@aperture-browser/api-client 0.0.0-init.0 → 0.0.0-nightly.82.2e4f6368108f

package/dist/passkeys.js

@@ -0,0 +1,54 @@
+import { t as AuthApi } from "./service-riqZPQHq.js";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { startAuthentication, startRegistration } from "@simplewebauthn/browser";
+//#region src/passkeys.ts
+const PasskeyCeremony = Schema.Literals(["authentication", "registration"]);
+/**
+* The browser did not complete the WebAuthn ceremony. `cancelled` covers the user
+* dismissing the prompt or letting it time out; anything else is `failed`.
+*/
+var PasskeyCeremonyError = class extends Schema.TaggedError()("PasskeyCeremonyError", {
+	ceremony: PasskeyCeremony,
+	reason: Schema.Literals(["cancelled", "failed"]),
+	message: Schema.String,
+	cause: Schema.Defect()
+}) {};
+const ceremonyLabels = {
+	authentication: "Passkey sign-in",
+	registration: "Passkey registration"
+};
+const toCeremonyError = (ceremony) => (cause) => {
+	const cancelled = cause instanceof Error && (cause.name === "NotAllowedError" || cause.name === "AbortError");
+	const label = ceremonyLabels[ceremony];
+	return new PasskeyCeremonyError({
+		ceremony,
+		reason: cancelled ? "cancelled" : "failed",
+		message: cancelled ? `${label} was cancelled` : `${label} failed`,
+		cause
+	});
+};
+/** Signs the browser in with a passkey, establishing the web session. */
+const loginWithPasskey = Effect.fn("loginWithPasskey")(function* () {
+	const auth = yield* AuthApi;
+	const options = yield* auth.beginPasskeyLogin();
+	const credential = yield* Effect.tryPromise({
+		try: () => startAuthentication({ optionsJSON: options.publicKey }),
+		catch: toCeremonyError("authentication")
+	});
+	yield* auth.finishPasskeyLogin(credential);
+});
+/** Creates a passkey on this device and registers it for the signed-in user. */
+const registerPasskey = Effect.fn("registerPasskey")(function* (name) {
+	const auth = yield* AuthApi;
+	const options = yield* auth.beginPasskeyRegistration(name);
+	const credential = yield* Effect.tryPromise({
+		try: () => startRegistration({ optionsJSON: options.publicKey }),
+		catch: toCeremonyError("registration")
+	});
+	return yield* auth.finishPasskeyRegistration(credential);
+});
+//#endregion
+export { PasskeyCeremonyError, loginWithPasskey, registerPasskey };
+
+//# sourceMappingURL=passkeys.js.map

package/dist/passkeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkeys.js","names":[],"sources":["../src/passkeys.ts"],"sourcesContent":["import * as Effect from \"effect/Effect\";\nimport * as Schema from \"effect/Schema\";\nimport { startAuthentication, startRegistration } from \"@simplewebauthn/browser\";\nimport { AuthApi } from \"./auth/service.ts\";\n\nconst PasskeyCeremony = Schema.Literals([\"authentication\", \"registration\"]);\ntype PasskeyCeremony = typeof PasskeyCeremony.Type;\n\n/**\n * The browser did not complete the WebAuthn ceremony. `cancelled` covers the user\n * dismissing the prompt or letting it time out; anything else is `failed`.\n */\nexport class PasskeyCeremonyError extends Schema.TaggedError<PasskeyCeremonyError>()(\n  \"PasskeyCeremonyError\",\n  {\n    ceremony: PasskeyCeremony,\n    reason: Schema.Literals([\"cancelled\", \"failed\"]),\n    message: Schema.String,\n    cause: Schema.Defect(),\n  },\n) {}\n\nconst ceremonyLabels = {\n  authentication: \"Passkey sign-in\",\n  registration: \"Passkey registration\",\n} satisfies Record<PasskeyCeremony, string>;\n\n// Browsers report a dismissed or timed-out prompt as NotAllowedError, and an aborted one as\n// AbortError; @simplewebauthn/browser keeps that name on the WebAuthnError it rethrows.\nconst toCeremonyError = (ceremony: PasskeyCeremony) => (cause: unknown) => {\n  const cancelled =\n    cause instanceof Error && (cause.name === \"NotAllowedError\" || cause.name === \"AbortError\");\n  const label = ceremonyLabels[ceremony];\n  return new PasskeyCeremonyError({\n    ceremony,\n    reason: cancelled ? \"cancelled\" : \"failed\",\n    message: cancelled ? `${label} was cancelled` : `${label} failed`,\n    cause,\n  });\n};\n\n/** Signs the browser in with a passkey, establishing the web session. */\nexport const loginWithPasskey = Effect.fn(\"loginWithPasskey\")(function* () {\n  const auth = yield* AuthApi;\n  const options = yield* auth.beginPasskeyLogin();\n  const credential = yield* Effect.tryPromise({\n    try: () => startAuthentication({ optionsJSON: options.publicKey }),\n    catch: toCeremonyError(\"authentication\"),\n  });\n  yield* auth.finishPasskeyLogin(credential);\n});\n\n/** Creates a passkey on this device and registers it for the signed-in user. */\nexport const registerPasskey = Effect.fn(\"registerPasskey\")(function* (name: string) {\n  const auth = yield* AuthApi;\n  const options = yield* auth.beginPasskeyRegistration(name);\n  const credential = yield* Effect.tryPromise({\n    try: () => startRegistration({ optionsJSON: options.publicKey }),\n    catch: toCeremonyError(\"registration\"),\n  });\n  return yield* auth.finishPasskeyRegistration(credential);\n});\n"],"mappings":";;;;;AAKA,MAAM,kBAAkB,OAAO,SAAS,CAAC,kBAAkB,cAAc,CAAC;;;;;AAO1E,IAAa,uBAAb,cAA0C,OAAO,YAAkC,CAAC,CAClF,wBACA;CACE,UAAU;CACV,QAAQ,OAAO,SAAS,CAAC,aAAa,QAAQ,CAAC;CAC/C,SAAS,OAAO;CAChB,OAAO,OAAO,OAAO;AACvB,CACF,CAAC,CAAC,CAAC;AAEH,MAAM,iBAAiB;CACrB,gBAAgB;CAChB,cAAc;AAChB;AAIA,MAAM,mBAAmB,cAA+B,UAAmB;CACzE,MAAM,YACJ,iBAAiB,UAAU,MAAM,SAAS,qBAAqB,MAAM,SAAS;CAChF,MAAM,QAAQ,eAAe;CAC7B,OAAO,IAAI,qBAAqB;EAC9B;EACA,QAAQ,YAAY,cAAc;EAClC,SAAS,YAAY,GAAG,MAAM,kBAAkB,GAAG,MAAM;EACzD;CACF,CAAC;AACH;;AAGA,MAAa,mBAAmB,OAAO,GAAG,kBAAkB,CAAC,CAAC,aAAa;CACzE,MAAM,OAAO,OAAO;CACpB,MAAM,UAAU,OAAO,KAAK,kBAAkB;CAC9C,MAAM,aAAa,OAAO,OAAO,WAAW;EAC1C,WAAW,oBAAoB,EAAE,aAAa,QAAQ,UAAU,CAAC;EACjE,OAAO,gBAAgB,gBAAgB;CACzC,CAAC;CACD,OAAO,KAAK,mBAAmB,UAAU;AAC3C,CAAC;;AAGD,MAAa,kBAAkB,OAAO,GAAG,iBAAiB,CAAC,CAAC,WAAW,MAAc;CACnF,MAAM,OAAO,OAAO;CACpB,MAAM,UAAU,OAAO,KAAK,yBAAyB,IAAI;CACzD,MAAM,aAAa,OAAO,OAAO,WAAW;EAC1C,WAAW,kBAAkB,EAAE,aAAa,QAAQ,UAAU,CAAC;EAC/D,OAAO,gBAAgB,cAAc;CACvC,CAAC;CACD,OAAO,OAAO,KAAK,0BAA0B,UAAU;AACzD,CAAC"}

package/dist/service-DhkerN7u.d.ts

@@ -0,0 +1,296 @@
+import * as Effect from "effect/Effect";
+import * as Api from "@aperture-browser/api-schema";
+import * as Context from "effect/Context";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as HttpClientError from "effect/unstable/http/HttpClientError";
+
+//#region src/errors.d.ts
+declare const ApiErrorBody: Schema.Struct<{
+  readonly error: Schema.Struct<{
+    readonly code: Schema.String;
+    readonly message: Schema.String;
+  }>;
+}>;
+type ApiErrorBody = typeof ApiErrorBody.Type;
+/**
+ * The error body of a live-session route that failed inside the running session. It carries
+ * no stable code, so the resulting ApiRequestError uses `live_session_error` and callers
+ * branch on its status.
+ */
+declare const LiveSessionErrorBody: Schema.Struct<{
+  readonly error: Schema.String;
+}>;
+type LiveSessionErrorBody = typeof LiveSessionErrorBody.Type;
+declare const ApiRequestError_base: Schema.Class<ApiRequestError, Schema.TaggedStruct<"ApiRequestError", {
+  readonly code: Schema.String;
+  readonly message: Schema.String;
+  readonly status: Schema.Number;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A failed API request. `code` and `message` come from the server's error body when it
+ * sent one; `status` is 0 when no HTTP status applies.
+ */
+declare class ApiRequestError extends ApiRequestError_base {}
+/**
+ * Maps HTTP and decoding failures to ApiRequestError. Error responses keep the code and
+ * message of the server's error body.
+ */
+declare const toApiRequestError: <A, R>(self: Effect.Effect<A, HttpClientError.HttpClientError | Schema.SchemaError, R>) => Effect.Effect<A, ApiRequestError, R>;
+//#endregion
+//#region src/authorization/service.d.ts
+declare const TENANT_HEADER = "X-Aperture-Tenant-Id";
+interface CredentialContext {
+  authorityType: "system_admin" | "tenant" | null;
+  tenantId: string | null;
+  selectedTenantId: string | null;
+}
+type ApiCredentials = (CredentialContext & {
+  kind: "bearer";
+  token: string;
+}) | (CredentialContext & {
+  kind: "session";
+});
+/** The browser's own login session, sent as a cookie. */
+declare const webSessionCredentials: ApiCredentials;
+type TenantHeaderMode = "none" | "optional" | "tenant-scoped";
+/** Which tenant, if any, a request acts for under the given credentials. */
+declare function resolveTenantHeader(credentials: ApiCredentials, mode: TenantHeaderMode): string | undefined;
+/** How a request authenticates, and which tenant it acts for. */
+interface Authorization {
+  readonly credentials?: ApiCredentials;
+  readonly bearerToken?: string;
+  readonly tenantHeader?: TenantHeaderMode;
+}
+declare const Authorization: {
+  anonymous: Authorization;
+  webSession: Authorization;
+  of: (credentials: ApiCredentials) => Authorization;
+  tenantScoped: (credentials: ApiCredentials) => Authorization;
+};
+declare const ApiAuthorization_base: Context.ServiceClass<ApiAuthorization, "@aperture-browser/api-client/ApiAuthorization", {
+  /** Runs a call with the given authorization and maps its failures to ApiRequestError. */readonly authorize: (authorization: Authorization) => <A, R>(self: Effect.Effect<A, HttpClientError.HttpClientError | Schema.SchemaError, R>) => Effect.Effect<A, ApiRequestError, R>; /** Emits whenever the web session is found to be missing, expired or revoked. */
+  readonly sessionAuthenticationFailures: Stream.Stream<void>;
+}>;
+/**
+ * Authenticates API calls. Inside `authorize`, every request sent through the HttpClient
+ * that `authorizedHttpClientLayer` provides carries that call's credentials and tenant, so
+ * callers never touch headers.
+ */
+declare class ApiAuthorization extends ApiAuthorization_base {}
+//#endregion
+//#region src/schemas.d.ts
+type PageMeta = Api.PageMeta;
+type Tenant = Api.Tenant;
+type User = Api.User;
+type UserInvitation = Api.UserInvitation;
+type TenantMembership = Api.TenantMembership;
+type AuthMeResponse = Api.AuthMe;
+type AuthMePrincipal = Api.Principal;
+type AuthMeTenant = Api.Tenant;
+type ResourceMode = Api.ResourceMode;
+type ResourceGrant = Api.ResourceGrant;
+type Scope = Api.Scope;
+type TenantScope = Api.TenantScope;
+type Session = Api.Session;
+type SessionMedia = Api.SessionMedia;
+type SessionProxy = Api.SessionProxy;
+type ProxyConfig = Api.ProxyConfig;
+type UpdateProxyConfig = Api.UpdateProxyConfig;
+type ProxyUpstream = Api.ProxyUpstream;
+type ProxyRule = Api.ProxyRule;
+type CursorVisibility = Api.CursorVisibility;
+type SessionRecording = Api.Recording;
+type SessionFile = Api.SessionFile;
+type SessionDirectory = Api.SessionDirectory;
+type SessionFileEntry = Api.SessionFileEntry;
+type SessionFileDownloadURL = Api.SessionFileDownloadURL;
+type SetViewportInput = Api.SetViewportInput;
+type TargetViewport = Api.TargetViewport;
+type Health = Api.Health;
+type AuditEvent = Api.AuditEvent;
+type AuditEventsPage = Api.AuditEventPage;
+type IceServer = Api.IceServer;
+declare const SessionStatus: import("effect/Schema").Literals<readonly ["creating", "running", "suspended", "deleted", "expired", "failed"]>;
+type SessionStatus = Api.SessionStatus;
+type Snapshot = Api.Snapshot;
+type ApiToken = Api.Token;
+type TenantsPage = Api.TenantPage;
+type UsersPage = Api.UserPage;
+type SessionsPage = Api.SessionPage;
+type SessionsBulkResponse = Api.SessionBulkResponse;
+type SnapshotsPage = Api.SnapshotPage;
+type TokensPage = Api.TokenPage;
+type BrowserChannel = Api.BrowserChannel;
+type BrowserChannelsResponse = Api.BrowserChannels;
+type ResourceEvent = Api.Event;
+type EventsPage = Api.EventPage;
+type CreateSessionResponse = Api.CreateSessionResult;
+type SessionMutationResponse = Api.SessionMutation;
+type SnapshotMutationResponse = Api.SnapshotMutation;
+type PromoteSessionResponse = Api.SnapshotMutation;
+type CreateTokenResponse = Api.CreateTokenResponse;
+//#endregion
+//#region src/auth/schemas.d.ts
+declare const LoginMethods: Schema.Struct<{
+  readonly methods: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"password">;
+  }>, Schema.Struct<{
+    readonly type: Schema.Literal<"api_token">;
+  }>, Schema.Struct<{
+    readonly type: Schema.Literal<"passkey">;
+  }>, Schema.Struct<{
+    readonly type: Schema.Literal<"oidc">;
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly loginUrl: Schema.String;
+  }>]>>;
+}>;
+declare const PasskeyLoginOptions: Schema.Struct<{
+  readonly publicKey: Schema.Struct<{
+    readonly challenge: Schema.String;
+    readonly timeout: Schema.optionalKey<Schema.Number>;
+    readonly rpId: Schema.optionalKey<Schema.String>;
+    readonly allowCredentials: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Struct<{
+      readonly id: Schema.String;
+      readonly type: Schema.Literal<"public-key">;
+      readonly transports: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb"]>>>>;
+    }>>>>;
+    readonly userVerification: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
+    readonly hints: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>>;
+    readonly extensions: Schema.optionalKey<Schema.Struct<{
+      readonly appid: Schema.optionalKey<Schema.String>;
+      readonly credProps: Schema.optionalKey<Schema.Boolean>;
+      readonly hmacCreateSecret: Schema.optionalKey<Schema.Boolean>;
+      readonly minPinLength: Schema.optionalKey<Schema.Boolean>;
+    }>>;
+  }>;
+}>;
+declare const PasskeyRegistrationOptions: Schema.Struct<{
+  readonly publicKey: Schema.Struct<{
+    readonly rp: Schema.Struct<{
+      readonly id: Schema.optionalKey<Schema.String>;
+      readonly name: Schema.String;
+    }>;
+    readonly user: Schema.Struct<{
+      readonly id: Schema.String;
+      readonly name: Schema.String;
+      readonly displayName: Schema.String;
+    }>;
+    readonly challenge: Schema.String;
+    readonly pubKeyCredParams: Schema.mutable<Schema.$Array<Schema.Struct<{
+      readonly alg: Schema.Literals<readonly [-7, -8, -35, -36, -37, -38, -39, -257, -258, -259]>;
+      readonly type: Schema.Literal<"public-key">;
+    }>>>;
+    readonly timeout: Schema.optionalKey<Schema.Number>;
+    readonly excludeCredentials: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Struct<{
+      readonly id: Schema.String;
+      readonly type: Schema.Literal<"public-key">;
+      readonly transports: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb"]>>>>;
+    }>>>>;
+    readonly authenticatorSelection: Schema.optionalKey<Schema.Struct<{
+      readonly authenticatorAttachment: Schema.optionalKey<Schema.Literals<readonly ["platform", "cross-platform"]>>;
+      readonly requireResidentKey: Schema.optionalKey<Schema.Boolean>;
+      readonly residentKey: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
+      readonly userVerification: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
+    }>>;
+    readonly hints: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>>;
+    readonly attestation: Schema.optionalKey<Schema.Literals<readonly ["direct", "enterprise", "indirect", "none"]>>;
+    readonly attestationFormats: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["fido-u2f", "packed", "android-safetynet", "android-key", "tpm", "apple", "none"]>>>>;
+    readonly extensions: Schema.optionalKey<Schema.Struct<{
+      readonly appid: Schema.optionalKey<Schema.String>;
+      readonly credProps: Schema.optionalKey<Schema.Boolean>;
+      readonly hmacCreateSecret: Schema.optionalKey<Schema.Boolean>;
+      readonly minPinLength: Schema.optionalKey<Schema.Boolean>;
+    }>>;
+  }>;
+}>;
+declare const Passkey: Schema.Struct<{
+  readonly id: Schema.String;
+  readonly name: Schema.String;
+  readonly createdAt: Schema.String;
+  readonly lastUsedAt: Schema.NullOr<Schema.String>;
+}>;
+declare const Passkeys: Schema.Struct<{
+  readonly passkeys: Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly createdAt: Schema.String;
+    readonly lastUsedAt: Schema.NullOr<Schema.String>;
+  }>>;
+}>;
+declare const PasskeyMutation: Schema.Struct<{
+  readonly passkey: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly createdAt: Schema.String;
+    readonly lastUsedAt: Schema.NullOr<Schema.String>;
+  }>;
+}>;
+declare const PasswordLoginResponse: Schema.Struct<{
+  readonly mfaRequired: Schema.Boolean;
+}>;
+declare const SecurityStatus: Schema.Struct<{
+  readonly hasPassword: Schema.Boolean;
+  readonly totpEnabled: Schema.Boolean;
+  readonly recoveryCodesRemaining: Schema.Number;
+}>;
+declare const TOTPEnrollment: Schema.Struct<{
+  readonly secret: Schema.String;
+  readonly otpauthUrl: Schema.String;
+  readonly qrCodeDataUrl: Schema.String;
+}>;
+declare const RecoveryCodes: Schema.Struct<{
+  readonly recoveryCodes: Schema.$Array<Schema.String>;
+}>;
+type LoginMethods = typeof LoginMethods.Type;
+type PasskeyLoginOptions = typeof PasskeyLoginOptions.Type;
+type PasskeyRegistrationOptions = typeof PasskeyRegistrationOptions.Type;
+type Passkey = typeof Passkey.Type;
+type Passkeys = typeof Passkeys.Type;
+type PasskeyMutation = typeof PasskeyMutation.Type;
+type PasswordLoginResponse = typeof PasswordLoginResponse.Type;
+type RecoveryCodes = typeof RecoveryCodes.Type;
+type SecurityStatus = typeof SecurityStatus.Type;
+type TOTPEnrollment = typeof TOTPEnrollment.Type;
+//#endregion
+//#region src/auth/service.d.ts
+type Call<A> = Effect.Effect<A, ApiRequestError>;
+/**
+ * A WebAuthn credential serialized to JSON by the browser ceremony, as
+ * `@aperture-browser/api-client/passkeys` produces it. The server verifies its contents.
+ */
+interface PasskeyCredentialJSON {
+  readonly id: string;
+  readonly rawId: string;
+  readonly type: "public-key";
+  readonly response: object;
+  readonly clientExtensionResults: object;
+}
+declare const AuthApi_base: Context.ServiceClass<AuthApi, "@aperture-browser/api-client/AuthApi", {
+  readonly listLoginMethods: () => Call<LoginMethods>;
+  readonly loginWithPassword: (email: string, password: string) => Call<PasswordLoginResponse>;
+  readonly completePasswordMFA: (code: string) => Call<void>;
+  readonly loginWithAPIToken: (token: string) => Call<void>;
+  readonly beginPasskeyLogin: () => Call<PasskeyLoginOptions>;
+  readonly finishPasskeyLogin: (credential: PasskeyCredentialJSON) => Call<void>;
+  readonly acceptUserInvitation: (token: string, password: string) => Call<void>;
+  readonly logoutWebSession: () => Call<void>;
+  readonly getAuthMe: (selectedTenantId?: string | null, credentials?: ApiCredentials) => Call<AuthMeResponse>;
+  readonly getSecurityStatus: () => Call<SecurityStatus>;
+  readonly setPassword: (currentPassword: string, newPassword: string) => Call<void>;
+  readonly listPasskeys: () => Call<Passkeys>;
+  readonly beginPasskeyRegistration: (name: string) => Call<PasskeyRegistrationOptions>;
+  readonly finishPasskeyRegistration: (credential: PasskeyCredentialJSON) => Call<PasskeyMutation>;
+  readonly renamePasskey: (passkeyId: string, name: string) => Call<PasskeyMutation>;
+  readonly deletePasskey: (passkeyId: string) => Call<void>;
+  readonly beginTOTPEnrollment: () => Call<TOTPEnrollment>;
+  readonly completeTOTPEnrollment: (code: string) => Call<RecoveryCodes>;
+  readonly regenerateRecoveryCodes: (code: string) => Call<RecoveryCodes>;
+  readonly disableTOTP: (code: string) => Call<void>;
+}>;
+/** Browser login, account security, and the current principal. */
+declare class AuthApi extends AuthApi_base {}
+//#endregion
+export { Tenant as $, ProxyRule as A, SessionFileEntry as B, CursorVisibility as C, PageMeta as D, IceServer as E, Scope as F, SessionStatus as G, SessionMutationResponse as H, Session as I, SetViewportInput as J, SessionsBulkResponse as K, SessionDirectory as L, ResourceEvent as M, ResourceGrant as N, PromoteSessionResponse as O, ResourceMode as P, TargetViewport as Q, SessionFile as R, CreateTokenResponse as S, Health as T, SessionProxy as U, SessionMedia as V, SessionRecording as W, SnapshotMutationResponse as X, Snapshot as Y, SnapshotsPage as Z, AuthMeResponse as _, LiveSessionErrorBody as _t, PasskeyLoginOptions as a, User as at, BrowserChannelsResponse as b, Passkeys as c, ApiAuthorization as ct, SecurityStatus as d, TENANT_HEADER as dt, TenantMembership as et, TOTPEnrollment as f, TenantHeaderMode as ft, AuthMePrincipal as g, ApiRequestError as gt, AuditEventsPage as h, ApiErrorBody as ht, Passkey as i, UpdateProxyConfig as it, ProxyUpstream as j, ProxyConfig as k, PasswordLoginResponse as l, ApiCredentials as lt, AuditEvent as m, webSessionCredentials as mt, PasskeyCredentialJSON as n, TenantsPage as nt, PasskeyMutation as o, UserInvitation as ot, ApiToken as p, resolveTenantHeader as pt, SessionsPage as q, LoginMethods as r, TokensPage as rt, PasskeyRegistrationOptions as s, UsersPage as st, AuthApi as t, TenantScope as tt, RecoveryCodes as u, Authorization as ut, AuthMeTenant as v, toApiRequestError as vt, EventsPage as w, CreateSessionResponse as x, BrowserChannel as y, SessionFileDownloadURL as z };
+//# sourceMappingURL=service-DhkerN7u.d.ts.map

package/dist/service-riqZPQHq.js

@@ -0,0 +1,8 @@
+import * as Context from "effect/Context";
+//#region src/auth/service.ts
+/** Browser login, account security, and the current principal. */
+var AuthApi = class extends Context.Service()("@aperture-browser/api-client/AuthApi") {};
+//#endregion
+export { AuthApi as t };
+
+//# sourceMappingURL=service-riqZPQHq.js.map

package/dist/service-riqZPQHq.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-riqZPQHq.js","names":[],"sources":["../src/auth/service.ts"],"sourcesContent":["import * as Context from \"effect/Context\";\nimport type * as Effect from \"effect/Effect\";\nimport type { ApiCredentials } from \"../authorization/service.ts\";\nimport type { ApiRequestError } from \"../errors.ts\";\nimport type { AuthMeResponse } from \"../schemas.ts\";\nimport type * as S from \"./schemas.ts\";\n\ntype Call<A> = Effect.Effect<A, ApiRequestError>;\n\n/**\n * A WebAuthn credential serialized to JSON by the browser ceremony, as\n * `@aperture-browser/api-client/passkeys` produces it. The server verifies its contents.\n */\nexport interface PasskeyCredentialJSON {\n  readonly id: string;\n  readonly rawId: string;\n  readonly type: \"public-key\";\n  readonly response: object;\n  readonly clientExtensionResults: object;\n}\n\n/** Browser login, account security, and the current principal. */\nexport class AuthApi extends Context.Service<\n  AuthApi,\n  {\n    readonly listLoginMethods: () => Call<S.LoginMethods>;\n    readonly loginWithPassword: (email: string, password: string) => Call<S.PasswordLoginResponse>;\n    readonly completePasswordMFA: (code: string) => Call<void>;\n    readonly loginWithAPIToken: (token: string) => Call<void>;\n    readonly beginPasskeyLogin: () => Call<S.PasskeyLoginOptions>;\n    readonly finishPasskeyLogin: (credential: PasskeyCredentialJSON) => Call<void>;\n    readonly acceptUserInvitation: (token: string, password: string) => Call<void>;\n    readonly logoutWebSession: () => Call<void>;\n\n    readonly getAuthMe: (\n      selectedTenantId?: string | null,\n      credentials?: ApiCredentials,\n    ) => Call<AuthMeResponse>;\n\n    readonly getSecurityStatus: () => Call<S.SecurityStatus>;\n    readonly setPassword: (currentPassword: string, newPassword: string) => Call<void>;\n    readonly listPasskeys: () => Call<S.Passkeys>;\n    readonly beginPasskeyRegistration: (name: string) => Call<S.PasskeyRegistrationOptions>;\n    readonly finishPasskeyRegistration: (\n      credential: PasskeyCredentialJSON,\n    ) => Call<S.PasskeyMutation>;\n    readonly renamePasskey: (passkeyId: string, name: string) => Call<S.PasskeyMutation>;\n    readonly deletePasskey: (passkeyId: string) => Call<void>;\n    readonly beginTOTPEnrollment: () => Call<S.TOTPEnrollment>;\n    readonly completeTOTPEnrollment: (code: string) => Call<S.RecoveryCodes>;\n    readonly regenerateRecoveryCodes: (code: string) => Call<S.RecoveryCodes>;\n    readonly disableTOTP: (code: string) => Call<void>;\n  }\n>()(\"@aperture-browser/api-client/AuthApi\") {}\n"],"mappings":";;;AAsBA,IAAa,UAAb,cAA6B,QAAQ,QA+BnC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aperture-browser/api-client",
-  "version": "0.0.0-init.0",
+  "version": "0.0.0-nightly.82.2e4f6368108f",
   "description": "Effect services for the Aperture API: sessions, snapshots, tenants, users, tokens, events and authentication.",
   "homepage": "https://github.com/tarik02/aperture#readme",
   "bugs": "https://github.com/tarik02/aperture/issues",
@@ -19,22 +19,32 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./passkeys": {
+      "types": "./dist/passkeys.d.ts",
+      "default": "./dist/passkeys.js"
     }
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@aperture-browser/api-schema": "0.0.0-init.0",
-    "@simplewebauthn/browser": "13.3.0"
+    "@aperture-browser/api-schema": "0.0.0-nightly.82.2e4f6368108f"
   },
   "devDependencies": {
+    "@simplewebauthn/browser": "13.3.0",
     "effect": "4.0.0-rc.117",
     "vite-plus": "0.2.4"
   },
   "peerDependencies": {
+    "@simplewebauthn/browser": "^13.3.0",
     "effect": "^4.0.0-rc.117"
   },
+  "peerDependenciesMeta": {
+    "@simplewebauthn/browser": {
+      "optional": true
+    }
+  },
   "scripts": {
     "build": "vp pack",
     "typecheck": "tsgo --noEmit"