise<T> {
+    return this.http.request<T>({ path: this.path(suffix), ...(query ? { query } : {}) });
+  }
+
+  protected post<T = Api>(suffix = "", body?: unknown, query?: Query): Promise<T> {
+    return this.http.request<T>({ method: "POST", path: this.path(suffix), body, ...(query ? { query } : {}) });
+  }
+
+  protected put<T = Api>(suffix: string, body?: unknown, query?: Query): Promise<T> {
+    return this.http.request<T>({ method: "PUT", path: this.path(suffix), body, ...(query ? { query } : {}) });
+  }
+
+  protected patch<T = Api>(suffix: string, body?: unknown, query?: Query): Promise<T> {
+    return this.http.request<T>({ method: "PATCH", path: this.path(suffix), body, ...(query ? { query } : {}) });
+  }
+
+  protected del<T = Api>(suffix: string, query?: Query, body?: unknown): Promise<T> {
+    return this.http.request<T>({ method: "DELETE", path: this.path(suffix), ...(query ? { query } : {}), ...(body !== undefined ? { body } : {}) });
+  }
+
+  /** A call that is not scoped to an environment (`/platform/v1/...`). */
+  protected project<T = Api>(method: string, suffix: string, options: { body?: unknown; query?: Query; parse?: "json" | "text" | "response" } = {}): Promise<T> {
+    return this.http.request<T>({ method, path: `/platform/v1${suffix}`, ...options });
+  }
+}
+
+/**
+ * A kind of definition an environment holds (`flows`, `policies`, `webhooks`…): list, get, create, replace, remove.
+ * Pass `branch` to work on a feature branch's draft instead of the live environment. A definition is addressed by its name
+ * (inbound hooks: their slug).
+ */
+export class Definitions extends Service {
+  protected readonly kind: string = "";
+
+  list(options: { branch?: string } = {}): Promise<Api> {
+    return this.get(seg(this.kind), { branch: options.branch });
+  }
+
+  getOne(key: string, options: { branch?: string } = {}): Promise<Api> {
+    return this.get(seg(this.kind, key), { branch: options.branch });
+  }
+
+  create(body: Body, options: { branch?: string } = {}): Promise<Api> {
+    return this.post(seg(this.kind), body, { branch: options.branch });
+  }
+
+  replace(key: string, body: Body, options: { branch?: string } = {}): Promise<Api> {
+    return this.put(seg(this.kind, key), body, { branch: options.branch });
+  }
+
+  remove(key: string, options: { branch?: string } = {}): Promise<Api> {
+    return this.del(seg(this.kind, key), { branch: options.branch });
+  }
+}

package/src/manage/data.ts

@@ -0,0 +1,159 @@
+import { Definitions, Service, seg, type Api, type Body, type Query } from "./base.js";
+
+/**
+ * Resources: the tables your API serves, with fields, relations, per-operation policies and indexes.
+ *
+ * ```ts
+ * await m.resources.create({ name: "posts", fields: [{ name: "title", type: "string", required: true }],
+ *                            operations: { list: { enabled: true, policy: "public" } } });
+ * await m.resources.migrate("posts");
+ * ```
+ */
+export class Resources extends Definitions {
+  protected override readonly kind = "resources";
+
+  /** Browse a resource's records as an operator (policies do not apply). Extra keys are passed as query parameters (`filter[field]`…). */
+  records(name: string, options: { limit?: number; offset?: number; filters?: Query } = {}): Promise<Api> {
+    return this.get(seg(this.kind, name, "records"), { limit: options.limit, offset: options.offset, ...options.filters });
+  }
+
+  insert(name: string, values: Body): Promise<Api> {
+    return this.post(seg(this.kind, name, "records"), values);
+  }
+
+  updateRecord(name: string, recordId: string | number, values: Body): Promise<Api> {
+    return this.patch(seg(this.kind, name, "records", recordId), values);
+  }
+
+  deleteRecord(name: string, recordId: string | number): Promise<Api> {
+    return this.del(seg(this.kind, name, "records", recordId));
+  }
+
+  /** Every record, for a file download. */
+  export(name: string, options: { format?: string } = {}): Promise<Api> {
+    return this.get(seg(this.kind, name, "export"), { format: options.format });
+  }
+
+  /** Add or update records from parsed rows: `{ created, updated, failed, errors }`. */
+  importRecords(name: string, rows: Body[], options: { key?: string; mode?: string; dryRun?: boolean } = {}): Promise<Api> {
+    return this.post(seg(this.kind, name, "import"), { rows, key: options.key, mode: options.mode, dry_run: options.dryRun });
+  }
+
+  /** The resource's compiled routes. */
+  openapi(name: string): Promise<Api> {
+    return this.get(seg(this.kind, name, "openapi"));
+  }
+
+  /** Create the resource's table, or add what its definition gained. Returns the statements it ran. */
+  migrate(name: string): Promise<Api> {
+    return this.post(seg(this.kind, name, "migrate"));
+  }
+
+  /** What applying the definition would change. */
+  schemaPlan(name: string): Promise<Api> {
+    return this.get(seg(this.kind, name, "schema"));
+  }
+
+  schemaApply(name: string, body: Body = {}): Promise<Api> {
+    return this.post(seg(this.kind, name, "schema", "apply"), body);
+  }
+
+  /** Take the table as it is now as the starting point and put what changed in the definition. */
+  schemaAcknowledge(name: string, body: Body = {}): Promise<Api> {
+    return this.post(seg(this.kind, name, "schema", "acknowledge"), body);
+  }
+
+  /** Remove what migrations kept for a rollback. */
+  schemaPurge(name: string, body: Body = {}): Promise<Api> {
+    return this.post(seg(this.kind, name, "schema", "purge"), body);
+  }
+
+  migrations(name: string): Promise<Api> {
+    return this.get(seg(this.kind, name, "migrations"));
+  }
+
+  rollbackMigration(name: string, migrationId: string): Promise<Api> {
+    return this.post(seg(this.kind, name, "migrations", migrationId, "rollback"));
+  }
+
+  /** A table's indexes: declared, field, hand-made and system. */
+  indexes(name: string): Promise<Api> {
+    return this.get(seg(this.kind, name, "indexes"));
+  }
+
+  /** Drop an index made outside Pawabase. */
+  dropIndex(name: string, index: string, body: Body = {}): Promise<Api> {
+    return this.post(seg(this.kind, name, "indexes", index, "drop"), body);
+  }
+}
+
+/** The whole database against its definitions. */
+export class Schema extends Service {
+  /** Every resource's table against its definition. */
+  overview(): Promise<Api> {
+    return this.get("/schema");
+  }
+
+  /** Tables in the database that no resource is defined for. */
+  unmappedTables(): Promise<Api> {
+    return this.get("/schema/tables");
+  }
+}
+
+/** Named access policies (conditions) that resources, buckets, channels and functions refer to. */
+export class Policies extends Definitions {
+  protected override readonly kind = "policies";
+}
+
+/** Reusable data shapes referred to by resource fields. */
+export class Schemas extends Definitions {
+  protected override readonly kind = "schemas";
+}
+
+/** Transformers that reshape a field's value on the way out (hide, mask, format). */
+export class Transformers extends Definitions {
+  protected override readonly kind = "transformers";
+}
+
+/** Custom HTTP routes under `/rest` that run a flow. */
+export class Routes extends Definitions {
+  protected override readonly kind = "routes";
+}
+
+/** The environment's database: tables, rows and the SQL console (one statement at a time; reads are read-only in the database itself). */
+export class Database extends Service {
+  info(): Promise<Api> {
+    return this.get("/database");
+  }
+
+  /** A table's columns, indexes and foreign keys. */
+  table(table: string): Promise<Api> {
+    return this.get(seg("database", "tables", table));
+  }
+
+  rows(table: string, options: { limit?: number; offset?: number; sort?: string; filters?: Query } = {}): Promise<Api> {
+    return this.get(seg("database", "tables", table, "rows"), { limit: options.limit, offset: options.offset, sort: options.sort, ...options.filters });
+  }
+
+  /** Run one statement. A write needs `allowWrite`; it is audited and clears the environment's caches. */
+  query(sql: string, params: unknown[] = [], options: { allowWrite?: boolean } = {}): Promise<Api> {
+    return this.post("/database/query", { sql, params, allow_write: options.allowWrite ?? false });
+  }
+}
+
+/** The runtime capabilities a function sees, called remotely (what `pawabase emulate` uses). */
+export class Runtime extends Service {
+  call(method: string, args: unknown[] = [], kwargs: Body = {}, options: { asUser?: Body; branch?: string } = {}): Promise<Api> {
+    return this.post("/runtime/call", { method, args, kwargs, as_user: options.asUser ?? null, branch: options.branch ?? null });
+  }
+
+  /** `fetch`, `insert`, `execute`, `begin`, `commit`…, optionally inside a transaction (`tx`). */
+  sql(op: string, fields: Body = {}): Promise<Api> {
+    return this.post("/runtime/db", { op, ...fields });
+  }
+
+  /** Who a user access token belongs to. */
+  identify(token: string | null): Promise<Api> {
+    return this.post("/runtime/identify", { token });
+  }
+}

package/src/manage/files.ts

@@ -0,0 +1,79 @@
+import { Definitions, Service, seg, type Api } from "./base.js";
+
+/**
+ * Storage administration: buckets, the objects in them, temporary share links and signed URLs. (Reading and writing files as
+ * your app does is `client.storage`; this is the operator's view and works with a secret key regardless of policies.)
+ */
+export class Buckets extends Definitions {
+  protected override readonly kind = "buckets";
+
+  /** One page of the bucket's objects: `{ files, prefixes, cursor }`. */
+  objects(bucket: string, options: { prefix?: string; cursor?: string; limit?: number } = {}): Promise<Api> {
+    return this.get(seg(this.kind, bucket, "objects"), options);
+  }
+
+  /** One object's details and a way to read it. */
+  object(bucket: string, key: string): Promise<Api> {
+    return this.get(seg(this.kind, bucket, "object"), { key });
+  }
+
+  putObject(bucket: string, key: string, content: Blob | ArrayBuffer | Uint8Array | string, contentType = "application/octet-stream"): Promise<Api> {
+    return this.http.request({
+      method: "PUT",
+      path: this.path(seg(this.kind, bucket, "object")),
+      query: { key },
+      body: content,
+      headers: { "content-type": contentType },
+    });
+  }
+
+  deleteObject(bucket: string, key: string): Promise<Api> {
+    return this.del(seg(this.kind, bucket, "objects", key));
+  }
+
+  /** Rename or move an object inside the bucket. */
+  moveObject(bucket: string, source: string, target: string): Promise<Api> {
+    return this.post(seg(this.kind, bucket, "object", "move"), { source, target });
+  }
+
+  /** A temporary signed link to one object (`GET` to read, `PUT` to upload). */
+  sign(bucket: string, key: string, options: { method?: "GET" | "PUT"; expiresIn?: number; contentType?: string; maxBytes?: number } = {}): Promise<Api> {
+    return this.post(seg(this.kind, bucket, "sign"), {
+      key,
+      method: options.method ?? "GET",
+      expires_in: options.expiresIn ?? 300,
+      content_type: options.contentType,
+      max_bytes: options.maxBytes,
+    });
+  }
+
+  shares(bucket: string): Promise<Api> {
+    return this.get(seg(this.kind, bucket, "shares"));
+  }
+
+  /** A link to one object for people with no account. `permissions`: `view`, `download`, `both`. The URL is in the answer. */
+  createShare(bucket: string, key: string, options: { expiresIn?: number; permissions?: "view" | "download" | "both"; label?: string } = {}): Promise<Api> {
+    return this.post(seg(this.kind, bucket, "shares"), {
+      key,
+      expires_in: options.expiresIn ?? 3600,
+      permissions: options.permissions ?? "both",
+      label: options.label ?? "",
+    });
+  }
+
+  revokeShare(bucket: string, shareId: string): Promise<Api> {
+    return this.del(seg(this.kind, bucket, "shares", shareId));
+  }
+}
+
+/** The environment's response cache. */
+export class Cache extends Service {
+  stats(): Promise<Api> {
+    return this.get("/cache");
+  }
+
+  /** Drop cached responses by tag (`resource:posts`) or for whole resources. */
+  invalidate(options: { tags?: string[]; resources?: string[] } = {}): Promise<Api> {
+    return this.post("/cache/invalidate", { tags: options.tags ?? [], resources: options.resources ?? [] });
+  }
+}

package/src/manage/functions.ts

@@ -0,0 +1,69 @@
+import { Service, seg, type Api, type Body } from "./base.js";
+
+/** Deployed functions (Python or TypeScript; a project's functions are one language). */
+export class Functions extends Service {
+  /** Functions visible to the environment (and `branch`), each saying whether it came from a branch, a deployment or mounted code. */
+  list(options: { branch?: string } = {}): Promise<Api> {
+    return this.get("/functions", options);
+  }
+
+  /** Run a function now as an operator (or `asUser`), bypassing its HTTP policy: `{ status, result | error }`. */
+  run(name: string, input?: unknown, options: { branch?: string; asUser?: Body } = {}): Promise<Api> {
+    return this.post(seg("functions", name, "invoke"), { input, branch: options.branch ?? null, as_user: options.asUser ?? null });
+  }
+
+  /** Upload a base64 `.tar.gz` bundle (`functions/*.py` or `functions/*.ts`) and activate it. The `pawabase deploy` command builds the bundle. */
+  deploy(archive: string, options: { branch?: string; manifest?: Body; runtime?: string; limits?: Body } = {}): Promise<Api> {
+    return this.post("/function-deployments", {
+      archive,
+      branch: options.branch ?? "main",
+      manifest: options.manifest ?? {},
+      runtime: options.runtime ?? "python3.11",
+      limits: options.limits ?? {},
+    });
+  }
+
+  deployments(options: { branch?: string; limit?: number } = {}): Promise<Api> {
+    return this.get("/function-deployments", { limit: 50, ...options });
+  }
+
+  deployment(deploymentId: string): Promise<Api> {
+    return this.get(seg("function-deployments", deploymentId));
+  }
+
+  /** Make an earlier deployment the active one again (a rollback). */
+  activate(deploymentId: string): Promise<Api> {
+    return this.post(seg("function-deployments", deploymentId, "activate"));
+  }
+
+  removeDeployment(deploymentId: string): Promise<Api> {
+    return this.del(seg("function-deployments", deploymentId));
+  }
+
+  branches(): Promise<Api> {
+    return this.get("/function-branches");
+  }
+
+  /** Delete the functions deployed on `branch`. The environment's own are untouched. */
+  removeBranch(branch: string): Promise<Api> {
+    return this.del(seg("function-branches", branch));
+  }
+
+  runs(options: { function?: string; branch?: string; status?: string; after?: string; limit?: number } = {}): Promise<Api> {
+    return this.get("/function-runs", { limit: 50, ...options });
+  }
+
+  /** One run with its input, output, error and logs. */
+  runDetail(runId: string): Promise<Api> {
+    return this.get(seg("function-runs", runId));
+  }
+
+  /** The files of the live deployment. */
+  source(options: { branch?: string } = {}): Promise<Api> {
+    return this.get("/function-source", options);
+  }
+
+  sourceFile(path: string, options: { branch?: string } = {}): Promise<Api> {
+    return this.get("/function-source/file", { path, ...options });
+  }
+}

package/src/manage/index.ts

@@ -0,0 +1,132 @@
+/**
+ * The management plane of one environment, with that environment's secret key (`pb_sk_…`).
+ *
+ * ```ts
+ * import { createClient } from "@pawabase/client";
+ * import { manage } from "@pawabase/client/manage";
+ *
+ * const pawabase = createClient({ url, apiKey: "pb_sk_…", environment: "production" });
+ * const m = manage(pawabase);
+ * await m.secrets.set("STRIPE_KEY", "sk_live_…");
+ * await manage(pawabase, "staging").flows.list();     // the same API for another environment the key may manage
+ * ```
+ */
+import type { PawabaseClient } from "../client.js";
+import { ConfigError } from "../errors.js";
+import { isSecretKey } from "../util.js";
+import { Domains, Firewall, Keys, Secrets } from "./access.js";
+import { Events, Flows, InboundHooks, Jobs, Schedules, Subscriptions, Webhooks } from "./automation.js";
+import { Database, Policies, Resources, Routes, Runtime, Schema, Schemas, Transformers } from "./data.js";
+import { Buckets, Cache } from "./files.js";
+import { Functions } from "./functions.js";
+import { Backups, Environments, Releases } from "./lifecycle.js";
+import { Mail, MailTemplates } from "./mail.js";
+import { Alarms, Health, Observability, StatusPage } from "./observe.js";
+import { Dashboards, RealtimeChannels } from "./realtime.js";
+
+export class Manage {
+  // data
+  readonly resources: Resources;
+  readonly schema: Schema;
+  readonly policies: Policies;
+  readonly schemas: Schemas;
+  readonly transformers: Transformers;
+  readonly routes: Routes;
+  readonly database: Database;
+  readonly runtime: Runtime;
+  // automation
+  readonly flows: Flows;
+  readonly schedules: Schedules;
+  readonly subscriptions: Subscriptions;
+  readonly events: Events;
+  readonly webhooks: Webhooks;
+  readonly inboundHooks: InboundHooks;
+  readonly jobs: Jobs;
+  readonly functions: Functions;
+  // files and mail
+  readonly buckets: Buckets;
+  readonly cache: Cache;
+  readonly mail: Mail;
+  readonly mailTemplates: MailTemplates;
+  // realtime and dashboards
+  readonly realtimeChannels: RealtimeChannels;
+  readonly dashboards: Dashboards;
+  // access
+  readonly keys: Keys;
+  readonly secrets: Secrets;
+  readonly domains: Domains;
+  readonly firewall: Firewall;
+  // observe
+  readonly observability: Observability;
+  readonly alarms: Alarms;
+  readonly statusPage: StatusPage;
+  readonly health: Health;
+  // lifecycle
+  readonly environments: Environments;
+  readonly releases: Releases;
+  readonly backups: Backups;
+
+  constructor(
+    private readonly client: PawabaseClient<any>,
+    readonly environment: string,
+  ) {
+    const http = client.http;
+    this.resources = new Resources(http, environment);
+    this.schema = new Schema(http, environment);
+    this.policies = new Policies(http, environment);
+    this.schemas = new Schemas(http, environment);
+    this.transformers = new Transformers(http, environment);
+    this.routes = new Routes(http, environment);
+    this.database = new Database(http, environment);
+    this.runtime = new Runtime(http, environment);
+    this.flows = new Flows(http, environment);
+    this.schedules = new Schedules(http, environment);
+    this.subscriptions = new Subscriptions(http, environment);
+    this.events = new Events(http, environment);
+    this.webhooks = new Webhooks(http, environment);
+    this.inboundHooks = new InboundHooks(http, environment);
+    this.jobs = new Jobs(http, environment);
+    this.functions = new Functions(http, environment);
+    this.buckets = new Buckets(http, environment);
+    this.cache = new Cache(http, environment);
+    this.mail = new Mail(http, environment);
+    this.mailTemplates = new MailTemplates(http, environment);
+    this.realtimeChannels = new RealtimeChannels(http, environment);
+    this.dashboards = new Dashboards(http, environment);
+    this.keys = new Keys(http, environment);
+    this.secrets = new Secrets(http, environment);
+    this.domains = new Domains(http, environment);
+    this.firewall = new Firewall(http, environment);
+    this.observability = new Observability(http, environment);
+    this.alarms = new Alarms(http, environment);
+    this.statusPage = new StatusPage(http, environment);
+    this.health = new Health(http, environment);
+    this.environments = new Environments(http, environment);
+    this.releases = new Releases(http, environment);
+    this.backups = new Backups(http, environment);
+  }
+
+  /** The same services for another environment the key may manage. */
+  withEnvironment(name: string): Manage {
+    return new Manage(this.client, name);
+  }
+}
+
+/** The management plane of the client's environment (or `environment`). Needs a secret key. */
+export function manage(client: PawabaseClient<any>, environment?: string): Manage {
+  if (!isSecretKey(client.options.apiKey)) {
+    throw new ConfigError("The management plane needs a secret key (pb_sk_…).");
+  }
+  return new Manage(client, environment ?? client.options.environment ?? "development");
+}
+
+export * from "./access.js";
+export * from "./automation.js";
+export * from "./base.js";
+export * from "./data.js";
+export * from "./files.js";
+export * from "./functions.js";
+export * from "./lifecycle.js";
+export * from "./mail.js";
+export * from "./observe.js";
+export * from "./realtime.js";