@aperture-browser/api-client 0.0.0-init.0

package/dist/index.d.ts

@@ -0,0 +1,767 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as Api from "@aperture-browser/api-schema";
+import * as Context from "effect/Context";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as HttpClientError from "effect/unstable/http/HttpClientError";
+import { AuthenticationResponseJSON, RegistrationResponseJSON } from "@simplewebauthn/browser";
+
+//#region src/errors.d.ts
+declare const ApiErrorBody: Schema.Struct<{
+  readonly error: Schema.Struct<{
+    readonly code: Schema.String;
+    readonly message: Schema.String;
+  }>;
+}>;
+type ApiErrorBody = typeof ApiErrorBody.Type;
+declare const ApiRequestError_base: Schema.Class<ApiRequestError, Schema.TaggedStruct<"ApiRequestError", {
+  readonly code: Schema.String;
+  readonly message: Schema.String;
+  readonly status: Schema.Number;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A failed API request. `code` and `message` come from the server's error body when it
+ * sent one; `status` is 0 when no HTTP status applies.
+ */
+declare class ApiRequestError extends ApiRequestError_base {}
+/**
+ * Maps HTTP and decoding failures to ApiRequestError. Error responses keep the code and
+ * message of the server's error body.
+ */
+declare const toApiRequestError: <A, R>(self: Effect.Effect<A, HttpClientError.HttpClientError | Schema.SchemaError, R>) => Effect.Effect<A, ApiRequestError, R>;
+//#endregion
+//#region src/authorization/service.d.ts
+declare const TENANT_HEADER = "X-Aperture-Tenant-Id";
+interface CredentialContext {
+  authorityType: "system_admin" | "tenant" | null;
+  tenantId: string | null;
+  selectedTenantId: string | null;
+}
+type ApiCredentials = (CredentialContext & {
+  kind: "bearer";
+  token: string;
+}) | (CredentialContext & {
+  kind: "session";
+});
+/** The browser's own login session, sent as a cookie. */
+declare const webSessionCredentials: ApiCredentials;
+type TenantHeaderMode = "none" | "optional" | "tenant-scoped";
+/** Which tenant, if any, a request acts for under the given credentials. */
+declare function resolveTenantHeader(credentials: ApiCredentials, mode: TenantHeaderMode): string | undefined;
+/** How a request authenticates, and which tenant it acts for. */
+interface Authorization {
+  readonly credentials?: ApiCredentials;
+  readonly bearerToken?: string;
+  readonly tenantHeader?: TenantHeaderMode;
+}
+declare const Authorization: {
+  anonymous: Authorization;
+  webSession: Authorization;
+  of: (credentials: ApiCredentials) => Authorization;
+  tenantScoped: (credentials: ApiCredentials) => Authorization;
+};
+declare const ApiAuthorization_base: Context.ServiceClass<ApiAuthorization, "@aperture-browser/api-client/ApiAuthorization", {
+  /** Runs a call with the given authorization and maps its failures to ApiRequestError. */readonly authorize: (authorization: Authorization) => <A, R>(self: Effect.Effect<A, HttpClientError.HttpClientError | Schema.SchemaError, R>) => Effect.Effect<A, ApiRequestError, R>; /** Emits whenever the web session is found to be missing, expired or revoked. */
+  readonly sessionAuthenticationFailures: Stream.Stream<void>;
+}>;
+/**
+ * Authenticates API calls. Inside `authorize`, every request sent through the HttpClient
+ * that `authorizedHttpClientLayer` provides carries that call's credentials and tenant, so
+ * callers never touch headers.
+ */
+declare class ApiAuthorization extends ApiAuthorization_base {}
+//#endregion
+//#region src/schemas.d.ts
+type PageMeta = Api.PageMeta;
+type Tenant = Api.Tenant;
+type User = Api.User;
+type UserInvitation = Api.UserInvitation;
+type TenantMembership = Api.TenantMembership;
+type AuthMeResponse = Api.AuthMe;
+type AuthMePrincipal = Api.Principal;
+type AuthMeTenant = Api.Tenant;
+type ResourceMode = Api.ResourceMode;
+type ResourceGrant = Api.ResourceGrant;
+type Scope = Api.Scope;
+type TenantScope = Api.TenantScope;
+type Session = Api.Session;
+type SessionMedia = Api.SessionMedia;
+type IceServer = Api.IceServer;
+declare const SessionStatus: import("effect/Schema").Literals<readonly ["creating", "running", "suspended", "deleted", "expired", "failed"]>;
+type SessionStatus = Api.SessionStatus;
+type Snapshot = Api.Snapshot;
+type ApiToken = Api.Token;
+type TenantsPage = Api.TenantPage;
+type UsersPage = Api.UserPage;
+type SessionsPage = Api.SessionPage;
+type SessionsBulkResponse = Api.SessionBulkResponse;
+type SnapshotsPage = Api.SnapshotPage;
+type TokensPage = Api.TokenPage;
+type BrowserChannel = Api.BrowserChannel;
+type BrowserChannelsResponse = Api.BrowserChannels;
+type ResourceEvent = Api.Event;
+type EventsPage = Api.EventPage;
+type CreateSessionResponse = Api.CreateSessionResult;
+type SessionMutationResponse = Api.SessionMutation;
+type SnapshotMutationResponse = Api.SnapshotMutation;
+type PromoteSessionResponse = Api.SnapshotMutation;
+type CreateTokenResponse = Api.CreateTokenResponse;
+//#endregion
+//#region src/auth/schemas.d.ts
+declare const LoginMethods: Schema.Struct<{
+  readonly methods: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"password">;
+  }>, Schema.Struct<{
+    readonly type: Schema.Literal<"api_token">;
+  }>, Schema.Struct<{
+    readonly type: Schema.Literal<"passkey">;
+  }>, Schema.Struct<{
+    readonly type: Schema.Literal<"oidc">;
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly loginUrl: Schema.String;
+  }>]>>;
+}>;
+declare const PasskeyLoginOptions: Schema.Struct<{
+  readonly publicKey: Schema.Struct<{
+    readonly challenge: Schema.String;
+    readonly timeout: Schema.optionalKey<Schema.Number>;
+    readonly rpId: Schema.optionalKey<Schema.String>;
+    readonly allowCredentials: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Struct<{
+      readonly id: Schema.String;
+      readonly type: Schema.Literal<"public-key">;
+      readonly transports: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb"]>>>>;
+    }>>>>;
+    readonly userVerification: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
+    readonly hints: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>>;
+    readonly extensions: Schema.optionalKey<Schema.Struct<{
+      readonly appid: Schema.optionalKey<Schema.String>;
+      readonly credProps: Schema.optionalKey<Schema.Boolean>;
+      readonly hmacCreateSecret: Schema.optionalKey<Schema.Boolean>;
+      readonly minPinLength: Schema.optionalKey<Schema.Boolean>;
+    }>>;
+  }>;
+}>;
+declare const PasskeyRegistrationOptions: Schema.Struct<{
+  readonly publicKey: Schema.Struct<{
+    readonly rp: Schema.Struct<{
+      readonly id: Schema.optionalKey<Schema.String>;
+      readonly name: Schema.String;
+    }>;
+    readonly user: Schema.Struct<{
+      readonly id: Schema.String;
+      readonly name: Schema.String;
+      readonly displayName: Schema.String;
+    }>;
+    readonly challenge: Schema.String;
+    readonly pubKeyCredParams: Schema.mutable<Schema.$Array<Schema.Struct<{
+      readonly alg: Schema.Literals<readonly [-7, -8, -35, -36, -37, -38, -39, -257, -258, -259]>;
+      readonly type: Schema.Literal<"public-key">;
+    }>>>;
+    readonly timeout: Schema.optionalKey<Schema.Number>;
+    readonly excludeCredentials: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Struct<{
+      readonly id: Schema.String;
+      readonly type: Schema.Literal<"public-key">;
+      readonly transports: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb"]>>>>;
+    }>>>>;
+    readonly authenticatorSelection: Schema.optionalKey<Schema.Struct<{
+      readonly authenticatorAttachment: Schema.optionalKey<Schema.Literals<readonly ["platform", "cross-platform"]>>;
+      readonly requireResidentKey: Schema.optionalKey<Schema.Boolean>;
+      readonly residentKey: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
+      readonly userVerification: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
+    }>>;
+    readonly hints: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>>;
+    readonly attestation: Schema.optionalKey<Schema.Literals<readonly ["direct", "enterprise", "indirect", "none"]>>;
+    readonly attestationFormats: Schema.optionalKey<Schema.mutable<Schema.$Array<Schema.Literals<readonly ["fido-u2f", "packed", "android-safetynet", "android-key", "tpm", "apple", "none"]>>>>;
+    readonly extensions: Schema.optionalKey<Schema.Struct<{
+      readonly appid: Schema.optionalKey<Schema.String>;
+      readonly credProps: Schema.optionalKey<Schema.Boolean>;
+      readonly hmacCreateSecret: Schema.optionalKey<Schema.Boolean>;
+      readonly minPinLength: Schema.optionalKey<Schema.Boolean>;
+    }>>;
+  }>;
+}>;
+declare const Passkey: Schema.Struct<{
+  readonly id: Schema.String;
+  readonly name: Schema.String;
+  readonly createdAt: Schema.String;
+  readonly lastUsedAt: Schema.NullOr<Schema.String>;
+}>;
+declare const Passkeys: Schema.Struct<{
+  readonly passkeys: Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly createdAt: Schema.String;
+    readonly lastUsedAt: Schema.NullOr<Schema.String>;
+  }>>;
+}>;
+declare const PasskeyMutation: Schema.Struct<{
+  readonly passkey: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly createdAt: Schema.String;
+    readonly lastUsedAt: Schema.NullOr<Schema.String>;
+  }>;
+}>;
+declare const PasswordLoginResponse: Schema.Struct<{
+  readonly mfaRequired: Schema.Boolean;
+}>;
+declare const SecurityStatus: Schema.Struct<{
+  readonly hasPassword: Schema.Boolean;
+  readonly totpEnabled: Schema.Boolean;
+  readonly recoveryCodesRemaining: Schema.Number;
+}>;
+declare const TOTPEnrollment: Schema.Struct<{
+  readonly secret: Schema.String;
+  readonly otpauthUrl: Schema.String;
+  readonly qrCodeDataUrl: Schema.String;
+}>;
+declare const RecoveryCodes: Schema.Struct<{
+  readonly recoveryCodes: Schema.$Array<Schema.String>;
+}>;
+type LoginMethods = typeof LoginMethods.Type;
+type PasskeyLoginOptions = typeof PasskeyLoginOptions.Type;
+type PasskeyRegistrationOptions = typeof PasskeyRegistrationOptions.Type;
+type Passkey = typeof Passkey.Type;
+type Passkeys = typeof Passkeys.Type;
+type PasskeyMutation = typeof PasskeyMutation.Type;
+type PasswordLoginResponse = typeof PasswordLoginResponse.Type;
+type RecoveryCodes = typeof RecoveryCodes.Type;
+type SecurityStatus = typeof SecurityStatus.Type;
+type TOTPEnrollment = typeof TOTPEnrollment.Type;
+//#endregion
+//#region src/auth/service.d.ts
+type Call$5<A> = Effect.Effect<A, ApiRequestError>;
+declare const AuthApi_base: Context.ServiceClass<AuthApi, "@aperture-browser/api-client/AuthApi", {
+  readonly listLoginMethods: () => Call$5<LoginMethods>;
+  readonly loginWithPassword: (email: string, password: string) => Call$5<PasswordLoginResponse>;
+  readonly completePasswordMFA: (code: string) => Call$5<void>;
+  readonly loginWithAPIToken: (token: string) => Call$5<void>;
+  readonly beginPasskeyLogin: () => Call$5<PasskeyLoginOptions>;
+  readonly finishPasskeyLogin: (credential: AuthenticationResponseJSON) => Call$5<void>;
+  readonly acceptUserInvitation: (token: string, password: string) => Call$5<void>;
+  readonly logoutWebSession: () => Call$5<void>;
+  readonly getAuthMe: (selectedTenantId?: string | null, credentials?: ApiCredentials) => Call$5<AuthMeResponse>;
+  readonly getSecurityStatus: () => Call$5<SecurityStatus>;
+  readonly setPassword: (currentPassword: string, newPassword: string) => Call$5<void>;
+  readonly listPasskeys: () => Call$5<Passkeys>;
+  readonly beginPasskeyRegistration: (name: string) => Call$5<PasskeyRegistrationOptions>;
+  readonly finishPasskeyRegistration: (credential: RegistrationResponseJSON) => Call$5<PasskeyMutation>;
+  readonly renamePasskey: (passkeyId: string, name: string) => Call$5<PasskeyMutation>;
+  readonly deletePasskey: (passkeyId: string) => Call$5<void>;
+  readonly beginTOTPEnrollment: () => Call$5<TOTPEnrollment>;
+  readonly completeTOTPEnrollment: (code: string) => Call$5<RecoveryCodes>;
+  readonly regenerateRecoveryCodes: (code: string) => Call$5<RecoveryCodes>;
+  readonly disableTOTP: (code: string) => Call$5<void>;
+}>;
+/** Browser login, account security, and the current principal. */
+declare class AuthApi extends AuthApi_base {}
+//#endregion
+//#region src/auth/layer.d.ts
+declare const makeAuthApi: Effect.Effect<{
+  readonly listLoginMethods: () => Effect.Effect<{
+    readonly methods: readonly ({
+      readonly type: "password";
+    } | {
+      readonly type: "api_token";
+    } | {
+      readonly type: "passkey";
+    } | {
+      readonly type: "oidc";
+      readonly id: string;
+      readonly name: string;
+      readonly loginUrl: string;
+    })[];
+  }, ApiRequestError, never>;
+  readonly loginWithPassword: (email: string, password: string) => Effect.Effect<{
+    readonly mfaRequired: boolean;
+  }, ApiRequestError, never>;
+  readonly completePasswordMFA: (code: string) => Effect.Effect<void, ApiRequestError, never>;
+  readonly loginWithAPIToken: (token: string) => Effect.Effect<void, ApiRequestError, never>;
+  readonly beginPasskeyLogin: () => Effect.Effect<{
+    readonly publicKey: {
+      readonly challenge: string;
+      readonly timeout?: number | undefined;
+      readonly rpId?: string | undefined;
+      readonly allowCredentials?: {
+        readonly type: "public-key";
+        readonly id: string;
+        readonly transports?: ("ble" | "cable" | "hybrid" | "internal" | "nfc" | "smart-card" | "usb")[] | undefined;
+      }[] | undefined;
+      readonly userVerification?: "required" | "discouraged" | "preferred" | undefined;
+      readonly hints?: ("hybrid" | "security-key" | "client-device")[] | undefined;
+      readonly extensions?: {
+        readonly appid?: string | undefined;
+        readonly credProps?: boolean | undefined;
+        readonly hmacCreateSecret?: boolean | undefined;
+        readonly minPinLength?: boolean | undefined;
+      } | undefined;
+    };
+  }, ApiRequestError, never>;
+  readonly finishPasskeyLogin: (credential: AuthenticationResponseJSON) => Effect.Effect<void, ApiRequestError, never>;
+  readonly acceptUserInvitation: (token: string, password: string) => Effect.Effect<void, ApiRequestError, never>;
+  readonly logoutWebSession: () => Effect.Effect<void, ApiRequestError, never>;
+  readonly getAuthMe: (selectedTenantId?: string | null, credentials?: ApiCredentials) => Effect.Effect<Api.AuthMe, ApiRequestError, never>;
+  readonly getSecurityStatus: () => Effect.Effect<{
+    readonly hasPassword: boolean;
+    readonly totpEnabled: boolean;
+    readonly recoveryCodesRemaining: number;
+  }, ApiRequestError, never>;
+  readonly setPassword: (currentPassword: string, newPassword: string) => Effect.Effect<void, ApiRequestError, never>;
+  readonly listPasskeys: () => Effect.Effect<{
+    readonly passkeys: readonly {
+      readonly id: string;
+      readonly name: string;
+      readonly createdAt: string;
+      readonly lastUsedAt: string | null;
+    }[];
+  }, ApiRequestError, never>;
+  readonly beginPasskeyRegistration: (name: string) => Effect.Effect<{
+    readonly publicKey: {
+      readonly challenge: string;
+      readonly rp: {
+        readonly name: string;
+        readonly id?: string | undefined;
+      };
+      readonly user: {
+        readonly id: string;
+        readonly name: string;
+        readonly displayName: string;
+      };
+      readonly pubKeyCredParams: {
+        readonly alg: -7 | -8 | -35 | -36 | -37 | -38 | -39 | -257 | -258 | -259;
+        readonly type: "public-key";
+      }[];
+      readonly timeout?: number | undefined;
+      readonly hints?: ("hybrid" | "security-key" | "client-device")[] | undefined;
+      readonly extensions?: {
+        readonly appid?: string | undefined;
+        readonly credProps?: boolean | undefined;
+        readonly hmacCreateSecret?: boolean | undefined;
+        readonly minPinLength?: boolean | undefined;
+      } | undefined;
+      readonly excludeCredentials?: {
+        readonly type: "public-key";
+        readonly id: string;
+        readonly transports?: ("ble" | "cable" | "hybrid" | "internal" | "nfc" | "smart-card" | "usb")[] | undefined;
+      }[] | undefined;
+      readonly authenticatorSelection?: {
+        readonly userVerification?: "required" | "discouraged" | "preferred" | undefined;
+        readonly authenticatorAttachment?: "platform" | "cross-platform" | undefined;
+        readonly requireResidentKey?: boolean | undefined;
+        readonly residentKey?: "required" | "discouraged" | "preferred" | undefined;
+      } | undefined;
+      readonly attestation?: "direct" | "enterprise" | "indirect" | "none" | undefined;
+      readonly attestationFormats?: ("none" | "fido-u2f" | "packed" | "android-safetynet" | "android-key" | "tpm" | "apple")[] | undefined;
+    };
+  }, ApiRequestError, never>;
+  readonly finishPasskeyRegistration: (credential: RegistrationResponseJSON) => Effect.Effect<{
+    readonly passkey: {
+      readonly id: string;
+      readonly name: string;
+      readonly createdAt: string;
+      readonly lastUsedAt: string | null;
+    };
+  }, ApiRequestError, never>;
+  readonly renamePasskey: (passkeyId: string, name: string) => Effect.Effect<{
+    readonly passkey: {
+      readonly id: string;
+      readonly name: string;
+      readonly createdAt: string;
+      readonly lastUsedAt: string | null;
+    };
+  }, ApiRequestError, never>;
+  readonly deletePasskey: (passkeyId: string) => Effect.Effect<void, ApiRequestError, never>;
+  readonly beginTOTPEnrollment: () => Effect.Effect<{
+    readonly secret: string;
+    readonly otpauthUrl: string;
+    readonly qrCodeDataUrl: string;
+  }, ApiRequestError, never>;
+  readonly completeTOTPEnrollment: (code: string) => Effect.Effect<{
+    readonly recoveryCodes: readonly string[];
+  }, ApiRequestError, never>;
+  readonly regenerateRecoveryCodes: (code: string) => Effect.Effect<{
+    readonly recoveryCodes: readonly string[];
+  }, ApiRequestError, never>;
+  readonly disableTOTP: (code: string) => Effect.Effect<void, ApiRequestError, never>;
+}, never, HttpClient.HttpClient | ApiAuthorization>;
+declare const authApiLayer: Layer.Layer<AuthApi, never, HttpClient.HttpClient | ApiAuthorization>;
+//#endregion
+//#region src/authorization/layer.d.ts
+/**
+ * Decorates the HttpClient so each request carries the authorization of the `authorize`
+ * call it runs in.
+ */
+declare const authorizedHttpClientLayer: Layer.Layer<HttpClient.HttpClient, never, HttpClient.HttpClient>;
+declare const makeApiAuthorization: Effect.Effect<{
+  readonly authorize: (authorization: Authorization) => <A, R>(self: Effect.Effect<A, HttpClientError.HttpClientError | Schema.SchemaError, R>) => Effect.Effect<A, ApiRequestError, R>;
+  readonly sessionAuthenticationFailures: Stream.Stream<void>;
+}, never, never>;
+declare const apiAuthorizationLayer: Layer.Layer<ApiAuthorization, never, never>;
+//#endregion
+//#region src/events/service.d.ts
+interface EventsListParams {
+  limit?: number;
+  cursor?: string;
+  resourceType?: string;
+  resourceId?: string;
+}
+declare const EventsApi_base: Context.ServiceClass<EventsApi, "@aperture-browser/api-client/EventsApi", {
+  readonly listEvents: (credentials: ApiCredentials, params?: EventsListParams) => Effect.Effect<EventsPage, ApiRequestError>;
+}>;
+/** The tenant's resource event log. */
+declare class EventsApi extends EventsApi_base {}
+//#endregion
+//#region src/events/layer.d.ts
+declare const makeEventsApi: Effect.Effect<{
+  readonly listEvents: (credentials: ApiCredentials, params?: EventsListParams) => Effect.Effect<EventsPage, ApiRequestError>;
+}, never, HttpClient.HttpClient | ApiAuthorization>;
+declare const eventsApiLayer: Layer.Layer<EventsApi, never, HttpClient.HttpClient | ApiAuthorization>;
+//#endregion
+//#region src/layer.d.ts
+/**
+ * Every API service, sharing one ApiAuthorization. The services send requests through the
+ * HttpClient the app provides, decorated with each call's authorization.
+ */
+declare const apiClientLayer: Layer.Layer<AuthApi | ApiAuthorization | EventsApi | TenantsApi | UsersApi | SessionsApi | SnapshotsApi | TokensApi, never, HttpClient.HttpClient>;
+type ApiServices = Layer.Success<typeof apiClientLayer>;
+declare const baseUrlLayer: (baseUrl: string) => Layer.Layer<HttpClient.HttpClient, never, HttpClient.HttpClient>;
+//#endregion
+//#region src/pagination.d.ts
+interface PaginatedResponse<T> {
+  readonly data: ReadonlyArray<T>;
+  readonly meta: PageMeta;
+}
+interface ListQueryParams {
+  limit?: number;
+  cursor?: string;
+}
+declare function getNextPageParam<T>(page: PaginatedResponse<T>): string | undefined;
+declare function flattenInfinitePages<T>(pages: PaginatedResponse<T>[] | undefined): T[];
+declare const defaultListLimit = 50;
+declare const listQueryDefaults: {
+  readonly refetchOnWindowFocus: true;
+};
+//#endregion
+//#region src/query.d.ts
+type TagFilterValue = Array<{
+  key: string;
+  operator: "eq" | "neq" | "in" | "not_in";
+  values: string[];
+}>;
+/** Encodes tag filters as the parallel tagKey, tagOperator and tagValue query lists. */
+declare const tagQuery: (tags: TagFilterValue | undefined) => {
+  tagKey: string[] | undefined;
+  tagOperator: ("eq" | "neq" | "in" | "not_in")[] | undefined;
+  tagValue: string[] | undefined;
+};
+/** Drops empty strings and empty list items, which mean "no filter". */
+declare const compactQuery: <T extends object>(query: T) => T;
+//#endregion
+//#region src/sessions/schemas.d.ts
+declare const BrowserStatus: Schema.Struct<{
+  readonly sessionId: Schema.String;
+  readonly cdpUrl: Schema.String;
+  readonly media: Schema.Struct<{
+    readonly mode: Schema.Literals<readonly ["auto", "cdp"]>;
+    readonly webrtcProducer: Schema.Boolean;
+    readonly iceServers: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+      readonly urls: Schema.$Array<Schema.String>;
+      readonly username: Schema.optionalKey<Schema.String>;
+      readonly credential: Schema.optionalKey<Schema.String>;
+    }>>>;
+  }>;
+  readonly targets: Schema.withDecodingDefaultKey<Schema.$Array<Schema.Struct<{
+    readonly targetId: Schema.String;
+    readonly generation: Schema.Number;
+    readonly state: Schema.Literals<readonly ["pending", "ready", "unavailable", "closed"]>;
+    readonly title: Schema.String;
+    readonly url: Schema.String;
+    readonly viewport: Schema.Struct<{
+      readonly width: Schema.Number;
+      readonly height: Schema.Number;
+      readonly deviceScaleFactor: Schema.Number;
+      readonly contentWidth: Schema.Number;
+      readonly contentHeight: Schema.Number;
+      readonly canvasWidth: Schema.Number;
+      readonly canvasHeight: Schema.Number;
+    }>;
+  }>>, never>;
+}>;
+/** A recording as the live session reports it. */
+declare const Recording: Schema.Struct<{
+  readonly recordingId: Schema.String;
+  readonly mode: Schema.Literals<readonly ["tab", "viewer"]>;
+  readonly targetId: Schema.String;
+  readonly captureGeneration: Schema.Number;
+  readonly status: Schema.Literals<readonly ["starting", "running", "stopped", "failed"]>;
+  readonly stopReason: Schema.optionalKey<Schema.String>;
+  readonly path: Schema.String;
+  readonly startedAt: Schema.String;
+  readonly stoppedAt: Schema.optionalKey<Schema.String>;
+  readonly sizeBytes: Schema.optionalKey<Schema.Number>;
+  readonly fps: Schema.Number;
+  readonly bitrateKbps: Schema.Number;
+  readonly codec: Schema.String;
+}>;
+type BrowserStatus = typeof BrowserStatus.Type;
+type Recording = typeof Recording.Type;
+//#endregion
+//#region src/sessions/service.d.ts
+type Call$4<A> = Effect.Effect<A, ApiRequestError>;
+interface SessionsListParams {
+  limit?: number;
+  cursor?: string;
+  includeDeleted?: boolean;
+  status?: Api.SessionStatus;
+  tags?: TagFilterValue;
+}
+type InitialBrowserTarget = Api.InitialBrowserTarget;
+type InitialBrowserStorageState = Api.InitialBrowserStorageState;
+interface CreateSessionInput {
+  baseSnapshotName?: string | null;
+  label?: string | null;
+  browser: {
+    channel: string;
+    args?: string[];
+  };
+  initialTargets?: readonly InitialBrowserTarget[];
+  storageState?: InitialBrowserStorageState;
+  tags?: Record<string, string>;
+}
+interface CreateSessionOptions {
+  waitForReady?: boolean;
+}
+interface PromoteSessionInput {
+  name: string;
+  description?: string | null;
+  force?: boolean;
+  tags?: Record<string, string>;
+}
+interface DownloadedFile {
+  blob: Blob;
+  filename: string | null;
+}
+declare const SessionsApi_base: Context.ServiceClass<SessionsApi, "@aperture-browser/api-client/SessionsApi", {
+  readonly listSessions: (credentials: ApiCredentials, params?: SessionsListParams) => Call$4<SessionsPage>;
+  readonly getSession: (credentials: ApiCredentials, sessionId: string) => Call$4<Session>;
+  readonly getSessionsBulk: (credentials: ApiCredentials, sessionIds: readonly string[]) => Call$4<SessionsBulkResponse>;
+  readonly createSession: (credentials: ApiCredentials, input: CreateSessionInput, options?: CreateSessionOptions) => Call$4<CreateSessionResponse>;
+  readonly deleteSession: (credentials: ApiCredentials, sessionId: string) => Call$4<SessionMutationResponse>;
+  readonly reopenSession: (credentials: ApiCredentials, sessionId: string) => Call$4<SessionMutationResponse>;
+  readonly suspendSession: (credentials: ApiCredentials, sessionId: string) => Call$4<SessionMutationResponse>;
+  readonly rotateSessionToken: (credentials: ApiCredentials, sessionId: string) => Call$4<SessionMutationResponse>;
+  readonly rotateCollaborationCapability: (credentials: ApiCredentials, sessionId: string, role: "editor" | "viewer") => Call$4<SessionMutationResponse>;
+  readonly replaceSessionTags: (credentials: ApiCredentials, sessionId: string, tags: Record<string, string>) => Call$4<SessionMutationResponse>;
+  readonly promoteSession: (credentials: ApiCredentials, sessionId: string, input: PromoteSessionInput) => Call$4<PromoteSessionResponse>;
+  readonly getBrowserChannels: (credentials: ApiCredentials) => Call$4<BrowserChannelsResponse>;
+  readonly getBrowserStatus: (credentials: ApiCredentials, sessionId: string, sessionToken?: string) => Call$4<BrowserStatus>;
+  readonly downloadSessionRecording: (credentials: ApiCredentials, sessionId: string, recordingId: string, sessionToken?: string) => Call$4<DownloadedFile>;
+}>;
+/** Browser sessions, their live browser, and their recordings. */
+declare class SessionsApi extends SessionsApi_base {}
+//#endregion
+//#region src/sessions/layer.d.ts
+declare const makeSessionsApi: Effect.Effect<{
+  readonly listSessions: (credentials: ApiCredentials, params?: SessionsListParams) => Effect.Effect<Api.SessionPage, ApiRequestError, never>;
+  readonly getSession: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<Api.Session, ApiRequestError, never>;
+  readonly getSessionsBulk: (credentials: ApiCredentials, sessionIds: readonly string[]) => Effect.Effect<Api.SessionBulkResponse, ApiRequestError, never>;
+  readonly createSession: (credentials: ApiCredentials, input: CreateSessionInput, options?: CreateSessionOptions) => Effect.Effect<Api.CreateSessionResult, ApiRequestError, never>;
+  readonly deleteSession: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
+  readonly reopenSession: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
+  readonly suspendSession: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
+  readonly rotateSessionToken: (credentials: ApiCredentials, sessionId: string) => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
+  readonly rotateCollaborationCapability: (credentials: ApiCredentials, sessionId: string, role: "editor" | "viewer") => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
+  readonly replaceSessionTags: (credentials: ApiCredentials, sessionId: string, tags: Record<string, string>) => Effect.Effect<Api.SessionMutation, ApiRequestError, never>;
+  readonly promoteSession: (credentials: ApiCredentials, sessionId: string, input: PromoteSessionInput) => Effect.Effect<Api.SnapshotMutation, ApiRequestError, never>;
+  readonly getBrowserChannels: (credentials: ApiCredentials) => Effect.Effect<Api.BrowserChannels, ApiRequestError, never>;
+  readonly getBrowserStatus: (credentials: ApiCredentials, sessionId: string, sessionToken?: string) => Effect.Effect<{
+    readonly sessionId: string;
+    readonly cdpUrl: string;
+    readonly media: {
+      readonly mode: "auto" | "cdp";
+      readonly webrtcProducer: boolean;
+      readonly iceServers?: readonly {
+        readonly urls: readonly string[];
+        readonly username?: string | undefined;
+        readonly credential?: string | undefined;
+      }[] | undefined;
+    };
+    readonly targets: readonly {
+      readonly targetId: string;
+      readonly generation: number;
+      readonly state: "pending" | "ready" | "unavailable" | "closed";
+      readonly title: string;
+      readonly url: string;
+      readonly viewport: {
+        readonly width: number;
+        readonly height: number;
+        readonly deviceScaleFactor: number;
+        readonly contentWidth: number;
+        readonly contentHeight: number;
+        readonly canvasWidth: number;
+        readonly canvasHeight: number;
+      };
+    }[];
+  }, ApiRequestError, never>;
+  readonly downloadSessionRecording: (credentials: ApiCredentials, sessionId: string, recordingId: string, sessionToken?: string) => Effect.Effect<DownloadedFile, ApiRequestError, never>;
+}, never, HttpClient.HttpClient | ApiAuthorization>;
+declare const sessionsApiLayer: Layer.Layer<SessionsApi, never, HttpClient.HttpClient | ApiAuthorization>;
+//#endregion
+//#region src/snapshots/service.d.ts
+type Call$3<A> = Effect.Effect<A, ApiRequestError>;
+interface SnapshotsListParams {
+  limit?: number;
+  cursor?: string;
+  includeDeleted?: boolean;
+  deleted?: "active" | "deleted" | "all";
+  name?: string;
+  tags?: TagFilterValue;
+}
+interface UpdateSnapshotInput {
+  description: string | null;
+}
+declare const SnapshotsApi_base: Context.ServiceClass<SnapshotsApi, "@aperture-browser/api-client/SnapshotsApi", {
+  readonly listSnapshots: (credentials: ApiCredentials, params?: SnapshotsListParams) => Call$3<SnapshotsPage>;
+  readonly updateSnapshot: (credentials: ApiCredentials, name: string, input: UpdateSnapshotInput) => Call$3<SnapshotMutationResponse>;
+  readonly replaceSnapshotTags: (credentials: ApiCredentials, name: string, tags: Record<string, string>) => Call$3<SnapshotMutationResponse>;
+  readonly deleteSnapshot: (credentials: ApiCredentials, name: string) => Call$3<SnapshotMutationResponse>;
+  readonly restoreSnapshot: (credentials: ApiCredentials, name: string) => Call$3<SnapshotMutationResponse>;
+}>;
+/** Retained snapshots that new sessions start from. */
+declare class SnapshotsApi extends SnapshotsApi_base {}
+//#endregion
+//#region src/snapshots/layer.d.ts
+declare const makeSnapshotsApi: Effect.Effect<{
+  readonly listSnapshots: (credentials: ApiCredentials, params?: SnapshotsListParams) => Effect.Effect<Api.SnapshotPage, ApiRequestError, never>;
+  readonly updateSnapshot: (credentials: ApiCredentials, name: string, input: UpdateSnapshotInput) => Effect.Effect<Api.SnapshotMutation, ApiRequestError, never>;
+  readonly replaceSnapshotTags: (credentials: ApiCredentials, name: string, tags: Record<string, string>) => Effect.Effect<Api.SnapshotMutation, ApiRequestError, never>;
+  readonly deleteSnapshot: (credentials: ApiCredentials, name: string) => Effect.Effect<Api.SnapshotMutation, ApiRequestError, never>;
+  readonly restoreSnapshot: (credentials: ApiCredentials, name: string) => Effect.Effect<Api.SnapshotMutation, ApiRequestError, never>;
+}, never, HttpClient.HttpClient | ApiAuthorization>;
+declare const snapshotsApiLayer: Layer.Layer<SnapshotsApi, never, HttpClient.HttpClient | ApiAuthorization>;
+//#endregion
+//#region src/tenants/service.d.ts
+type Call$2<A> = Effect.Effect<A, ApiRequestError>;
+interface TenantsListParams {
+  limit?: number;
+  cursor?: string;
+  includeDeleted?: boolean;
+  deleted?: "active" | "deleted" | "all";
+}
+declare const TenantsApi_base: Context.ServiceClass<TenantsApi, "@aperture-browser/api-client/TenantsApi", {
+  readonly listTenants: (credentials: ApiCredentials, params?: TenantsListParams) => Call$2<TenantsPage>;
+  readonly createTenant: (credentials: ApiCredentials, input: Api.TenantInput) => Call$2<Tenant>;
+  readonly updateTenant: (credentials: ApiCredentials, tenantId: string, input: Api.TenantInput) => Call$2<Tenant>;
+  readonly deleteTenant: (credentials: ApiCredentials, tenantId: string) => Call$2<Tenant>;
+  readonly restoreTenant: (credentials: ApiCredentials, tenantId: string) => Call$2<Tenant>;
+}>;
+/** Tenant administration. */
+declare class TenantsApi extends TenantsApi_base {}
+//#endregion
+//#region src/tenants/layer.d.ts
+declare const makeTenantsApi: Effect.Effect<{
+  readonly listTenants: (credentials: ApiCredentials, params?: TenantsListParams) => Effect.Effect<Api.TenantPage, ApiRequestError, never>;
+  readonly createTenant: (credentials: ApiCredentials, input: Api.TenantInput) => Effect.Effect<Api.Tenant, ApiRequestError, never>;
+  readonly updateTenant: (credentials: ApiCredentials, tenantId: string, input: Api.TenantInput) => Effect.Effect<Api.Tenant, ApiRequestError, never>;
+  readonly deleteTenant: (credentials: ApiCredentials, tenantId: string) => Effect.Effect<Api.Tenant, ApiRequestError, never>;
+  readonly restoreTenant: (credentials: ApiCredentials, tenantId: string) => Effect.Effect<Api.Tenant, ApiRequestError, never>;
+}, never, HttpClient.HttpClient | ApiAuthorization>;
+declare const tenantsApiLayer: Layer.Layer<TenantsApi, never, HttpClient.HttpClient | ApiAuthorization>;
+//#endregion
+//#region src/tokens/service.d.ts
+type Call$1<A> = Effect.Effect<A, ApiRequestError>;
+interface TokensListParams {
+  limit?: number;
+  cursor?: string;
+  tenantId?: string;
+  name?: string;
+  authorityType?: "system_admin" | "tenant";
+  revoked?: "all" | "active" | "revoked";
+  scope?: string;
+}
+interface CreateAdminTokenInput {
+  name: string;
+  authorityType: "system_admin" | "tenant";
+  tenantId?: string | null;
+  scopes: string[];
+  resourceMode: ResourceMode;
+  resourceGrants: ResourceGrant[];
+  expiresAt?: string | null;
+}
+interface CreateTenantTokenInput {
+  name: string;
+  scopes: string[];
+  resourceMode: ResourceMode;
+  resourceGrants: ResourceGrant[];
+  expiresAt?: string | null;
+}
+declare const TokensApi_base: Context.ServiceClass<TokensApi, "@aperture-browser/api-client/TokensApi", {
+  readonly listAdminTokens: (credentials: ApiCredentials, params?: TokensListParams) => Call$1<TokensPage>;
+  readonly createAdminToken: (credentials: ApiCredentials, input: CreateAdminTokenInput) => Call$1<CreateTokenResponse>;
+  readonly revokeAdminToken: (credentials: ApiCredentials, tokenId: string) => Call$1<void>;
+  readonly listTenantTokens: (credentials: ApiCredentials, params?: TokensListParams) => Call$1<TokensPage>;
+  readonly createTenantToken: (credentials: ApiCredentials, input: CreateTenantTokenInput) => Call$1<CreateTokenResponse>;
+  readonly revokeTenantToken: (credentials: ApiCredentials, tokenId: string) => Call$1<void>;
+}>;
+/** API tokens, issued either deployment-wide or within the current tenant. */
+declare class TokensApi extends TokensApi_base {}
+//#endregion
+//#region src/tokens/layer.d.ts
+declare const makeTokensApi: Effect.Effect<{
+  readonly listAdminTokens: (credentials: ApiCredentials, params?: TokensListParams) => Effect.Effect<Api.TokenPage, ApiRequestError, never>;
+  readonly createAdminToken: (credentials: ApiCredentials, input: CreateAdminTokenInput) => Effect.Effect<Api.CreateTokenResponse, ApiRequestError, never>;
+  readonly revokeAdminToken: (credentials: ApiCredentials, tokenId: string) => Effect.Effect<void, ApiRequestError, never>;
+  readonly listTenantTokens: (credentials: ApiCredentials, params?: TokensListParams) => Effect.Effect<Api.TokenPage, ApiRequestError, never>;
+  readonly createTenantToken: (credentials: ApiCredentials, input: CreateTenantTokenInput) => Effect.Effect<Api.CreateTokenResponse, ApiRequestError, never>;
+  readonly revokeTenantToken: (credentials: ApiCredentials, tokenId: string) => Effect.Effect<void, ApiRequestError, never>;
+}, never, HttpClient.HttpClient | ApiAuthorization>;
+declare const tokensApiLayer: Layer.Layer<TokensApi, never, HttpClient.HttpClient | ApiAuthorization>;
+//#endregion
+//#region src/users/service.d.ts
+type Call<A> = Effect.Effect<A, ApiRequestError>;
+interface UsersListParams {
+  limit?: number;
+  cursor?: string;
+  query?: string;
+  disabled?: "active" | "disabled" | "all";
+}
+interface UserInput {
+  email: string | null;
+  displayName: string;
+  isSystemAdmin: boolean;
+}
+declare const UsersApi_base: Context.ServiceClass<UsersApi, "@aperture-browser/api-client/UsersApi", {
+  readonly listUsers: (credentials: ApiCredentials, params?: UsersListParams) => Call<UsersPage>;
+  readonly createUser: (credentials: ApiCredentials, input: UserInput) => Call<User>;
+  readonly getUser: (credentials: ApiCredentials, userId: string) => Call<User>;
+  readonly updateUser: (credentials: ApiCredentials, userId: string, input: UserInput) => Call<User>;
+  readonly createUserInvitation: (credentials: ApiCredentials, userId: string) => Call<UserInvitation>;
+  readonly disableUser: (credentials: ApiCredentials, userId: string) => Call<User>;
+  readonly restoreUser: (credentials: ApiCredentials, userId: string) => Call<User>;
+  readonly listUserMemberships: (credentials: ApiCredentials, userId: string) => Call<ReadonlyArray<TenantMembership>>;
+  readonly upsertTenantMembership: (credentials: ApiCredentials, tenantId: string, userId: string, scopes: readonly string[]) => Call<TenantMembership>;
+  readonly deleteTenantMembership: (credentials: ApiCredentials, tenantId: string, userId: string) => Call<void>;
+}>;
+/** User administration and tenant memberships. */
+declare class UsersApi extends UsersApi_base {}
+//#endregion
+//#region src/users/layer.d.ts
+declare const makeUsersApi: Effect.Effect<{
+  readonly listUsers: (credentials: ApiCredentials, params?: UsersListParams) => Effect.Effect<Api.UserPage, ApiRequestError, never>;
+  readonly createUser: (credentials: ApiCredentials, input: UserInput) => Effect.Effect<Api.User, ApiRequestError, never>;
+  readonly getUser: (credentials: ApiCredentials, userId: string) => Effect.Effect<Api.User, ApiRequestError, never>;
+  readonly updateUser: (credentials: ApiCredentials, userId: string, input: UserInput) => Effect.Effect<Api.User, ApiRequestError, never>;
+  readonly createUserInvitation: (credentials: ApiCredentials, userId: string) => Effect.Effect<Api.UserInvitation, ApiRequestError, never>;
+  readonly disableUser: (credentials: ApiCredentials, userId: string) => Effect.Effect<Api.User, ApiRequestError, never>;
+  readonly restoreUser: (credentials: ApiCredentials, userId: string) => Effect.Effect<Api.User, ApiRequestError, never>;
+  readonly listUserMemberships: (credentials: ApiCredentials, userId: string) => Effect.Effect<readonly Api.TenantMembership[], ApiRequestError, never>;
+  readonly upsertTenantMembership: (credentials: ApiCredentials, tenantId: string, userId: string, scopes: readonly string[]) => Effect.Effect<Api.TenantMembership, ApiRequestError, never>;
+  readonly deleteTenantMembership: (credentials: ApiCredentials, tenantId: string, userId: string) => Effect.Effect<void, ApiRequestError, never>;
+}, never, HttpClient.HttpClient | ApiAuthorization>;
+declare const usersApiLayer: Layer.Layer<UsersApi, never, HttpClient.HttpClient | ApiAuthorization>;
+//#endregion
+export { ApiAuthorization, ApiCredentials, ApiErrorBody, ApiRequestError, ApiServices, ApiToken, AuthApi, AuthMePrincipal, AuthMeResponse, AuthMeTenant, Authorization, BrowserChannel, BrowserChannelsResponse, BrowserStatus, CreateAdminTokenInput, CreateSessionInput, CreateSessionOptions, CreateSessionResponse, CreateTenantTokenInput, CreateTokenResponse, DownloadedFile, EventsApi, EventsListParams, EventsPage, IceServer, InitialBrowserStorageState, InitialBrowserTarget, ListQueryParams, LoginMethods, PageMeta, PaginatedResponse, Passkey, PasskeyLoginOptions, PasskeyMutation, PasskeyRegistrationOptions, Passkeys, PasswordLoginResponse, PromoteSessionInput, PromoteSessionResponse, Recording, RecoveryCodes, ResourceEvent, ResourceGrant, ResourceMode, Scope, SecurityStatus, Session, SessionMedia, SessionMutationResponse, SessionStatus, SessionsApi, SessionsBulkResponse, SessionsListParams, SessionsPage, Snapshot, SnapshotMutationResponse, SnapshotsApi, SnapshotsListParams, SnapshotsPage, TENANT_HEADER, TOTPEnrollment, TagFilterValue, Tenant, TenantHeaderMode, TenantMembership, TenantScope, TenantsApi, TenantsListParams, TenantsPage, TokensApi, TokensListParams, TokensPage, UpdateSnapshotInput, User, UserInput, UserInvitation, UsersApi, UsersListParams, UsersPage, apiAuthorizationLayer, apiClientLayer, authApiLayer, authorizedHttpClientLayer, baseUrlLayer, compactQuery, defaultListLimit, eventsApiLayer, flattenInfinitePages, getNextPageParam, listQueryDefaults, makeApiAuthorization, makeAuthApi, makeEventsApi, makeSessionsApi, makeSnapshotsApi, makeTenantsApi, makeTokensApi, makeUsersApi, resolveTenantHeader, sessionsApiLayer, snapshotsApiLayer, tagQuery, tenantsApiLayer, toApiRequestError, tokensApiLayer, usersApiLayer, webSessionCredentials };
+//# sourceMappingURL=index.d.ts.map