@aperture-browser/api-client 0.0.0-init.0 → 0.0.0-nightly.100.78b4e7ef6edc

package/dist/index.d.ts

@@ -1,264 +1,15 @@
+import { $ as LoginMethods, A as SessionFileEntry, B as Snapshot, C as ResourceGrant, Ct as ApiRequestError, D as SessionDirectory, E as Session, F as SessionRecordingEditError, G as TenantMembership, H as SnapshotsPage, I as SessionStatus, J as TokensPage, K as TenantScope, L as SessionsBulkResponse, M as SessionMutationResponse, N as SessionProxy, O as SessionFile, P as SessionRecording, Q as UsersPage, R as SessionsPage, S as ResourceEvent, St as ApiErrorBody, T as Scope, Tt as toApiRequestError, U as TargetViewport, V as SnapshotMutationResponse, W as Tenant, X as User, Y as UpdateProxyConfig, Z as UserInvitation, _ as PageMeta, _t as Authorization, a as AuditEventsPage, at as OAuthRedirect, b as ProxyRule, bt as resolveTenantHeader, c as AuthMeTenant, ct as PasskeyMutation, d as CreateSessionResponse, dt as PasswordLoginResponse, et as OAuthApproval, f as CreateTokenResponse, ft as RecoveryCodes, g as IceServer, gt as ApiCredentials, h as Health, ht as ApiAuthorization, i as AuditEvent, it as OAuthGrants, j as SessionMedia, k as SessionFileDownloadURL, l as BrowserChannel, lt as PasskeyRegistrationOptions, m as EventsPage, mt as TOTPEnrollment, n as PasskeyCredentialJSON, nt as OAuthClient, o as AuthMePrincipal, ot as Passkey, p as CursorVisibility, pt as SecurityStatus, q as TenantsPage, r as ApiToken, rt as OAuthGrant, s as AuthMeResponse, st as PasskeyLoginOptions, t as AuthApi, tt as OAuthAuthorizationRequest, u as BrowserChannelsResponse, ut as Passkeys, v as PromoteSessionResponse, vt as TENANT_HEADER, w as ResourceMode, wt as LiveSessionErrorBody, x as ProxyUpstream, xt as webSessionCredentials, y as ProxyConfig, yt as TenantHeaderMode, z as SetViewportInput } from "./service-DbyEmdKS.js";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClient from "effect/http/HttpClient";
 import * as Api from "@aperture-browser/api-schema";
 import * as Context from "effect/Context";
 import * as Schema from "effect/Schema";
+import * as Redacted from "effect/Redacted";
 import * as Stream from "effect/Stream";
-import * as HttpClientError from "effect/unstable/http/HttpClientError";
-import { AuthenticationResponseJSON, RegistrationResponseJSON } from "@simplewebauthn/browser";
+import * as HttpClientError from "effect/http/HttpClientError";
+import * as Option from "effect/Option";
 
-//#region src/errors.d.ts
-declare const ApiErrorBody: Schema.Struct<{
-  readonly error: Schema.Struct<{
-    readonly code: Schema.String;
-    readonly message: Schema.String;
-  }>;
-}>;
-type ApiErrorBody = typeof ApiErrorBody.Type;
-declare const ApiRequestError_base: Schema.Class<ApiRequestError, Schema.TaggedStruct<"ApiRequestError", {
-  readonly code: Schema.String;
-  readonly message: Schema.String;
-  readonly status: Schema.Number;
-}>, import("effect/Cause").YieldableError>;
-/**
- * A failed API request. `code` and `message` come from the server's error body when it
- * sent one; `status` is 0 when no HTTP status applies.
- */
-declare class ApiRequestError extends ApiRequestError_base {}
-/**
- * Maps HTTP and decoding failures to ApiRequestError. Error responses keep the code and
- * message of the server's error body.
- */
-declare const toApiRequestError: <A, R>(self: Effect.Effect<A, HttpClientError.HttpClientError | Schema.SchemaError, R>) => Effect.Effect<A, ApiRequestError, R>;
-//#endregion
-//#region src/authorization/service.d.ts
-declare const TENANT_HEADER = "X-Aperture-Tenant-Id";
-interface CredentialContext {
-  authorityType: "system_admin" | "tenant" | null;
-  tenantId: string | null;
-  selectedTenantId: string | null;
-}
-type ApiCredentials = (CredentialContext & {
-  kind: "bearer";
-  token: string;
-}) | (CredentialContext & {
-  kind: "session";
-});
-/** The browser's own login session, sent as a cookie. */
-declare const webSessionCredentials: ApiCredentials;
-type TenantHeaderMode = "none" | "optional" | "tenant-scoped";
-/** Which tenant, if any, a request acts for under the given credentials. */
-declare function resolveTenantHeader(credentials: ApiCredentials, mode: TenantHeaderMode): string | undefined;
-/** How a request authenticates, and which tenant it acts for. */
-interface Authorization {
-  readonly credentials?: ApiCredentials;
-  readonly bearerToken?: string;
-  readonly tenantHeader?: TenantHeaderMode;
-}
-declare const Authorization: {
-  anonymous: Authorization;
-  webSession: Authorization;
-  of: (credentials: ApiCredentials) => Authorization;
-  tenantScoped: (credentials: ApiCredentials) => Authorization;
-};
-declare const ApiAuthorization_base: Context.ServiceClass<ApiAuthorization, "@aperture-browser/api-client/ApiAuthorization", {
-  /** Runs a call with the given authorization and maps its failures to ApiRequestError. */readonly authorize: (authorization: Authorization) => <A, R>(self: Effect.Effect<A, HttpClientError.HttpClientError | Schema.SchemaError, R>) => Effect.Effect<A, ApiRequestError, R>; /** Emits whenever the web session is found to be missing, expired or revoked. */
-  readonly sessionAuthenticationFailures: Stream.Stream<void>;
-}>;
-/**
- * Authenticates API calls. Inside `authorize`, every request sent through the HttpClient
- * that `authorizedHttpClientLayer` provides carries that call's credentials and tenant, so
- * callers never touch headers.
- */
-declare class ApiAuthorization extends ApiAuthorization_base {}
-//#endregion
-//#region src/schemas.d.ts
-type PageMeta = Api.PageMeta;
-type Tenant = Api.Tenant;
-type User = Api.User;
-type UserInvitation = Api.UserInvitation;
-type TenantMembership = Api.TenantMembership;
-type AuthMeResponse = Api.AuthMe;
-type AuthMePrincipal = Api.Principal;
-type AuthMeTenant = Api.Tenant;
-type ResourceMode = Api.ResourceMode;
-type ResourceGrant = Api.ResourceGrant;
-type Scope = Api.Scope;
-type TenantScope = Api.TenantScope;
-type Session = Api.Session;
-type SessionMedia = Api.SessionMedia;
-type IceServer = Api.IceServer;
-declare const SessionStatus: import("effect/Schema").Literals<readonly ["creating", "running", "suspended", "deleted", "expired", "failed"]>;
-type SessionStatus = Api.SessionStatus;
-type Snapshot = Api.Snapshot;
-type ApiToken = Api.Token;
-type TenantsPage = Api.TenantPage;
-type UsersPage = Api.UserPage;
-type SessionsPage = Api.SessionPage;
-type SessionsBulkResponse = Api.SessionBulkResponse;
-type SnapshotsPage = Api.SnapshotPage;
-type TokensPage = Api.TokenPage;
-type BrowserChannel = Api.BrowserChannel;
-type BrowserChannelsResponse = Api.BrowserChannels;
-type ResourceEvent = Api.Event;
-type EventsPage = Api.EventPage;
-type CreateSessionResponse = Api.CreateSessionResult;
-type SessionMutationResponse = Api.SessionMutation;
-type SnapshotMutationResponse = Api.SnapshotMutation;
-type PromoteSessionResponse = Api.SnapshotMutation;
-type CreateTokenResponse = Api.CreateTokenResponse;
-//#endregion
-//#region src/auth/schemas.d.ts
-declare const LoginMethods: Schema.Struct<{
-  readonly methods: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
-    readonly type: Schema.Literal<"password">;
-  }>, Schema.Struct<{
-    readonly type: Schema.Literal<"api_token">;
-  }>, Schema.Struct<{
-    readonly type: Schema.Literal<"passkey">;
-  }>, Schema.Struct<{
-    readonly type: Schema.Literal<"oidc">;
-    readonly id: Schema.String;
-    readonly name: Schema.String;
-    readonly loginUrl: Schema.String;
-  }>]>>;
-}>;
-declare const PasskeyLoginOptions: Schema.Struct<{
-  readonly publicKey: Schema.Struct<{
-    readonly challenge: Schema.String;
-    readonly timeout: Schema.optionalKey<Schema.Number>;
-    readonly rpId: Schema.optionalKey<Schema.String>;
-    readonly allowCredentials: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Struct<{
-      readonly id: Schema.String;
-      readonly type: Schema.Literal<"public-key">;
-      readonly transports: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb"]>>>>;
-    }>>>>;
-    readonly userVerification: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
-    readonly hints: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>>;
-    readonly extensions: Schema.optionalKey<Schema.Struct<{
-      readonly appid: Schema.optionalKey<Schema.String>;
-      readonly credProps: Schema.optionalKey<Schema.Boolean>;
-      readonly hmacCreateSecret: Schema.optionalKey<Schema.Boolean>;
-      readonly minPinLength: Schema.optionalKey<Schema.Boolean>;
-    }>>;
-  }>;
-}>;
-declare const PasskeyRegistrationOptions: Schema.Struct<{
-  readonly publicKey: Schema.Struct<{
-    readonly rp: Schema.Struct<{
-      readonly id: Schema.optionalKey<Schema.String>;
-      readonly name: Schema.String;
-    }>;
-    readonly user: Schema.Struct<{
-      readonly id: Schema.String;
-      readonly name: Schema.String;
-      readonly displayName: Schema.String;
-    }>;
-    readonly challenge: Schema.String;
-    readonly pubKeyCredParams: Schema.mutable<Schema.$Array<Schema.Struct<{
-      readonly alg: Schema.Literals<readonly [-7, -8, -35, -36, -37, -38, -39, -257, -258, -259]>;
-      readonly type: Schema.Literal<"public-key">;
-    }>>>;
-    readonly timeout: Schema.optionalKey<Schema.Number>;
-    readonly excludeCredentials: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Struct<{
-      readonly id: Schema.String;
-      readonly type: Schema.Literal<"public-key">;
-      readonly transports: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb"]>>>>;
-    }>>>>;
-    readonly authenticatorSelection: Schema.optionalKey<Schema.Struct<{
-      readonly authenticatorAttachment: Schema.optionalKey<Schema.Literals<readonly ["platform", "cross-platform"]>>;
-      readonly requireResidentKey: Schema.optionalKey<Schema.Boolean>;
-      readonly residentKey: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
-      readonly userVerification: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
-    }>>;
-    readonly hints: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>>;
-    readonly attestation: Schema.optionalKey<Schema.Literals<readonly ["direct", "enterprise", "indirect", "none"]>>;
-    readonly attestationFormats: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["fido-u2f", "packed", "android-safetynet", "android-key", "tpm", "apple", "none"]>>>>;
-    readonly extensions: Schema.optionalKey<Schema.Struct<{
-      readonly appid: Schema.optionalKey<Schema.String>;
-      readonly credProps: Schema.optionalKey<Schema.Boolean>;
-      readonly hmacCreateSecret: Schema.optionalKey<Schema.Boolean>;
-      readonly minPinLength: Schema.optionalKey<Schema.Boolean>;
-    }>>;
-  }>;
-}>;
-declare const Passkey: Schema.Struct<{
-  readonly id: Schema.String;
-  readonly name: Schema.String;
-  readonly createdAt: Schema.String;
-  readonly lastUsedAt: Schema.NullOr<Schema.String>;
-}>;
-declare const Passkeys: Schema.Struct<{
-  readonly passkeys: Schema.$Array<Schema.Struct<{
-    readonly id: Schema.String;
-    readonly name: Schema.String;
-    readonly createdAt: Schema.String;
-    readonly lastUsedAt: Schema.NullOr<Schema.String>;
-  }>>;
-}>;
-declare const PasskeyMutation: Schema.Struct<{
-  readonly passkey: Schema.Struct<{
-    readonly id: Schema.String;
-    readonly name: Schema.String;
-    readonly createdAt: Schema.String;
-    readonly lastUsedAt: Schema.NullOr<Schema.String>;
-  }>;
-}>;
-declare const PasswordLoginResponse: Schema.Struct<{
-  readonly mfaRequired: Schema.Boolean;
-}>;
-declare const SecurityStatus: Schema.Struct<{
-  readonly hasPassword: Schema.Boolean;
-  readonly totpEnabled: Schema.Boolean;
-  readonly recoveryCodesRemaining: Schema.Number;
-}>;
-declare const TOTPEnrollment: Schema.Struct<{
-  readonly secret: Schema.String;
-  readonly otpauthUrl: Schema.String;
-  readonly qrCodeDataUrl: Schema.String;
-}>;
-declare const RecoveryCodes: Schema.Struct<{
-  readonly recoveryCodes: Schema.$Array<Schema.String>;
-}>;
-type LoginMethods = typeof LoginMethods.Type;
-type PasskeyLoginOptions = typeof PasskeyLoginOptions.Type;
-type PasskeyRegistrationOptions = typeof PasskeyRegistrationOptions.Type;
-type Passkey = typeof Passkey.Type;
-type Passkeys = typeof Passkeys.Type;
-type PasskeyMutation = typeof PasskeyMutation.Type;
-type PasswordLoginResponse = typeof PasswordLoginResponse.Type;
-type RecoveryCodes = typeof RecoveryCodes.Type;
-type SecurityStatus = typeof SecurityStatus.Type;
-type TOTPEnrollment = typeof TOTPEnrollment.Type;
-//#endregion
-//#region src/auth/service.d.ts
-type Call$5<A> = Effect.Effect<A, ApiRequestError>;
-declare const AuthApi_base: Context.ServiceClass<AuthApi, "@aperture-browser/api-client/AuthApi", {
-  readonly listLoginMethods: () => Call$5<LoginMethods>;
-  readonly loginWithPassword: (email: string, password: string) => Call$5<PasswordLoginResponse>;
-  readonly completePasswordMFA: (code: string) => Call$5<void>;
-  readonly loginWithAPIToken: (token: string) => Call$5<void>;
-  readonly beginPasskeyLogin: () => Call$5<PasskeyLoginOptions>;
-  readonly finishPasskeyLogin: (credential: AuthenticationResponseJSON) => Call$5<void>;
-  readonly acceptUserInvitation: (token: string, password: string) => Call$5<void>;
-  readonly logoutWebSession: () => Call$5<void>;
-  readonly getAuthMe: (selectedTenantId?: string | null, credentials?: ApiCredentials) => Call$5<AuthMeResponse>;
-  readonly getSecurityStatus: () => Call$5<SecurityStatus>;
-  readonly setPassword: (currentPassword: string, newPassword: string) => Call$5<void>;
-  readonly listPasskeys: () => Call$5<Passkeys>;
-  readonly beginPasskeyRegistration: (name: string) => Call$5<PasskeyRegistrationOptions>;
-  readonly finishPasskeyRegistration: (credential: RegistrationResponseJSON) => Call$5<PasskeyMutation>;
-  readonly renamePasskey: (passkeyId: string, name: string) => Call$5<PasskeyMutation>;
-  readonly deletePasskey: (passkeyId: string) => Call$5<void>;
-  readonly beginTOTPEnrollment: () => Call$5<TOTPEnrollment>;
-  readonly completeTOTPEnrollment: (code: string) => Call$5<RecoveryCodes>;
-  readonly regenerateRecoveryCodes: (code: string) => Call$5<RecoveryCodes>;
-  readonly disableTOTP: (code: string) => Call$5<void>;
-}>;
-/** Browser login, account security, and the current principal. */
-declare class AuthApi extends AuthApi_base {}
-//#endregion
 //#region src/auth/layer.d.ts
 declare const makeAuthApi: Effect.Effect<{
   readonly listLoginMethods: () => Effect.Effect<{
@@ -300,7 +51,7 @@ declare const makeAuthApi: Effect.Effect<{
       } | undefined;
     };
   }, ApiRequestError, never>;
-  readonly finishPasskeyLogin: (credential: AuthenticationResponseJSON) => Effect.Effect<void, ApiRequestError, never>;
+  readonly finishPasskeyLogin: (credential: PasskeyCredentialJSON) => Effect.Effect<void, ApiRequestError, never>;
   readonly acceptUserInvitation: (token: string, password: string) => Effect.Effect<void, ApiRequestError, never>;
   readonly logoutWebSession: () => Effect.Effect<void, ApiRequestError, never>;
   readonly getAuthMe: (selectedTenantId?: string | null, credentials?: ApiCredentials) => Effect.Effect<Api.AuthMe, ApiRequestError, never>;
@@ -357,7 +108,7 @@ declare const makeAuthApi: Effect.Effect<{
       readonly attestationFormats?: ("none" | "fido-u2f" | "packed" | "android-safetynet" | "android-key" | "tpm" | "apple")[] | undefined;
     };
   }, ApiRequestError, never>;
-  readonly finishPasskeyRegistration: (credential: RegistrationResponseJSON) => Effect.Effect<{
+  readonly finishPasskeyRegistration: (credential: PasskeyCredentialJSON) => Effect.Effect<{
     readonly passkey: {
       readonly id: string;
       readonly name: string;
@@ -386,8 +137,63 @@ declare const makeAuthApi: Effect.Effect<{
     readonly recoveryCodes: readonly string[];
   }, ApiRequestError, never>;
   readonly disableTOTP: (code: string) => Effect.Effect<void, ApiRequestError, never>;
-}, never, HttpClient.HttpClient | ApiAuthorization>;
-declare const authApiLayer: Layer.Layer<AuthApi, never, HttpClient.HttpClient | ApiAuthorization>;
+  readonly getOAuthAuthorization: (query: string) => Effect.Effect<{
+    readonly client: {
+      readonly id: string;
+      readonly name: string;
+      readonly uri: string | null;
+      readonly logoUri: string | null;
+      readonly kind: "registered" | "metadata_document";
+    };
+    readonly redirectUri: string;
+    readonly requestedScopes: readonly string[];
+    readonly user: {
+      readonly id: string;
+      readonly displayName: string;
+      readonly isSystemAdmin: boolean;
+    };
+    readonly tenants: readonly {
+      readonly id: string;
+      readonly displayName: string;
+      readonly scopes: readonly ("sessions:read" | "sessions:write" | "snapshots:read" | "snapshots:write" | "tenant:write")[];
+    }[];
+    readonly availableScopes: readonly ("sessions:read" | "sessions:write" | "snapshots:read" | "snapshots:write" | "tenant:write")[];
+    readonly canGrantSystemAdmin: boolean;
+  }, ApiRequestError, never>;
+  readonly approveOAuthAuthorization: (approval: OAuthApproval) => Effect.Effect<{
+    readonly redirectUrl: string;
+  }, ApiRequestError, never>;
+  readonly denyOAuthAuthorization: (query: string) => Effect.Effect<{
+    readonly redirectUrl: string;
+  }, ApiRequestError, never>;
+  readonly listOAuthGrants: () => Effect.Effect<{
+    readonly grants: readonly {
+      readonly id: string;
+      readonly client: {
+        readonly id: string;
+        readonly name: string;
+        readonly uri: string | null;
+        readonly logoUri: string | null;
+        readonly kind: "registered" | "metadata_document";
+      };
+      readonly authorityType: "system_admin" | "tenant";
+      readonly tenants: readonly {
+        readonly id: string;
+        readonly displayName: string;
+      }[];
+      readonly scopes: readonly string[];
+      readonly resourceMode: "all" | "allowlist";
+      readonly resourceGrants: readonly {
+        readonly resourceType: "session" | "snapshot";
+        readonly resourceId: string;
+      }[];
+      readonly createdAt: string;
+      readonly lastUsedAt: string | null;
+    }[];
+  }, ApiRequestError, never>;
+  readonly revokeOAuthGrant: (grantId: string) => Effect.Effect<void, ApiRequestError, never>;
+}, never, ApiAuthorization | HttpClient.HttpClient>;
+declare const authApiLayer: Layer.Layer<AuthApi, never, ApiAuthorization | HttpClient.HttpClient>;
 //#endregion
 //#region src/authorization/layer.d.ts
 /**
@@ -401,50 +207,74 @@ declare const makeApiAuthorization: Effect.Effect<{
 }, never, never>;
 declare const apiAuthorizationLayer: Layer.Layer<ApiAuthorization, never, never>;
 //#endregion
-//#region src/events/service.d.ts
-interface EventsListParams {
-  limit?: number;
-  cursor?: string;
-  resourceType?: string;
-  resourceId?: string;
-}
-declare const EventsApi_base: Context.ServiceClass<EventsApi, "@aperture-browser/api-client/EventsApi", {
-  readonly listEvents: (credentials: ApiCredentials, params?: EventsListParams) => Effect.Effect<EventsPage, ApiRequestError>;
-}>;
-/** The tenant's resource event log. */
-declare class EventsApi extends EventsApi_base {}
-//#endregion
-//#region src/events/layer.d.ts
-declare const makeEventsApi: Effect.Effect<{
-  readonly listEvents: (credentials: ApiCredentials, params?: EventsListParams) => Effect.Effect<EventsPage, ApiRequestError>;
-}, never, HttpClient.HttpClient | ApiAuthorization>;
-declare const eventsApiLayer: Layer.Layer<EventsApi, never, HttpClient.HttpClient | ApiAuthorization>;
-//#endregion
-//#region src/layer.d.ts
-/**
- * Every API service, sharing one ApiAuthorization. The services send requests through the
- * HttpClient the app provides, decorated with each call's authorization.
- */
-declare const apiClientLayer: Layer.Layer<AuthApi | ApiAuthorization | EventsApi | TenantsApi | UsersApi | SessionsApi | SnapshotsApi | TokensApi, never, HttpClient.HttpClient>;
-type ApiServices = Layer.Success<typeof apiClientLayer>;
-declare const baseUrlLayer: (baseUrl: string) => Layer.Layer<HttpClient.HttpClient, never, HttpClient.HttpClient>;
-//#endregion
 //#region src/pagination.d.ts
 interface PaginatedResponse<T> {
   readonly data: ReadonlyArray<T>;
   readonly meta: PageMeta;
 }
-interface ListQueryParams {
-  limit?: number;
+/** The opaque `nextCursor` of the previous page, sent along with the same filter. */
+interface PageCursor {
   cursor?: string;
 }
+/**
+ * The calls every cursor-paginated list exposes. The filter's `limit` is the page size.
+ * `list` fetches one page; `stream` fetches pages only as the stream is pulled; `listAll`
+ * collects every page.
+ */
+interface PaginatedList<Filter, T> {
+  readonly list: (credentials: ApiCredentials, params?: Filter & PageCursor) => Effect.Effect<PaginatedResponse<T>, ApiRequestError>;
+  readonly stream: (credentials: ApiCredentials, filter?: Filter) => Stream.Stream<T, ApiRequestError>;
+  readonly listAll: (credentials: ApiCredentials, filter?: Filter) => Effect.Effect<ReadonlyArray<T>, ApiRequestError>;
+}
 declare function getNextPageParam<T>(page: PaginatedResponse<T>): string | undefined;
 declare function flattenInfinitePages<T>(pages: PaginatedResponse<T>[] | undefined): T[];
+/**
+ * Derives `stream` and `listAll` from the call that fetches one page. That call must also
+ * accept a bare cursor, which every filter allows because all its fields are optional.
+ */
+declare function paginated<Filter, T>(list: (credentials: ApiCredentials, params?: (Filter & PageCursor) | PageCursor) => Effect.Effect<PaginatedResponse<T>, ApiRequestError>): PaginatedList<Filter, T>;
 declare const defaultListLimit = 50;
 declare const listQueryDefaults: {
   readonly refetchOnWindowFocus: true;
 };
 //#endregion
+//#region src/events/service.d.ts
+interface EventsFilter {
+  limit?: number;
+  resourceType?: string;
+  resourceId?: string;
+}
+type EventsListParams = EventsFilter & PageCursor;
+type EventsList = PaginatedList<EventsFilter, ResourceEvent>;
+interface AuditEventsFilter {
+  limit?: number;
+  tenantId?: string;
+  actorType?: Api.PrincipalType;
+  actorId?: string;
+  action?: string;
+  resourceType?: string;
+  resourceId?: string;
+}
+type AuditEventsListParams = AuditEventsFilter & PageCursor;
+type AuditEventsList = PaginatedList<AuditEventsFilter, AuditEvent>;
+declare const EventsApi_base: Context.ServiceClass<EventsApi, "@aperture-browser/api-client/EventsApi", {
+  readonly listEvents: EventsList["list"];
+  readonly streamEvents: EventsList["stream"];
+  readonly listAllEvents: EventsList["listAll"];
+  readonly listAuditEvents: AuditEventsList["list"];
+  readonly streamAuditEvents: AuditEventsList["stream"];
+  readonly listAllAuditEvents: AuditEventsList["listAll"];
+}>;
+/** The tenant's resource event log, and the deployment-wide audit log. */
+declare class EventsApi extends EventsApi_base {}
+//#endregion
+//#region src/health/service.d.ts
+declare const HealthApi_base: Context.ServiceClass<HealthApi, "@aperture-browser/api-client/HealthApi", {
+  readonly getHealth: () => Effect.Effect<Health, ApiRequestError>;
+}>;
+/** The instance's unauthenticated health check. */
+declare class HealthApi extends HealthApi_base {}
+//#endregion
 //#region src/query.d.ts
 type TagFilterValue = Array<{
   key: string;
@@ -461,7 +291,28 @@ declare const tagQuery: (tags: TagFilterValue | undefined) => {
 declare const compactQuery: <T extends object>(query: T) => T;
 //#endregion
 //#region src/sessions/schemas.d.ts
-declare const BrowserStatus: Schema.Struct<{
+declare const BrowserPage: Schema.Struct<{
+  readonly targetId: Schema.String;
+  readonly state: Schema.Literals<readonly ["pending", "ready", "unavailable", "closed"]>;
+  readonly title: Schema.String;
+  readonly url: Schema.String;
+  readonly viewport: Schema.optionalKey<Schema.Struct<{
+    readonly width: Schema.Number;
+    readonly height: Schema.Number;
+    readonly deviceScaleFactor: Schema.Number;
+    readonly contentWidth: Schema.Number;
+    readonly contentHeight: Schema.Number;
+    readonly canvasWidth: Schema.Number;
+    readonly canvasHeight: Schema.Number;
+  }>>;
+  readonly thumbnailAvailable: Schema.Boolean;
+}>;
+/** Passive page discovery. Reading it never wakes or keeps a browser session alive. */
+declare const BrowserStatus: Schema.Union<readonly [Schema.Struct<{
+  readonly status: Schema.Literal<"running">;
+  readonly source: Schema.Literal<"live">;
+  readonly capturedAt: Schema.String;
+  readonly representativeTargetId: Schema.optionalKey<Schema.String>;
   readonly sessionId: Schema.String;
   readonly cdpUrl: Schema.String;
   readonly media: Schema.Struct<{
@@ -470,16 +321,16 @@ declare const BrowserStatus: Schema.Struct<{
     readonly iceServers: Schema.optionalKey<Schema.$Array<Schema.Struct<{
       readonly urls: Schema.$Array<Schema.String>;
       readonly username: Schema.optionalKey<Schema.String>;
-      readonly credential: Schema.optionalKey<Schema.String>;
+      readonly credential: Schema.optionalKey<Schema.suspend<Schema.Codec<Api.SensitiveString, string, never, never>>>;
     }>>>;
   }>;
-  readonly targets: Schema.withDecodingDefaultKey<Schema.$Array<Schema.Struct<{
+  readonly thumbnailAvailable: Schema.Boolean;
+  readonly pages: Schema.withDecodingDefaultKey<Schema.$Array<Schema.Struct<{
     readonly targetId: Schema.String;
-    readonly generation: Schema.Number;
     readonly state: Schema.Literals<readonly ["pending", "ready", "unavailable", "closed"]>;
     readonly title: Schema.String;
     readonly url: Schema.String;
-    readonly viewport: Schema.Struct<{
+    readonly viewport: Schema.optionalKey<Schema.Struct<{
       readonly width: Schema.Number;
       readonly height: Schema.Number;
       readonly deviceScaleFactor: Schema.Number;
@@ -487,37 +338,140 @@ declare const BrowserStatus: Schema.Struct<{
       readonly contentHeight: Schema.Number;
       readonly canvasWidth: Schema.Number;
       readonly canvasHeight: Schema.Number;
-    }>;
+    }>>;
+    readonly thumbnailAvailable: Schema.Boolean;
   }>>, never>;
-}>;
-/** A recording as the live session reports it. */
-declare const Recording: Schema.Struct<{
+}>, Schema.Struct<{
+  readonly status: Schema.Literal<"suspended">;
+  readonly source: Schema.Literal<"persisted">;
+  readonly capturedAt: Schema.String;
+  readonly representativeTargetId: Schema.optionalKey<Schema.String>;
+  readonly sessionId: Schema.String;
+  readonly cdpUrl: Schema.String;
+  readonly media: Schema.Struct<{
+    readonly mode: Schema.Literals<readonly ["auto", "cdp"]>;
+    readonly webrtcProducer: Schema.Boolean;
+    readonly iceServers: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+      readonly urls: Schema.$Array<Schema.String>;
+      readonly username: Schema.optionalKey<Schema.String>;
+      readonly credential: Schema.optionalKey<Schema.suspend<Schema.Codec<Api.SensitiveString, string, never, never>>>;
+    }>>>;
+  }>;
+  readonly thumbnailAvailable: Schema.Boolean;
+  readonly pages: Schema.withDecodingDefaultKey<Schema.$Array<Schema.Struct<{
+    readonly targetId: Schema.String;
+    readonly state: Schema.Literals<readonly ["pending", "ready", "unavailable", "closed"]>;
+    readonly title: Schema.String;
+    readonly url: Schema.String;
+    readonly viewport: Schema.optionalKey<Schema.Struct<{
+      readonly width: Schema.Number;
+      readonly height: Schema.Number;
+      readonly deviceScaleFactor: Schema.Number;
+      readonly contentWidth: Schema.Number;
+      readonly contentHeight: Schema.Number;
+      readonly canvasWidth: Schema.Number;
+      readonly canvasHeight: Schema.Number;
+    }>>;
+    readonly thumbnailAvailable: Schema.Boolean;
+  }>>, never>;
+}>, Schema.Struct<{
+  readonly status: Schema.Literal<"suspended">;
+  readonly source: Schema.Literal<"unavailable">;
+  readonly sessionId: Schema.String;
+  readonly cdpUrl: Schema.String;
+  readonly media: Schema.Struct<{
+    readonly mode: Schema.Literals<readonly ["auto", "cdp"]>;
+    readonly webrtcProducer: Schema.Boolean;
+    readonly iceServers: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+      readonly urls: Schema.$Array<Schema.String>;
+      readonly username: Schema.optionalKey<Schema.String>;
+      readonly credential: Schema.optionalKey<Schema.suspend<Schema.Codec<Api.SensitiveString, string, never, never>>>;
+    }>>>;
+  }>;
+  readonly thumbnailAvailable: Schema.Boolean;
+  readonly pages: Schema.withDecodingDefaultKey<Schema.$Array<Schema.Struct<{
+    readonly targetId: Schema.String;
+    readonly state: Schema.Literals<readonly ["pending", "ready", "unavailable", "closed"]>;
+    readonly title: Schema.String;
+    readonly url: Schema.String;
+    readonly viewport: Schema.optionalKey<Schema.Struct<{
+      readonly width: Schema.Number;
+      readonly height: Schema.Number;
+      readonly deviceScaleFactor: Schema.Number;
+      readonly contentWidth: Schema.Number;
+      readonly contentHeight: Schema.Number;
+      readonly canvasWidth: Schema.Number;
+      readonly canvasHeight: Schema.Number;
+    }>>;
+    readonly thumbnailAvailable: Schema.Boolean;
+  }>>, never>;
+}>]>;
+/**
+ * A recording as the live session reports it. Sessions that are still running an
+ * older wrapper send only `path`, which decoding carries over into `relativePath`.
+ */
+declare const Recording: Schema.decodeTo<Schema.Struct<{
+  readonly relativePath: Schema.String;
   readonly recordingId: Schema.String;
   readonly mode: Schema.Literals<readonly ["tab", "viewer"]>;
   readonly targetId: Schema.String;
   readonly captureGeneration: Schema.Number;
   readonly status: Schema.Literals<readonly ["starting", "running", "stopped", "failed"]>;
   readonly stopReason: Schema.optionalKey<Schema.String>;
-  readonly path: Schema.String;
+  readonly sandboxPath: Schema.optionalKey<Schema.String>;
+  readonly path: Schema.optionalKey<Schema.String>;
   readonly startedAt: Schema.String;
   readonly stoppedAt: Schema.optionalKey<Schema.String>;
   readonly sizeBytes: Schema.optionalKey<Schema.Number>;
   readonly fps: Schema.Number;
   readonly bitrateKbps: Schema.Number;
   readonly codec: Schema.String;
-}>;
+  readonly editing: Schema.Boolean;
+  readonly editedRelativePath: Schema.optionalKey<Schema.String>;
+  readonly timelineRelativePath: Schema.optionalKey<Schema.String>;
+  readonly editError: Schema.optionalKey<Schema.Struct<{
+    readonly code: Schema.Literals<readonly ["ffmpeg_unavailable", "open_failed", "nothing_kept", "analysis_failed", "plan_failed", "render_failed", "timeout", "cancelled", "timeline_failed"]>;
+    readonly message: Schema.String;
+  }>>;
+}>, Schema.Struct<{
+  readonly relativePath: Schema.optionalKey<Schema.String>;
+  readonly recordingId: Schema.String;
+  readonly mode: Schema.Literals<readonly ["tab", "viewer"]>;
+  readonly targetId: Schema.String;
+  readonly captureGeneration: Schema.Number;
+  readonly status: Schema.Literals<readonly ["starting", "running", "stopped", "failed"]>;
+  readonly stopReason: Schema.optionalKey<Schema.String>;
+  readonly sandboxPath: Schema.optionalKey<Schema.String>;
+  readonly path: Schema.optionalKey<Schema.String>;
+  readonly startedAt: Schema.String;
+  readonly stoppedAt: Schema.optionalKey<Schema.String>;
+  readonly sizeBytes: Schema.optionalKey<Schema.Number>;
+  readonly fps: Schema.Number;
+  readonly bitrateKbps: Schema.Number;
+  readonly codec: Schema.String;
+  readonly editing: Schema.Boolean;
+  readonly editedRelativePath: Schema.optionalKey<Schema.String>;
+  readonly timelineRelativePath: Schema.optionalKey<Schema.String>;
+  readonly editError: Schema.optionalKey<Schema.Struct<{
+    readonly code: Schema.Literals<readonly ["ffmpeg_unavailable", "open_failed", "nothing_kept", "analysis_failed", "plan_failed", "render_failed", "timeout", "cancelled", "timeline_failed"]>;
+    readonly message: Schema.String;
+  }>>;
+}>, never, never>;
 type BrowserStatus = typeof BrowserStatus.Type;
+type BrowserPage = typeof BrowserPage.Type;
 type Recording = typeof Recording.Type;
 //#endregion
 //#region src/sessions/service.d.ts
 type Call$4<A> = Effect.Effect<A, ApiRequestError>;
-interface SessionsListParams {
+interface SessionsFilter {
   limit?: number;
-  cursor?: string;
   includeDeleted?: boolean;
   status?: Api.SessionStatus;
+  query?: string;
   tags?: TagFilterValue;
 }
+type SessionsListParams = SessionsFilter & PageCursor;
+type SessionsList = PaginatedList<SessionsFilter, Session>;
 type InitialBrowserTarget = Api.InitialBrowserTarget;
 type InitialBrowserStorageState = Api.InitialBrowserStorageState;
 interface CreateSessionInput {
@@ -530,6 +484,7 @@ interface CreateSessionInput {
   initialTargets?: readonly InitialBrowserTarget[];
   storageState?: InitialBrowserStorageState;
   tags?: Record<string, string>;
+  proxy?: ProxyConfig;
 }
 interface CreateSessionOptions {
   waitForReady?: boolean;
@@ -540,13 +495,36 @@ interface PromoteSessionInput {
   force?: boolean;
   tags?: Record<string, string>;
 }
+type CreateSessionRecordingInput = Api.CreateSessionRecordingInput;
+type SessionFileDownloadURLInput = Api.SessionFileDownloadURLInput;
 interface DownloadedFile {
   blob: Blob;
   filename: string | null;
 }
+/**
+ * One file to upload. Blob and Uint8Array contents are sent as FormData. Any stream content
+ * makes the whole body a streamed request, which browsers other than Chromium cannot send;
+ * a stream failure aborts the upload and surfaces as a `network_error`.
+ */
+interface SessionUploadFile {
+  name: string;
+  content: Blob | Uint8Array | Stream.Stream<Uint8Array, unknown>;
+}
+interface UploadSessionFilesOptions {
+  /** Directory below the session files root; `uploads` when omitted. */
+  directory?: string;
+}
+type MoveSessionFileInput = Api.MoveSessionFileInput;
+interface DeleteSessionFileOptions {
+  /** Delete a directory together with everything below it. */
+  recursive?: boolean;
+}
 declare const SessionsApi_base: Context.ServiceClass<SessionsApi, "@aperture-browser/api-client/SessionsApi", {
-  readonly listSessions: (credentials: ApiCredentials, params?: SessionsListParams) => Call$4<SessionsPage>;
-  readonly getSession: (credentials: ApiCredentials, sessionId: string) => Call$4<Session>;
+  readonly listSessions: SessionsList["list"];
+  readonly streamSessions: SessionsList["stream"];
+  readonly listAllSessions: SessionsList["listAll"];
+  readonly exportSessionStorageState: (credentials: ApiCredentials, sessionId: string, input: Api.ExportSessionStorageStateInput) => Call$4<Api.InitialBrowserStorageState>;
+  readonly getSession: (credentials: ApiCredentials, sessionId: string) => Call$4<Session>; /** Any number of IDs; the API takes 100 per request, so larger lists are sent in batches. */
   readonly getSessionsBulk: (credentials: ApiCredentials, sessionIds: readonly string[]) => Call$4<SessionsBulkResponse>;
   readonly createSession: (credentials: ApiCredentials, input: CreateSessionInput, options?: CreateSessionOptions) => Call$4<CreateSessionResponse>;
   readonly deleteSession: (credentials: ApiCredentials, sessionId: string) => Call$4<SessionMutationResponse>;
@@ -554,77 +532,73 @@ declare const SessionsApi_base: Context.ServiceClass<SessionsApi, "@aperture-bro
   readonly suspendSession: (credentials: ApiCredentials, sessionId: string) => Call$4<SessionMutationResponse>;
   readonly rotateSessionToken: (credentials: ApiCredentials, sessionId: string) => Call$4<SessionMutationResponse>;
   readonly rotateCollaborationCapability: (credentials: ApiCredentials, sessionId: string, role: "editor" | "viewer") => Call$4<SessionMutationResponse>;
-  readonly replaceSessionTags: (credentials: ApiCredentials, sessionId: string, tags: Record<string, string>) => Call$4<SessionMutationResponse>;
+  readonly replaceSessionTags: (credentials: ApiCredentials, sessionId: string, tags: Record<string, string>) => Call$4<SessionMutationResponse>; /** Replaces the session's egress proxy; new connections use it immediately. */
+  readonly updateSessionProxy: (credentials: ApiCredentials, sessionId: string, proxy: UpdateProxyConfig) => Call$4<SessionMutationResponse>;
   readonly promoteSession: (credentials: ApiCredentials, sessionId: string, input: PromoteSessionInput) => Call$4<PromoteSessionResponse>;
-  readonly getBrowserChannels: (credentials: ApiCredentials) => Call$4<BrowserChannelsResponse>;
-  readonly getBrowserStatus: (credentials: ApiCredentials, sessionId: string, sessionToken?: string) => Call$4<BrowserStatus>;
-  readonly downloadSessionRecording: (credentials: ApiCredentials, sessionId: string, recordingId: string, sessionToken?: string) => Call$4<DownloadedFile>;
+  readonly getSessionCursor: (credentials: ApiCredentials, sessionId: string) => Call$4<CursorVisibility>;
+  readonly setSessionCursor: (credentials: ApiCredentials, sessionId: string, visible: boolean) => Call$4<CursorVisibility>;
+  readonly listSessionRecordings: (credentials: ApiCredentials, sessionId: string) => Call$4<ReadonlyArray<SessionRecording>>;
+  readonly createSessionRecording: (credentials: ApiCredentials, sessionId: string, input: CreateSessionRecordingInput) => Call$4<SessionRecording>;
+  readonly getSessionRecording: (credentials: ApiCredentials, sessionId: string, recordingId: string) => Call$4<SessionRecording>; /** Moves a running tab recording to another ready target. */
+  readonly retargetSessionRecording: (credentials: ApiCredentials, sessionId: string, recordingId: string, targetId: string) => Call$4<SessionRecording>;
+  /**
+   * Stops a recording and returns it at once with its raw video published. The edit runs
+   * afterwards: the recording stays `editing` until `editedRelativePath` or `editError` is set,
+   * which `getSessionRecording` reports.
+   */
+  readonly stopSessionRecording: (credentials: ApiCredentials, sessionId: string, recordingId: string) => Call$4<SessionRecording>;
+  /**
+   * Every file and directory of the session, also while it is not running. See
+   * `sessionFileTree`.
+   */
+  readonly listSessionFiles: (credentials: ApiCredentials, sessionId: string) => Call$4<ReadonlyArray<SessionFileEntry>>;
+  /**
+   * Stores files in a directory of the session's files, `uploads` by default, in any
+   * retained state. Contents are sent as described for `SessionUploadFile`.
+   */
+  readonly uploadSessionFiles: (credentials: ApiCredentials, sessionId: string, files: ReadonlyArray<SessionUploadFile>, options?: UploadSessionFilesOptions) => Call$4<ReadonlyArray<SessionFile>>; /** Deletes one file, or a directory; a directory with entries needs `recursive`. */
+  readonly deleteSessionFile: (credentials: ApiCredentials, sessionId: string, relativePath: string, options?: DeleteSessionFileOptions) => Call$4<void>; /** Moves or renames one file or directory. It never replaces an existing entry. */
+  readonly moveSessionFile: (credentials: ApiCredentials, sessionId: string, input: MoveSessionFileInput) => Call$4<SessionFileEntry>; /** Creates a directory, with any missing parents. */
+  readonly createSessionDirectory: (credentials: ApiCredentials, sessionId: string, relativePath: string) => Call$4<SessionDirectory>;
+  /**
+   * A signed URL that serves one session file without credentials until it expires.
+   * `disposition: "inline"` makes it usable as an `<img>` or `<video>` source.
+   */
+  readonly createSessionFileDownloadURL: (credentials: ApiCredentials, sessionId: string, input: SessionFileDownloadURLInput) => Call$4<SessionFileDownloadURL>;
+  readonly getBrowserChannels: (credentials: ApiCredentials) => Call$4<BrowserChannelsResponse>; /** Reads live or persisted page metadata without waking or keeping the session alive. */
+  readonly getBrowserStatus: (credentials: ApiCredentials, sessionId: string, sessionToken?: Redacted.Redacted<string>) => Call$4<BrowserStatus>;
+  readonly downloadSessionRecording: (credentials: ApiCredentials, sessionId: string, recordingId: string, sessionToken?: Redacted.Redacted<string>) => Call$4<DownloadedFile>; /** A JPEG of the session, or of one tab when `targetId` is given. Never wakes a suspended session. */
+  readonly getSessionThumbnail: (credentials: ApiCredentials, sessionId: string, targetId?: string) => Call$4<Blob>; /** The recording's bytes as they arrive, for files too large to hold in memory. */
+  readonly streamSessionRecording: (credentials: ApiCredentials, sessionId: string, recordingId: string, sessionToken?: Redacted.Redacted<string>) => Stream.Stream<Uint8Array, ApiRequestError>;
+  /**
+   * Stores files in the running session's `uploads` directory through the session itself,
+   * which also accepts its `sessionToken`.
+   */
+  readonly uploadLiveSessionFiles: (credentials: ApiCredentials, sessionId: string, files: ReadonlyArray<SessionUploadFile>, sessionToken?: Redacted.Redacted<string>) => Call$4<ReadonlyArray<SessionFile>>; /** Resizes a top-level target of the running session and returns the applied viewport. */
+  readonly setSessionViewport: (credentials: ApiCredentials, sessionId: string, input: SetViewportInput, sessionToken?: Redacted.Redacted<string>) => Call$4<TargetViewport>;
 }>;
 /** Browser sessions, their live browser, and their recordings. */
 declare class SessionsApi extends SessionsApi_base {}
 //#endregion
-//#region src/sessions/layer.d.ts
-declare const makeSessionsApi: Effect.Effect<{
-  readonly listSessions: (credentials: ApiCredentials, params?: SessionsListParams) => Effect.Effect<Api.SessionPage, ApiRequestError, never>;
-  readonly getSession: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<Api.Session, ApiRequestError, never>;
-  readonly getSessionsBulk: (credentials: ApiCredentials, sessionIds: readonly string[]) => Effect.Effect<Api.SessionBulkResponse, ApiRequestError, never>;
-  readonly createSession: (credentials: ApiCredentials, input: CreateSessionInput, options?: CreateSessionOptions) => Effect.Effect<Api.CreateSessionResult, ApiRequestError, never>;
-  readonly deleteSession: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
-  readonly reopenSession: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
-  readonly suspendSession: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
-  readonly rotateSessionToken: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
-  readonly rotateCollaborationCapability: (credentials: ApiCredentials, sessionId: string, role: "editor" | "viewer") => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
-  readonly replaceSessionTags: (credentials: ApiCredentials, sessionId: string, tags: Record<string, string>) => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
-  readonly promoteSession: (credentials: ApiCredentials, sessionId: string, input: PromoteSessionInput) => Effect.Effect<Api.SnapshotMutation, ApiRequestError, never>;
-  readonly getBrowserChannels: (credentials: ApiCredentials) => Effect.Effect<Api.BrowserChannels, ApiRequestError, never>;
-  readonly getBrowserStatus: (credentials: ApiCredentials, sessionId: string, sessionToken?: string) => Effect.Effect<{
-    readonly sessionId: string;
-    readonly cdpUrl: string;
-    readonly media: {
-      readonly mode: "auto" | "cdp";
-      readonly webrtcProducer: boolean;
-      readonly iceServers?: readonly {
-        readonly urls: readonly string[];
-        readonly username?: string | undefined;
-        readonly credential?: string | undefined;
-      }[] | undefined;
-    };
-    readonly targets: readonly {
-      readonly targetId: string;
-      readonly generation: number;
-      readonly state: "pending" | "ready" | "unavailable" | "closed";
-      readonly title: string;
-      readonly url: string;
-      readonly viewport: {
-        readonly width: number;
-        readonly height: number;
-        readonly deviceScaleFactor: number;
-        readonly contentWidth: number;
-        readonly contentHeight: number;
-        readonly canvasWidth: number;
-        readonly canvasHeight: number;
-      };
-    }[];
-  }, ApiRequestError, never>;
-  readonly downloadSessionRecording: (credentials: ApiCredentials, sessionId: string, recordingId: string, sessionToken?: string) => Effect.Effect<DownloadedFile, ApiRequestError, never>;
-}, never, HttpClient.HttpClient | ApiAuthorization>;
-declare const sessionsApiLayer: Layer.Layer<SessionsApi, never, HttpClient.HttpClient | ApiAuthorization>;
-//#endregion
 //#region src/snapshots/service.d.ts
 type Call$3<A> = Effect.Effect<A, ApiRequestError>;
-interface SnapshotsListParams {
+interface SnapshotsFilter {
   limit?: number;
-  cursor?: string;
   includeDeleted?: boolean;
   deleted?: "active" | "deleted" | "all";
   name?: string;
   tags?: TagFilterValue;
 }
+type SnapshotsListParams = SnapshotsFilter & PageCursor;
+type SnapshotsList = PaginatedList<SnapshotsFilter, Snapshot>;
 interface UpdateSnapshotInput {
   description: string | null;
 }
 declare const SnapshotsApi_base: Context.ServiceClass<SnapshotsApi, "@aperture-browser/api-client/SnapshotsApi", {
-  readonly listSnapshots: (credentials: ApiCredentials, params?: SnapshotsListParams) => Call$3<SnapshotsPage>;
+  readonly listSnapshots: SnapshotsList["list"];
+  readonly streamSnapshots: SnapshotsList["stream"];
+  readonly listAllSnapshots: SnapshotsList["listAll"]; /** The active snapshot with exactly this name, if there is one. */
+  readonly getSnapshotByName: (credentials: ApiCredentials, name: string) => Call$3<Option.Option<Snapshot>>;
   readonly updateSnapshot: (credentials: ApiCredentials, name: string, input: UpdateSnapshotInput) => Call$3<SnapshotMutationResponse>;
   readonly replaceSnapshotTags: (credentials: ApiCredentials, name: string, tags: Record<string, string>) => Call$3<SnapshotMutationResponse>;
   readonly deleteSnapshot: (credentials: ApiCredentials, name: string) => Call$3<SnapshotMutationResponse>;
@@ -633,55 +607,42 @@ declare const SnapshotsApi_base: Context.ServiceClass<SnapshotsApi, "@aperture-b
 /** Retained snapshots that new sessions start from. */
 declare class SnapshotsApi extends SnapshotsApi_base {}
 //#endregion
-//#region src/snapshots/layer.d.ts
-declare const makeSnapshotsApi: Effect.Effect<{
-  readonly listSnapshots: (credentials: ApiCredentials, params?: SnapshotsListParams) => Effect.Effect<Api.SnapshotPage, ApiRequestError, never>;
-  readonly updateSnapshot: (credentials: ApiCredentials, name: string, input: UpdateSnapshotInput) => Effect.Effect<Api.SnapshotMutation, ApiRequestError, never>;
-  readonly replaceSnapshotTags: (credentials: ApiCredentials, name: string, tags: Record<string, string>) => Effect.Effect<Api.SnapshotMutation, ApiRequestError, never>;
-  readonly deleteSnapshot: (credentials: ApiCredentials, name: string) => Effect.Effect<Api.SnapshotMutation, ApiRequestError, never>;
-  readonly restoreSnapshot: (credentials: ApiCredentials, name: string) => Effect.Effect<Api.SnapshotMutation, ApiRequestError, never>;
-}, never, HttpClient.HttpClient | ApiAuthorization>;
-declare const snapshotsApiLayer: Layer.Layer<SnapshotsApi, never, HttpClient.HttpClient | ApiAuthorization>;
-//#endregion
 //#region src/tenants/service.d.ts
 type Call$2<A> = Effect.Effect<A, ApiRequestError>;
-interface TenantsListParams {
+interface TenantsFilter {
   limit?: number;
-  cursor?: string;
   includeDeleted?: boolean;
   deleted?: "active" | "deleted" | "all";
+  query?: string;
 }
+type TenantsListParams = TenantsFilter & PageCursor;
+type TenantsList = PaginatedList<TenantsFilter, Tenant>;
 declare const TenantsApi_base: Context.ServiceClass<TenantsApi, "@aperture-browser/api-client/TenantsApi", {
-  readonly listTenants: (credentials: ApiCredentials, params?: TenantsListParams) => Call$2<TenantsPage>;
+  readonly listTenants: TenantsList["list"];
+  readonly streamTenants: TenantsList["stream"];
+  readonly listAllTenants: TenantsList["listAll"];
   readonly createTenant: (credentials: ApiCredentials, input: Api.TenantInput) => Call$2<Tenant>;
   readonly updateTenant: (credentials: ApiCredentials, tenantId: string, input: Api.TenantInput) => Call$2<Tenant>;
   readonly deleteTenant: (credentials: ApiCredentials, tenantId: string) => Call$2<Tenant>;
-  readonly restoreTenant: (credentials: ApiCredentials, tenantId: string) => Call$2<Tenant>;
+  readonly restoreTenant: (credentials: ApiCredentials, tenantId: string) => Call$2<Tenant>; /** The tenant of a tenant token. */
+  readonly getCurrentTenant: (credentials: ApiCredentials) => Call$2<Tenant>;
+  readonly updateCurrentTenant: (credentials: ApiCredentials, input: Api.TenantInput) => Call$2<Tenant>;
 }>;
-/** Tenant administration. */
+/** Tenant administration, and the tenant a tenant token belongs to. */
 declare class TenantsApi extends TenantsApi_base {}
 //#endregion
-//#region src/tenants/layer.d.ts
-declare const makeTenantsApi: Effect.Effect<{
-  readonly listTenants: (credentials: ApiCredentials, params?: TenantsListParams) => Effect.Effect<Api.TenantPage, ApiRequestError, never>;
-  readonly createTenant: (credentials: ApiCredentials, input: Api.TenantInput) => Effect.Effect<Api.Tenant, ApiRequestError, never>;
-  readonly updateTenant: (credentials: ApiCredentials, tenantId: string, input: Api.TenantInput) => Effect.Effect<Api.Tenant, ApiRequestError, never>;
-  readonly deleteTenant: (credentials: ApiCredentials, tenantId: string) => Effect.Effect<Api.Tenant, ApiRequestError, never>;
-  readonly restoreTenant: (credentials: ApiCredentials, tenantId: string) => Effect.Effect<Api.Tenant, ApiRequestError, never>;
-}, never, HttpClient.HttpClient | ApiAuthorization>;
-declare const tenantsApiLayer: Layer.Layer<TenantsApi, never, HttpClient.HttpClient | ApiAuthorization>;
-//#endregion
 //#region src/tokens/service.d.ts
 type Call$1<A> = Effect.Effect<A, ApiRequestError>;
-interface TokensListParams {
+interface TokensFilter {
   limit?: number;
-  cursor?: string;
   tenantId?: string;
   name?: string;
   authorityType?: "system_admin" | "tenant";
   revoked?: "all" | "active" | "revoked";
   scope?: string;
 }
+type TokensListParams = TokensFilter & PageCursor;
+type TokensList = PaginatedList<TokensFilter, ApiToken>;
 interface CreateAdminTokenInput {
   name: string;
   authorityType: "system_admin" | "tenant";
@@ -699,42 +660,38 @@ interface CreateTenantTokenInput {
   expiresAt?: string | null;
 }
 declare const TokensApi_base: Context.ServiceClass<TokensApi, "@aperture-browser/api-client/TokensApi", {
-  readonly listAdminTokens: (credentials: ApiCredentials, params?: TokensListParams) => Call$1<TokensPage>;
+  readonly listAdminTokens: TokensList["list"];
+  readonly streamAdminTokens: TokensList["stream"];
+  readonly listAllAdminTokens: TokensList["listAll"];
   readonly createAdminToken: (credentials: ApiCredentials, input: CreateAdminTokenInput) => Call$1<CreateTokenResponse>;
   readonly revokeAdminToken: (credentials: ApiCredentials, tokenId: string) => Call$1<void>;
-  readonly listTenantTokens: (credentials: ApiCredentials, params?: TokensListParams) => Call$1<TokensPage>;
+  readonly listTenantTokens: TokensList["list"];
+  readonly streamTenantTokens: TokensList["stream"];
+  readonly listAllTenantTokens: TokensList["listAll"];
   readonly createTenantToken: (credentials: ApiCredentials, input: CreateTenantTokenInput) => Call$1<CreateTokenResponse>;
   readonly revokeTenantToken: (credentials: ApiCredentials, tokenId: string) => Call$1<void>;
 }>;
 /** API tokens, issued either deployment-wide or within the current tenant. */
 declare class TokensApi extends TokensApi_base {}
 //#endregion
-//#region src/tokens/layer.d.ts
-declare const makeTokensApi: Effect.Effect<{
-  readonly listAdminTokens: (credentials: ApiCredentials, params?: TokensListParams) => Effect.Effect<Api.TokenPage, ApiRequestError, never>;
-  readonly createAdminToken: (credentials: ApiCredentials, input: CreateAdminTokenInput) => Effect.Effect<Api.CreateTokenResponse, ApiRequestError, never>;
-  readonly revokeAdminToken: (credentials: ApiCredentials, tokenId: string) => Effect.Effect<void, ApiRequestError, never>;
-  readonly listTenantTokens: (credentials: ApiCredentials, params?: TokensListParams) => Effect.Effect<Api.TokenPage, ApiRequestError, never>;
-  readonly createTenantToken: (credentials: ApiCredentials, input: CreateTenantTokenInput) => Effect.Effect<Api.CreateTokenResponse, ApiRequestError, never>;
-  readonly revokeTenantToken: (credentials: ApiCredentials, tokenId: string) => Effect.Effect<void, ApiRequestError, never>;
-}, never, HttpClient.HttpClient | ApiAuthorization>;
-declare const tokensApiLayer: Layer.Layer<TokensApi, never, HttpClient.HttpClient | ApiAuthorization>;
-//#endregion
 //#region src/users/service.d.ts
 type Call<A> = Effect.Effect<A, ApiRequestError>;
-interface UsersListParams {
+interface UsersFilter {
   limit?: number;
-  cursor?: string;
   query?: string;
   disabled?: "active" | "disabled" | "all";
 }
+type UsersListParams = UsersFilter & PageCursor;
+type UsersList = PaginatedList<UsersFilter, User>;
 interface UserInput {
   email: string | null;
   displayName: string;
   isSystemAdmin: boolean;
 }
 declare const UsersApi_base: Context.ServiceClass<UsersApi, "@aperture-browser/api-client/UsersApi", {
-  readonly listUsers: (credentials: ApiCredentials, params?: UsersListParams) => Call<UsersPage>;
+  readonly listUsers: UsersList["list"];
+  readonly streamUsers: UsersList["stream"];
+  readonly listAllUsers: UsersList["listAll"];
   readonly createUser: (credentials: ApiCredentials, input: UserInput) => Call<User>;
   readonly getUser: (credentials: ApiCredentials, userId: string) => Call<User>;
   readonly updateUser: (credentials: ApiCredentials, userId: string, input: UserInput) => Call<User>;
@@ -742,15 +699,289 @@ declare const UsersApi_base: Context.ServiceClass<UsersApi, "@aperture-browser/a
   readonly disableUser: (credentials: ApiCredentials, userId: string) => Call<User>;
   readonly restoreUser: (credentials: ApiCredentials, userId: string) => Call<User>;
   readonly listUserMemberships: (credentials: ApiCredentials, userId: string) => Call<ReadonlyArray<TenantMembership>>;
+  readonly listTenantMemberships: (credentials: ApiCredentials, tenantId: string) => Call<ReadonlyArray<TenantMembership>>;
   readonly upsertTenantMembership: (credentials: ApiCredentials, tenantId: string, userId: string, scopes: readonly string[]) => Call<TenantMembership>;
   readonly deleteTenantMembership: (credentials: ApiCredentials, tenantId: string, userId: string) => Call<void>;
 }>;
 /** User administration and tenant memberships. */
 declare class UsersApi extends UsersApi_base {}
 //#endregion
+//#region src/client.d.ts
+type CredentialedMethod = (credentials: ApiCredentials, ...args: never[]) => unknown;
+/** A service whose methods have their leading credentials argument already applied. */
+type WithCredentials<S> = { readonly [K in keyof S]: S[K] extends ((credentials: ApiCredentials, ...args: infer Args) => infer Result) ? (...args: Args) => Result : never };
+/** Binds `credentials` as the first argument of every method of `service`. */
+declare function withCredentials<S extends { readonly [K in keyof S]: CredentialedMethod }>(service: S, credentials: ApiCredentials): WithCredentials<S>;
+declare const ApertureClient_base: Context.ServiceClass<ApertureClient, "@aperture-browser/api-client/ApertureClient", {
+  readonly sessions: WithCredentials<SessionsApi["Service"]>;
+  readonly snapshots: WithCredentials<SnapshotsApi["Service"]>;
+  readonly tenants: WithCredentials<TenantsApi["Service"]>;
+  readonly users: WithCredentials<UsersApi["Service"]>;
+  readonly tokens: WithCredentials<TokensApi["Service"]>;
+  readonly events: WithCredentials<EventsApi["Service"]>; /** The calls of AuthApi that work with API credentials rather than a browser login. */
+  readonly auth: {
+    readonly getAuthMe: () => Effect.Effect<AuthMeResponse, ApiRequestError>;
+  };
+  readonly health: HealthApi["Service"];
+}>;
+/**
+ * The credentialed API services with one set of credentials bound, for callers that always
+ * act as the same principal, such as a server holding one API token.
+ */
+declare class ApertureClient extends ApertureClient_base {}
+declare const makeApertureClient: (credentials: ApiCredentials) => Effect.Effect<{
+  readonly sessions: WithCredentials<SessionsApi["Service"]>;
+  readonly snapshots: WithCredentials<SnapshotsApi["Service"]>;
+  readonly tenants: WithCredentials<TenantsApi["Service"]>;
+  readonly users: WithCredentials<UsersApi["Service"]>;
+  readonly tokens: WithCredentials<TokensApi["Service"]>;
+  readonly events: WithCredentials<EventsApi["Service"]>; /** The calls of AuthApi that work with API credentials rather than a browser login. */
+  readonly auth: {
+    readonly getAuthMe: () => Effect.Effect<AuthMeResponse, ApiRequestError>;
+  };
+  readonly health: HealthApi["Service"];
+}, never, AuthApi | EventsApi | UsersApi | HealthApi | SessionsApi | SnapshotsApi | TenantsApi | TokensApi>;
+/** ApertureClient acting with `credentials`, over the HttpClient the app provides. */
+declare const apertureClientLayer: (credentials: ApiCredentials) => Layer.Layer<ApertureClient, never, import("effect/http/HttpClient").HttpClient>;
+//#endregion
+//#region src/events/layer.d.ts
+declare const makeEventsApi: Effect.Effect<{
+  readonly listEvents: (credentials: ApiCredentials, params?: (EventsFilter & PageCursor) | undefined) => Effect.Effect<PaginatedResponse<Api.Event>, ApiRequestError, never>;
+  readonly streamEvents: (credentials: ApiCredentials, filter?: EventsFilter | undefined) => import("effect/Stream").Stream<Api.Event, ApiRequestError, never>;
+  readonly listAllEvents: (credentials: ApiCredentials, filter?: EventsFilter | undefined) => Effect.Effect<readonly Api.Event[], ApiRequestError, never>;
+  readonly listAuditEvents: (credentials: ApiCredentials, params?: (AuditEventsFilter & PageCursor) | undefined) => Effect.Effect<PaginatedResponse<Api.AuditEvent>, ApiRequestError, never>;
+  readonly streamAuditEvents: (credentials: ApiCredentials, filter?: AuditEventsFilter | undefined) => import("effect/Stream").Stream<Api.AuditEvent, ApiRequestError, never>;
+  readonly listAllAuditEvents: (credentials: ApiCredentials, filter?: AuditEventsFilter | undefined) => Effect.Effect<readonly Api.AuditEvent[], ApiRequestError, never>;
+}, never, ApiAuthorization | HttpClient.HttpClient>;
+declare const eventsApiLayer: Layer.Layer<EventsApi, never, ApiAuthorization | HttpClient.HttpClient>;
+//#endregion
+//#region src/health/layer.d.ts
+declare const makeHealthApi: Effect.Effect<{
+  readonly getHealth: () => Effect.Effect<Health, ApiRequestError>;
+}, never, ApiAuthorization | HttpClient.HttpClient>;
+declare const healthApiLayer: Layer.Layer<HealthApi, never, ApiAuthorization | HttpClient.HttpClient>;
+//#endregion
+//#region src/layer.d.ts
+/**
+ * Every API service, sharing one ApiAuthorization. The services send requests through the
+ * HttpClient the app provides, decorated with each call's authorization.
+ */
+declare const apiClientLayer: Layer.Layer<AuthApi | ApiAuthorization | EventsApi | UsersApi | HealthApi | SessionsApi | SnapshotsApi | TenantsApi | TokensApi, never, HttpClient.HttpClient>;
+type ApiServices = Layer.Success<typeof apiClientLayer>;
+declare const baseUrlLayer: (baseUrl: string) => Layer.Layer<HttpClient.HttpClient, never, HttpClient.HttpClient>;
+//#endregion
+//#region src/sessions/layer.d.ts
+declare const contentDispositionFilename: (header: string | undefined) => string | null;
+declare const makeSessionsApi: Effect.Effect<{
+  readonly listSessions: (credentials: ApiCredentials, params?: (SessionsFilter & PageCursor) | undefined) => Effect.Effect<PaginatedResponse<Api.Session>, ApiRequestError, never>;
+  readonly streamSessions: (credentials: ApiCredentials, filter?: SessionsFilter | undefined) => Stream.Stream<Api.Session, ApiRequestError, never>;
+  readonly listAllSessions: (credentials: ApiCredentials, filter?: SessionsFilter | undefined) => Effect.Effect<readonly Api.Session[], ApiRequestError, never>;
+  readonly exportSessionStorageState: (credentials: ApiCredentials, sessionId: string, input: Api.ExportSessionStorageStateInput) => Effect.Effect<Api.InitialBrowserStorageState, ApiRequestError, never>;
+  readonly getSession: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<Api.Session, ApiRequestError, never>;
+  readonly getSessionsBulk: (credentials: ApiCredentials, sessionIds: readonly string[]) => Effect.Effect<Api.SessionBulkResponse, ApiRequestError, never>;
+  readonly createSession: (credentials: ApiCredentials, input: CreateSessionInput, options?: CreateSessionOptions) => Effect.Effect<Api.CreateSessionResult, ApiRequestError, never>;
+  readonly deleteSession: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
+  readonly reopenSession: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
+  readonly suspendSession: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
+  readonly rotateSessionToken: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
+  readonly rotateCollaborationCapability: (credentials: ApiCredentials, sessionId: string, role: "editor" | "viewer") => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
+  readonly replaceSessionTags: (credentials: ApiCredentials, sessionId: string, tags: Record<string, string>) => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
+  readonly updateSessionProxy: (credentials: ApiCredentials, sessionId: string, proxy: UpdateProxyConfig) => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
+  readonly promoteSession: (credentials: ApiCredentials, sessionId: string, input: PromoteSessionInput) => Effect.Effect<Api.SnapshotMutation, ApiRequestError, never>;
+  readonly getSessionCursor: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<Api.CursorVisibility, ApiRequestError, never>;
+  readonly setSessionCursor: (credentials: ApiCredentials, sessionId: string, visible: boolean) => Effect.Effect<Api.CursorVisibility, ApiRequestError, never>;
+  readonly listSessionRecordings: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<readonly Api.Recording[], ApiRequestError, never>;
+  readonly createSessionRecording: (credentials: ApiCredentials, sessionId: string, input: CreateSessionRecordingInput) => Effect.Effect<Api.Recording, ApiRequestError, never>;
+  readonly getSessionRecording: (credentials: ApiCredentials, sessionId: string, recordingId: string) => Effect.Effect<Api.Recording, ApiRequestError, never>;
+  readonly retargetSessionRecording: (credentials: ApiCredentials, sessionId: string, recordingId: string, targetId: string) => Effect.Effect<Api.Recording, ApiRequestError, never>;
+  readonly stopSessionRecording: (credentials: ApiCredentials, sessionId: string, recordingId: string) => Effect.Effect<Api.Recording, ApiRequestError, never>;
+  readonly listSessionFiles: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<readonly Api.SessionFileEntry[], ApiRequestError, never>;
+  readonly uploadSessionFiles: (credentials: ApiCredentials, sessionId: string, files: ReadonlyArray<SessionUploadFile>, options?: UploadSessionFilesOptions) => Effect.Effect<readonly Api.SessionFile[], ApiRequestError, never>;
+  readonly deleteSessionFile: (credentials: ApiCredentials, sessionId: string, relativePath: string, options?: DeleteSessionFileOptions) => Effect.Effect<void, ApiRequestError, never>;
+  readonly moveSessionFile: (credentials: ApiCredentials, sessionId: string, input: MoveSessionFileInput) => Effect.Effect<Api.SessionFileEntry, ApiRequestError, never>;
+  readonly createSessionDirectory: (credentials: ApiCredentials, sessionId: string, relativePath: string) => Effect.Effect<Api.SessionDirectory, ApiRequestError, never>;
+  readonly createSessionFileDownloadURL: (credentials: ApiCredentials, sessionId: string, input: SessionFileDownloadURLInput) => Effect.Effect<Api.SessionFileDownloadURL, ApiRequestError, never>;
+  readonly getBrowserChannels: (credentials: ApiCredentials) => Effect.Effect<Api.BrowserChannels, ApiRequestError, never>;
+  readonly getBrowserStatus: (credentials: ApiCredentials, sessionId: string, sessionToken?: Redacted.Redacted<string>) => Effect.Effect<{
+    readonly status: "running";
+    readonly thumbnailAvailable: boolean;
+    readonly source: "live";
+    readonly capturedAt: string;
+    readonly sessionId: string;
+    readonly cdpUrl: string;
+    readonly media: {
+      readonly mode: "auto" | "cdp";
+      readonly webrtcProducer: boolean;
+      readonly iceServers?: readonly {
+        readonly urls: readonly string[];
+        readonly username?: string | undefined;
+        readonly credential?: Api.SensitiveString | undefined;
+      }[] | undefined;
+    };
+    readonly pages: readonly {
+      readonly url: string;
+      readonly state: "pending" | "ready" | "unavailable" | "closed";
+      readonly targetId: string;
+      readonly title: string;
+      readonly thumbnailAvailable: boolean;
+      readonly viewport?: {
+        readonly width: number;
+        readonly height: number;
+        readonly deviceScaleFactor: number;
+        readonly contentWidth: number;
+        readonly contentHeight: number;
+        readonly canvasWidth: number;
+        readonly canvasHeight: number;
+      } | undefined;
+    }[];
+    readonly representativeTargetId?: string | undefined;
+  } | {
+    readonly status: "suspended";
+    readonly thumbnailAvailable: boolean;
+    readonly source: "persisted";
+    readonly capturedAt: string;
+    readonly sessionId: string;
+    readonly cdpUrl: string;
+    readonly media: {
+      readonly mode: "auto" | "cdp";
+      readonly webrtcProducer: boolean;
+      readonly iceServers?: readonly {
+        readonly urls: readonly string[];
+        readonly username?: string | undefined;
+        readonly credential?: Api.SensitiveString | undefined;
+      }[] | undefined;
+    };
+    readonly pages: readonly {
+      readonly url: string;
+      readonly state: "pending" | "ready" | "unavailable" | "closed";
+      readonly targetId: string;
+      readonly title: string;
+      readonly thumbnailAvailable: boolean;
+      readonly viewport?: {
+        readonly width: number;
+        readonly height: number;
+        readonly deviceScaleFactor: number;
+        readonly contentWidth: number;
+        readonly contentHeight: number;
+        readonly canvasWidth: number;
+        readonly canvasHeight: number;
+      } | undefined;
+    }[];
+    readonly representativeTargetId?: string | undefined;
+  } | {
+    readonly status: "suspended";
+    readonly source: "unavailable";
+    readonly sessionId: string;
+    readonly cdpUrl: string;
+    readonly media: {
+      readonly mode: "auto" | "cdp";
+      readonly webrtcProducer: boolean;
+      readonly iceServers?: readonly {
+        readonly urls: readonly string[];
+        readonly username?: string | undefined;
+        readonly credential?: Api.SensitiveString | undefined;
+      }[] | undefined;
+    };
+    readonly thumbnailAvailable: boolean;
+    readonly pages: readonly {
+      readonly url: string;
+      readonly state: "pending" | "ready" | "unavailable" | "closed";
+      readonly targetId: string;
+      readonly title: string;
+      readonly thumbnailAvailable: boolean;
+      readonly viewport?: {
+        readonly width: number;
+        readonly height: number;
+        readonly deviceScaleFactor: number;
+        readonly contentWidth: number;
+        readonly contentHeight: number;
+        readonly canvasWidth: number;
+        readonly canvasHeight: number;
+      } | undefined;
+    }[];
+  }, ApiRequestError, never>;
+  readonly downloadSessionRecording: (credentials: ApiCredentials, sessionId: string, recordingId: string, sessionToken?: Redacted.Redacted<string>) => Effect.Effect<DownloadedFile, ApiRequestError, never>;
+  readonly getSessionThumbnail: (credentials: ApiCredentials, sessionId: string, targetId?: string) => Effect.Effect<Blob, ApiRequestError, never>;
+  readonly streamSessionRecording: (credentials: ApiCredentials, sessionId: string, recordingId: string, sessionToken?: Redacted.Redacted<string>) => Stream.Stream<Uint8Array, ApiRequestError>;
+  readonly uploadLiveSessionFiles: (credentials: ApiCredentials, sessionId: string, files: ReadonlyArray<SessionUploadFile>, sessionToken?: Redacted.Redacted<string>) => Effect.Effect<readonly Api.SessionFile[], ApiRequestError, never>;
+  readonly setSessionViewport: (credentials: ApiCredentials, sessionId: string, input: SetViewportInput, sessionToken?: Redacted.Redacted<string>) => Effect.Effect<Api.TargetViewport, ApiRequestError, never>;
+}, never, ApiAuthorization | HttpClient.HttpClient>;
+declare const sessionsApiLayer: Layer.Layer<SessionsApi, never, ApiAuthorization | HttpClient.HttpClient>;
+//#endregion
+//#region src/sessions/tree.d.ts
+/**
+ * The top-level directories the session writes into. They always exist and cannot be
+ * deleted, moved or renamed.
+ */
+declare const sessionFileRootDirectories: readonly ["downloads", "recordings", "uploads", "outputs"];
+interface SessionFileDirectoryNode {
+  readonly kind: "directory";
+  readonly name: string;
+  readonly relativePath: string;
+  /** Absent for a directory known only from the paths of legacy files. */
+  readonly directory: SessionDirectory | undefined;
+  readonly children: ReadonlyArray<SessionFileTreeNode>;
+}
+interface SessionFileNode {
+  readonly kind: "file";
+  readonly name: string;
+  readonly relativePath: string;
+  readonly file: SessionFile;
+}
+type SessionFileTreeNode = SessionFileDirectoryNode | SessionFileNode;
+/**
+ * Arranges `listSessionFiles` results into a tree: directories first, then files, each
+ * sorted by name. Empty directories appear because the listing includes them.
+ */
+declare function sessionFileTree(entries: ReadonlyArray<SessionFileEntry>): ReadonlyArray<SessionFileTreeNode>;
+//#endregion
+//#region src/snapshots/layer.d.ts
+declare const makeSnapshotsApi: Effect.Effect<{
+  readonly listSnapshots: (credentials: ApiCredentials, params?: (SnapshotsFilter & PageCursor) | undefined) => Effect.Effect<PaginatedResponse<Api.Snapshot>, ApiRequestError, never>;
+  readonly streamSnapshots: (credentials: ApiCredentials, filter?: SnapshotsFilter | undefined) => Stream.Stream<Api.Snapshot, ApiRequestError, never>;
+  readonly listAllSnapshots: (credentials: ApiCredentials, filter?: SnapshotsFilter | undefined) => Effect.Effect<readonly Api.Snapshot[], ApiRequestError, never>;
+  readonly getSnapshotByName: (credentials: ApiCredentials, name: string) => Effect.Effect<import("effect/Option").Option<Api.Snapshot>, ApiRequestError, never>;
+  readonly updateSnapshot: (credentials: ApiCredentials, name: string, input: UpdateSnapshotInput) => Effect.Effect<Api.SnapshotMutation, ApiRequestError, never>;
+  readonly replaceSnapshotTags: (credentials: ApiCredentials, name: string, tags: Record<string, string>) => Effect.Effect<Api.SnapshotMutation, ApiRequestError, never>;
+  readonly deleteSnapshot: (credentials: ApiCredentials, name: string) => Effect.Effect<Api.SnapshotMutation, ApiRequestError, never>;
+  readonly restoreSnapshot: (credentials: ApiCredentials, name: string) => Effect.Effect<Api.SnapshotMutation, ApiRequestError, never>;
+}, never, ApiAuthorization | HttpClient.HttpClient>;
+declare const snapshotsApiLayer: Layer.Layer<SnapshotsApi, never, ApiAuthorization | HttpClient.HttpClient>;
+//#endregion
+//#region src/tenants/layer.d.ts
+declare const makeTenantsApi: Effect.Effect<{
+  readonly listTenants: (credentials: ApiCredentials, params?: (TenantsFilter & PageCursor) | undefined) => Effect.Effect<PaginatedResponse<Api.Tenant>, ApiRequestError, never>;
+  readonly streamTenants: (credentials: ApiCredentials, filter?: TenantsFilter | undefined) => import("effect/Stream").Stream<Api.Tenant, ApiRequestError, never>;
+  readonly listAllTenants: (credentials: ApiCredentials, filter?: TenantsFilter | undefined) => Effect.Effect<readonly Api.Tenant[], ApiRequestError, never>;
+  readonly createTenant: (credentials: ApiCredentials, input: Api.TenantInput) => Effect.Effect<Api.Tenant, ApiRequestError, never>;
+  readonly updateTenant: (credentials: ApiCredentials, tenantId: string, input: Api.TenantInput) => Effect.Effect<Api.Tenant, ApiRequestError, never>;
+  readonly deleteTenant: (credentials: ApiCredentials, tenantId: string) => Effect.Effect<Api.Tenant, ApiRequestError, never>;
+  readonly restoreTenant: (credentials: ApiCredentials, tenantId: string) => Effect.Effect<Api.Tenant, ApiRequestError, never>;
+  readonly getCurrentTenant: (credentials: ApiCredentials) => Effect.Effect<Api.Tenant, ApiRequestError, never>;
+  readonly updateCurrentTenant: (credentials: ApiCredentials, input: Api.TenantInput) => Effect.Effect<Api.Tenant, ApiRequestError, never>;
+}, never, ApiAuthorization | HttpClient.HttpClient>;
+declare const tenantsApiLayer: Layer.Layer<TenantsApi, never, ApiAuthorization | HttpClient.HttpClient>;
+//#endregion
+//#region src/tokens/layer.d.ts
+declare const makeTokensApi: Effect.Effect<{
+  readonly listAdminTokens: (credentials: ApiCredentials, params?: (TokensFilter & PageCursor) | undefined) => Effect.Effect<PaginatedResponse<Api.Token>, ApiRequestError, never>;
+  readonly streamAdminTokens: (credentials: ApiCredentials, filter?: TokensFilter | undefined) => import("effect/Stream").Stream<Api.Token, ApiRequestError, never>;
+  readonly listAllAdminTokens: (credentials: ApiCredentials, filter?: TokensFilter | undefined) => Effect.Effect<readonly Api.Token[], ApiRequestError, never>;
+  readonly createAdminToken: (credentials: ApiCredentials, input: CreateAdminTokenInput) => Effect.Effect<Api.CreateTokenResponse, ApiRequestError, never>;
+  readonly revokeAdminToken: (credentials: ApiCredentials, tokenId: string) => Effect.Effect<void, ApiRequestError, never>;
+  readonly listTenantTokens: (credentials: ApiCredentials, params?: (TokensFilter & PageCursor) | undefined) => Effect.Effect<PaginatedResponse<Api.Token>, ApiRequestError, never>;
+  readonly streamTenantTokens: (credentials: ApiCredentials, filter?: TokensFilter | undefined) => import("effect/Stream").Stream<Api.Token, ApiRequestError, never>;
+  readonly listAllTenantTokens: (credentials: ApiCredentials, filter?: TokensFilter | undefined) => Effect.Effect<readonly Api.Token[], ApiRequestError, never>;
+  readonly createTenantToken: (credentials: ApiCredentials, input: CreateTenantTokenInput) => Effect.Effect<Api.CreateTokenResponse, ApiRequestError, never>;
+  readonly revokeTenantToken: (credentials: ApiCredentials, tokenId: string) => Effect.Effect<void, ApiRequestError, never>;
+}, never, ApiAuthorization | HttpClient.HttpClient>;
+declare const tokensApiLayer: Layer.Layer<TokensApi, never, ApiAuthorization | HttpClient.HttpClient>;
+//#endregion
 //#region src/users/layer.d.ts
 declare const makeUsersApi: Effect.Effect<{
-  readonly listUsers: (credentials: ApiCredentials, params?: UsersListParams) => Effect.Effect<Api.UserPage, ApiRequestError, never>;
+  readonly listUsers: (credentials: ApiCredentials, params?: (UsersFilter & PageCursor) | undefined) => Effect.Effect<PaginatedResponse<Api.User>, ApiRequestError, never>;
+  readonly streamUsers: (credentials: ApiCredentials, filter?: UsersFilter | undefined) => import("effect/Stream").Stream<Api.User, ApiRequestError, never>;
+  readonly listAllUsers: (credentials: ApiCredentials, filter?: UsersFilter | undefined) => Effect.Effect<readonly Api.User[], ApiRequestError, never>;
   readonly createUser: (credentials: ApiCredentials, input: UserInput) => Effect.Effect<Api.User, ApiRequestError, never>;
   readonly getUser: (credentials: ApiCredentials, userId: string) => Effect.Effect<Api.User, ApiRequestError, never>;
   readonly updateUser: (credentials: ApiCredentials, userId: string, input: UserInput) => Effect.Effect<Api.User, ApiRequestError, never>;
@@ -758,10 +989,11 @@ declare const makeUsersApi: Effect.Effect<{
   readonly disableUser: (credentials: ApiCredentials, userId: string) => Effect.Effect<Api.User, ApiRequestError, never>;
   readonly restoreUser: (credentials: ApiCredentials, userId: string) => Effect.Effect<Api.User, ApiRequestError, never>;
   readonly listUserMemberships: (credentials: ApiCredentials, userId: string) => Effect.Effect<readonly Api.TenantMembership[], ApiRequestError, never>;
+  readonly listTenantMemberships: (credentials: ApiCredentials, tenantId: string) => Effect.Effect<readonly Api.TenantMembership[], ApiRequestError, never>;
   readonly upsertTenantMembership: (credentials: ApiCredentials, tenantId: string, userId: string, scopes: readonly string[]) => Effect.Effect<Api.TenantMembership, ApiRequestError, never>;
   readonly deleteTenantMembership: (credentials: ApiCredentials, tenantId: string, userId: string) => Effect.Effect<void, ApiRequestError, never>;
-}, never, HttpClient.HttpClient | ApiAuthorization>;
-declare const usersApiLayer: Layer.Layer<UsersApi, never, HttpClient.HttpClient | ApiAuthorization>;
+}, never, ApiAuthorization | HttpClient.HttpClient>;
+declare const usersApiLayer: Layer.Layer<UsersApi, never, ApiAuthorization | HttpClient.HttpClient>;
 //#endregion
-export { ApiAuthorization, ApiCredentials, ApiErrorBody, ApiRequestError, ApiServices, ApiToken, AuthApi, AuthMePrincipal, AuthMeResponse, AuthMeTenant, Authorization, BrowserChannel, BrowserChannelsResponse, BrowserStatus, CreateAdminTokenInput, CreateSessionInput, CreateSessionOptions, CreateSessionResponse, CreateTenantTokenInput, CreateTokenResponse, DownloadedFile, EventsApi, EventsListParams, EventsPage, IceServer, InitialBrowserStorageState, InitialBrowserTarget, ListQueryParams, LoginMethods, PageMeta, PaginatedResponse, Passkey, PasskeyLoginOptions, PasskeyMutation, PasskeyRegistrationOptions, Passkeys, PasswordLoginResponse, PromoteSessionInput, PromoteSessionResponse, Recording, RecoveryCodes, ResourceEvent, ResourceGrant, ResourceMode, Scope, SecurityStatus, Session, SessionMedia, SessionMutationResponse, SessionStatus, SessionsApi, SessionsBulkResponse, SessionsListParams, SessionsPage, Snapshot, SnapshotMutationResponse, SnapshotsApi, SnapshotsListParams, SnapshotsPage, TENANT_HEADER, TOTPEnrollment, TagFilterValue, Tenant, TenantHeaderMode, TenantMembership, TenantScope, TenantsApi, TenantsListParams, TenantsPage, TokensApi, TokensListParams, TokensPage, UpdateSnapshotInput, User, UserInput, UserInvitation, UsersApi, UsersListParams, UsersPage, apiAuthorizationLayer, apiClientLayer, authApiLayer, authorizedHttpClientLayer, baseUrlLayer, compactQuery, defaultListLimit, eventsApiLayer, flattenInfinitePages, getNextPageParam, listQueryDefaults, makeApiAuthorization, makeAuthApi, makeEventsApi, makeSessionsApi, makeSnapshotsApi, makeTenantsApi, makeTokensApi, makeUsersApi, resolveTenantHeader, sessionsApiLayer, snapshotsApiLayer, tagQuery, tenantsApiLayer, toApiRequestError, tokensApiLayer, usersApiLayer, webSessionCredentials };
+export { ApertureClient, ApiAuthorization, ApiCredentials, ApiErrorBody, ApiRequestError, ApiServices, ApiToken, AuditEvent, AuditEventsFilter, AuditEventsListParams, AuditEventsPage, AuthApi, AuthMePrincipal, AuthMeResponse, AuthMeTenant, Authorization, BrowserChannel, BrowserChannelsResponse, BrowserPage, BrowserStatus, CreateAdminTokenInput, CreateSessionInput, CreateSessionOptions, CreateSessionRecordingInput, CreateSessionResponse, CreateTenantTokenInput, CreateTokenResponse, CursorVisibility, DeleteSessionFileOptions, DownloadedFile, EventsApi, EventsFilter, EventsListParams, EventsPage, Health, HealthApi, IceServer, InitialBrowserStorageState, InitialBrowserTarget, LiveSessionErrorBody, LoginMethods, MoveSessionFileInput, OAuthApproval, OAuthAuthorizationRequest, OAuthClient, OAuthGrant, OAuthGrants, OAuthRedirect, PageCursor, PageMeta, PaginatedList, PaginatedResponse, Passkey, PasskeyCredentialJSON, PasskeyLoginOptions, PasskeyMutation, PasskeyRegistrationOptions, Passkeys, PasswordLoginResponse, PromoteSessionInput, PromoteSessionResponse, ProxyConfig, ProxyRule, ProxyUpstream, Recording, RecoveryCodes, ResourceEvent, ResourceGrant, ResourceMode, Scope, SecurityStatus, Session, SessionDirectory, SessionFile, SessionFileDirectoryNode, SessionFileDownloadURL, SessionFileDownloadURLInput, SessionFileEntry, SessionFileNode, SessionFileTreeNode, SessionMedia, SessionMutationResponse, SessionProxy, SessionRecording, SessionRecordingEditError, SessionStatus, SessionUploadFile, SessionsApi, SessionsBulkResponse, SessionsFilter, SessionsListParams, SessionsPage, SetViewportInput, Snapshot, SnapshotMutationResponse, SnapshotsApi, SnapshotsFilter, SnapshotsListParams, SnapshotsPage, TENANT_HEADER, TOTPEnrollment, TagFilterValue, TargetViewport, Tenant, TenantHeaderMode, TenantMembership, TenantScope, TenantsApi, TenantsFilter, TenantsListParams, TenantsPage, TokensApi, TokensFilter, TokensListParams, TokensPage, UpdateProxyConfig, UpdateSnapshotInput, UploadSessionFilesOptions, User, UserInput, UserInvitation, UsersApi, UsersFilter, UsersListParams, UsersPage, WithCredentials, apertureClientLayer, apiAuthorizationLayer, apiClientLayer, authApiLayer, authorizedHttpClientLayer, baseUrlLayer, compactQuery, contentDispositionFilename, defaultListLimit, eventsApiLayer, flattenInfinitePages, getNextPageParam, healthApiLayer, listQueryDefaults, makeApertureClient, makeApiAuthorization, makeAuthApi, makeEventsApi, makeHealthApi, makeSessionsApi, makeSnapshotsApi, makeTenantsApi, makeTokensApi, makeUsersApi, paginated, resolveTenantHeader, sessionFileRootDirectories, sessionFileTree, sessionsApiLayer, snapshotsApiLayer, tagQuery, tenantsApiLayer, toApiRequestError, tokensApiLayer, usersApiLayer, webSessionCredentials, withCredentials };
 //# sourceMappingURL=index.d.ts.map