@aperture-browser/api-client 0.0.0-init.0 → 0.0.0-nightly.100.78b4e7ef6edc

package/dist/index.js

@@ -1,15 +1,22 @@
+import { t as AuthApi } from "./service-riqZPQHq.js";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import * as HttpBody from "effect/unstable/http/HttpBody";
-import * as HttpClient from "effect/unstable/http/HttpClient";
-import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import * as HttpBody from "effect/http/HttpBody";
+import * as HttpClient from "effect/http/HttpClient";
+import * as HttpClientResponse from "effect/http/HttpClientResponse";
 import * as Api from "@aperture-browser/api-schema";
 import * as Context from "effect/Context";
 import * as Schema from "effect/Schema";
 import * as PubSub from "effect/PubSub";
+import * as Redacted from "effect/Redacted";
 import * as Stream from "effect/Stream";
 import * as Function from "effect/Function";
-import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as HttpClientRequest from "effect/http/HttpClientRequest";
+import * as HttpClientError from "effect/http/HttpClientError";
+import * as Option from "effect/Option";
+import * as Arr from "effect/Array";
+import * as SchemaTransformation from "effect/SchemaTransformation";
+import * as Random from "effect/Random";
 //#region src/authorization/service.ts
 const TENANT_HEADER = "X-Aperture-Tenant-Id";
 /** The browser's own login session, sent as a cookie. */
@@ -172,10 +179,51 @@ const TOTPEnrollment = Schema.Struct({
 	qrCodeDataUrl: Schema.String
 });
 const RecoveryCodes = Schema.Struct({ recoveryCodes: Schema.Array(Schema.String) });
-//#endregion
-//#region src/auth/service.ts
-/** Browser login, account security, and the current principal. */
-var AuthApi = class extends Context.Service()("@aperture-browser/api-client/AuthApi") {};
+const OAuthClient = Schema.Struct({
+	id: Schema.String,
+	name: Schema.String,
+	uri: Schema.NullOr(Schema.String),
+	logoUri: Schema.NullOr(Schema.String),
+	kind: Schema.Literals(["registered", "metadata_document"])
+});
+/** A pending OAuth authorization request, as the consent page presents it. */
+const OAuthAuthorizationRequest = Schema.Struct({
+	client: OAuthClient,
+	redirectUri: Schema.String,
+	requestedScopes: Schema.Array(Schema.String),
+	user: Schema.Struct({
+		id: Schema.String,
+		displayName: Schema.String,
+		isSystemAdmin: Schema.Boolean
+	}),
+	tenants: Schema.Array(Schema.Struct({
+		id: Schema.String,
+		displayName: Schema.String,
+		scopes: Schema.Array(Api.TenantScope)
+	})),
+	availableScopes: Schema.Array(Api.TenantScope),
+	canGrantSystemAdmin: Schema.Boolean
+});
+/** Where the browser goes after the user approves or denies an authorization request. */
+const OAuthRedirect = Schema.Struct({ redirectUrl: Schema.String });
+const OAuthGrant = Schema.Struct({
+	id: Schema.String,
+	client: OAuthClient,
+	authorityType: Api.AuthorityType,
+	tenants: Schema.Array(Schema.Struct({
+		id: Schema.String,
+		displayName: Schema.String
+	})),
+	scopes: Schema.Array(Schema.String),
+	resourceMode: Api.ResourceMode,
+	resourceGrants: Schema.Array(Schema.Struct({
+		resourceType: Api.ResourceType,
+		resourceId: Schema.String
+	})),
+	createdAt: Schema.String,
+	lastUsedAt: Schema.NullOr(Schema.String)
+});
+const OAuthGrants = Schema.Struct({ grants: Schema.Array(OAuthGrant) });
 //#endregion
 //#region src/auth/layer.ts
 const jsonBody = (body) => ({ body: HttpBody.jsonUnsafe(body) });
@@ -261,6 +309,21 @@ const makeAuthApi = Effect.gen(function* () {
 	const disableTOTP = Effect.fn("AuthApi.disableTOTP")(function* (code) {
 		yield* http.post("/auth/totp/disable", jsonBody({ code })).pipe(webSession);
 	});
+	const getOAuthAuthorization = Effect.fn("AuthApi.getOAuthAuthorization")(function* (query) {
+		return yield* http.get(`/auth/oauth/authorization?${query}`).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(OAuthAuthorizationRequest)), webSession);
+	});
+	const approveOAuthAuthorization = Effect.fn("AuthApi.approveOAuthAuthorization")(function* (approval) {
+		return yield* http.post("/auth/oauth/authorization/approve", jsonBody(approval)).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(OAuthRedirect)), webSession);
+	});
+	const denyOAuthAuthorization = Effect.fn("AuthApi.denyOAuthAuthorization")(function* (query) {
+		return yield* http.post("/auth/oauth/authorization/deny", jsonBody({ query })).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(OAuthRedirect)), webSession);
+	});
+	const listOAuthGrants = Effect.fn("AuthApi.listOAuthGrants")(function* () {
+		return yield* http.get("/auth/oauth/grants").pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(OAuthGrants)), webSession);
+	});
+	const revokeOAuthGrant = Effect.fn("AuthApi.revokeOAuthGrant")(function* (grantId) {
+		yield* http.del(`/auth/oauth/grants/${encodeURIComponent(grantId)}`).pipe(webSession);
+	});
 	return AuthApi.of({
 		listLoginMethods,
 		loginWithPassword,
@@ -281,7 +344,12 @@ const makeAuthApi = Effect.gen(function* () {
 		beginTOTPEnrollment,
 		completeTOTPEnrollment,
 		regenerateRecoveryCodes,
-		disableTOTP
+		disableTOTP,
+		getOAuthAuthorization,
+		approveOAuthAuthorization,
+		denyOAuthAuthorization,
+		listOAuthGrants,
+		revokeOAuthGrant
 	});
 });
 const authApiLayer = Layer.effect(AuthApi, makeAuthApi);
@@ -292,48 +360,64 @@ const ApiErrorBody = Schema.Struct({ error: Schema.Struct({
 	message: Schema.String
 }) });
 /**
+* The error body of a live-session route that failed inside the running session. It carries
+* no stable code, so the resulting ApiRequestError uses `live_session_error` and callers
+* branch on its status.
+*/
+const LiveSessionErrorBody = Schema.Struct({ error: Schema.String });
+const ErrorResponseBody = Schema.Union([ApiErrorBody, LiveSessionErrorBody]);
+/**
 * A failed API request. `code` and `message` come from the server's error body when it
-* sent one; `status` is 0 when no HTTP status applies.
+* sent one; `status` is 0 when no HTTP status applies. `cause` is the underlying HTTP or
+* decoding failure when the server's error body alone does not explain it.
 */
 var ApiRequestError = class extends Schema.TaggedError()("ApiRequestError", {
 	code: Schema.String,
 	message: Schema.String,
-	status: Schema.Number
+	status: Schema.Number,
+	cause: Schema.optional(Schema.Union([Schema.instanceOf(HttpClientError.HttpClientError), Schema.instanceOf(Schema.SchemaError)]))
 }) {};
-const invalidResponse = (status) => new ApiRequestError({
+const invalidResponse = (status, cause) => new ApiRequestError({
 	code: "internal_error",
 	message: "Invalid response",
-	status
-});
-const networkError = new ApiRequestError({
-	code: "network_error",
-	message: "The server could not be reached",
-	status: 0
+	status,
+	cause
 });
 /**
 * Maps HTTP and decoding failures to ApiRequestError. Error responses keep the code and
 * message of the server's error body.
 */
 const toApiRequestError = (self) => self.pipe(Effect.catchReasons("HttpClientError", {
-	StatusCodeError: ({ response }) => HttpClientResponse.schemaBodyJson(ApiErrorBody)(response).pipe(Effect.map(({ error }) => new ApiRequestError({
+	StatusCodeError: ({ response }, cause) => HttpClientResponse.schemaBodyJson(ErrorResponseBody)(response).pipe(Effect.map(({ error }) => typeof error === "string" ? new ApiRequestError({
+		code: "live_session_error",
+		message: error,
+		status: response.status
+	}) : new ApiRequestError({
 		...error,
 		status: response.status
 	})), Effect.orElseSucceed(() => new ApiRequestError({
 		code: "internal_error",
 		message: "Request failed",
-		status: response.status
+		status: response.status,
+		cause
 	})), Effect.flatMap(Effect.fail)),
-	DecodeError: ({ response }) => Effect.fail(invalidResponse(response.status))
+	DecodeError: ({ response }, cause) => Effect.fail(invalidResponse(response.status, cause))
 }), Effect.catchTags({
-	HttpClientError: () => Effect.fail(networkError),
-	SchemaError: () => Effect.fail(invalidResponse(0))
+	HttpClientError: (cause) => Effect.fail(new ApiRequestError({
+		code: "network_error",
+		message: "The server could not be reached",
+		status: 0,
+		cause
+	})),
+	SchemaError: (cause) => Effect.fail(invalidResponse(0, cause))
 }));
 //#endregion
 //#region src/authorization/layer.ts
 /** The authorization of the call a request belongs to; set by `authorize`. */
 const CurrentAuthorization = Context.Reference("@aperture-browser/api-client/CurrentAuthorization", { defaultValue: () => ({}) });
 const authorizeRequest = (request) => CurrentAuthorization.useSync(({ credentials, bearerToken, tenantHeader = "none" }) => {
-	const token = bearerToken ?? (credentials?.kind === "bearer" ? credentials.token.trim() : void 0);
+	const secret = bearerToken ?? (credentials?.kind === "bearer" ? credentials.token : void 0);
+	const token = secret === void 0 ? void 0 : Redacted.value(secret).trim();
 	const tenantId = credentials ? resolveTenantHeader(credentials, tenantHeader) : void 0;
 	return request.pipe(HttpClientRequest.acceptJson, token ? HttpClientRequest.bearerToken(token) : Function.identity, tenantId ? HttpClientRequest.setHeader(TENANT_HEADER, tenantId) : HttpClientRequest.removeHeader(TENANT_HEADER));
 });
@@ -359,6 +443,43 @@ const makeApiAuthorization = Effect.gen(function* () {
 });
 const apiAuthorizationLayer = Layer.effect(ApiAuthorization, makeApiAuthorization);
 //#endregion
+//#region src/events/service.ts
+/** The tenant's resource event log, and the deployment-wide audit log. */
+var EventsApi = class extends Context.Service()("@aperture-browser/api-client/EventsApi") {};
+//#endregion
+//#region src/health/service.ts
+/** The instance's unauthenticated health check. */
+var HealthApi = class extends Context.Service()("@aperture-browser/api-client/HealthApi") {};
+//#endregion
+//#region src/pagination.ts
+function getNextPageParam(page) {
+	return page.meta.hasMore ? page.meta.nextCursor : void 0;
+}
+function flattenInfinitePages(pages) {
+	return pages?.flatMap((page) => page.data) ?? [];
+}
+/**
+* Derives `stream` and `listAll` from the call that fetches one page. That call must also
+* accept a bare cursor, which every filter allows because all its fields are optional.
+*/
+function paginated(list) {
+	const stream = (credentials, filter) => Stream.paginate(void 0, (cursor) => list(credentials, filter === void 0 ? { cursor } : {
+		...filter,
+		cursor
+	}).pipe(Effect.map((page) => {
+		const next = getNextPageParam(page);
+		return [page.data, next === void 0 ? Option.none() : Option.some(next)];
+	})));
+	const listAll = (credentials, filter) => Stream.runCollect(stream(credentials, filter));
+	return {
+		list,
+		stream,
+		listAll
+	};
+}
+const defaultListLimit = 50;
+const listQueryDefaults = { refetchOnWindowFocus: true };
+//#endregion
 //#region src/query.ts
 /** Encodes tag filters as the parallel tagKey, tagOperator and tagValue query lists. */
 const tagQuery = (tags) => ({
@@ -374,10 +495,6 @@ const compactQuery = (query) => Object.fromEntries(Object.entries(query).flatMap
 	return items.length > 0 ? [[key, items]] : [];
 }));
 //#endregion
-//#region src/events/service.ts
-/** The tenant's resource event log. */
-var EventsApi = class extends Context.Service()("@aperture-browser/api-client/EventsApi") {};
-//#endregion
 //#region src/events/layer.ts
 const makeEventsApi = Effect.gen(function* () {
 	const httpClient = yield* HttpClient.HttpClient;
@@ -391,41 +508,98 @@ const makeEventsApi = Effect.gen(function* () {
 			resourceId: params.resourceId
 		}) }).pipe(authorize(Authorization.tenantScoped(credentials)));
 	});
-	return EventsApi.of({ listEvents });
+	const listAuditEvents = Effect.fn("EventsApi.listAuditEvents")(function* (credentials, params = {}) {
+		return yield* api.listAuditEvents({ params: compactQuery({
+			limit: params.limit,
+			cursor: params.cursor,
+			tenantId: params.tenantId,
+			actorType: params.actorType,
+			actorId: params.actorId,
+			action: params.action,
+			resourceType: params.resourceType,
+			resourceId: params.resourceId
+		}) }).pipe(authorize(Authorization.of(credentials)));
+	});
+	const events = paginated(listEvents);
+	const auditEvents = paginated(listAuditEvents);
+	return EventsApi.of({
+		listEvents,
+		streamEvents: events.stream,
+		listAllEvents: events.listAll,
+		listAuditEvents,
+		streamAuditEvents: auditEvents.stream,
+		listAllAuditEvents: auditEvents.listAll
+	});
 });
 const eventsApiLayer = Layer.effect(EventsApi, makeEventsApi);
 //#endregion
+//#region src/health/layer.ts
+const makeHealthApi = Effect.gen(function* () {
+	const httpClient = yield* HttpClient.HttpClient;
+	const { authorize } = yield* ApiAuthorization;
+	const api = Api.make(httpClient);
+	const getHealth = Effect.fn("HealthApi.getHealth")(function* () {
+		return yield* api.getHealth(void 0).pipe(authorize(Authorization.anonymous));
+	});
+	return HealthApi.of({ getHealth });
+});
+const healthApiLayer = Layer.effect(HealthApi, makeHealthApi);
+//#endregion
 //#region src/sessions/schemas.ts
 const positiveInt = Schema.Number.check(Schema.isInt(), Schema.isGreaterThan(0));
 const emptyArray = Effect.succeed([]);
-const BrowserStatus = Schema.Struct({
+const BrowserPage = Schema.Struct({
+	targetId: Schema.String,
+	state: Schema.Literals([
+		"pending",
+		"ready",
+		"unavailable",
+		"closed"
+	]),
+	title: Schema.String,
+	url: Schema.String,
+	viewport: Schema.optionalKey(Schema.Struct({
+		width: positiveInt,
+		height: positiveInt,
+		deviceScaleFactor: Schema.Number.check(Schema.isGreaterThan(0)),
+		contentWidth: positiveInt,
+		contentHeight: positiveInt,
+		canvasWidth: positiveInt,
+		canvasHeight: positiveInt
+	})),
+	thumbnailAvailable: Schema.Boolean
+});
+const browserStatusCommon = {
 	sessionId: Schema.String,
 	cdpUrl: Schema.String,
 	media: Api.SessionMedia,
-	targets: Schema.Array(Schema.Struct({
-		targetId: Schema.String,
-		generation: positiveInt,
-		state: Schema.Literals([
-			"pending",
-			"ready",
-			"unavailable",
-			"closed"
-		]),
-		title: Schema.String,
-		url: Schema.String,
-		viewport: Schema.Struct({
-			width: positiveInt,
-			height: positiveInt,
-			deviceScaleFactor: Schema.Number.check(Schema.isGreaterThan(0)),
-			contentWidth: positiveInt,
-			contentHeight: positiveInt,
-			canvasWidth: positiveInt,
-			canvasHeight: positiveInt
-		})
-	})).pipe(Schema.withDecodingDefaultKey(emptyArray))
-});
-/** A recording as the live session reports it. */
-const Recording = Schema.Struct({
+	thumbnailAvailable: Schema.Boolean,
+	pages: Schema.Array(BrowserPage).pipe(Schema.withDecodingDefaultKey(emptyArray))
+};
+const availableBrowserStatus = {
+	...browserStatusCommon,
+	capturedAt: Schema.String,
+	representativeTargetId: Schema.optionalKey(Schema.String)
+};
+/** Passive page discovery. Reading it never wakes or keeps a browser session alive. */
+const BrowserStatus = Schema.Union([
+	Schema.Struct({
+		...availableBrowserStatus,
+		status: Schema.Literal("running"),
+		source: Schema.Literal("live")
+	}),
+	Schema.Struct({
+		...availableBrowserStatus,
+		status: Schema.Literal("suspended"),
+		source: Schema.Literal("persisted")
+	}),
+	Schema.Struct({
+		...browserStatusCommon,
+		status: Schema.Literal("suspended"),
+		source: Schema.Literal("unavailable")
+	})
+]);
+const recordingFields = {
 	recordingId: Schema.String,
 	mode: Schema.Literals(["tab", "viewer"]),
 	targetId: Schema.String,
@@ -437,21 +611,81 @@ const Recording = Schema.Struct({
 		"failed"
 	]),
 	stopReason: Schema.optionalKey(Schema.String),
-	path: Schema.String,
+	sandboxPath: Schema.optionalKey(Schema.String),
+	/** @deprecated Read `relativePath`. Sessions started before it existed send only this. */
+	path: Schema.optionalKey(Schema.String),
 	startedAt: Schema.String,
 	stoppedAt: Schema.optionalKey(Schema.String),
 	sizeBytes: Schema.optionalKey(Schema.Number.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(0))),
 	fps: positiveInt,
 	bitrateKbps: positiveInt,
-	codec: Schema.String
-});
+	codec: Schema.String,
+	/** The stop returned and the edit is still running; `editedRelativePath` or `editError` follows. */
+	editing: Schema.Boolean,
+	editedRelativePath: Schema.optionalKey(Schema.String),
+	timelineRelativePath: Schema.optionalKey(Schema.String),
+	editError: Schema.optionalKey(Api.RecordingEditError)
+};
+/**
+* A recording as the live session reports it. Sessions that are still running an
+* older wrapper send only `path`, which decoding carries over into `relativePath`.
+*/
+const Recording = Schema.Struct({
+	...recordingFields,
+	relativePath: Schema.optionalKey(Schema.String)
+}).pipe(Schema.decodeTo(Schema.Struct({
+	...recordingFields,
+	relativePath: Schema.String
+}), SchemaTransformation.transform({
+	decode: ({ relativePath, ...recording }) => ({
+		...recording,
+		relativePath: relativePath ?? recording.path ?? ""
+	}),
+	encode: (recording) => recording
+})));
 //#endregion
 //#region src/sessions/service.ts
 /** Browser sessions, their live browser, and their recordings. */
 var SessionsApi = class extends Context.Service()("@aperture-browser/api-client/SessionsApi") {};
 //#endregion
+//#region src/sessions/uploads.ts
+const encoder = new TextEncoder();
+const quotedFilename = (name) => name.replaceAll("\"", "%22").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+const contentStream = (content) => {
+	if (content instanceof Blob) return Stream.fromReadableStream({
+		evaluate: () => content.stream(),
+		onError: (cause) => cause
+	});
+	if (content instanceof Uint8Array) return Stream.succeed(content);
+	return content;
+};
+const streamedMultipart = Effect.fn("SessionsApi.streamedMultipart")(function* (files) {
+	const boundary = `aperture-upload-${(yield* Random.nextIntBetween(0, Number.MAX_SAFE_INTEGER)).toString(36)}`;
+	const parts = files.map((file) => {
+		const header = `--${boundary}\r\nContent-Disposition: form-data; name="files"; filename="${quotedFilename(file.name)}"\r\nContent-Type: application/octet-stream\r
+\r
+`;
+		return Stream.succeed(encoder.encode(header)).pipe(Stream.concat(contentStream(file.content)), Stream.concat(Stream.succeed(encoder.encode("\r\n"))));
+	});
+	const body = Stream.fromIterable(parts).pipe(Stream.flatten(), Stream.concat(Stream.succeed(encoder.encode(`--${boundary}--\r\n`))));
+	return HttpBody.stream(body, `multipart/form-data; boundary=${boundary}`);
+});
+/**
+* The multipart body of an upload. FormData works with every fetch, so it is used unless a
+* content is a stream, which needs the body itself to be streamed.
+*/
+const uploadBody = Effect.fn("SessionsApi.uploadBody")(function* (files) {
+	const form = new FormData();
+	for (const file of files) if (file.content instanceof Blob) form.append("files", file.content, file.name);
+	else if (file.content instanceof Uint8Array) form.append("files", new Blob([new Uint8Array(file.content)]), file.name);
+	else return yield* streamedMultipart(files);
+	return HttpBody.formData(form);
+});
+//#endregion
 //#region src/sessions/layer.ts
 const contentDispositionFilename = (header) => header?.match(/filename="([^"]+)"/)?.[1] ?? null;
+const recordingContentPath = (sessionId, recordingId) => `/sessions/${encodeURIComponent(sessionId)}/recordings/${encodeURIComponent(recordingId)}/content`;
+const BULK_SESSION_IDS_LIMIT = 100;
 const makeSessionsApi = Effect.gen(function* () {
 	const httpClient = yield* HttpClient.HttpClient;
 	const { authorize } = yield* ApiAuthorization;
@@ -464,19 +698,24 @@ const makeSessionsApi = Effect.gen(function* () {
 			cursor: params.cursor,
 			includeDeleted: params.includeDeleted || void 0,
 			status: params.status,
+			query: params.query,
 			...tagQuery(params.tags)
 		}) }).pipe(tenantScoped(credentials));
 	});
+	const sessions = paginated(listSessions);
+	const exportSessionStorageState = Effect.fn("SessionsApi.exportSessionStorageState")(function* (credentials, sessionId, input) {
+		return yield* api.exportSessionStorageState(sessionId, { payload: input }).pipe(tenantScoped(credentials));
+	});
 	const getSession = Effect.fn("SessionsApi.getSession")(function* (credentials, sessionId) {
 		return yield* api.getSession(sessionId, void 0).pipe(tenantScoped(credentials));
 	});
 	const getSessionsBulk = Effect.fn("SessionsApi.getSessionsBulk")(function* (credentials, sessionIds) {
-		return yield* api.getSessionsBulk({ payload: { ids: sessionIds } }).pipe(tenantScoped(credentials));
+		return { sessions: (yield* Effect.forEach(Arr.chunksOf(sessionIds, BULK_SESSION_IDS_LIMIT), (ids) => api.getSessionsBulk({ payload: { ids } }).pipe(tenantScoped(credentials)))).flatMap((response) => response.sessions) };
 	});
 	const createSession = Effect.fn("SessionsApi.createSession")(function* (credentials, input, options = {}) {
 		return yield* api.createSession({
 			params: compactQuery({ waitForReady: options.waitForReady }),
-			payload: {
+			payload: Schema.encodeSync(Api.CreateSessionRequestJson)({
 				baseSnapshotName: input.baseSnapshotName ?? null,
 				label: input.label ?? null,
 				browser: {
@@ -485,8 +724,9 @@ const makeSessionsApi = Effect.gen(function* () {
 				},
 				initialTargets: input.initialTargets ?? [],
 				...input.storageState === void 0 ? {} : { storageState: input.storageState },
-				tags: input.tags ?? {}
-			}
+				tags: input.tags ?? {},
+				...input.proxy === void 0 ? {} : { proxy: input.proxy }
+			})
 		}).pipe(tenantScoped(credentials));
 	});
 	const deleteSession = Effect.fn("SessionsApi.deleteSession")(function* (credentials, sessionId) {
@@ -507,6 +747,9 @@ const makeSessionsApi = Effect.gen(function* () {
 	const replaceSessionTags = Effect.fn("SessionsApi.replaceSessionTags")(function* (credentials, sessionId, tags) {
 		return yield* api.replaceSessionTags(sessionId, { payload: { tags } }).pipe(tenantScoped(credentials));
 	});
+	const updateSessionProxy = Effect.fn("SessionsApi.updateSessionProxy")(function* (credentials, sessionId, proxy) {
+		return yield* api.updateSessionProxy(sessionId, { payload: Schema.encodeSync(Api.UpdateSessionProxyRequestJson)(proxy) }).pipe(tenantScoped(credentials));
+	});
 	const promoteSession = Effect.fn("SessionsApi.promoteSession")(function* (credentials, sessionId, input) {
 		return yield* api.promoteSession(sessionId, { payload: {
 			name: input.name,
@@ -515,17 +758,45 @@ const makeSessionsApi = Effect.gen(function* () {
 			tags: input.tags ?? {}
 		} }).pipe(tenantScoped(credentials));
 	});
+	const getSessionCursor = Effect.fn("SessionsApi.getSessionCursor")(function* (credentials, sessionId) {
+		return yield* api.getSessionCursor(sessionId, void 0).pipe(tenantScoped(credentials));
+	});
+	const setSessionCursor = Effect.fn("SessionsApi.setSessionCursor")(function* (credentials, sessionId, visible) {
+		return yield* api.setSessionCursor(sessionId, { payload: { visible } }).pipe(tenantScoped(credentials));
+	});
+	const listSessionRecordings = Effect.fn("SessionsApi.listSessionRecordings")(function* (credentials, sessionId) {
+		return yield* api.listSessionRecordings(sessionId, void 0).pipe(tenantScoped(credentials));
+	});
+	const createSessionRecording = Effect.fn("SessionsApi.createSessionRecording")(function* (credentials, sessionId, input) {
+		return yield* api.createSessionRecording(sessionId, { payload: input }).pipe(tenantScoped(credentials));
+	});
+	const getSessionRecording = Effect.fn("SessionsApi.getSessionRecording")(function* (credentials, sessionId, recordingId) {
+		return yield* api.getSessionRecording(sessionId, recordingId, void 0).pipe(tenantScoped(credentials));
+	});
+	const retargetSessionRecording = Effect.fn("SessionsApi.retargetSessionRecording")(function* (credentials, sessionId, recordingId, targetId) {
+		return yield* api.retargetSessionRecording(sessionId, recordingId, { payload: { targetId } }).pipe(tenantScoped(credentials));
+	});
+	const stopSessionRecording = Effect.fn("SessionsApi.stopSessionRecording")(function* (credentials, sessionId, recordingId) {
+		return yield* api.stopSessionRecording(sessionId, recordingId, void 0).pipe(tenantScoped(credentials));
+	});
+	const listSessionFiles = Effect.fn("SessionsApi.listSessionFiles")(function* (credentials, sessionId) {
+		return yield* api.listSessionFiles(sessionId, void 0).pipe(tenantScoped(credentials));
+	});
+	const createSessionFileDownloadURL = Effect.fn("SessionsApi.createSessionFileDownloadURL")(function* (credentials, sessionId, input) {
+		return yield* api.createSessionFileDownloadURL(sessionId, { payload: input }).pipe(tenantScoped(credentials));
+	});
 	const getBrowserChannels = Effect.fn("SessionsApi.getBrowserChannels")(function* (credentials) {
 		return yield* api.listBrowserChannels(void 0).pipe(tenantScoped(credentials));
 	});
 	const getBrowserStatus = Effect.fn("SessionsApi.getBrowserStatus")(function* (credentials, sessionId, sessionToken) {
 		return yield* http.get(`/sessions/${encodeURIComponent(sessionId)}/browser/status`).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(BrowserStatus)), authorize({
 			credentials,
-			bearerToken: sessionToken
+			bearerToken: sessionToken,
+			tenantHeader: "tenant-scoped"
 		}));
 	});
 	const downloadSessionRecording = Effect.fn("SessionsApi.downloadSessionRecording")(function* (credentials, sessionId, recordingId, sessionToken) {
-		return yield* http.get(`/sessions/${encodeURIComponent(sessionId)}/recordings/${encodeURIComponent(recordingId)}/content`).pipe(Effect.flatMap((response) => Effect.map(response.arrayBuffer, (body) => ({
+		return yield* http.get(recordingContentPath(sessionId, recordingId)).pipe(Effect.flatMap((response) => Effect.map(response.arrayBuffer, (body) => ({
 			blob: new Blob([body], { type: response.headers["content-type"] ?? "" }),
 			filename: contentDispositionFilename(response.headers["content-disposition"])
 		}))), authorize({
@@ -534,9 +805,59 @@ const makeSessionsApi = Effect.gen(function* () {
 			tenantHeader: "tenant-scoped"
 		}));
 	});
+	const getSessionThumbnail = Effect.fn("SessionsApi.getSessionThumbnail")(function* (credentials, sessionId, targetId) {
+		const session = `/api/sessions/${encodeURIComponent(sessionId)}`;
+		const path = targetId === void 0 ? `${session}/thumbnail` : `${session}/targets/${encodeURIComponent(targetId)}/thumbnail`;
+		return yield* http.get(path).pipe(Effect.flatMap((response) => Effect.map(response.arrayBuffer, (body) => new Blob([body], { type: "image/jpeg" }))), authorize({
+			credentials,
+			tenantHeader: "tenant-scoped"
+		}));
+	});
+	const streamSessionRecording = (credentials, sessionId, recordingId, sessionToken) => http.get(recordingContentPath(sessionId, recordingId)).pipe(authorize({
+		credentials,
+		bearerToken: sessionToken,
+		tenantHeader: "tenant-scoped"
+	}), Effect.map((response) => response.stream.pipe(Stream.catchTag("HttpClientError", (error) => Stream.fromEffect(toApiRequestError(Effect.fail(error)))))), Stream.unwrap);
+	const uploadSessionFiles = Effect.fn("SessionsApi.uploadSessionFiles")(function* (credentials, sessionId, files, options = {}) {
+		const body = yield* uploadBody(files);
+		return (yield* http.post(`/api/sessions/${encodeURIComponent(sessionId)}/files`, {
+			body,
+			urlParams: compactQuery({ directory: options.directory })
+		}).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(Api.UploadSessionFiles201)), tenantScoped(credentials))).files;
+	});
+	const deleteSessionFile = Effect.fn("SessionsApi.deleteSessionFile")(function* (credentials, sessionId, relativePath, options = {}) {
+		yield* api.deleteSessionFile(sessionId, { params: compactQuery({
+			relativePath,
+			recursive: options.recursive
+		}) }).pipe(tenantScoped(credentials));
+	});
+	const createSessionDirectory = Effect.fn("SessionsApi.createSessionDirectory")(function* (credentials, sessionId, relativePath) {
+		return yield* api.createSessionDirectory(sessionId, { payload: { relativePath } }).pipe(tenantScoped(credentials));
+	});
+	const moveSessionFile = Effect.fn("SessionsApi.moveSessionFile")(function* (credentials, sessionId, input) {
+		return yield* api.moveSessionFile(sessionId, { payload: input }).pipe(tenantScoped(credentials));
+	});
+	const uploadLiveSessionFiles = Effect.fn("SessionsApi.uploadLiveSessionFiles")(function* (credentials, sessionId, files, sessionToken) {
+		const body = yield* uploadBody(files);
+		return (yield* http.post(`/sessions/${encodeURIComponent(sessionId)}/uploads`, { body }).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(Api.UploadLiveSessionFiles201)), authorize({
+			credentials,
+			bearerToken: sessionToken,
+			tenantHeader: "tenant-scoped"
+		}))).files;
+	});
+	const setSessionViewport = Effect.fn("SessionsApi.setSessionViewport")(function* (credentials, sessionId, input, sessionToken) {
+		return yield* api.setSessionViewport(sessionId, { payload: input }).pipe(authorize({
+			credentials,
+			bearerToken: sessionToken,
+			tenantHeader: "tenant-scoped"
+		}));
+	});
 	return SessionsApi.of({
 		listSessions,
+		streamSessions: sessions.stream,
+		listAllSessions: sessions.listAll,
 		getSession,
+		exportSessionStorageState,
 		getSessionsBulk,
 		createSession,
 		deleteSession,
@@ -545,10 +866,28 @@ const makeSessionsApi = Effect.gen(function* () {
 		rotateSessionToken,
 		rotateCollaborationCapability,
 		replaceSessionTags,
+		updateSessionProxy,
 		promoteSession,
+		getSessionCursor,
+		setSessionCursor,
+		listSessionRecordings,
+		createSessionRecording,
+		getSessionRecording,
+		retargetSessionRecording,
+		stopSessionRecording,
+		listSessionFiles,
+		createSessionFileDownloadURL,
 		getBrowserChannels,
 		getBrowserStatus,
-		downloadSessionRecording
+		downloadSessionRecording,
+		getSessionThumbnail,
+		streamSessionRecording,
+		uploadSessionFiles,
+		uploadLiveSessionFiles,
+		deleteSessionFile,
+		moveSessionFile,
+		createSessionDirectory,
+		setSessionViewport
 	});
 });
 const sessionsApiLayer = Layer.effect(SessionsApi, makeSessionsApi);
@@ -573,6 +912,13 @@ const makeSnapshotsApi = Effect.gen(function* () {
 			...tagQuery(params.tags)
 		}) }).pipe(tenantScoped(credentials));
 	});
+	const snapshots = paginated(listSnapshots);
+	const getSnapshotByName = Effect.fn("SnapshotsApi.getSnapshotByName")(function* (credentials, name) {
+		return yield* snapshots.stream(credentials, {
+			name,
+			limit: 100
+		}).pipe(Stream.filter((candidate) => candidate.name === name), Stream.runHead);
+	});
 	const updateSnapshot = Effect.fn("SnapshotsApi.updateSnapshot")(function* (credentials, name, input) {
 		return yield* api.updateSnapshot(name, { payload: input }).pipe(tenantScoped(credentials));
 	});
@@ -587,6 +933,9 @@ const makeSnapshotsApi = Effect.gen(function* () {
 	});
 	return SnapshotsApi.of({
 		listSnapshots,
+		streamSnapshots: snapshots.stream,
+		listAllSnapshots: snapshots.listAll,
+		getSnapshotByName,
 		updateSnapshot,
 		replaceSnapshotTags,
 		deleteSnapshot,
@@ -596,7 +945,7 @@ const makeSnapshotsApi = Effect.gen(function* () {
 const snapshotsApiLayer = Layer.effect(SnapshotsApi, makeSnapshotsApi);
 //#endregion
 //#region src/tenants/service.ts
-/** Tenant administration. */
+/** Tenant administration, and the tenant a tenant token belongs to. */
 var TenantsApi = class extends Context.Service()("@aperture-browser/api-client/TenantsApi") {};
 //#endregion
 //#region src/tenants/layer.ts
@@ -609,9 +958,17 @@ const makeTenantsApi = Effect.gen(function* () {
 			limit: params.limit,
 			cursor: params.cursor,
 			includeDeleted: params.includeDeleted || void 0,
-			deleted: params.deleted
+			deleted: params.deleted,
+			query: params.query
 		}) }).pipe(authorize(Authorization.of(credentials)));
 	});
+	const tenants = paginated(listTenants);
+	const getCurrentTenant = Effect.fn("TenantsApi.getCurrentTenant")(function* (credentials) {
+		return yield* api.getTenant(void 0).pipe(authorize(Authorization.of(credentials)));
+	});
+	const updateCurrentTenant = Effect.fn("TenantsApi.updateCurrentTenant")(function* (credentials, input) {
+		return yield* api.updateSelectedTenant({ payload: input }).pipe(authorize(Authorization.of(credentials)));
+	});
 	const createTenant = Effect.fn("TenantsApi.createTenant")(function* (credentials, input) {
 		return yield* api.createTenant({ payload: input }).pipe(authorize(Authorization.of(credentials)));
 	});
@@ -626,10 +983,14 @@ const makeTenantsApi = Effect.gen(function* () {
 	});
 	return TenantsApi.of({
 		listTenants,
+		streamTenants: tenants.stream,
+		listAllTenants: tenants.listAll,
 		createTenant,
 		updateTenant,
 		deleteTenant,
-		restoreTenant
+		restoreTenant,
+		getCurrentTenant,
+		updateCurrentTenant
 	});
 });
 const tenantsApiLayer = Layer.effect(TenantsApi, makeTenantsApi);
@@ -654,6 +1015,7 @@ const makeTokensApi = Effect.gen(function* () {
 			scope: params.scope
 		}) }).pipe(authorize(Authorization.of(credentials)));
 	});
+	const adminTokens = paginated(listAdminTokens);
 	const createAdminToken = Effect.fn("TokensApi.createAdminToken")(function* (credentials, input) {
 		const systemAdmin = input.authorityType === "system_admin";
 		return yield* api.createAdminToken({ payload: {
@@ -678,6 +1040,7 @@ const makeTokensApi = Effect.gen(function* () {
 			scope: params.scope
 		}) }).pipe(authorize(Authorization.of(credentials)));
 	});
+	const tenantTokens = paginated(listTenantTokens);
 	const createTenantToken = Effect.fn("TokensApi.createTenantToken")(function* (credentials, input) {
 		return yield* api.createTenantToken({ payload: {
 			name: input.name,
@@ -692,9 +1055,13 @@ const makeTokensApi = Effect.gen(function* () {
 	});
 	return TokensApi.of({
 		listAdminTokens,
+		streamAdminTokens: adminTokens.stream,
+		listAllAdminTokens: adminTokens.listAll,
 		createAdminToken,
 		revokeAdminToken,
 		listTenantTokens,
+		streamTenantTokens: tenantTokens.stream,
+		listAllTenantTokens: tenantTokens.listAll,
 		createTenantToken,
 		revokeTenantToken
 	});
@@ -718,6 +1085,7 @@ const makeUsersApi = Effect.gen(function* () {
 			disabled: params.disabled
 		}) }).pipe(authorize(Authorization.of(credentials)));
 	});
+	const users = paginated(listUsers);
 	const createUser = Effect.fn("UsersApi.createUser")(function* (credentials, input) {
 		return yield* api.createUser({ payload: input }).pipe(authorize(Authorization.of(credentials)));
 	});
@@ -739,6 +1107,9 @@ const makeUsersApi = Effect.gen(function* () {
 	const listUserMemberships = Effect.fn("UsersApi.listUserMemberships")(function* (credentials, userId) {
 		return yield* api.listUserMemberships(userId, void 0).pipe(authorize(Authorization.of(credentials)));
 	});
+	const listTenantMemberships = Effect.fn("UsersApi.listTenantMemberships")(function* (credentials, tenantId) {
+		return yield* api.listTenantMemberships(tenantId, void 0).pipe(authorize(Authorization.of(credentials)));
+	});
 	const upsertTenantMembership = Effect.fn("UsersApi.upsertTenantMembership")(function* (credentials, tenantId, userId, scopes) {
 		const payload = { scopes };
 		return yield* api.upsertTenantMembership(tenantId, userId, { payload }).pipe(authorize(Authorization.of(credentials)));
@@ -748,6 +1119,8 @@ const makeUsersApi = Effect.gen(function* () {
 	});
 	return UsersApi.of({
 		listUsers,
+		streamUsers: users.stream,
+		listAllUsers: users.listAll,
 		createUser,
 		getUser,
 		updateUser,
@@ -755,6 +1128,7 @@ const makeUsersApi = Effect.gen(function* () {
 		disableUser,
 		restoreUser,
 		listUserMemberships,
+		listTenantMemberships,
 		upsertTenantMembership,
 		deleteTenantMembership
 	});
@@ -766,22 +1140,104 @@ const usersApiLayer = Layer.effect(UsersApi, makeUsersApi);
 * Every API service, sharing one ApiAuthorization. The services send requests through the
 * HttpClient the app provides, decorated with each call's authorization.
 */
-const apiClientLayer = Layer.mergeAll(authApiLayer, tenantsApiLayer, usersApiLayer, sessionsApiLayer, snapshotsApiLayer, tokensApiLayer, eventsApiLayer).pipe(Layer.provide(authorizedHttpClientLayer), Layer.provideMerge(apiAuthorizationLayer));
+const apiClientLayer = Layer.mergeAll(authApiLayer, tenantsApiLayer, usersApiLayer, sessionsApiLayer, snapshotsApiLayer, tokensApiLayer, eventsApiLayer, healthApiLayer).pipe(Layer.provide(authorizedHttpClientLayer), Layer.provideMerge(apiAuthorizationLayer));
 const baseUrlLayer = (baseUrl) => Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, HttpClient.mapRequest(HttpClientRequest.prependUrl(baseUrl))));
 //#endregion
-//#region src/pagination.ts
-function getNextPageParam(page) {
-	return page.meta.hasMore ? page.meta.nextCursor : void 0;
-}
-function flattenInfinitePages(pages) {
-	return pages?.flatMap((page) => page.data) ?? [];
+//#region src/client.ts
+/** Binds `credentials` as the first argument of every method of `service`. */
+function withCredentials(service, credentials) {
+	const methods = Object.entries(service);
+	return Object.fromEntries(methods.map(([name, method]) => [name, (...args) => method(credentials, ...args)]));
 }
-const defaultListLimit = 50;
-const listQueryDefaults = { refetchOnWindowFocus: true };
+/**
+* The credentialed API services with one set of credentials bound, for callers that always
+* act as the same principal, such as a server holding one API token.
+*/
+var ApertureClient = class extends Context.Service()("@aperture-browser/api-client/ApertureClient") {};
+const makeApertureClient = Effect.fn("makeApertureClient")(function* (credentials) {
+	const auth = yield* AuthApi;
+	return ApertureClient.of({
+		sessions: withCredentials(yield* SessionsApi, credentials),
+		snapshots: withCredentials(yield* SnapshotsApi, credentials),
+		tenants: withCredentials(yield* TenantsApi, credentials),
+		users: withCredentials(yield* UsersApi, credentials),
+		tokens: withCredentials(yield* TokensApi, credentials),
+		events: withCredentials(yield* EventsApi, credentials),
+		auth: { getAuthMe: () => auth.getAuthMe(credentials.selectedTenantId, credentials) },
+		health: yield* HealthApi
+	});
+});
+/** ApertureClient acting with `credentials`, over the HttpClient the app provides. */
+const apertureClientLayer = (credentials) => Layer.effect(ApertureClient, makeApertureClient(credentials)).pipe(Layer.provide(apiClientLayer));
 //#endregion
 //#region src/schemas.ts
 const SessionStatus = Api.SessionStatus;
 //#endregion
-export { ApiAuthorization, ApiErrorBody, ApiRequestError, AuthApi, Authorization, BrowserStatus, EventsApi, LoginMethods, Passkey, PasskeyLoginOptions, PasskeyMutation, PasskeyRegistrationOptions, Passkeys, PasswordLoginResponse, Recording, RecoveryCodes, SecurityStatus, SessionStatus, SessionsApi, SnapshotsApi, TENANT_HEADER, TOTPEnrollment, TenantsApi, TokensApi, UsersApi, apiAuthorizationLayer, apiClientLayer, authApiLayer, authorizedHttpClientLayer, baseUrlLayer, compactQuery, defaultListLimit, eventsApiLayer, flattenInfinitePages, getNextPageParam, listQueryDefaults, makeApiAuthorization, makeAuthApi, makeEventsApi, makeSessionsApi, makeSnapshotsApi, makeTenantsApi, makeTokensApi, makeUsersApi, resolveTenantHeader, sessionsApiLayer, snapshotsApiLayer, tagQuery, tenantsApiLayer, toApiRequestError, tokensApiLayer, usersApiLayer, webSessionCredentials };
+//#region src/sessions/tree.ts
+/**
+* The top-level directories the session writes into. They always exist and cannot be
+* deleted, moved or renamed.
+*/
+const sessionFileRootDirectories = [
+	"downloads",
+	"recordings",
+	"uploads",
+	"outputs"
+];
+const emptyDirectory = () => ({
+	directory: void 0,
+	directories: /* @__PURE__ */ new Map(),
+	files: []
+});
+function directoryAt(root, segments) {
+	let directory = root;
+	for (const segment of segments) {
+		let child = directory.directories.get(segment);
+		if (child === void 0) {
+			child = emptyDirectory();
+			directory.directories.set(segment, child);
+		}
+		directory = child;
+	}
+	return directory;
+}
+function toNodes(directory, parentPath) {
+	const directories = [...directory.directories.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([name, child]) => {
+		const relativePath = parentPath === "" ? name : `${parentPath}/${name}`;
+		return {
+			kind: "directory",
+			name,
+			relativePath,
+			directory: child.directory,
+			children: toNodes(child, relativePath)
+		};
+	});
+	const files = [...directory.files].sort((left, right) => left.name.localeCompare(right.name));
+	return [...directories, ...files];
+}
+/**
+* Arranges `listSessionFiles` results into a tree: directories first, then files, each
+* sorted by name. Empty directories appear because the listing includes them.
+*/
+function sessionFileTree(entries) {
+	const root = emptyDirectory();
+	for (const entry of entries) {
+		const segments = entry.relativePath.split("/");
+		if (entry.type === "directory") {
+			directoryAt(root, segments).directory = entry;
+			continue;
+		}
+		const name = segments.pop() ?? entry.relativePath;
+		directoryAt(root, segments).files.push({
+			kind: "file",
+			name,
+			relativePath: entry.relativePath,
+			file: entry
+		});
+	}
+	return toNodes(root, "");
+}
+//#endregion
+export { ApertureClient, ApiAuthorization, ApiErrorBody, ApiRequestError, AuthApi, Authorization, BrowserPage, BrowserStatus, EventsApi, HealthApi, LiveSessionErrorBody, LoginMethods, OAuthAuthorizationRequest, OAuthClient, OAuthGrant, OAuthGrants, OAuthRedirect, Passkey, PasskeyLoginOptions, PasskeyMutation, PasskeyRegistrationOptions, Passkeys, PasswordLoginResponse, Recording, RecoveryCodes, SecurityStatus, SessionStatus, SessionsApi, SnapshotsApi, TENANT_HEADER, TOTPEnrollment, TenantsApi, TokensApi, UsersApi, apertureClientLayer, apiAuthorizationLayer, apiClientLayer, authApiLayer, authorizedHttpClientLayer, baseUrlLayer, compactQuery, contentDispositionFilename, defaultListLimit, eventsApiLayer, flattenInfinitePages, getNextPageParam, healthApiLayer, listQueryDefaults, makeApertureClient, makeApiAuthorization, makeAuthApi, makeEventsApi, makeHealthApi, makeSessionsApi, makeSnapshotsApi, makeTenantsApi, makeTokensApi, makeUsersApi, paginated, resolveTenantHeader, sessionFileRootDirectories, sessionFileTree, sessionsApiLayer, snapshotsApiLayer, tagQuery, tenantsApiLayer, toApiRequestError, tokensApiLayer, usersApiLayer, webSessionCredentials, withCredentials };
 
 //# sourceMappingURL=index.js.map