@aperture-browser/api-client 0.0.0-init.0

package/dist/index.js

@@ -0,0 +1,787 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as HttpBody from "effect/unstable/http/HttpBody";
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
+import * as Api from "@aperture-browser/api-schema";
+import * as Context from "effect/Context";
+import * as Schema from "effect/Schema";
+import * as PubSub from "effect/PubSub";
+import * as Stream from "effect/Stream";
+import * as Function from "effect/Function";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+//#region src/authorization/service.ts
+const TENANT_HEADER = "X-Aperture-Tenant-Id";
+/** The browser's own login session, sent as a cookie. */
+const webSessionCredentials = {
+	kind: "session",
+	authorityType: null,
+	tenantId: null,
+	selectedTenantId: null
+};
+/** Which tenant, if any, a request acts for under the given credentials. */
+function resolveTenantHeader(credentials, mode) {
+	if (mode === "none") return;
+	if (mode === "optional") return credentials.selectedTenantId ?? void 0;
+	if (credentials.authorityType === "tenant") {
+		if (credentials.kind === "bearer") return;
+		return credentials.tenantId ?? void 0;
+	}
+	if (credentials.authorityType === "system_admin") return credentials.selectedTenantId ?? void 0;
+}
+const Authorization = {
+	anonymous: {},
+	webSession: { credentials: webSessionCredentials },
+	of: (credentials) => ({ credentials }),
+	tenantScoped: (credentials) => ({
+		credentials,
+		tenantHeader: "tenant-scoped"
+	})
+};
+/**
+* Authenticates API calls. Inside `authorize`, every request sent through the HttpClient
+* that `authorizedHttpClientLayer` provides carries that call's credentials and tenant, so
+* callers never touch headers.
+*/
+var ApiAuthorization = class extends Context.Service()("@aperture-browser/api-client/ApiAuthorization") {};
+//#endregion
+//#region src/auth/schemas.ts
+const passkeyAuthenticatorTransport = Schema.Literals([
+	"ble",
+	"cable",
+	"hybrid",
+	"internal",
+	"nfc",
+	"smart-card",
+	"usb"
+]);
+const passkeyCredentialDescriptor = Schema.Struct({
+	id: Schema.String,
+	type: Schema.Literal("public-key"),
+	transports: Schema.optionalKey(Schema.mutable(Schema.Array(passkeyAuthenticatorTransport)))
+});
+const passkeyExtensions = Schema.optionalKey(Schema.Struct({
+	appid: Schema.optionalKey(Schema.String),
+	credProps: Schema.optionalKey(Schema.Boolean),
+	hmacCreateSecret: Schema.optionalKey(Schema.Boolean),
+	minPinLength: Schema.optionalKey(Schema.Boolean)
+}));
+const passkeyHint = Schema.Literals([
+	"hybrid",
+	"security-key",
+	"client-device"
+]);
+const passkeyUserVerification = Schema.Literals([
+	"discouraged",
+	"preferred",
+	"required"
+]);
+const LoginMethods = Schema.Struct({ methods: Schema.Array(Schema.Union([
+	Schema.Struct({ type: Schema.Literal("password") }),
+	Schema.Struct({ type: Schema.Literal("api_token") }),
+	Schema.Struct({ type: Schema.Literal("passkey") }),
+	Schema.Struct({
+		type: Schema.Literal("oidc"),
+		id: Schema.String,
+		name: Schema.String,
+		loginUrl: Schema.String
+	})
+])) });
+const PasskeyLoginOptions = Schema.Struct({ publicKey: Schema.Struct({
+	challenge: Schema.String,
+	timeout: Schema.optionalKey(Schema.Number),
+	rpId: Schema.optionalKey(Schema.String),
+	allowCredentials: Schema.optionalKey(Schema.mutable(Schema.Array(passkeyCredentialDescriptor))),
+	userVerification: Schema.optionalKey(passkeyUserVerification),
+	hints: Schema.optionalKey(Schema.mutable(Schema.Array(passkeyHint))),
+	extensions: passkeyExtensions
+}) });
+const PasskeyRegistrationOptions = Schema.Struct({ publicKey: Schema.Struct({
+	rp: Schema.Struct({
+		id: Schema.optionalKey(Schema.String),
+		name: Schema.String
+	}),
+	user: Schema.Struct({
+		id: Schema.String,
+		name: Schema.String,
+		displayName: Schema.String
+	}),
+	challenge: Schema.String,
+	pubKeyCredParams: Schema.mutable(Schema.Array(Schema.Struct({
+		alg: Schema.Literals([
+			-7,
+			-8,
+			-35,
+			-36,
+			-37,
+			-38,
+			-39,
+			-257,
+			-258,
+			-259
+		]),
+		type: Schema.Literal("public-key")
+	}))),
+	timeout: Schema.optionalKey(Schema.Number),
+	excludeCredentials: Schema.optionalKey(Schema.mutable(Schema.Array(passkeyCredentialDescriptor))),
+	authenticatorSelection: Schema.optionalKey(Schema.Struct({
+		authenticatorAttachment: Schema.optionalKey(Schema.Literals(["platform", "cross-platform"])),
+		requireResidentKey: Schema.optionalKey(Schema.Boolean),
+		residentKey: Schema.optionalKey(Schema.Literals([
+			"discouraged",
+			"preferred",
+			"required"
+		])),
+		userVerification: Schema.optionalKey(passkeyUserVerification)
+	})),
+	hints: Schema.optionalKey(Schema.mutable(Schema.Array(passkeyHint))),
+	attestation: Schema.optionalKey(Schema.Literals([
+		"direct",
+		"enterprise",
+		"indirect",
+		"none"
+	])),
+	attestationFormats: Schema.optionalKey(Schema.mutable(Schema.Array(Schema.Literals([
+		"fido-u2f",
+		"packed",
+		"android-safetynet",
+		"android-key",
+		"tpm",
+		"apple",
+		"none"
+	])))),
+	extensions: passkeyExtensions
+}) });
+const Passkey = Schema.Struct({
+	id: Schema.String,
+	name: Schema.String,
+	createdAt: Schema.String,
+	lastUsedAt: Schema.NullOr(Schema.String)
+});
+const Passkeys = Schema.Struct({ passkeys: Schema.Array(Passkey) });
+const PasskeyMutation = Schema.Struct({ passkey: Passkey });
+const PasswordLoginResponse = Schema.Struct({ mfaRequired: Schema.Boolean });
+const SecurityStatus = Schema.Struct({
+	hasPassword: Schema.Boolean,
+	totpEnabled: Schema.Boolean,
+	recoveryCodesRemaining: Schema.Number.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(0))
+});
+const TOTPEnrollment = Schema.Struct({
+	secret: Schema.String,
+	otpauthUrl: Schema.String,
+	qrCodeDataUrl: Schema.String
+});
+const RecoveryCodes = Schema.Struct({ recoveryCodes: Schema.Array(Schema.String) });
+//#endregion
+//#region src/auth/service.ts
+/** Browser login, account security, and the current principal. */
+var AuthApi = class extends Context.Service()("@aperture-browser/api-client/AuthApi") {};
+//#endregion
+//#region src/auth/layer.ts
+const jsonBody = (body) => ({ body: HttpBody.jsonUnsafe(body) });
+const makeAuthApi = Effect.gen(function* () {
+	const httpClient = yield* HttpClient.HttpClient;
+	const { authorize } = yield* ApiAuthorization;
+	const http = HttpClient.filterStatusOk(httpClient);
+	const api = Api.make(httpClient);
+	const anonymous = authorize(Authorization.anonymous);
+	const webSession = authorize(Authorization.webSession);
+	const listLoginMethods = Effect.fn("AuthApi.listLoginMethods")(function* () {
+		return yield* http.get("/auth/login-methods").pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(LoginMethods)), anonymous);
+	});
+	const loginWithPassword = Effect.fn("AuthApi.loginWithPassword")(function* (email, password) {
+		return yield* http.post("/auth/password/login", jsonBody({
+			email,
+			password
+		})).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(PasswordLoginResponse)), anonymous);
+	});
+	const completePasswordMFA = Effect.fn("AuthApi.completePasswordMFA")(function* (code) {
+		yield* http.post("/auth/password/login/mfa", jsonBody({ code })).pipe(anonymous);
+	});
+	const loginWithAPIToken = Effect.fn("AuthApi.loginWithAPIToken")(function* (token) {
+		yield* http.post("/auth/token/login", jsonBody({ token })).pipe(anonymous);
+	});
+	const beginPasskeyLogin = Effect.fn("AuthApi.beginPasskeyLogin")(function* () {
+		return yield* http.post("/auth/passkeys/login/options").pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(PasskeyLoginOptions)), anonymous);
+	});
+	const finishPasskeyLogin = Effect.fn("AuthApi.finishPasskeyLogin")(function* (credential) {
+		yield* http.post("/auth/passkeys/login/finish", jsonBody(credential)).pipe(anonymous);
+	});
+	const acceptUserInvitation = Effect.fn("AuthApi.acceptUserInvitation")(function* (token, password) {
+		yield* http.post("/auth/invitations/accept", jsonBody({
+			token,
+			password
+		})).pipe(anonymous);
+	});
+	const logoutWebSession = Effect.fn("AuthApi.logoutWebSession")(function* () {
+		yield* http.post("/auth/logout").pipe(webSession);
+	});
+	const getAuthMe = Effect.fn("AuthApi.getAuthMe")(function* (selectedTenantId = null, credentials = webSessionCredentials) {
+		return yield* api.getCurrentPrincipal(void 0).pipe(authorize({
+			credentials: {
+				...credentials,
+				selectedTenantId
+			},
+			tenantHeader: "optional"
+		}));
+	});
+	const getSecurityStatus = Effect.fn("AuthApi.getSecurityStatus")(function* () {
+		return yield* http.get("/auth/security").pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(SecurityStatus)), webSession);
+	});
+	const setPassword = Effect.fn("AuthApi.setPassword")(function* (currentPassword, newPassword) {
+		yield* http.put("/auth/password", jsonBody({
+			currentPassword,
+			newPassword
+		})).pipe(webSession);
+	});
+	const listPasskeys = Effect.fn("AuthApi.listPasskeys")(function* () {
+		return yield* http.get("/auth/passkeys").pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(Passkeys)), webSession);
+	});
+	const beginPasskeyRegistration = Effect.fn("AuthApi.beginPasskeyRegistration")(function* (name) {
+		return yield* http.post("/auth/passkeys/registration/options", jsonBody({ name })).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(PasskeyRegistrationOptions)), webSession);
+	});
+	const finishPasskeyRegistration = Effect.fn("AuthApi.finishPasskeyRegistration")(function* (credential) {
+		return yield* http.post("/auth/passkeys/registration/finish", jsonBody(credential)).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(PasskeyMutation)), webSession);
+	});
+	const renamePasskey = Effect.fn("AuthApi.renamePasskey")(function* (passkeyId, name) {
+		return yield* http.patch(`/auth/passkeys/${encodeURIComponent(passkeyId)}`, jsonBody({ name })).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(PasskeyMutation)), webSession);
+	});
+	const deletePasskey = Effect.fn("AuthApi.deletePasskey")(function* (passkeyId) {
+		yield* http.del(`/auth/passkeys/${encodeURIComponent(passkeyId)}`).pipe(webSession);
+	});
+	const beginTOTPEnrollment = Effect.fn("AuthApi.beginTOTPEnrollment")(function* () {
+		return yield* http.post("/auth/totp/enrollment/options").pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(TOTPEnrollment)), webSession);
+	});
+	const completeTOTPEnrollment = Effect.fn("AuthApi.completeTOTPEnrollment")(function* (code) {
+		return yield* http.post("/auth/totp/enrollment/finish", jsonBody({ code })).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(RecoveryCodes)), webSession);
+	});
+	const regenerateRecoveryCodes = Effect.fn("AuthApi.regenerateRecoveryCodes")(function* (code) {
+		return yield* http.post("/auth/totp/recovery-codes", jsonBody({ code })).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(RecoveryCodes)), webSession);
+	});
+	const disableTOTP = Effect.fn("AuthApi.disableTOTP")(function* (code) {
+		yield* http.post("/auth/totp/disable", jsonBody({ code })).pipe(webSession);
+	});
+	return AuthApi.of({
+		listLoginMethods,
+		loginWithPassword,
+		completePasswordMFA,
+		loginWithAPIToken,
+		beginPasskeyLogin,
+		finishPasskeyLogin,
+		acceptUserInvitation,
+		logoutWebSession,
+		getAuthMe,
+		getSecurityStatus,
+		setPassword,
+		listPasskeys,
+		beginPasskeyRegistration,
+		finishPasskeyRegistration,
+		renamePasskey,
+		deletePasskey,
+		beginTOTPEnrollment,
+		completeTOTPEnrollment,
+		regenerateRecoveryCodes,
+		disableTOTP
+	});
+});
+const authApiLayer = Layer.effect(AuthApi, makeAuthApi);
+//#endregion
+//#region src/errors.ts
+const ApiErrorBody = Schema.Struct({ error: Schema.Struct({
+	code: Schema.String,
+	message: Schema.String
+}) });
+/**
+* A failed API request. `code` and `message` come from the server's error body when it
+* sent one; `status` is 0 when no HTTP status applies.
+*/
+var ApiRequestError = class extends Schema.TaggedError()("ApiRequestError", {
+	code: Schema.String,
+	message: Schema.String,
+	status: Schema.Number
+}) {};
+const invalidResponse = (status) => new ApiRequestError({
+	code: "internal_error",
+	message: "Invalid response",
+	status
+});
+const networkError = new ApiRequestError({
+	code: "network_error",
+	message: "The server could not be reached",
+	status: 0
+});
+/**
+* Maps HTTP and decoding failures to ApiRequestError. Error responses keep the code and
+* message of the server's error body.
+*/
+const toApiRequestError = (self) => self.pipe(Effect.catchReasons("HttpClientError", {
+	StatusCodeError: ({ response }) => HttpClientResponse.schemaBodyJson(ApiErrorBody)(response).pipe(Effect.map(({ error }) => new ApiRequestError({
+		...error,
+		status: response.status
+	})), Effect.orElseSucceed(() => new ApiRequestError({
+		code: "internal_error",
+		message: "Request failed",
+		status: response.status
+	})), Effect.flatMap(Effect.fail)),
+	DecodeError: ({ response }) => Effect.fail(invalidResponse(response.status))
+}), Effect.catchTags({
+	HttpClientError: () => Effect.fail(networkError),
+	SchemaError: () => Effect.fail(invalidResponse(0))
+}));
+//#endregion
+//#region src/authorization/layer.ts
+/** The authorization of the call a request belongs to; set by `authorize`. */
+const CurrentAuthorization = Context.Reference("@aperture-browser/api-client/CurrentAuthorization", { defaultValue: () => ({}) });
+const authorizeRequest = (request) => CurrentAuthorization.useSync(({ credentials, bearerToken, tenantHeader = "none" }) => {
+	const token = bearerToken ?? (credentials?.kind === "bearer" ? credentials.token.trim() : void 0);
+	const tenantId = credentials ? resolveTenantHeader(credentials, tenantHeader) : void 0;
+	return request.pipe(HttpClientRequest.acceptJson, token ? HttpClientRequest.bearerToken(token) : Function.identity, tenantId ? HttpClientRequest.setHeader(TENANT_HEADER, tenantId) : HttpClientRequest.removeHeader(TENANT_HEADER));
+});
+const sessionAuthenticationFailureCodes = /* @__PURE__ */ new Set([
+	"authentication_required",
+	"invalid_authentication_token",
+	"authentication_token_expired",
+	"authentication_token_revoked",
+	"user_disabled"
+]);
+/**
+* Decorates the HttpClient so each request carries the authorization of the `authorize`
+* call it runs in.
+*/
+const authorizedHttpClientLayer = Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, HttpClient.mapRequestEffect(authorizeRequest)));
+const makeApiAuthorization = Effect.gen(function* () {
+	const failures = yield* PubSub.unbounded();
+	const authorize = (authorization) => (self) => self.pipe(toApiRequestError, Effect.tapError((error) => authorization.credentials?.kind === "session" && sessionAuthenticationFailureCodes.has(error.code) ? PubSub.publish(failures, void 0) : Effect.void), Effect.provideService(CurrentAuthorization, authorization));
+	return ApiAuthorization.of({
+		authorize,
+		sessionAuthenticationFailures: Stream.fromPubSub(failures)
+	});
+});
+const apiAuthorizationLayer = Layer.effect(ApiAuthorization, makeApiAuthorization);
+//#endregion
+//#region src/query.ts
+/** Encodes tag filters as the parallel tagKey, tagOperator and tagValue query lists. */
+const tagQuery = (tags) => ({
+	tagKey: tags?.map((tag) => tag.key),
+	tagOperator: tags?.map((tag) => tag.operator),
+	tagValue: tags?.map((tag) => tag.values.join(","))
+});
+/** Drops empty strings and empty list items, which mean "no filter". */
+const compactQuery = (query) => Object.fromEntries(Object.entries(query).flatMap(([key, value]) => {
+	if (value === void 0 || value === null || value === "") return [];
+	if (!Array.isArray(value)) return [[key, value]];
+	const items = value.filter((item) => item !== "");
+	return items.length > 0 ? [[key, items]] : [];
+}));
+//#endregion
+//#region src/events/service.ts
+/** The tenant's resource event log. */
+var EventsApi = class extends Context.Service()("@aperture-browser/api-client/EventsApi") {};
+//#endregion
+//#region src/events/layer.ts
+const makeEventsApi = Effect.gen(function* () {
+	const httpClient = yield* HttpClient.HttpClient;
+	const { authorize } = yield* ApiAuthorization;
+	const api = Api.make(httpClient);
+	const listEvents = Effect.fn("EventsApi.listEvents")(function* (credentials, params = {}) {
+		return yield* api.listEvents({ params: compactQuery({
+			limit: params.limit,
+			cursor: params.cursor,
+			resourceType: params.resourceType,
+			resourceId: params.resourceId
+		}) }).pipe(authorize(Authorization.tenantScoped(credentials)));
+	});
+	return EventsApi.of({ listEvents });
+});
+const eventsApiLayer = Layer.effect(EventsApi, makeEventsApi);
+//#endregion
+//#region src/sessions/schemas.ts
+const positiveInt = Schema.Number.check(Schema.isInt(), Schema.isGreaterThan(0));
+const emptyArray = Effect.succeed([]);
+const BrowserStatus = Schema.Struct({
+	sessionId: Schema.String,
+	cdpUrl: Schema.String,
+	media: Api.SessionMedia,
+	targets: Schema.Array(Schema.Struct({
+		targetId: Schema.String,
+		generation: positiveInt,
+		state: Schema.Literals([
+			"pending",
+			"ready",
+			"unavailable",
+			"closed"
+		]),
+		title: Schema.String,
+		url: Schema.String,
+		viewport: Schema.Struct({
+			width: positiveInt,
+			height: positiveInt,
+			deviceScaleFactor: Schema.Number.check(Schema.isGreaterThan(0)),
+			contentWidth: positiveInt,
+			contentHeight: positiveInt,
+			canvasWidth: positiveInt,
+			canvasHeight: positiveInt
+		})
+	})).pipe(Schema.withDecodingDefaultKey(emptyArray))
+});
+/** A recording as the live session reports it. */
+const Recording = Schema.Struct({
+	recordingId: Schema.String,
+	mode: Schema.Literals(["tab", "viewer"]),
+	targetId: Schema.String,
+	captureGeneration: positiveInt,
+	status: Schema.Literals([
+		"starting",
+		"running",
+		"stopped",
+		"failed"
+	]),
+	stopReason: Schema.optionalKey(Schema.String),
+	path: Schema.String,
+	startedAt: Schema.String,
+	stoppedAt: Schema.optionalKey(Schema.String),
+	sizeBytes: Schema.optionalKey(Schema.Number.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(0))),
+	fps: positiveInt,
+	bitrateKbps: positiveInt,
+	codec: Schema.String
+});
+//#endregion
+//#region src/sessions/service.ts
+/** Browser sessions, their live browser, and their recordings. */
+var SessionsApi = class extends Context.Service()("@aperture-browser/api-client/SessionsApi") {};
+//#endregion
+//#region src/sessions/layer.ts
+const contentDispositionFilename = (header) => header?.match(/filename="([^"]+)"/)?.[1] ?? null;
+const makeSessionsApi = Effect.gen(function* () {
+	const httpClient = yield* HttpClient.HttpClient;
+	const { authorize } = yield* ApiAuthorization;
+	const http = HttpClient.filterStatusOk(httpClient);
+	const api = Api.make(httpClient);
+	const tenantScoped = (credentials) => authorize(Authorization.tenantScoped(credentials));
+	const listSessions = Effect.fn("SessionsApi.listSessions")(function* (credentials, params = {}) {
+		return yield* api.listSessions({ params: compactQuery({
+			limit: params.limit,
+			cursor: params.cursor,
+			includeDeleted: params.includeDeleted || void 0,
+			status: params.status,
+			...tagQuery(params.tags)
+		}) }).pipe(tenantScoped(credentials));
+	});
+	const getSession = Effect.fn("SessionsApi.getSession")(function* (credentials, sessionId) {
+		return yield* api.getSession(sessionId, void 0).pipe(tenantScoped(credentials));
+	});
+	const getSessionsBulk = Effect.fn("SessionsApi.getSessionsBulk")(function* (credentials, sessionIds) {
+		return yield* api.getSessionsBulk({ payload: { ids: sessionIds } }).pipe(tenantScoped(credentials));
+	});
+	const createSession = Effect.fn("SessionsApi.createSession")(function* (credentials, input, options = {}) {
+		return yield* api.createSession({
+			params: compactQuery({ waitForReady: options.waitForReady }),
+			payload: {
+				baseSnapshotName: input.baseSnapshotName ?? null,
+				label: input.label ?? null,
+				browser: {
+					channel: input.browser.channel,
+					args: input.browser.args ?? []
+				},
+				initialTargets: input.initialTargets ?? [],
+				...input.storageState === void 0 ? {} : { storageState: input.storageState },
+				tags: input.tags ?? {}
+			}
+		}).pipe(tenantScoped(credentials));
+	});
+	const deleteSession = Effect.fn("SessionsApi.deleteSession")(function* (credentials, sessionId) {
+		return yield* api.deleteSession(sessionId, void 0).pipe(tenantScoped(credentials));
+	});
+	const reopenSession = Effect.fn("SessionsApi.reopenSession")(function* (credentials, sessionId) {
+		return yield* api.reopenSession(sessionId, void 0).pipe(tenantScoped(credentials));
+	});
+	const suspendSession = Effect.fn("SessionsApi.suspendSession")(function* (credentials, sessionId) {
+		return yield* api.suspendSession(sessionId, void 0).pipe(tenantScoped(credentials));
+	});
+	const rotateSessionToken = Effect.fn("SessionsApi.rotateSessionToken")(function* (credentials, sessionId) {
+		return yield* api.rotateSessionToken(sessionId, void 0).pipe(tenantScoped(credentials));
+	});
+	const rotateCollaborationCapability = Effect.fn("SessionsApi.rotateCollaborationCapability")(function* (credentials, sessionId, role) {
+		return yield* api.rotateCollaborationCapability(sessionId, role, void 0).pipe(tenantScoped(credentials));
+	});
+	const replaceSessionTags = Effect.fn("SessionsApi.replaceSessionTags")(function* (credentials, sessionId, tags) {
+		return yield* api.replaceSessionTags(sessionId, { payload: { tags } }).pipe(tenantScoped(credentials));
+	});
+	const promoteSession = Effect.fn("SessionsApi.promoteSession")(function* (credentials, sessionId, input) {
+		return yield* api.promoteSession(sessionId, { payload: {
+			name: input.name,
+			description: input.description ?? null,
+			force: input.force ?? false,
+			tags: input.tags ?? {}
+		} }).pipe(tenantScoped(credentials));
+	});
+	const getBrowserChannels = Effect.fn("SessionsApi.getBrowserChannels")(function* (credentials) {
+		return yield* api.listBrowserChannels(void 0).pipe(tenantScoped(credentials));
+	});
+	const getBrowserStatus = Effect.fn("SessionsApi.getBrowserStatus")(function* (credentials, sessionId, sessionToken) {
+		return yield* http.get(`/sessions/${encodeURIComponent(sessionId)}/browser/status`).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(BrowserStatus)), authorize({
+			credentials,
+			bearerToken: sessionToken
+		}));
+	});
+	const downloadSessionRecording = Effect.fn("SessionsApi.downloadSessionRecording")(function* (credentials, sessionId, recordingId, sessionToken) {
+		return yield* http.get(`/sessions/${encodeURIComponent(sessionId)}/recordings/${encodeURIComponent(recordingId)}/content`).pipe(Effect.flatMap((response) => Effect.map(response.arrayBuffer, (body) => ({
+			blob: new Blob([body], { type: response.headers["content-type"] ?? "" }),
+			filename: contentDispositionFilename(response.headers["content-disposition"])
+		}))), authorize({
+			credentials,
+			bearerToken: sessionToken,
+			tenantHeader: "tenant-scoped"
+		}));
+	});
+	return SessionsApi.of({
+		listSessions,
+		getSession,
+		getSessionsBulk,
+		createSession,
+		deleteSession,
+		reopenSession,
+		suspendSession,
+		rotateSessionToken,
+		rotateCollaborationCapability,
+		replaceSessionTags,
+		promoteSession,
+		getBrowserChannels,
+		getBrowserStatus,
+		downloadSessionRecording
+	});
+});
+const sessionsApiLayer = Layer.effect(SessionsApi, makeSessionsApi);
+//#endregion
+//#region src/snapshots/service.ts
+/** Retained snapshots that new sessions start from. */
+var SnapshotsApi = class extends Context.Service()("@aperture-browser/api-client/SnapshotsApi") {};
+//#endregion
+//#region src/snapshots/layer.ts
+const makeSnapshotsApi = Effect.gen(function* () {
+	const httpClient = yield* HttpClient.HttpClient;
+	const { authorize } = yield* ApiAuthorization;
+	const api = Api.make(httpClient);
+	const tenantScoped = (credentials) => authorize(Authorization.tenantScoped(credentials));
+	const listSnapshots = Effect.fn("SnapshotsApi.listSnapshots")(function* (credentials, params = {}) {
+		return yield* api.listSnapshots({ params: compactQuery({
+			limit: params.limit,
+			cursor: params.cursor,
+			includeDeleted: params.includeDeleted || void 0,
+			deleted: params.deleted,
+			name: params.name,
+			...tagQuery(params.tags)
+		}) }).pipe(tenantScoped(credentials));
+	});
+	const updateSnapshot = Effect.fn("SnapshotsApi.updateSnapshot")(function* (credentials, name, input) {
+		return yield* api.updateSnapshot(name, { payload: input }).pipe(tenantScoped(credentials));
+	});
+	const replaceSnapshotTags = Effect.fn("SnapshotsApi.replaceSnapshotTags")(function* (credentials, name, tags) {
+		return yield* api.replaceSnapshotTags(name, { payload: { tags } }).pipe(tenantScoped(credentials));
+	});
+	const deleteSnapshot = Effect.fn("SnapshotsApi.deleteSnapshot")(function* (credentials, name) {
+		return yield* api.deleteSnapshot(name, void 0).pipe(tenantScoped(credentials));
+	});
+	const restoreSnapshot = Effect.fn("SnapshotsApi.restoreSnapshot")(function* (credentials, name) {
+		return yield* api.restoreSnapshot(name, void 0).pipe(tenantScoped(credentials));
+	});
+	return SnapshotsApi.of({
+		listSnapshots,
+		updateSnapshot,
+		replaceSnapshotTags,
+		deleteSnapshot,
+		restoreSnapshot
+	});
+});
+const snapshotsApiLayer = Layer.effect(SnapshotsApi, makeSnapshotsApi);
+//#endregion
+//#region src/tenants/service.ts
+/** Tenant administration. */
+var TenantsApi = class extends Context.Service()("@aperture-browser/api-client/TenantsApi") {};
+//#endregion
+//#region src/tenants/layer.ts
+const makeTenantsApi = Effect.gen(function* () {
+	const httpClient = yield* HttpClient.HttpClient;
+	const { authorize } = yield* ApiAuthorization;
+	const api = Api.make(httpClient);
+	const listTenants = Effect.fn("TenantsApi.listTenants")(function* (credentials, params = {}) {
+		return yield* api.listTenants({ params: compactQuery({
+			limit: params.limit,
+			cursor: params.cursor,
+			includeDeleted: params.includeDeleted || void 0,
+			deleted: params.deleted
+		}) }).pipe(authorize(Authorization.of(credentials)));
+	});
+	const createTenant = Effect.fn("TenantsApi.createTenant")(function* (credentials, input) {
+		return yield* api.createTenant({ payload: input }).pipe(authorize(Authorization.of(credentials)));
+	});
+	const updateTenant = Effect.fn("TenantsApi.updateTenant")(function* (credentials, tenantId, input) {
+		return yield* api.updateTenant(tenantId, { payload: input }).pipe(authorize(Authorization.of(credentials)));
+	});
+	const deleteTenant = Effect.fn("TenantsApi.deleteTenant")(function* (credentials, tenantId) {
+		return yield* api.deleteTenant(tenantId, void 0).pipe(authorize(Authorization.of(credentials)));
+	});
+	const restoreTenant = Effect.fn("TenantsApi.restoreTenant")(function* (credentials, tenantId) {
+		return yield* api.restoreTenant(tenantId, void 0).pipe(authorize(Authorization.of(credentials)));
+	});
+	return TenantsApi.of({
+		listTenants,
+		createTenant,
+		updateTenant,
+		deleteTenant,
+		restoreTenant
+	});
+});
+const tenantsApiLayer = Layer.effect(TenantsApi, makeTenantsApi);
+//#endregion
+//#region src/tokens/service.ts
+/** API tokens, issued either deployment-wide or within the current tenant. */
+var TokensApi = class extends Context.Service()("@aperture-browser/api-client/TokensApi") {};
+//#endregion
+//#region src/tokens/layer.ts
+const makeTokensApi = Effect.gen(function* () {
+	const httpClient = yield* HttpClient.HttpClient;
+	const { authorize } = yield* ApiAuthorization;
+	const api = Api.make(httpClient);
+	const listAdminTokens = Effect.fn("TokensApi.listAdminTokens")(function* (credentials, params = {}) {
+		return yield* api.listAdminTokens({ params: compactQuery({
+			limit: params.limit,
+			cursor: params.cursor,
+			tenantId: params.tenantId,
+			name: params.name,
+			authorityType: params.authorityType,
+			revoked: params.revoked,
+			scope: params.scope
+		}) }).pipe(authorize(Authorization.of(credentials)));
+	});
+	const createAdminToken = Effect.fn("TokensApi.createAdminToken")(function* (credentials, input) {
+		const systemAdmin = input.authorityType === "system_admin";
+		return yield* api.createAdminToken({ payload: {
+			name: input.name,
+			authorityType: input.authorityType,
+			tenantId: input.tenantId ?? null,
+			scopes: input.scopes,
+			resourceMode: systemAdmin ? "all" : input.resourceMode,
+			resourceGrants: systemAdmin ? [] : input.resourceGrants,
+			expiresAt: input.expiresAt ?? null
+		} }).pipe(authorize(Authorization.of(credentials)));
+	});
+	const revokeAdminToken = Effect.fn("TokensApi.revokeAdminToken")(function* (credentials, tokenId) {
+		yield* api.revokeAdminToken(tokenId, void 0).pipe(authorize(Authorization.of(credentials)));
+	});
+	const listTenantTokens = Effect.fn("TokensApi.listTenantTokens")(function* (credentials, params = {}) {
+		return yield* api.listTenantTokens({ params: compactQuery({
+			limit: params.limit,
+			cursor: params.cursor,
+			name: params.name,
+			revoked: params.revoked,
+			scope: params.scope
+		}) }).pipe(authorize(Authorization.of(credentials)));
+	});
+	const createTenantToken = Effect.fn("TokensApi.createTenantToken")(function* (credentials, input) {
+		return yield* api.createTenantToken({ payload: {
+			name: input.name,
+			scopes: input.scopes,
+			resourceMode: input.resourceMode,
+			resourceGrants: input.resourceGrants,
+			expiresAt: input.expiresAt ?? null
+		} }).pipe(authorize(Authorization.of(credentials)));
+	});
+	const revokeTenantToken = Effect.fn("TokensApi.revokeTenantToken")(function* (credentials, tokenId) {
+		yield* api.revokeTenantToken(tokenId, void 0).pipe(authorize(Authorization.of(credentials)));
+	});
+	return TokensApi.of({
+		listAdminTokens,
+		createAdminToken,
+		revokeAdminToken,
+		listTenantTokens,
+		createTenantToken,
+		revokeTenantToken
+	});
+});
+const tokensApiLayer = Layer.effect(TokensApi, makeTokensApi);
+//#endregion
+//#region src/users/service.ts
+/** User administration and tenant memberships. */
+var UsersApi = class extends Context.Service()("@aperture-browser/api-client/UsersApi") {};
+//#endregion
+//#region src/users/layer.ts
+const makeUsersApi = Effect.gen(function* () {
+	const httpClient = yield* HttpClient.HttpClient;
+	const { authorize } = yield* ApiAuthorization;
+	const api = Api.make(httpClient);
+	const listUsers = Effect.fn("UsersApi.listUsers")(function* (credentials, params = {}) {
+		return yield* api.listUsers({ params: compactQuery({
+			limit: params.limit,
+			cursor: params.cursor,
+			query: params.query,
+			disabled: params.disabled
+		}) }).pipe(authorize(Authorization.of(credentials)));
+	});
+	const createUser = Effect.fn("UsersApi.createUser")(function* (credentials, input) {
+		return yield* api.createUser({ payload: input }).pipe(authorize(Authorization.of(credentials)));
+	});
+	const getUser = Effect.fn("UsersApi.getUser")(function* (credentials, userId) {
+		return yield* api.getUser(userId, void 0).pipe(authorize(Authorization.of(credentials)));
+	});
+	const updateUser = Effect.fn("UsersApi.updateUser")(function* (credentials, userId, input) {
+		return yield* api.updateUser(userId, { payload: input }).pipe(authorize(Authorization.of(credentials)));
+	});
+	const createUserInvitation = Effect.fn("UsersApi.createUserInvitation")(function* (credentials, userId) {
+		return yield* api.createUserInvitation(userId, void 0).pipe(authorize(Authorization.of(credentials)));
+	});
+	const disableUser = Effect.fn("UsersApi.disableUser")(function* (credentials, userId) {
+		return yield* api.disableUser(userId, void 0).pipe(authorize(Authorization.of(credentials)));
+	});
+	const restoreUser = Effect.fn("UsersApi.restoreUser")(function* (credentials, userId) {
+		return yield* api.restoreUser(userId, void 0).pipe(authorize(Authorization.of(credentials)));
+	});
+	const listUserMemberships = Effect.fn("UsersApi.listUserMemberships")(function* (credentials, userId) {
+		return yield* api.listUserMemberships(userId, void 0).pipe(authorize(Authorization.of(credentials)));
+	});
+	const upsertTenantMembership = Effect.fn("UsersApi.upsertTenantMembership")(function* (credentials, tenantId, userId, scopes) {
+		const payload = { scopes };
+		return yield* api.upsertTenantMembership(tenantId, userId, { payload }).pipe(authorize(Authorization.of(credentials)));
+	});
+	const deleteTenantMembership = Effect.fn("UsersApi.deleteTenantMembership")(function* (credentials, tenantId, userId) {
+		yield* api.deleteTenantMembership(tenantId, userId, void 0).pipe(authorize(Authorization.of(credentials)));
+	});
+	return UsersApi.of({
+		listUsers,
+		createUser,
+		getUser,
+		updateUser,
+		createUserInvitation,
+		disableUser,
+		restoreUser,
+		listUserMemberships,
+		upsertTenantMembership,
+		deleteTenantMembership
+	});
+});
+const usersApiLayer = Layer.effect(UsersApi, makeUsersApi);
+//#endregion
+//#region src/layer.ts
+/**
+* Every API service, sharing one ApiAuthorization. The services send requests through the
+* HttpClient the app provides, decorated with each call's authorization.
+*/
+const apiClientLayer = Layer.mergeAll(authApiLayer, tenantsApiLayer, usersApiLayer, sessionsApiLayer, snapshotsApiLayer, tokensApiLayer, eventsApiLayer).pipe(Layer.provide(authorizedHttpClientLayer), Layer.provideMerge(apiAuthorizationLayer));
+const baseUrlLayer = (baseUrl) => Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, HttpClient.mapRequest(HttpClientRequest.prependUrl(baseUrl))));
+//#endregion
+//#region src/pagination.ts
+function getNextPageParam(page) {
+	return page.meta.hasMore ? page.meta.nextCursor : void 0;
+}
+function flattenInfinitePages(pages) {
+	return pages?.flatMap((page) => page.data) ?? [];
+}
+const defaultListLimit = 50;
+const listQueryDefaults = { refetchOnWindowFocus: true };
+//#endregion
+//#region src/schemas.ts
+const SessionStatus = Api.SessionStatus;
+//#endregion
+export { ApiAuthorization, ApiErrorBody, ApiRequestError, AuthApi, Authorization, BrowserStatus, EventsApi, LoginMethods, Passkey, PasskeyLoginOptions, PasskeyMutation, PasskeyRegistrationOptions, Passkeys, PasswordLoginResponse, Recording, RecoveryCodes, SecurityStatus, SessionStatus, SessionsApi, SnapshotsApi, TENANT_HEADER, TOTPEnrollment, TenantsApi, TokensApi, UsersApi, apiAuthorizationLayer, apiClientLayer, authApiLayer, authorizedHttpClientLayer, baseUrlLayer, compactQuery, defaultListLimit, eventsApiLayer, flattenInfinitePages, getNextPageParam, listQueryDefaults, makeApiAuthorization, makeAuthApi, makeEventsApi, makeSessionsApi, makeSnapshotsApi, makeTenantsApi, makeTokensApi, makeUsersApi, resolveTenantHeader, sessionsApiLayer, snapshotsApiLayer, tagQuery, tenantsApiLayer, toApiRequestError, tokensApiLayer, usersApiLayer, webSessionCredentials };
+
+//# sourceMappingURL=index.js.map