@aperture-browser/api-client 0.0.0-init.0 → 0.0.0-nightly.82.2e4f6368108f

package/dist/index.js

@@ -1,3 +1,4 @@
+import { t as AuthApi } from "./service-riqZPQHq.js";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as HttpBody from "effect/unstable/http/HttpBody";
@@ -10,6 +11,9 @@ import * as PubSub from "effect/PubSub";
 import * as Stream from "effect/Stream";
 import * as Function from "effect/Function";
 import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as Option from "effect/Option";
+import * as SchemaTransformation from "effect/SchemaTransformation";
+import * as Random from "effect/Random";
 //#region src/authorization/service.ts
 const TENANT_HEADER = "X-Aperture-Tenant-Id";
 /** The browser's own login session, sent as a cookie. */
@@ -173,10 +177,6 @@ const TOTPEnrollment = Schema.Struct({
 });
 const RecoveryCodes = Schema.Struct({ recoveryCodes: Schema.Array(Schema.String) });
 //#endregion
-//#region src/auth/service.ts
-/** Browser login, account security, and the current principal. */
-var AuthApi = class extends Context.Service()("@aperture-browser/api-client/AuthApi") {};
-//#endregion
 //#region src/auth/layer.ts
 const jsonBody = (body) => ({ body: HttpBody.jsonUnsafe(body) });
 const makeAuthApi = Effect.gen(function* () {
@@ -292,6 +292,13 @@ const ApiErrorBody = Schema.Struct({ error: Schema.Struct({
 	message: Schema.String
 }) });
 /**
+* The error body of a live-session route that failed inside the running session. It carries
+* no stable code, so the resulting ApiRequestError uses `live_session_error` and callers
+* branch on its status.
+*/
+const LiveSessionErrorBody = Schema.Struct({ error: Schema.String });
+const ErrorResponseBody = Schema.Union([ApiErrorBody, LiveSessionErrorBody]);
+/**
 * A failed API request. `code` and `message` come from the server's error body when it
 * sent one; `status` is 0 when no HTTP status applies.
 */
@@ -315,7 +322,11 @@ const networkError = new ApiRequestError({
 * message of the server's error body.
 */
 const toApiRequestError = (self) => self.pipe(Effect.catchReasons("HttpClientError", {
-	StatusCodeError: ({ response }) => HttpClientResponse.schemaBodyJson(ApiErrorBody)(response).pipe(Effect.map(({ error }) => new ApiRequestError({
+	StatusCodeError: ({ response }) => HttpClientResponse.schemaBodyJson(ErrorResponseBody)(response).pipe(Effect.map(({ error }) => typeof error === "string" ? new ApiRequestError({
+		code: "live_session_error",
+		message: error,
+		status: response.status
+	}) : new ApiRequestError({
 		...error,
 		status: response.status
 	})), Effect.orElseSucceed(() => new ApiRequestError({
@@ -359,6 +370,43 @@ const makeApiAuthorization = Effect.gen(function* () {
 });
 const apiAuthorizationLayer = Layer.effect(ApiAuthorization, makeApiAuthorization);
 //#endregion
+//#region src/events/service.ts
+/** The tenant's resource event log, and the deployment-wide audit log. */
+var EventsApi = class extends Context.Service()("@aperture-browser/api-client/EventsApi") {};
+//#endregion
+//#region src/health/service.ts
+/** The instance's unauthenticated health check. */
+var HealthApi = class extends Context.Service()("@aperture-browser/api-client/HealthApi") {};
+//#endregion
+//#region src/pagination.ts
+function getNextPageParam(page) {
+	return page.meta.hasMore ? page.meta.nextCursor : void 0;
+}
+function flattenInfinitePages(pages) {
+	return pages?.flatMap((page) => page.data) ?? [];
+}
+/**
+* Derives `stream` and `listAll` from the call that fetches one page. That call must also
+* accept a bare cursor, which every filter allows because all its fields are optional.
+*/
+function paginated(list) {
+	const stream = (credentials, filter) => Stream.paginate(void 0, (cursor) => list(credentials, filter === void 0 ? { cursor } : {
+		...filter,
+		cursor
+	}).pipe(Effect.map((page) => {
+		const next = getNextPageParam(page);
+		return [page.data, next === void 0 ? Option.none() : Option.some(next)];
+	})));
+	const listAll = (credentials, filter) => Stream.runCollect(stream(credentials, filter));
+	return {
+		list,
+		stream,
+		listAll
+	};
+}
+const defaultListLimit = 50;
+const listQueryDefaults = { refetchOnWindowFocus: true };
+//#endregion
 //#region src/query.ts
 /** Encodes tag filters as the parallel tagKey, tagOperator and tagValue query lists. */
 const tagQuery = (tags) => ({
@@ -374,10 +422,6 @@ const compactQuery = (query) => Object.fromEntries(Object.entries(query).flatMap
 	return items.length > 0 ? [[key, items]] : [];
 }));
 //#endregion
-//#region src/events/service.ts
-/** The tenant's resource event log. */
-var EventsApi = class extends Context.Service()("@aperture-browser/api-client/EventsApi") {};
-//#endregion
 //#region src/events/layer.ts
 const makeEventsApi = Effect.gen(function* () {
 	const httpClient = yield* HttpClient.HttpClient;
@@ -391,10 +435,43 @@ const makeEventsApi = Effect.gen(function* () {
 			resourceId: params.resourceId
 		}) }).pipe(authorize(Authorization.tenantScoped(credentials)));
 	});
-	return EventsApi.of({ listEvents });
+	const listAuditEvents = Effect.fn("EventsApi.listAuditEvents")(function* (credentials, params = {}) {
+		return yield* api.listAuditEvents({ params: compactQuery({
+			limit: params.limit,
+			cursor: params.cursor,
+			tenantId: params.tenantId,
+			actorType: params.actorType,
+			actorId: params.actorId,
+			action: params.action,
+			resourceType: params.resourceType,
+			resourceId: params.resourceId
+		}) }).pipe(authorize(Authorization.of(credentials)));
+	});
+	const events = paginated(listEvents);
+	const auditEvents = paginated(listAuditEvents);
+	return EventsApi.of({
+		listEvents,
+		streamEvents: events.stream,
+		listAllEvents: events.listAll,
+		listAuditEvents,
+		streamAuditEvents: auditEvents.stream,
+		listAllAuditEvents: auditEvents.listAll
+	});
 });
 const eventsApiLayer = Layer.effect(EventsApi, makeEventsApi);
 //#endregion
+//#region src/health/layer.ts
+const makeHealthApi = Effect.gen(function* () {
+	const httpClient = yield* HttpClient.HttpClient;
+	const { authorize } = yield* ApiAuthorization;
+	const api = Api.make(httpClient);
+	const getHealth = Effect.fn("HealthApi.getHealth")(function* () {
+		return yield* api.getHealth(void 0).pipe(authorize(Authorization.anonymous));
+	});
+	return HealthApi.of({ getHealth });
+});
+const healthApiLayer = Layer.effect(HealthApi, makeHealthApi);
+//#endregion
 //#region src/sessions/schemas.ts
 const positiveInt = Schema.Number.check(Schema.isInt(), Schema.isGreaterThan(0));
 const emptyArray = Effect.succeed([]);
@@ -424,8 +501,7 @@ const BrowserStatus = Schema.Struct({
 		})
 	})).pipe(Schema.withDecodingDefaultKey(emptyArray))
 });
-/** A recording as the live session reports it. */
-const Recording = Schema.Struct({
+const recordingFields = {
 	recordingId: Schema.String,
 	mode: Schema.Literals(["tab", "viewer"]),
 	targetId: Schema.String,
@@ -437,21 +513,75 @@ const Recording = Schema.Struct({
 		"failed"
 	]),
 	stopReason: Schema.optionalKey(Schema.String),
-	path: Schema.String,
+	sandboxPath: Schema.optionalKey(Schema.String),
+	/** @deprecated Read `relativePath`. Sessions started before it existed send only this. */
+	path: Schema.optionalKey(Schema.String),
 	startedAt: Schema.String,
 	stoppedAt: Schema.optionalKey(Schema.String),
 	sizeBytes: Schema.optionalKey(Schema.Number.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(0))),
 	fps: positiveInt,
 	bitrateKbps: positiveInt,
 	codec: Schema.String
-});
+};
+/**
+* A recording as the live session reports it. Sessions that are still running an
+* older wrapper send only `path`, which decoding carries over into `relativePath`.
+*/
+const Recording = Schema.Struct({
+	...recordingFields,
+	relativePath: Schema.optionalKey(Schema.String)
+}).pipe(Schema.decodeTo(Schema.Struct({
+	...recordingFields,
+	relativePath: Schema.String
+}), SchemaTransformation.transform({
+	decode: ({ relativePath, ...recording }) => ({
+		...recording,
+		relativePath: relativePath ?? recording.path ?? ""
+	}),
+	encode: (recording) => recording
+})));
 //#endregion
 //#region src/sessions/service.ts
 /** Browser sessions, their live browser, and their recordings. */
 var SessionsApi = class extends Context.Service()("@aperture-browser/api-client/SessionsApi") {};
 //#endregion
+//#region src/sessions/uploads.ts
+const encoder = new TextEncoder();
+const quotedFilename = (name) => name.replaceAll("\"", "%22").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+const contentStream = (content) => {
+	if (content instanceof Blob) return Stream.fromReadableStream({
+		evaluate: () => content.stream(),
+		onError: (cause) => cause
+	});
+	if (content instanceof Uint8Array) return Stream.succeed(content);
+	return content;
+};
+const streamedMultipart = Effect.fn("SessionsApi.streamedMultipart")(function* (files) {
+	const boundary = `aperture-upload-${(yield* Random.nextIntBetween(0, Number.MAX_SAFE_INTEGER)).toString(36)}`;
+	const parts = files.map((file) => {
+		const header = `--${boundary}\r\nContent-Disposition: form-data; name="files"; filename="${quotedFilename(file.name)}"\r\nContent-Type: application/octet-stream\r
+\r
+`;
+		return Stream.succeed(encoder.encode(header)).pipe(Stream.concat(contentStream(file.content)), Stream.concat(Stream.succeed(encoder.encode("\r\n"))));
+	});
+	const body = Stream.fromIterable(parts).pipe(Stream.flatten(), Stream.concat(Stream.succeed(encoder.encode(`--${boundary}--\r\n`))));
+	return HttpBody.stream(body, `multipart/form-data; boundary=${boundary}`);
+});
+/**
+* The multipart body of an upload. FormData works with every fetch, so it is used unless a
+* content is a stream, which needs the body itself to be streamed.
+*/
+const uploadBody = Effect.fn("SessionsApi.uploadBody")(function* (files) {
+	const form = new FormData();
+	for (const file of files) if (file.content instanceof Blob) form.append("files", file.content, file.name);
+	else if (file.content instanceof Uint8Array) form.append("files", new Blob([new Uint8Array(file.content)]), file.name);
+	else return yield* streamedMultipart(files);
+	return HttpBody.formData(form);
+});
+//#endregion
 //#region src/sessions/layer.ts
 const contentDispositionFilename = (header) => header?.match(/filename="([^"]+)"/)?.[1] ?? null;
+const recordingContentPath = (sessionId, recordingId) => `/sessions/${encodeURIComponent(sessionId)}/recordings/${encodeURIComponent(recordingId)}/content`;
 const makeSessionsApi = Effect.gen(function* () {
 	const httpClient = yield* HttpClient.HttpClient;
 	const { authorize } = yield* ApiAuthorization;
@@ -467,6 +597,7 @@ const makeSessionsApi = Effect.gen(function* () {
 			...tagQuery(params.tags)
 		}) }).pipe(tenantScoped(credentials));
 	});
+	const sessions = paginated(listSessions);
 	const getSession = Effect.fn("SessionsApi.getSession")(function* (credentials, sessionId) {
 		return yield* api.getSession(sessionId, void 0).pipe(tenantScoped(credentials));
 	});
@@ -485,7 +616,8 @@ const makeSessionsApi = Effect.gen(function* () {
 				},
 				initialTargets: input.initialTargets ?? [],
 				...input.storageState === void 0 ? {} : { storageState: input.storageState },
-				tags: input.tags ?? {}
+				tags: input.tags ?? {},
+				...input.proxy === void 0 ? {} : { proxy: input.proxy }
 			}
 		}).pipe(tenantScoped(credentials));
 	});
@@ -507,6 +639,9 @@ const makeSessionsApi = Effect.gen(function* () {
 	const replaceSessionTags = Effect.fn("SessionsApi.replaceSessionTags")(function* (credentials, sessionId, tags) {
 		return yield* api.replaceSessionTags(sessionId, { payload: { tags } }).pipe(tenantScoped(credentials));
 	});
+	const updateSessionProxy = Effect.fn("SessionsApi.updateSessionProxy")(function* (credentials, sessionId, proxy) {
+		return yield* api.updateSessionProxy(sessionId, { payload: proxy }).pipe(tenantScoped(credentials));
+	});
 	const promoteSession = Effect.fn("SessionsApi.promoteSession")(function* (credentials, sessionId, input) {
 		return yield* api.promoteSession(sessionId, { payload: {
 			name: input.name,
@@ -515,17 +650,45 @@ const makeSessionsApi = Effect.gen(function* () {
 			tags: input.tags ?? {}
 		} }).pipe(tenantScoped(credentials));
 	});
+	const getSessionCursor = Effect.fn("SessionsApi.getSessionCursor")(function* (credentials, sessionId) {
+		return yield* api.getSessionCursor(sessionId, void 0).pipe(tenantScoped(credentials));
+	});
+	const setSessionCursor = Effect.fn("SessionsApi.setSessionCursor")(function* (credentials, sessionId, visible) {
+		return yield* api.setSessionCursor(sessionId, { payload: { visible } }).pipe(tenantScoped(credentials));
+	});
+	const listSessionRecordings = Effect.fn("SessionsApi.listSessionRecordings")(function* (credentials, sessionId) {
+		return yield* api.listSessionRecordings(sessionId, void 0).pipe(tenantScoped(credentials));
+	});
+	const createSessionRecording = Effect.fn("SessionsApi.createSessionRecording")(function* (credentials, sessionId, input) {
+		return yield* api.createSessionRecording(sessionId, { payload: input }).pipe(tenantScoped(credentials));
+	});
+	const getSessionRecording = Effect.fn("SessionsApi.getSessionRecording")(function* (credentials, sessionId, recordingId) {
+		return yield* api.getSessionRecording(sessionId, recordingId, void 0).pipe(tenantScoped(credentials));
+	});
+	const retargetSessionRecording = Effect.fn("SessionsApi.retargetSessionRecording")(function* (credentials, sessionId, recordingId, targetId) {
+		return yield* api.retargetSessionRecording(sessionId, recordingId, { payload: { targetId } }).pipe(tenantScoped(credentials));
+	});
+	const stopSessionRecording = Effect.fn("SessionsApi.stopSessionRecording")(function* (credentials, sessionId, recordingId) {
+		return yield* api.stopSessionRecording(sessionId, recordingId, void 0).pipe(tenantScoped(credentials));
+	});
+	const listSessionFiles = Effect.fn("SessionsApi.listSessionFiles")(function* (credentials, sessionId) {
+		return yield* api.listSessionFiles(sessionId, void 0).pipe(tenantScoped(credentials));
+	});
+	const createSessionFileDownloadURL = Effect.fn("SessionsApi.createSessionFileDownloadURL")(function* (credentials, sessionId, input) {
+		return yield* api.createSessionFileDownloadURL(sessionId, { payload: input }).pipe(tenantScoped(credentials));
+	});
 	const getBrowserChannels = Effect.fn("SessionsApi.getBrowserChannels")(function* (credentials) {
 		return yield* api.listBrowserChannels(void 0).pipe(tenantScoped(credentials));
 	});
 	const getBrowserStatus = Effect.fn("SessionsApi.getBrowserStatus")(function* (credentials, sessionId, sessionToken) {
 		return yield* http.get(`/sessions/${encodeURIComponent(sessionId)}/browser/status`).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(BrowserStatus)), authorize({
 			credentials,
-			bearerToken: sessionToken
+			bearerToken: sessionToken,
+			tenantHeader: "tenant-scoped"
 		}));
 	});
 	const downloadSessionRecording = Effect.fn("SessionsApi.downloadSessionRecording")(function* (credentials, sessionId, recordingId, sessionToken) {
-		return yield* http.get(`/sessions/${encodeURIComponent(sessionId)}/recordings/${encodeURIComponent(recordingId)}/content`).pipe(Effect.flatMap((response) => Effect.map(response.arrayBuffer, (body) => ({
+		return yield* http.get(recordingContentPath(sessionId, recordingId)).pipe(Effect.flatMap((response) => Effect.map(response.arrayBuffer, (body) => ({
 			blob: new Blob([body], { type: response.headers["content-type"] ?? "" }),
 			filename: contentDispositionFilename(response.headers["content-disposition"])
 		}))), authorize({
@@ -534,8 +697,49 @@ const makeSessionsApi = Effect.gen(function* () {
 			tenantHeader: "tenant-scoped"
 		}));
 	});
+	const streamSessionRecording = (credentials, sessionId, recordingId, sessionToken) => http.get(recordingContentPath(sessionId, recordingId)).pipe(authorize({
+		credentials,
+		bearerToken: sessionToken,
+		tenantHeader: "tenant-scoped"
+	}), Effect.map((response) => response.stream.pipe(Stream.catchTag("HttpClientError", (error) => Stream.fromEffect(toApiRequestError(Effect.fail(error)))))), Stream.unwrap);
+	const uploadSessionFiles = Effect.fn("SessionsApi.uploadSessionFiles")(function* (credentials, sessionId, files, options = {}) {
+		const body = yield* uploadBody(files);
+		return (yield* http.post(`/api/sessions/${encodeURIComponent(sessionId)}/files`, {
+			body,
+			urlParams: compactQuery({ directory: options.directory })
+		}).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(Api.UploadSessionFiles201)), tenantScoped(credentials))).files;
+	});
+	const deleteSessionFile = Effect.fn("SessionsApi.deleteSessionFile")(function* (credentials, sessionId, relativePath, options = {}) {
+		yield* api.deleteSessionFile(sessionId, { params: compactQuery({
+			relativePath,
+			recursive: options.recursive
+		}) }).pipe(tenantScoped(credentials));
+	});
+	const createSessionDirectory = Effect.fn("SessionsApi.createSessionDirectory")(function* (credentials, sessionId, relativePath) {
+		return yield* api.createSessionDirectory(sessionId, { payload: { relativePath } }).pipe(tenantScoped(credentials));
+	});
+	const moveSessionFile = Effect.fn("SessionsApi.moveSessionFile")(function* (credentials, sessionId, input) {
+		return yield* api.moveSessionFile(sessionId, { payload: input }).pipe(tenantScoped(credentials));
+	});
+	const uploadLiveSessionFiles = Effect.fn("SessionsApi.uploadLiveSessionFiles")(function* (credentials, sessionId, files, sessionToken) {
+		const body = yield* uploadBody(files);
+		return (yield* http.post(`/sessions/${encodeURIComponent(sessionId)}/uploads`, { body }).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(Api.UploadLiveSessionFiles201)), authorize({
+			credentials,
+			bearerToken: sessionToken,
+			tenantHeader: "tenant-scoped"
+		}))).files;
+	});
+	const setSessionViewport = Effect.fn("SessionsApi.setSessionViewport")(function* (credentials, sessionId, input, sessionToken) {
+		return yield* api.setSessionViewport(sessionId, { payload: input }).pipe(authorize({
+			credentials,
+			bearerToken: sessionToken,
+			tenantHeader: "tenant-scoped"
+		}));
+	});
 	return SessionsApi.of({
 		listSessions,
+		streamSessions: sessions.stream,
+		listAllSessions: sessions.listAll,
 		getSession,
 		getSessionsBulk,
 		createSession,
@@ -545,10 +749,27 @@ const makeSessionsApi = Effect.gen(function* () {
 		rotateSessionToken,
 		rotateCollaborationCapability,
 		replaceSessionTags,
+		updateSessionProxy,
 		promoteSession,
+		getSessionCursor,
+		setSessionCursor,
+		listSessionRecordings,
+		createSessionRecording,
+		getSessionRecording,
+		retargetSessionRecording,
+		stopSessionRecording,
+		listSessionFiles,
+		createSessionFileDownloadURL,
 		getBrowserChannels,
 		getBrowserStatus,
-		downloadSessionRecording
+		downloadSessionRecording,
+		streamSessionRecording,
+		uploadSessionFiles,
+		uploadLiveSessionFiles,
+		deleteSessionFile,
+		moveSessionFile,
+		createSessionDirectory,
+		setSessionViewport
 	});
 });
 const sessionsApiLayer = Layer.effect(SessionsApi, makeSessionsApi);
@@ -573,6 +794,13 @@ const makeSnapshotsApi = Effect.gen(function* () {
 			...tagQuery(params.tags)
 		}) }).pipe(tenantScoped(credentials));
 	});
+	const snapshots = paginated(listSnapshots);
+	const getSnapshotByName = Effect.fn("SnapshotsApi.getSnapshotByName")(function* (credentials, name) {
+		return yield* snapshots.stream(credentials, {
+			name,
+			limit: 100
+		}).pipe(Stream.filter((candidate) => candidate.name === name), Stream.runHead);
+	});
 	const updateSnapshot = Effect.fn("SnapshotsApi.updateSnapshot")(function* (credentials, name, input) {
 		return yield* api.updateSnapshot(name, { payload: input }).pipe(tenantScoped(credentials));
 	});
@@ -587,6 +815,9 @@ const makeSnapshotsApi = Effect.gen(function* () {
 	});
 	return SnapshotsApi.of({
 		listSnapshots,
+		streamSnapshots: snapshots.stream,
+		listAllSnapshots: snapshots.listAll,
+		getSnapshotByName,
 		updateSnapshot,
 		replaceSnapshotTags,
 		deleteSnapshot,
@@ -596,7 +827,7 @@ const makeSnapshotsApi = Effect.gen(function* () {
 const snapshotsApiLayer = Layer.effect(SnapshotsApi, makeSnapshotsApi);
 //#endregion
 //#region src/tenants/service.ts
-/** Tenant administration. */
+/** Tenant administration, and the tenant a tenant token belongs to. */
 var TenantsApi = class extends Context.Service()("@aperture-browser/api-client/TenantsApi") {};
 //#endregion
 //#region src/tenants/layer.ts
@@ -612,6 +843,13 @@ const makeTenantsApi = Effect.gen(function* () {
 			deleted: params.deleted
 		}) }).pipe(authorize(Authorization.of(credentials)));
 	});
+	const tenants = paginated(listTenants);
+	const getCurrentTenant = Effect.fn("TenantsApi.getCurrentTenant")(function* (credentials) {
+		return yield* api.getTenant(void 0).pipe(authorize(Authorization.of(credentials)));
+	});
+	const updateCurrentTenant = Effect.fn("TenantsApi.updateCurrentTenant")(function* (credentials, input) {
+		return yield* api.updateSelectedTenant({ payload: input }).pipe(authorize(Authorization.of(credentials)));
+	});
 	const createTenant = Effect.fn("TenantsApi.createTenant")(function* (credentials, input) {
 		return yield* api.createTenant({ payload: input }).pipe(authorize(Authorization.of(credentials)));
 	});
@@ -626,10 +864,14 @@ const makeTenantsApi = Effect.gen(function* () {
 	});
 	return TenantsApi.of({
 		listTenants,
+		streamTenants: tenants.stream,
+		listAllTenants: tenants.listAll,
 		createTenant,
 		updateTenant,
 		deleteTenant,
-		restoreTenant
+		restoreTenant,
+		getCurrentTenant,
+		updateCurrentTenant
 	});
 });
 const tenantsApiLayer = Layer.effect(TenantsApi, makeTenantsApi);
@@ -654,6 +896,7 @@ const makeTokensApi = Effect.gen(function* () {
 			scope: params.scope
 		}) }).pipe(authorize(Authorization.of(credentials)));
 	});
+	const adminTokens = paginated(listAdminTokens);
 	const createAdminToken = Effect.fn("TokensApi.createAdminToken")(function* (credentials, input) {
 		const systemAdmin = input.authorityType === "system_admin";
 		return yield* api.createAdminToken({ payload: {
@@ -678,6 +921,7 @@ const makeTokensApi = Effect.gen(function* () {
 			scope: params.scope
 		}) }).pipe(authorize(Authorization.of(credentials)));
 	});
+	const tenantTokens = paginated(listTenantTokens);
 	const createTenantToken = Effect.fn("TokensApi.createTenantToken")(function* (credentials, input) {
 		return yield* api.createTenantToken({ payload: {
 			name: input.name,
@@ -692,9 +936,13 @@ const makeTokensApi = Effect.gen(function* () {
 	});
 	return TokensApi.of({
 		listAdminTokens,
+		streamAdminTokens: adminTokens.stream,
+		listAllAdminTokens: adminTokens.listAll,
 		createAdminToken,
 		revokeAdminToken,
 		listTenantTokens,
+		streamTenantTokens: tenantTokens.stream,
+		listAllTenantTokens: tenantTokens.listAll,
 		createTenantToken,
 		revokeTenantToken
 	});
@@ -718,6 +966,7 @@ const makeUsersApi = Effect.gen(function* () {
 			disabled: params.disabled
 		}) }).pipe(authorize(Authorization.of(credentials)));
 	});
+	const users = paginated(listUsers);
 	const createUser = Effect.fn("UsersApi.createUser")(function* (credentials, input) {
 		return yield* api.createUser({ payload: input }).pipe(authorize(Authorization.of(credentials)));
 	});
@@ -739,6 +988,9 @@ const makeUsersApi = Effect.gen(function* () {
 	const listUserMemberships = Effect.fn("UsersApi.listUserMemberships")(function* (credentials, userId) {
 		return yield* api.listUserMemberships(userId, void 0).pipe(authorize(Authorization.of(credentials)));
 	});
+	const listTenantMemberships = Effect.fn("UsersApi.listTenantMemberships")(function* (credentials, tenantId) {
+		return yield* api.listTenantMemberships(tenantId, void 0).pipe(authorize(Authorization.of(credentials)));
+	});
 	const upsertTenantMembership = Effect.fn("UsersApi.upsertTenantMembership")(function* (credentials, tenantId, userId, scopes) {
 		const payload = { scopes };
 		return yield* api.upsertTenantMembership(tenantId, userId, { payload }).pipe(authorize(Authorization.of(credentials)));
@@ -748,6 +1000,8 @@ const makeUsersApi = Effect.gen(function* () {
 	});
 	return UsersApi.of({
 		listUsers,
+		streamUsers: users.stream,
+		listAllUsers: users.listAll,
 		createUser,
 		getUser,
 		updateUser,
@@ -755,6 +1009,7 @@ const makeUsersApi = Effect.gen(function* () {
 		disableUser,
 		restoreUser,
 		listUserMemberships,
+		listTenantMemberships,
 		upsertTenantMembership,
 		deleteTenantMembership
 	});
@@ -766,22 +1021,104 @@ const usersApiLayer = Layer.effect(UsersApi, makeUsersApi);
 * Every API service, sharing one ApiAuthorization. The services send requests through the
 * HttpClient the app provides, decorated with each call's authorization.
 */
-const apiClientLayer = Layer.mergeAll(authApiLayer, tenantsApiLayer, usersApiLayer, sessionsApiLayer, snapshotsApiLayer, tokensApiLayer, eventsApiLayer).pipe(Layer.provide(authorizedHttpClientLayer), Layer.provideMerge(apiAuthorizationLayer));
+const apiClientLayer = Layer.mergeAll(authApiLayer, tenantsApiLayer, usersApiLayer, sessionsApiLayer, snapshotsApiLayer, tokensApiLayer, eventsApiLayer, healthApiLayer).pipe(Layer.provide(authorizedHttpClientLayer), Layer.provideMerge(apiAuthorizationLayer));
 const baseUrlLayer = (baseUrl) => Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, HttpClient.mapRequest(HttpClientRequest.prependUrl(baseUrl))));
 //#endregion
-//#region src/pagination.ts
-function getNextPageParam(page) {
-	return page.meta.hasMore ? page.meta.nextCursor : void 0;
+//#region src/client.ts
+/** Binds `credentials` as the first argument of every method of `service`. */
+function withCredentials(service, credentials) {
+	const methods = Object.entries(service);
+	return Object.fromEntries(methods.map(([name, method]) => [name, (...args) => method(credentials, ...args)]));
 }
-function flattenInfinitePages(pages) {
-	return pages?.flatMap((page) => page.data) ?? [];
-}
-const defaultListLimit = 50;
-const listQueryDefaults = { refetchOnWindowFocus: true };
+/**
+* The credentialed API services with one set of credentials bound, for callers that always
+* act as the same principal, such as a server holding one API token.
+*/
+var ApertureClient = class extends Context.Service()("@aperture-browser/api-client/ApertureClient") {};
+const makeApertureClient = Effect.fn("makeApertureClient")(function* (credentials) {
+	const auth = yield* AuthApi;
+	return ApertureClient.of({
+		sessions: withCredentials(yield* SessionsApi, credentials),
+		snapshots: withCredentials(yield* SnapshotsApi, credentials),
+		tenants: withCredentials(yield* TenantsApi, credentials),
+		users: withCredentials(yield* UsersApi, credentials),
+		tokens: withCredentials(yield* TokensApi, credentials),
+		events: withCredentials(yield* EventsApi, credentials),
+		auth: { getAuthMe: () => auth.getAuthMe(credentials.selectedTenantId, credentials) },
+		health: yield* HealthApi
+	});
+});
+/** ApertureClient acting with `credentials`, over the HttpClient the app provides. */
+const apertureClientLayer = (credentials) => Layer.effect(ApertureClient, makeApertureClient(credentials)).pipe(Layer.provide(apiClientLayer));
 //#endregion
 //#region src/schemas.ts
 const SessionStatus = Api.SessionStatus;
 //#endregion
-export { ApiAuthorization, ApiErrorBody, ApiRequestError, AuthApi, Authorization, BrowserStatus, EventsApi, LoginMethods, Passkey, PasskeyLoginOptions, PasskeyMutation, PasskeyRegistrationOptions, Passkeys, PasswordLoginResponse, Recording, RecoveryCodes, SecurityStatus, SessionStatus, SessionsApi, SnapshotsApi, TENANT_HEADER, TOTPEnrollment, TenantsApi, TokensApi, UsersApi, apiAuthorizationLayer, apiClientLayer, authApiLayer, authorizedHttpClientLayer, baseUrlLayer, compactQuery, defaultListLimit, eventsApiLayer, flattenInfinitePages, getNextPageParam, listQueryDefaults, makeApiAuthorization, makeAuthApi, makeEventsApi, makeSessionsApi, makeSnapshotsApi, makeTenantsApi, makeTokensApi, makeUsersApi, resolveTenantHeader, sessionsApiLayer, snapshotsApiLayer, tagQuery, tenantsApiLayer, toApiRequestError, tokensApiLayer, usersApiLayer, webSessionCredentials };
+//#region src/sessions/tree.ts
+/**
+* The top-level directories the session writes into. They always exist and cannot be
+* deleted, moved or renamed.
+*/
+const sessionFileRootDirectories = [
+	"downloads",
+	"recordings",
+	"uploads",
+	"outputs"
+];
+const emptyDirectory = () => ({
+	directory: void 0,
+	directories: /* @__PURE__ */ new Map(),
+	files: []
+});
+function directoryAt(root, segments) {
+	let directory = root;
+	for (const segment of segments) {
+		let child = directory.directories.get(segment);
+		if (child === void 0) {
+			child = emptyDirectory();
+			directory.directories.set(segment, child);
+		}
+		directory = child;
+	}
+	return directory;
+}
+function toNodes(directory, parentPath) {
+	const directories = [...directory.directories.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([name, child]) => {
+		const relativePath = parentPath === "" ? name : `${parentPath}/${name}`;
+		return {
+			kind: "directory",
+			name,
+			relativePath,
+			directory: child.directory,
+			children: toNodes(child, relativePath)
+		};
+	});
+	const files = [...directory.files].sort((left, right) => left.name.localeCompare(right.name));
+	return [...directories, ...files];
+}
+/**
+* Arranges `listSessionFiles` results into a tree: directories first, then files, each
+* sorted by name. Empty directories appear because the listing includes them.
+*/
+function sessionFileTree(entries) {
+	const root = emptyDirectory();
+	for (const entry of entries) {
+		const segments = entry.relativePath.split("/");
+		if (entry.type === "directory") {
+			directoryAt(root, segments).directory = entry;
+			continue;
+		}
+		const name = segments.pop() ?? entry.relativePath;
+		directoryAt(root, segments).files.push({
+			kind: "file",
+			name,
+			relativePath: entry.relativePath,
+			file: entry
+		});
+	}
+	return toNodes(root, "");
+}
+//#endregion
+export { ApertureClient, ApiAuthorization, ApiErrorBody, ApiRequestError, AuthApi, Authorization, BrowserStatus, EventsApi, HealthApi, LiveSessionErrorBody, LoginMethods, Passkey, PasskeyLoginOptions, PasskeyMutation, PasskeyRegistrationOptions, Passkeys, PasswordLoginResponse, Recording, RecoveryCodes, SecurityStatus, SessionStatus, SessionsApi, SnapshotsApi, TENANT_HEADER, TOTPEnrollment, TenantsApi, TokensApi, UsersApi, apertureClientLayer, apiAuthorizationLayer, apiClientLayer, authApiLayer, authorizedHttpClientLayer, baseUrlLayer, compactQuery, defaultListLimit, eventsApiLayer, flattenInfinitePages, getNextPageParam, healthApiLayer, listQueryDefaults, makeApertureClient, makeApiAuthorization, makeAuthApi, makeEventsApi, makeHealthApi, makeSessionsApi, makeSnapshotsApi, makeTenantsApi, makeTokensApi, makeUsersApi, paginated, resolveTenantHeader, sessionFileRootDirectories, sessionFileTree, sessionsApiLayer, snapshotsApiLayer, tagQuery, tenantsApiLayer, toApiRequestError, tokensApiLayer, usersApiLayer, webSessionCredentials, withCredentials };
 
 //# sourceMappingURL=index.js.map