@aperture-browser/api-client 0.0.0-init.0 → 0.0.0-nightly.101.c63f90ec6164

package/dist/passkeys.js

@@ -0,0 +1,54 @@
+import { t as AuthApi } from "./service-riqZPQHq.js";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { startAuthentication, startRegistration } from "@simplewebauthn/browser";
+//#region src/passkeys.ts
+const PasskeyCeremony = Schema.Literals(["authentication", "registration"]);
+/**
+* The browser did not complete the WebAuthn ceremony. `cancelled` covers the user
+* dismissing the prompt or letting it time out; anything else is `failed`.
+*/
+var PasskeyCeremonyError = class extends Schema.TaggedError()("PasskeyCeremonyError", {
+	ceremony: PasskeyCeremony,
+	reason: Schema.Literals(["cancelled", "failed"]),
+	message: Schema.String,
+	cause: Schema.Defect()
+}) {};
+const ceremonyLabels = {
+	authentication: "Passkey sign-in",
+	registration: "Passkey registration"
+};
+const toCeremonyError = (ceremony) => (cause) => {
+	const cancelled = cause instanceof Error && (cause.name === "NotAllowedError" || cause.name === "AbortError");
+	const label = ceremonyLabels[ceremony];
+	return new PasskeyCeremonyError({
+		ceremony,
+		reason: cancelled ? "cancelled" : "failed",
+		message: cancelled ? `${label} was cancelled` : `${label} failed`,
+		cause
+	});
+};
+/** Signs the browser in with a passkey, establishing the web session. */
+const loginWithPasskey = Effect.fn("loginWithPasskey")(function* () {
+	const auth = yield* AuthApi;
+	const options = yield* auth.beginPasskeyLogin();
+	const credential = yield* Effect.tryPromise({
+		try: () => startAuthentication({ optionsJSON: options.publicKey }),
+		catch: toCeremonyError("authentication")
+	});
+	yield* auth.finishPasskeyLogin(credential);
+});
+/** Creates a passkey on this device and registers it for the signed-in user. */
+const registerPasskey = Effect.fn("registerPasskey")(function* (name) {
+	const auth = yield* AuthApi;
+	const options = yield* auth.beginPasskeyRegistration(name);
+	const credential = yield* Effect.tryPromise({
+		try: () => startRegistration({ optionsJSON: options.publicKey }),
+		catch: toCeremonyError("registration")
+	});
+	return yield* auth.finishPasskeyRegistration(credential);
+});
+//#endregion
+export { PasskeyCeremonyError, loginWithPasskey, registerPasskey };
+
+//# sourceMappingURL=passkeys.js.map

package/dist/passkeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.js","names":[],"sources":["../src/passkeys.ts"],"sourcesContent":["import * as Effect from \"effect/Effect\";\nimport * as Schema from \"effect/Schema\";\nimport { startAuthentication, startRegistration } from \"@simplewebauthn/browser\";\nimport { AuthApi } from \"./auth/service.ts\";\n\nconst PasskeyCeremony = Schema.Literals([\"authentication\", \"registration\"]);\ntype PasskeyCeremony = typeof PasskeyCeremony.Type;\n\n/**\n * The browser did not complete the WebAuthn ceremony. `cancelled` covers the user\n * dismissing the prompt or letting it time out; anything else is `failed`.\n */\nexport class PasskeyCeremonyError extends Schema.TaggedError<PasskeyCeremonyError>()(\n  \"PasskeyCeremonyError\",\n  {\n    ceremony: PasskeyCeremony,\n    reason: Schema.Literals([\"cancelled\", \"failed\"]),\n    message: Schema.String,\n    cause: Schema.Defect(),\n  },\n) {}\n\nconst ceremonyLabels = {\n  authentication: \"Passkey sign-in\",\n  registration: \"Passkey registration\",\n} satisfies Record<PasskeyCeremony, string>;\n\n// Browsers report a dismissed or timed-out prompt as NotAllowedError, and an aborted one as\n// AbortError; @simplewebauthn/browser keeps that name on the WebAuthnError it rethrows.\nconst toCeremonyError = (ceremony: PasskeyCeremony) => (cause: unknown) => {\n  const cancelled =\n    cause instanceof Error && (cause.name === \"NotAllowedError\" || cause.name === \"AbortError\");\n  const label = ceremonyLabels[ceremony];\n  return new PasskeyCeremonyError({\n    ceremony,\n    reason: cancelled ? \"cancelled\" : \"failed\",\n    message: cancelled ? `${label} was cancelled` : `${label} failed`,\n    cause,\n  });\n};\n\n/** Signs the browser in with a passkey, establishing the web session. */\nexport const loginWithPasskey = Effect.fn(\"loginWithPasskey\")(function* () {\n  const auth = yield* AuthApi;\n  const options = yield* auth.beginPasskeyLogin();\n  const credential = yield* Effect.tryPromise({\n    try: () => startAuthentication({ optionsJSON: options.publicKey }),\n    catch: toCeremonyError(\"authentication\"),\n  });\n  yield* auth.finishPasskeyLogin(credential);\n});\n\n/** Creates a passkey on this device and registers it for the signed-in user. */\nexport const registerPasskey = Effect.fn(\"registerPasskey\")(function* (name: string) {\n  const auth = yield* AuthApi;\n  const options = yield* auth.beginPasskeyRegistration(name);\n  const credential = yield* Effect.tryPromise({\n    try: () => startRegistration({ optionsJSON: options.publicKey }),\n    catch: toCeremonyError(\"registration\"),\n  });\n  return yield* auth.finishPasskeyRegistration(credential);\n});\n"],"mappings":";;;;;AAKA,MAAM,kBAAkB,OAAO,SAAS,CAAC,kBAAkB,cAAc,CAAC;;;;;AAO1E,IAAa,uBAAb,cAA0C,OAAO,YAAkC,CAAC,CAClF,wBACA;CACE,UAAU;CACV,QAAQ,OAAO,SAAS,CAAC,aAAa,QAAQ,CAAC;CAC/C,SAAS,OAAO;CAChB,OAAO,OAAO,OAAO;AACvB,CACF,CAAC,CAAC,CAAC;AAEH,MAAM,iBAAiB;CACrB,gBAAgB;CAChB,cAAc;AAChB;AAIA,MAAM,mBAAmB,cAA+B,UAAmB;CACzE,MAAM,YACJ,iBAAiB,UAAU,MAAM,SAAS,qBAAqB,MAAM,SAAS;CAChF,MAAM,QAAQ,eAAe;CAC7B,OAAO,IAAI,qBAAqB;EAC9B;EACA,QAAQ,YAAY,cAAc;EAClC,SAAS,YAAY,GAAG,MAAM,kBAAkB,GAAG,MAAM;EACzD;CACF,CAAC;AACH;;AAGA,MAAa,mBAAmB,OAAO,GAAG,kBAAkB,CAAC,CAAC,aAAa;CACzE,MAAM,OAAO,OAAO;CACpB,MAAM,UAAU,OAAO,KAAK,kBAAkB;CAC9C,MAAM,aAAa,OAAO,OAAO,WAAW;EAC1C,WAAW,oBAAoB,EAAE,aAAa,QAAQ,UAAU,CAAC;EACjE,OAAO,gBAAgB,gBAAgB;CACzC,CAAC;CACD,OAAO,KAAK,mBAAmB,UAAU;AAC3C,CAAC;;AAGD,MAAa,kBAAkB,OAAO,GAAG,iBAAiB,CAAC,CAAC,WAAW,MAAc;CACnF,MAAM,OAAO,OAAO;CACpB,MAAM,UAAU,OAAO,KAAK,yBAAyB,IAAI;CACzD,MAAM,aAAa,OAAO,OAAO,WAAW;EAC1C,WAAW,kBAAkB,EAAE,aAAa,QAAQ,UAAU,CAAC;EAC/D,OAAO,gBAAgB,cAAc;CACvC,CAAC;CACD,OAAO,OAAO,KAAK,0BAA0B,UAAU;AACzD,CAAC"}

package/dist/service-DbyEmdKS.d.ts

@@ -0,0 +1,406 @@
+import * as Effect from "effect/Effect";
+import * as Api from "@aperture-browser/api-schema";
+import * as Context from "effect/Context";
+import * as Schema from "effect/Schema";
+import * as Redacted from "effect/Redacted";
+import * as Stream from "effect/Stream";
+import * as HttpClientError from "effect/http/HttpClientError";
+
+//#region src/errors.d.ts
+declare const ApiErrorBody: Schema.Struct<{
+  readonly error: Schema.Struct<{
+    readonly code: Schema.String;
+    readonly message: Schema.String;
+  }>;
+}>;
+type ApiErrorBody = typeof ApiErrorBody.Type;
+/**
+ * The error body of a live-session route that failed inside the running session. It carries
+ * no stable code, so the resulting ApiRequestError uses `live_session_error` and callers
+ * branch on its status.
+ */
+declare const LiveSessionErrorBody: Schema.Struct<{
+  readonly error: Schema.String;
+}>;
+type LiveSessionErrorBody = typeof LiveSessionErrorBody.Type;
+declare const ApiRequestError_base: Schema.Class<ApiRequestError, Schema.TaggedStruct<"ApiRequestError", {
+  readonly code: Schema.String;
+  readonly message: Schema.String;
+  readonly status: Schema.Number;
+  readonly cause: Schema.optional<Schema.Union<readonly [Schema.instanceOf<HttpClientError.HttpClientError, unknown>, Schema.instanceOf<Schema.SchemaError, unknown>]>>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A failed API request. `code` and `message` come from the server's error body when it
+ * sent one; `status` is 0 when no HTTP status applies. `cause` is the underlying HTTP or
+ * decoding failure when the server's error body alone does not explain it.
+ */
+declare class ApiRequestError extends ApiRequestError_base {}
+/**
+ * Maps HTTP and decoding failures to ApiRequestError. Error responses keep the code and
+ * message of the server's error body.
+ */
+declare const toApiRequestError: <A, R>(self: Effect.Effect<A, HttpClientError.HttpClientError | Schema.SchemaError, R>) => Effect.Effect<A, ApiRequestError, R>;
+//#endregion
+//#region src/authorization/service.d.ts
+declare const TENANT_HEADER = "X-Aperture-Tenant-Id";
+interface CredentialContext {
+  authorityType: "system_admin" | "tenant" | null;
+  tenantId: string | null;
+  selectedTenantId: string | null;
+}
+type ApiCredentials = (CredentialContext & {
+  kind: "bearer";
+  token: Redacted.Redacted<string>;
+}) | (CredentialContext & {
+  kind: "session";
+});
+/** The browser's own login session, sent as a cookie. */
+declare const webSessionCredentials: ApiCredentials;
+type TenantHeaderMode = "none" | "optional" | "tenant-scoped";
+/** Which tenant, if any, a request acts for under the given credentials. */
+declare function resolveTenantHeader(credentials: ApiCredentials, mode: TenantHeaderMode): string | undefined;
+/** How a request authenticates, and which tenant it acts for. */
+interface Authorization {
+  readonly credentials?: ApiCredentials;
+  readonly bearerToken?: Redacted.Redacted<string>;
+  readonly tenantHeader?: TenantHeaderMode;
+}
+declare const Authorization: {
+  anonymous: Authorization;
+  webSession: Authorization;
+  of: (credentials: ApiCredentials) => Authorization;
+  tenantScoped: (credentials: ApiCredentials) => Authorization;
+};
+declare const ApiAuthorization_base: Context.ServiceClass<ApiAuthorization, "@aperture-browser/api-client/ApiAuthorization", {
+  /** Runs a call with the given authorization and maps its failures to ApiRequestError. */readonly authorize: (authorization: Authorization) => <A, R>(self: Effect.Effect<A, HttpClientError.HttpClientError | Schema.SchemaError, R>) => Effect.Effect<A, ApiRequestError, R>; /** Emits whenever the web session is found to be missing, expired or revoked. */
+  readonly sessionAuthenticationFailures: Stream.Stream<void>;
+}>;
+/**
+ * Authenticates API calls. Inside `authorize`, every request sent through the HttpClient
+ * that `authorizedHttpClientLayer` provides carries that call's credentials and tenant, so
+ * callers never touch headers.
+ */
+declare class ApiAuthorization extends ApiAuthorization_base {}
+//#endregion
+//#region src/auth/schemas.d.ts
+declare const LoginMethods: Schema.Struct<{
+  readonly methods: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"password">;
+  }>, Schema.Struct<{
+    readonly type: Schema.Literal<"api_token">;
+  }>, Schema.Struct<{
+    readonly type: Schema.Literal<"passkey">;
+  }>, Schema.Struct<{
+    readonly type: Schema.Literal<"oidc">;
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly loginUrl: Schema.String;
+  }>]>>;
+}>;
+declare const PasskeyLoginOptions: Schema.Struct<{
+  readonly publicKey: Schema.Struct<{
+    readonly challenge: Schema.String;
+    readonly timeout: Schema.optionalKey<Schema.Number>;
+    readonly rpId: Schema.optionalKey<Schema.String>;
+    readonly allowCredentials: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Struct<{
+      readonly id: Schema.String;
+      readonly type: Schema.Literal<"public-key">;
+      readonly transports: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb"]>>>>;
+    }>>>>;
+    readonly userVerification: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
+    readonly hints: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>>;
+    readonly extensions: Schema.optionalKey<Schema.Struct<{
+      readonly appid: Schema.optionalKey<Schema.String>;
+      readonly credProps: Schema.optionalKey<Schema.Boolean>;
+      readonly hmacCreateSecret: Schema.optionalKey<Schema.Boolean>;
+      readonly minPinLength: Schema.optionalKey<Schema.Boolean>;
+    }>>;
+  }>;
+}>;
+declare const PasskeyRegistrationOptions: Schema.Struct<{
+  readonly publicKey: Schema.Struct<{
+    readonly rp: Schema.Struct<{
+      readonly id: Schema.optionalKey<Schema.String>;
+      readonly name: Schema.String;
+    }>;
+    readonly user: Schema.Struct<{
+      readonly id: Schema.String;
+      readonly name: Schema.String;
+      readonly displayName: Schema.String;
+    }>;
+    readonly challenge: Schema.String;
+    readonly pubKeyCredParams: Schema.mutable<Schema.$Array<Schema.Struct<{
+      readonly alg: Schema.Literals<readonly [-7, -8, -35, -36, -37, -38, -39, -257, -258, -259]>;
+      readonly type: Schema.Literal<"public-key">;
+    }>>>;
+    readonly timeout: Schema.optionalKey<Schema.Number>;
+    readonly excludeCredentials: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Struct<{
+      readonly id: Schema.String;
+      readonly type: Schema.Literal<"public-key">;
+      readonly transports: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb"]>>>>;
+    }>>>>;
+    readonly authenticatorSelection: Schema.optionalKey<Schema.Struct<{
+      readonly authenticatorAttachment: Schema.optionalKey<Schema.Literals<readonly ["platform", "cross-platform"]>>;
+      readonly requireResidentKey: Schema.optionalKey<Schema.Boolean>;
+      readonly residentKey: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
+      readonly userVerification: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
+    }>>;
+    readonly hints: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>>;
+    readonly attestation: Schema.optionalKey<Schema.Literals<readonly ["direct", "enterprise", "indirect", "none"]>>;
+    readonly attestationFormats: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["fido-u2f", "packed", "android-safetynet", "android-key", "tpm", "apple", "none"]>>>>;
+    readonly extensions: Schema.optionalKey<Schema.Struct<{
+      readonly appid: Schema.optionalKey<Schema.String>;
+      readonly credProps: Schema.optionalKey<Schema.Boolean>;
+      readonly hmacCreateSecret: Schema.optionalKey<Schema.Boolean>;
+      readonly minPinLength: Schema.optionalKey<Schema.Boolean>;
+    }>>;
+  }>;
+}>;
+declare const Passkey: Schema.Struct<{
+  readonly id: Schema.String;
+  readonly name: Schema.String;
+  readonly createdAt: Schema.String;
+  readonly lastUsedAt: Schema.NullOr<Schema.String>;
+}>;
+declare const Passkeys: Schema.Struct<{
+  readonly passkeys: Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly createdAt: Schema.String;
+    readonly lastUsedAt: Schema.NullOr<Schema.String>;
+  }>>;
+}>;
+declare const PasskeyMutation: Schema.Struct<{
+  readonly passkey: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly createdAt: Schema.String;
+    readonly lastUsedAt: Schema.NullOr<Schema.String>;
+  }>;
+}>;
+declare const PasswordLoginResponse: Schema.Struct<{
+  readonly mfaRequired: Schema.Boolean;
+}>;
+declare const SecurityStatus: Schema.Struct<{
+  readonly hasPassword: Schema.Boolean;
+  readonly totpEnabled: Schema.Boolean;
+  readonly recoveryCodesRemaining: Schema.Number;
+}>;
+declare const TOTPEnrollment: Schema.Struct<{
+  readonly secret: Schema.String;
+  readonly otpauthUrl: Schema.String;
+  readonly qrCodeDataUrl: Schema.String;
+}>;
+declare const RecoveryCodes: Schema.Struct<{
+  readonly recoveryCodes: Schema.$Array<Schema.String>;
+}>;
+declare const OAuthClient: Schema.Struct<{
+  readonly id: Schema.String;
+  readonly name: Schema.String;
+  readonly uri: Schema.NullOr<Schema.String>;
+  readonly logoUri: Schema.NullOr<Schema.String>;
+  readonly kind: Schema.Literals<readonly ["registered", "metadata_document"]>;
+}>;
+/** A pending OAuth authorization request, as the consent page presents it. */
+declare const OAuthAuthorizationRequest: Schema.Struct<{
+  readonly client: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly uri: Schema.NullOr<Schema.String>;
+    readonly logoUri: Schema.NullOr<Schema.String>;
+    readonly kind: Schema.Literals<readonly ["registered", "metadata_document"]>;
+  }>;
+  readonly redirectUri: Schema.String;
+  readonly requestedScopes: Schema.$Array<Schema.String>;
+  readonly user: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly displayName: Schema.String;
+    readonly isSystemAdmin: Schema.Boolean;
+  }>;
+  readonly tenants: Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly displayName: Schema.String;
+    readonly scopes: Schema.$Array<Schema.Literals<readonly ["sessions:read", "sessions:write", "snapshots:read", "snapshots:write", "tenant:write"]>>;
+  }>>;
+  readonly availableScopes: Schema.$Array<Schema.Literals<readonly ["sessions:read", "sessions:write", "snapshots:read", "snapshots:write", "tenant:write"]>>;
+  readonly canGrantSystemAdmin: Schema.Boolean;
+}>;
+/** Where the browser goes after the user approves or denies an authorization request. */
+declare const OAuthRedirect: Schema.Struct<{
+  readonly redirectUrl: Schema.String;
+}>;
+declare const OAuthGrant: Schema.Struct<{
+  readonly id: Schema.String;
+  readonly client: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly uri: Schema.NullOr<Schema.String>;
+    readonly logoUri: Schema.NullOr<Schema.String>;
+    readonly kind: Schema.Literals<readonly ["registered", "metadata_document"]>;
+  }>;
+  readonly authorityType: Schema.Literals<readonly ["system_admin", "tenant"]>;
+  readonly tenants: Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly displayName: Schema.String;
+  }>>;
+  readonly scopes: Schema.$Array<Schema.String>;
+  readonly resourceMode: Schema.Literals<readonly ["all", "allowlist"]>;
+  readonly resourceGrants: Schema.$Array<Schema.Struct<{
+    readonly resourceType: Schema.Literals<readonly ["session", "snapshot"]>;
+    readonly resourceId: Schema.String;
+  }>>;
+  readonly createdAt: Schema.String;
+  readonly lastUsedAt: Schema.NullOr<Schema.String>;
+}>;
+declare const OAuthGrants: Schema.Struct<{
+  readonly grants: Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly client: Schema.Struct<{
+      readonly id: Schema.String;
+      readonly name: Schema.String;
+      readonly uri: Schema.NullOr<Schema.String>;
+      readonly logoUri: Schema.NullOr<Schema.String>;
+      readonly kind: Schema.Literals<readonly ["registered", "metadata_document"]>;
+    }>;
+    readonly authorityType: Schema.Literals<readonly ["system_admin", "tenant"]>;
+    readonly tenants: Schema.$Array<Schema.Struct<{
+      readonly id: Schema.String;
+      readonly displayName: Schema.String;
+    }>>;
+    readonly scopes: Schema.$Array<Schema.String>;
+    readonly resourceMode: Schema.Literals<readonly ["all", "allowlist"]>;
+    readonly resourceGrants: Schema.$Array<Schema.Struct<{
+      readonly resourceType: Schema.Literals<readonly ["session", "snapshot"]>;
+      readonly resourceId: Schema.String;
+    }>>;
+    readonly createdAt: Schema.String;
+    readonly lastUsedAt: Schema.NullOr<Schema.String>;
+  }>>;
+}>;
+/**
+ * The user's answer to an authorization request. `query` is the authorize query string
+ * without its leading `?`. With `systemAdmin`, the tenant, scope and resource fields are
+ * ignored.
+ */
+interface OAuthApproval {
+  readonly query: string;
+  readonly systemAdmin: boolean;
+  readonly tenantIds: ReadonlyArray<string>;
+  readonly scopes: ReadonlyArray<Api.TenantScope>;
+  readonly resourceMode: Api.ResourceMode;
+  readonly resourceGrants: ReadonlyArray<Api.ResourceGrant>;
+}
+type LoginMethods = typeof LoginMethods.Type;
+type PasskeyLoginOptions = typeof PasskeyLoginOptions.Type;
+type PasskeyRegistrationOptions = typeof PasskeyRegistrationOptions.Type;
+type Passkey = typeof Passkey.Type;
+type Passkeys = typeof Passkeys.Type;
+type PasskeyMutation = typeof PasskeyMutation.Type;
+type PasswordLoginResponse = typeof PasswordLoginResponse.Type;
+type RecoveryCodes = typeof RecoveryCodes.Type;
+type SecurityStatus = typeof SecurityStatus.Type;
+type TOTPEnrollment = typeof TOTPEnrollment.Type;
+type OAuthClient = typeof OAuthClient.Type;
+type OAuthAuthorizationRequest = typeof OAuthAuthorizationRequest.Type;
+type OAuthRedirect = typeof OAuthRedirect.Type;
+type OAuthGrant = typeof OAuthGrant.Type;
+type OAuthGrants = typeof OAuthGrants.Type;
+//#endregion
+//#region src/schemas.d.ts
+type PageMeta = Api.PageMeta;
+type Tenant = Api.Tenant;
+type User = Api.User;
+type UserInvitation = Api.UserInvitation;
+type TenantMembership = Api.TenantMembership;
+type AuthMeResponse = Api.AuthMe;
+type AuthMePrincipal = Api.Principal;
+type AuthMeTenant = Api.Tenant;
+type ResourceMode = Api.ResourceMode;
+type ResourceGrant = Api.ResourceGrant;
+type Scope = Api.Scope;
+type TenantScope = Api.TenantScope;
+type Session = Api.Session;
+type SessionMedia = Api.SessionMedia;
+type SessionProxy = Api.SessionProxy;
+type ProxyConfig = Api.ProxyConfig;
+type UpdateProxyConfig = Api.UpdateProxyConfig;
+type ProxyUpstream = Api.ProxyUpstream;
+type ProxyRule = Api.ProxyRule;
+type CursorVisibility = Api.CursorVisibility;
+type SessionRecording = Api.Recording;
+type SessionFile = Api.SessionFile;
+type SessionRecordingEditError = Api.RecordingEditError;
+type SessionDirectory = Api.SessionDirectory;
+type SessionFileEntry = Api.SessionFileEntry;
+type SessionFileDownloadURL = Api.SessionFileDownloadURL;
+type SetViewportInput = Api.SetViewportInput;
+type TargetViewport = Api.TargetViewport;
+type Health = Api.Health;
+type AuditEvent = Api.AuditEvent;
+type AuditEventsPage = Api.AuditEventPage;
+type IceServer = Api.IceServer;
+declare const SessionStatus: import("effect/Schema").Literals<readonly ["creating", "running", "suspended", "deleted", "expired", "failed"]>;
+type SessionStatus = Api.SessionStatus;
+type Snapshot = Api.Snapshot;
+type ApiToken = Api.Token;
+type TenantsPage = Api.TenantPage;
+type UsersPage = Api.UserPage;
+type SessionsPage = Api.SessionPage;
+type SessionsBulkResponse = Api.SessionBulkResponse;
+type SnapshotsPage = Api.SnapshotPage;
+type TokensPage = Api.TokenPage;
+type BrowserChannel = Api.BrowserChannel;
+type BrowserChannelsResponse = Api.BrowserChannels;
+type ResourceEvent = Api.Event;
+type EventsPage = Api.EventPage;
+type CreateSessionResponse = Api.CreateSessionResult;
+type SessionMutationResponse = Api.SessionMutation;
+type SnapshotMutationResponse = Api.SnapshotMutation;
+type PromoteSessionResponse = Api.SnapshotMutation;
+type CreateTokenResponse = Api.CreateTokenResponse;
+//#endregion
+//#region src/auth/service.d.ts
+type Call<A> = Effect.Effect<A, ApiRequestError>;
+/**
+ * A WebAuthn credential serialized to JSON by the browser ceremony, as
+ * `@aperture-browser/api-client/passkeys` produces it. The server verifies its contents.
+ */
+interface PasskeyCredentialJSON {
+  readonly id: string;
+  readonly rawId: string;
+  readonly type: "public-key";
+  readonly response: object;
+  readonly clientExtensionResults: object;
+}
+declare const AuthApi_base: Context.ServiceClass<AuthApi, "@aperture-browser/api-client/AuthApi", {
+  readonly listLoginMethods: () => Call<LoginMethods>;
+  readonly loginWithPassword: (email: string, password: string) => Call<PasswordLoginResponse>;
+  readonly completePasswordMFA: (code: string) => Call<void>;
+  readonly loginWithAPIToken: (token: string) => Call<void>;
+  readonly beginPasskeyLogin: () => Call<PasskeyLoginOptions>;
+  readonly finishPasskeyLogin: (credential: PasskeyCredentialJSON) => Call<void>;
+  readonly acceptUserInvitation: (token: string, password: string) => Call<void>;
+  readonly logoutWebSession: () => Call<void>;
+  readonly getAuthMe: (selectedTenantId?: string | null, credentials?: ApiCredentials) => Call<AuthMeResponse>;
+  readonly getSecurityStatus: () => Call<SecurityStatus>;
+  readonly setPassword: (currentPassword: string, newPassword: string) => Call<void>;
+  readonly listPasskeys: () => Call<Passkeys>;
+  readonly beginPasskeyRegistration: (name: string) => Call<PasskeyRegistrationOptions>;
+  readonly finishPasskeyRegistration: (credential: PasskeyCredentialJSON) => Call<PasskeyMutation>;
+  readonly renamePasskey: (passkeyId: string, name: string) => Call<PasskeyMutation>;
+  readonly deletePasskey: (passkeyId: string) => Call<void>;
+  readonly beginTOTPEnrollment: () => Call<TOTPEnrollment>;
+  readonly completeTOTPEnrollment: (code: string) => Call<RecoveryCodes>;
+  readonly regenerateRecoveryCodes: (code: string) => Call<RecoveryCodes>;
+  readonly disableTOTP: (code: string) => Call<void>; /** `query` is the OAuth authorize query string, without its leading `?`. */
+  readonly getOAuthAuthorization: (query: string) => Call<OAuthAuthorizationRequest>;
+  readonly approveOAuthAuthorization: (approval: OAuthApproval) => Call<OAuthRedirect>;
+  readonly denyOAuthAuthorization: (query: string) => Call<OAuthRedirect>;
+  readonly listOAuthGrants: () => Call<OAuthGrants>;
+  readonly revokeOAuthGrant: (grantId: string) => Call<void>;
+}>;
+/** Browser login, account security, and the current principal. */
+declare class AuthApi extends AuthApi_base {}
+//#endregion
+export { LoginMethods as $, SessionFileEntry as A, Snapshot as B, ResourceGrant as C, ApiRequestError as Ct, SessionDirectory as D, Session as E, SessionRecordingEditError as F, TenantMembership as G, SnapshotsPage as H, SessionStatus as I, TokensPage as J, TenantScope as K, SessionsBulkResponse as L, SessionMutationResponse as M, SessionProxy as N, SessionFile as O, SessionRecording as P, UsersPage as Q, SessionsPage as R, ResourceEvent as S, ApiErrorBody as St, Scope as T, toApiRequestError as Tt, TargetViewport as U, SnapshotMutationResponse as V, Tenant as W, User as X, UpdateProxyConfig as Y, UserInvitation as Z, PageMeta as _, Authorization as _t, AuditEventsPage as a, OAuthRedirect as at, ProxyRule as b, resolveTenantHeader as bt, AuthMeTenant as c, PasskeyMutation as ct, CreateSessionResponse as d, PasswordLoginResponse as dt, OAuthApproval as et, CreateTokenResponse as f, RecoveryCodes as ft, IceServer as g, ApiCredentials as gt, Health as h, ApiAuthorization as ht, AuditEvent as i, OAuthGrants as it, SessionMedia as j, SessionFileDownloadURL as k, BrowserChannel as l, PasskeyRegistrationOptions as lt, EventsPage as m, TOTPEnrollment as mt, PasskeyCredentialJSON as n, OAuthClient as nt, AuthMePrincipal as o, Passkey as ot, CursorVisibility as p, SecurityStatus as pt, TenantsPage as q, ApiToken as r, OAuthGrant as rt, AuthMeResponse as s, PasskeyLoginOptions as st, AuthApi as t, OAuthAuthorizationRequest as tt, BrowserChannelsResponse as u, Passkeys as ut, PromoteSessionResponse as v, TENANT_HEADER as vt, ResourceMode as w, LiveSessionErrorBody as wt, ProxyUpstream as x, webSessionCredentials as xt, ProxyConfig as y, TenantHeaderMode as yt, SetViewportInput as z };
+//# sourceMappingURL=service-DbyEmdKS.d.ts.map

package/dist/service-riqZPQHq.js

@@ -0,0 +1,8 @@
+import * as Context from "effect/Context";
+//#region src/auth/service.ts
+/** Browser login, account security, and the current principal. */
+var AuthApi = class extends Context.Service()("@aperture-browser/api-client/AuthApi") {};
+//#endregion
+export { AuthApi as t };
+
+//# sourceMappingURL=service-riqZPQHq.js.map

package/dist/service-riqZPQHq.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-riqZPQHq.js","names":[],"sources":["../src/auth/service.ts"],"sourcesContent":["import * as Context from \"effect/Context\";\nimport type * as Effect from \"effect/Effect\";\nimport type { ApiCredentials } from \"../authorization/service.ts\";\nimport type { ApiRequestError } from \"../errors.ts\";\nimport type { AuthMeResponse } from \"../schemas.ts\";\nimport type * as S from \"./schemas.ts\";\n\ntype Call<A> = Effect.Effect<A, ApiRequestError>;\n\n/**\n * A WebAuthn credential serialized to JSON by the browser ceremony, as\n * `@aperture-browser/api-client/passkeys` produces it. The server verifies its contents.\n */\nexport interface PasskeyCredentialJSON {\n  readonly id: string;\n  readonly rawId: string;\n  readonly type: \"public-key\";\n  readonly response: object;\n  readonly clientExtensionResults: object;\n}\n\n/** Browser login, account security, and the current principal. */\nexport class AuthApi extends Context.Service<\n  AuthApi,\n  {\n    readonly listLoginMethods: () => Call<S.LoginMethods>;\n    readonly loginWithPassword: (email: string, password: string) => Call<S.PasswordLoginResponse>;\n    readonly completePasswordMFA: (code: string) => Call<void>;\n    readonly loginWithAPIToken: (token: string) => Call<void>;\n    readonly beginPasskeyLogin: () => Call<S.PasskeyLoginOptions>;\n    readonly finishPasskeyLogin: (credential: PasskeyCredentialJSON) => Call<void>;\n    readonly acceptUserInvitation: (token: string, password: string) => Call<void>;\n    readonly logoutWebSession: () => Call<void>;\n\n    readonly getAuthMe: (\n      selectedTenantId?: string | null,\n      credentials?: ApiCredentials,\n    ) => Call<AuthMeResponse>;\n\n    readonly getSecurityStatus: () => Call<S.SecurityStatus>;\n    readonly setPassword: (currentPassword: string, newPassword: string) => Call<void>;\n    readonly listPasskeys: () => Call<S.Passkeys>;\n    readonly beginPasskeyRegistration: (name: string) => Call<S.PasskeyRegistrationOptions>;\n    readonly finishPasskeyRegistration: (\n      credential: PasskeyCredentialJSON,\n    ) => Call<S.PasskeyMutation>;\n    readonly renamePasskey: (passkeyId: string, name: string) => Call<S.PasskeyMutation>;\n    readonly deletePasskey: (passkeyId: string) => Call<void>;\n    readonly beginTOTPEnrollment: () => Call<S.TOTPEnrollment>;\n    readonly completeTOTPEnrollment: (code: string) => Call<S.RecoveryCodes>;\n    readonly regenerateRecoveryCodes: (code: string) => Call<S.RecoveryCodes>;\n    readonly disableTOTP: (code: string) => Call<void>;\n\n    /** `query` is the OAuth authorize query string, without its leading `?`. */\n    readonly getOAuthAuthorization: (query: string) => Call<S.OAuthAuthorizationRequest>;\n    readonly approveOAuthAuthorization: (approval: S.OAuthApproval) => Call<S.OAuthRedirect>;\n    readonly denyOAuthAuthorization: (query: string) => Call<S.OAuthRedirect>;\n    readonly listOAuthGrants: () => Call<S.OAuthGrants>;\n    readonly revokeOAuthGrant: (grantId: string) => Call<void>;\n  }\n>()(\"@aperture-browser/api-client/AuthApi\") {}\n"],"mappings":";;;AAsBA,IAAa,UAAb,cAA6B,QAAQ,QAsCnC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aperture-browser/api-client",
-  "version": "0.0.0-init.0",
+  "version": "0.0.0-nightly.101.c63f90ec6164",
   "description": "Effect services for the Aperture API: sessions, snapshots, tenants, users, tokens, events and authentication.",
   "homepage": "https://github.com/tarik02/aperture#readme",
   "bugs": "https://github.com/tarik02/aperture/issues",
@@ -19,21 +19,31 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./passkeys": {
+      "types": "./dist/passkeys.d.ts",
+      "default": "./dist/passkeys.js"
     }
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@aperture-browser/api-schema": "0.0.0-init.0",
-    "@simplewebauthn/browser": "13.3.0"
+    "@aperture-browser/api-schema": "0.0.0-nightly.101.c63f90ec6164"
   },
   "devDependencies": {
-    "effect": "4.0.0-rc.117",
+    "@simplewebauthn/browser": "13.3.0",
+    "effect": "4.0.0",
     "vite-plus": "0.2.4"
   },
   "peerDependencies": {
-    "effect": "^4.0.0-rc.117"
+    "@simplewebauthn/browser": "^13.3.0",
+    "effect": "^4.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@simplewebauthn/browser": {
+      "optional": true
+    }
   },
   "scripts": {
     "build": "vp pack",