@leaflow/sdk 0.0.0-dev.49.g6065fbb → 0.0.0-dev.496.g35e57c5

package/dist/fleet/v1/generated/schemas.zod.js

@@ -0,0 +1,1400 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Fleet API
+ * Machines that run the Leaflow Fleet Agent (`leaflow-fleet-agent`): adding machines, the
+ * accounts and groups that log in to them, running commands, opening and closing sessions, with
+ * or without a desktop, and admitting participants to them.
+ *
+ * ## What this API sees
+ *
+ * This API coordinates. It admits participants to sessions and passes the signaling of their
+ * PeerConnections, but everything a session shows or receives — terminals, files, the screen,
+ * input, the clipboard, printing and privilege approvals on a participant — travels end to end
+ * between the participant and the session, encrypted with keys that never leave them. The
+ * platform sees which machine, which session and who is connected, and nothing of what happens
+ * inside.
+ *
+ * Commands and privilege requests decided on the platform are the exception: the platform passes
+ * a command and its output between the caller and the machine, and keeps the command line of a
+ * privilege request it asks the owner about; it sees both.
+ *
+ * ## Authentication
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme.
+ *
+ * **Neither the path nor the headers carry a `project_id`**: the current project is determined by
+ * the token.
+ *
+ * ## Adding a machine
+ *
+ * 1. Install the Agent and run `leaflow-fleet-agent daemon enroll` on the machine. The command
+ *    carries no secret. The machine shows a pairing code such as `7K2QM-9XWTD`.
+ * 2. Find the request with `GET /api/v1/enrollments:find?pairing_code=…`. Compare its `hostname`
+ *    and `source_address` with the machine in front of you: the pairing code is not a secret,
+ *    and anyone can request enrollment.
+ * 3. Approve it with `POST /api/v1/enrollments/{enrollmentId}:approve`. The machine joins the
+ *    current project within its next polling interval.
+ *
+ * ## Adding a machine without interaction
+ *
+ * A machine that is set up unattended, such as by cloud-init on first boot, joins with a
+ * registration token instead of a pairing code:
+ *
+ * 1. Create a registration with `POST /api/v1/machine-registrations`. It reserves a machine in
+ *    the current project under the given name and returns its `machine_id` and a `token`. The
+ *    token is returned only in this response.
+ * 2. Give the token to the machine in a file that only root can read, and run
+ *    `leaflow-fleet-agent daemon enroll --url <control endpoint> --token-file <path>`. The
+ *    machine joins the current project as `machine_id` at once, and the Agent deletes the file.
+ *
+ * A token enrolls one machine once, and only until the registration expires. Anyone who reads
+ * the token before the machine uses it can enroll a key of their own instead, so pass it only
+ * to the machine, keep its lifetime short, and compare the `public_key` of the used
+ * registration with the key the machine shows when that matters. Revoke a registration that
+ * will not be used with `DELETE /api/v1/machine-registrations/{registrationId}`.
+ *
+ * ## Trusting a machine's key
+ *
+ * Each machine has an Ed25519 key that it generates itself and that never leaves it. Participants
+ * verify that key end to end before they exchange any data with a session, so a client must
+ * decide which key belongs to a machine without relying on any party in between:
+ *
+ * - When approving an enrollment, recompute the pairing code from `public_key` and compare it
+ *   with the code the machine shows. The code is derived as documented for
+ *   `EnrollMachineResponse.pairing_code` in `leaflow/fleet/machine/v1/machine.proto`.
+ *   Approve only when they match, and remember the key for the machine.
+ * - On any other client, remember the key the first time it connects to the machine, and
+ *   refuse to continue whenever the machine later proves a different key. The fingerprint can
+ *   be compared with the one the Agent prints on the machine.
+ *
+ * A machine that is reinstalled enrolls again as a new machine with a new key.
+ *
+ * ## Features
+ *
+ * A machine reports what it offers in `features`, each named after the protocol package that
+ * defines it:
+ *
+ * - `leaflow.fleet.directory.v1`: the accounts of the project's members and the project's groups
+ *   exist on the machine; members log in over SSH with their keys and become root through sudo
+ *   as their permissions allow;
+ * - `leaflow.fleet.command.v1`: running commands;
+ * - `leaflow.fleet.mcp.v1`: the MCP servers each account configures on the machine, local ones
+ *   and remote ones it connects to;
+ * - `leaflow.fleet.host.v1`: terminal sessions, with programs, files, ports, sound, devices,
+ *   printers and privilege approvals;
+ * - `leaflow.fleet.virtualdesktop.host.v1`: sessions with a graphical backend;
+ * - `leaflow.fleet.tool.v1`: live session tools. Builtin `computer.*` tools are exposed only while
+ *   the virtual desktop capability is actually available; MCP is a separate source.
+ *
+ * A graphical backend does not require a full desktop environment. Terminal logins, commands
+ * and MCP server initialization prepare or reuse the account's lightweight graphical context,
+ * in addition to their own session or job. Configuration reads and writes do not initialize a
+ * server and do not require this preparation. A request that needs a feature the machine does
+ * not report available fails with `FEATURE_UNAVAILABLE`, whose `metadata.feature` names it.
+ *
+ * ## Directory
+ *
+ * Every user has one account, as with Google Cloud OS Login: a username and a uid that are the
+ * same on every machine of every project. The account is created the first time the user may log
+ * in to a machine or opens a session; its username comes from the email address, such as
+ * `alice_example_com` for `alice@example.com`, and its owner can change it. A project's machines
+ * know the accounts of the project's members and the groups the project defines. A member who
+ * leaves the project can no longer log in, and files keep their owner.
+ *
+ * Who may log in to which machines, and who may become root there through sudo, are permissions
+ * of the project's roles: `fleet:machines.login` and `fleet:machines.admin`, each for all
+ * machines or for chosen ones. Changes reach the machines within about a minute, and every login
+ * and elevation is checked against the current permissions while the machine is connected. To
+ * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
+ * Elevation through sudo is never approved by a password; see "Approving sudo".
+ *
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
+ *
+ * Machines resolve directory accounts and groups themselves and never write them into their local
+ * account files. A local account or group that already uses a name or id of the directory keeps
+ * it, and the machine records the conflict among its events.
+ *
+ * ## Running commands
+ *
+ * `POST /api/v1/machines/{machineId}:runCommand` runs one command line on the machine as the
+ * caller's account, as `ssh machine 'command'` would, but without SSH: the machine needs no open
+ * port, no distributed key and no address the caller can reach. Like logging in, it requires
+ * `fleet:machines.login` on the machine. Inside the command, `sudo` works without a prompt for
+ * a caller with `fleet:machines.admin` on the machine: the request approves the elevation.
+ *
+ * ## MCP servers
+ *
+ * A machine that offers `leaflow.fleet.mcp.v1` reaches the MCP servers its accounts configure:
+ * servers it runs itself and remote servers it connects to. Each account configures them in
+ * `~/.local/share/leaflow/agent/mcp.json` in its home directory, in the `mcpServers` format other
+ * MCP clients use, by hand or through this API; the machine picks up every change by itself.
+ * The caller's servers run as the caller's account, and the requests below act on them only.
+ *
+ * The configuration stays on the machine. The values of `env` and `headers` often hold
+ * credentials: this API writes them, and they then pass through the platform, but never returns
+ * them. Arguments, URLs, tool arguments and tool results pass through the platform as they are.
+ *
+ * ## Approving sudo
+ *
+ * An account may become root through sudo on a machine while its user has
+ * `fleet:machines.admin` there. Each elevation is approved, in the first of these ways that
+ * applies:
+ *
+ * - inside a command run through this API, by the request itself;
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
+ * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
+ *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
+ *   to. A request nobody decides expires, and sudo fails.
+ *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
+ * Requests reach the user's devices as they happen through EventBus: the event
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
+ * pending requests.
+ *
+ * ## Connections that drop
+ *
+ * A machine's Agent and a session's process each keep a connection to the service, and on a poor
+ * network it may drop and come back within seconds. Requests do not fail for that:
+ *
+ * - A request that needs the machine or the session's process waits while it connects again,
+ *   for as long as the request would wait for its answer, and fails with `MACHINE_OFFLINE` or
+ *   `SESSION_UNAVAILABLE` only when it does not come back in that time.
+ * - What the machine or the session's process received before its connection dropped, such as a
+ *   command or a session being opened, goes on, and its result is returned once it has
+ *   connected again within that time.
+ *
+ * A machine stays `online` for up to a minute after its connection was lost, while its Agent
+ * connects again; a machine whose Agent stops is offline at once.
+ *
+ * ## Operations that do not exist
+ *
+ * Some resources lack an operation on purpose:
+ *
+ * - Accounts are created when they are first needed and are never deleted, so that files keep
+ *   their owner.
+ * - Enrollment requests are made only by machines.
+ * - A machine registration cannot be changed; revoke it and create another.
+ * - Machine events are a log: they are listed, never changed, and kept for 30 days.
+ * - A privilege request is decided only by the user whose account asks, or on a participant of
+ *   the session it comes from.
+ *
+ * ## Joining a session
+ *
+ * 1. Have an Ed25519 key, for as long as the client wants: one per participant or one kept by
+ *    the client. The private key must never leave the client; in a browser, use a
+ *    non-extractable WebCrypto key.
+ * 2. Get the ICE servers with `GET /api/v1/sessions/{sessionId}/rtc-configuration`, create a
+ *    PeerConnection with them and its data channels (`leaflow/fleet/transport/v1/transport.proto`)
+ *    and make an offer. Wait briefly for ICE candidates, such as until gathering completes or
+ *    one second has passed, so that the offer carries them.
+ * 3. Join with `POST /api/v1/sessions/{sessionId}/participants`, sending the public key and the
+ *    offer. The answer carries the participant's signed authorization, the keys the service
+ *    signs with, and the first PeerConnection: the session's SDP answer, the ICE candidates it
+ *    has passed so far and the signed PeerAuthorization. Pass candidates gathered later with
+ *    `POST …/participants/{participantId}/peer-connections/{peerConnectionId}/candidates`, and
+ *    read the session's later ones with
+ *    `GET …/participants/{participantId}/peer-connections/{peerConnectionId}` until
+ *    `candidates_complete`.
+ * 4. Renew the participant with `POST …/participants/{participantId}:renew` well before
+ *    `lease_expires_at`, every 15 seconds, presenting the PeerAuthorization of each
+ *    PeerConnection; the answer renews them. A participant whose lease runs out ends, and its
+ *    PeerConnections stop within 30 seconds of their last lease.
+ * 5. When a path fails, start another PeerConnection with
+ *    `POST …/participants/{participantId}/peer-connections` and move the connection to it with
+ *    `:prepareMigration` and `:commitMigration`. Abandon a PeerConnection that does not
+ *    connect with `DELETE …/peer-connections/{peerConnectionId}`.
+ * 6. Leave with `DELETE …/participants/{participantId}`.
+ *
+ * Signaling travels only through these requests; a participant holds no other connection to
+ * the service.
+ *
+ * What a participant may do in a session is decided when it is created, from the caller's
+ * permissions and what the request asks for, and does not change afterwards. Participants are not
+ * told apart by kind: a person in a browser and a program that operates the session are both
+ * participants, named by the `client_name` they choose, and either can be disconnected.
+ *
+ * Every participant that ends, including through `DELETE`, is announced through EventBus as
+ * `leaflow.fleet.participant.ended`, addressed to its user in the current project, with its
+ * `session_id`, `participant_id` (a decimal string) and `reason`: `left` when its user ended it,
+ * `removed` when someone else did, `lease_expired` when it was not renewed in time,
+ * `session_ended` when its session ended, `session_process_lost` when the session's process did
+ * not come back in time, `permission_revoked` when a permission it was created with was revoked
+ * from its user, `membership_ended` when its user is no longer a member of the project,
+ * `user_inactive` when its user's account was suspended or banned or its deletion was requested,
+ * `project_deletion_requested` when deletion of the project was requested, `machine_removed` when
+ * its machine was removed, or `key_revoked` when the key that signed its authorization was
+ * revoked. A participant whose creation failed is not announced.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+import { ApproveEnrollmentRequest } from "./validators/approveEnrollmentRequest.zod.js";
+import { CallMcpToolRequest } from "./validators/callMcpToolRequest.zod.js";
+import { CallToolRequest } from "./validators/callToolRequest.zod.js";
+import { CreateGroupMemberRequest } from "./validators/createGroupMemberRequest.zod.js";
+import { CreateGroupRequest } from "./validators/createGroupRequest.zod.js";
+import { CreateMachineRegistrationRequest } from "./validators/createMachineRegistrationRequest.zod.js";
+import { CreateParticipantRequest } from "./validators/createParticipantRequest.zod.js";
+import { CreatePeerConnectionCandidatesRequest } from "./validators/createPeerConnectionCandidatesRequest.zod.js";
+import { CreatePeerConnectionRequest } from "./validators/createPeerConnectionRequest.zod.js";
+import { CreateSessionRequest } from "./validators/createSessionRequest.zod.js";
+import { DenyPrivilegeRequestRequest } from "./validators/denyPrivilegeRequestRequest.zod.js";
+import { MigrationStep } from "./validators/migrationStep.zod.js";
+import { RenewParticipantRequest } from "./validators/renewParticipantRequest.zod.js";
+import { ReplaceMcpConfigurationRequest } from "./validators/replaceMcpConfigurationRequest.zod.js";
+import { RunCommandRequest } from "./validators/runCommandRequest.zod.js";
+import { SendMcpRequestRequest } from "./validators/sendMcpRequestRequest.zod.js";
+import { UpdateAccountRequest } from "./validators/updateAccountRequest.zod.js";
+import { UpdateGroupRequest } from "./validators/updateGroupRequest.zod.js";
+import { UpdateMachineRequest } from "./validators/updateMachineRequest.zod.js";
+import { UpdateMcpServerRequest } from "./validators/updateMcpServerRequest.zod.js";
+import { UpdatePrivilegeAutoApprovalRequest } from "./validators/updatePrivilegeAutoApprovalRequest.zod.js";
+/**
+ * Returns the machines of the current project, newest first.
+ * @summary List machines
+ */
+export const listMachinesQueryPageDefault = 1;
+export const listMachinesQueryPageMax = 2147483647;
+export const listMachinesQueryPageSizeDefault = 50;
+export const listMachinesQueryPageSizeMax = 200;
+export const listMachinesQueryKeywordMax = 128;
+export const ListMachinesQueryParams = zod.strictObject({
+    page: zod
+        .int()
+        .min(1)
+        .max(listMachinesQueryPageMax)
+        .default(listMachinesQueryPageDefault)
+        .describe("1-based page number. Defaults to 1."),
+    page_size: zod
+        .int()
+        .min(1)
+        .max(listMachinesQueryPageSizeMax)
+        .default(listMachinesQueryPageSizeDefault)
+        .describe("Items per page. Defaults to 50; at most 200."),
+    keyword: zod
+        .string()
+        .max(listMachinesQueryKeywordMax)
+        .optional()
+        .describe("Match the machine name or host name, case-insensitively"),
+});
+/**
+ * @summary Get a machine
+ */
+export const GetMachineParams = zod.strictObject({
+    machineId: zod.uuid(),
+});
+/**
+ * Changes the machine's name. Requires `fleet:machines.manage`.
+ * @summary Update a machine
+ */
+export const UpdateMachineParams = zod.strictObject({
+    machineId: zod.uuid(),
+});
+export const UpdateMachineBody = UpdateMachineRequest;
+/**
+ * Removes the machine from the project. Every participant of its sessions is disconnected at
+ * once and the Agent is refused from then on; to use the machine again, enroll it again.
+ * Sessions still open on the machine can no longer be reached and end according to their own
+ * timeouts. Nothing on the machine is deleted.
+ *
+ * Requires `fleet:machines.manage`.
+ * @summary Remove a machine
+ */
+export const DeleteMachineParams = zod.strictObject({
+    machineId: zod.uuid(),
+});
+/**
+ * Returns what the machine reported about itself, newest first, such as a directory account
+ * it does not serve because a local account uses its name. Events are kept for 30 days.
+ * @summary List the events of a machine
+ */
+export const ListMachineEventsParams = zod.strictObject({
+    machineId: zod.uuid(),
+});
+export const listMachineEventsQueryPageDefault = 1;
+export const listMachineEventsQueryPageMax = 2147483647;
+export const listMachineEventsQueryPageSizeDefault = 50;
+export const listMachineEventsQueryPageSizeMax = 200;
+export const ListMachineEventsQueryParams = zod.strictObject({
+    page: zod
+        .int()
+        .min(1)
+        .max(listMachineEventsQueryPageMax)
+        .default(listMachineEventsQueryPageDefault)
+        .describe("1-based page number. Defaults to 1."),
+    page_size: zod
+        .int()
+        .min(1)
+        .max(listMachineEventsQueryPageSizeMax)
+        .default(listMachineEventsQueryPageSizeDefault)
+        .describe("Items per page. Defaults to 50; at most 200."),
+    type: zod
+        .enum(["directory_account_conflict", "directory_group_conflict"])
+        .optional()
+        .describe("Return only events of this type"),
+});
+/**
+ * Runs one command line on the machine as the caller's account, with its login shell, and
+ * returns once it exited or was killed, with its exit status and what it wrote. Pipes,
+ * redirection and `&&` work; there is no terminal and no standard input. The machine admits
+ * the account through PAM as for a login. The account is created if the caller has none yet.
+ * A command that fails is still a successful request: its exit status is its result.
+ * Before starting it, Fleet prepares or reuses the account's ready lightweight graphical
+ * session, without starting a full desktop environment. The command has its own job scope;
+ * its timeout or exit must not close the account's graphical context.
+ *
+ * Inside the command, `sudo` works without a prompt while the caller has
+ * `fleet:machines.admin` on the machine, and refuses otherwise.
+ *
+ * After graphical context preparation, the request is held until the command ends, at most
+ * `timeout_seconds` and a few seconds more. Neither the command nor its output is hidden from the platform: do not put secrets
+ * into either.
+ *
+ * Requires `fleet:machines.login` on the machine.
+ *
+ * Fails with:
+ * - `MACHINE_OFFLINE` when the machine is not connected and does not connect again in time;
+ * - `FEATURE_UNAVAILABLE` when the command, session or graphical backend is unavailable;
+ * - `SESSION_UNAVAILABLE` or `SESSION_CLOSED` when the account context is not ready or closing;
+ * - `USER_NOT_FOUND`, `USER_NOT_ALLOWED`, `ACCOUNT_EXPIRED` or `PAM_PERMISSION_DENIED` when
+ *   the machine refuses the account, as for opening a session;
+ * - `COMMAND_START_FAILED` when the shell could not start; nothing ran;
+ * - `COMMAND_LOST` when the machine lost the command while it ran. The command may have run
+ *   in part, and its output is lost;
+ * - `MACHINE_TIMEOUT` when the machine did not answer in time. The command may have run.
+ * @summary Run a command
+ */
+export const RunMachineCommandParams = zod.strictObject({
+    machineId: zod.uuid(),
+});
+export const RunMachineCommandBody = RunCommandRequest;
+/**
+ * Returns the caller's MCP configuration file on the machine and every server in it, with
+ * what each is doing now. The values of `env` and `headers` are never returned, only their
+ * keys. Requires `fleet:machines.login` on the machine.
+ *
+ * Fails with:
+ * - `MACHINE_OFFLINE` when the machine is not connected and does not connect again in time;
+ * - `FEATURE_UNAVAILABLE` when the machine does not offer `leaflow.fleet.mcp.v1`;
+ * - `USER_NOT_FOUND`, `USER_NOT_ALLOWED`, `ACCOUNT_EXPIRED` or `PAM_PERMISSION_DENIED` when
+ *   the machine refuses the account, as for opening a session;
+ * - `MCP_START_FAILED` when the machine could not start MCP for the caller's account;
+ * - `MACHINE_TIMEOUT` when the machine did not answer in time.
+ * @summary Get the caller's MCP configuration on a machine
+ */
+export const GetMcpConfigurationParams = zod.strictObject({
+    machineId: zod.uuid(),
+});
+/**
+ * Replaces the caller's MCP configuration file on the machine as a whole, also one that cannot
+ * be read or is not valid. The machine starts the servers that were added, stops the ones
+ * that were removed and restarts the ones that changed when they are next used. The account
+ * is created if the caller has none yet. The content, secrets included, passes through the
+ * platform. Requires `fleet:machines.login` on the machine.
+ *
+ * Fails with:
+ * - `MCP_CONFIGURATION_CHANGED` when the file is no longer at `expected_revision`;
+ * - `MCP_CONFIGURATION_INVALID` when `content` is not an object with an object `mcpServers`,
+ *   with `metadata.line` and `metadata.column`;
+ * - `MCP_CONFIGURATION_WRITE_FAILED` when the machine could not write the file;
+ * - `MACHINE_OFFLINE` when the machine is not connected and does not connect again in time;
+ * - `FEATURE_UNAVAILABLE` when the machine does not offer `leaflow.fleet.mcp.v1`;
+ * - `USER_NOT_FOUND`, `USER_NOT_ALLOWED`, `ACCOUNT_EXPIRED` or `PAM_PERMISSION_DENIED` when
+ *   the machine refuses the account, as for opening a session;
+ * - `MCP_START_FAILED` when the machine could not start MCP for the caller's account;
+ * - `MACHINE_TIMEOUT` when the machine did not answer in time.
+ * @summary Replace the caller's MCP configuration on a machine
+ */
+export const ReplaceMcpConfigurationParams = zod.strictObject({
+    machineId: zod.uuid(),
+});
+export const ReplaceMcpConfigurationBody = ReplaceMcpConfigurationRequest;
+/**
+ * Adds a server to the caller's MCP configuration on the machine, or replaces the one with
+ * the same name. The values of `env` and `headers` the request gives, secrets included, pass
+ * through the platform; those named in `keep_env` and `keep_headers` stay as they are on the
+ * machine. The account is created if the caller has none yet. Requires
+ * `fleet:machines.login` on the machine.
+ *
+ * Fails with:
+ * - `MCP_CONFIGURATION_CHANGED` when the file is no longer at `expected_revision`;
+ * - `MCP_CONFIGURATION_INVALID` when the file cannot be read or is not valid; replace it
+ *   whole first;
+ * - `MCP_CONFIGURATION_WRITE_FAILED` when the machine could not write the file;
+ * - `MACHINE_OFFLINE` when the machine is not connected and does not connect again in time;
+ * - `FEATURE_UNAVAILABLE` when the machine does not offer `leaflow.fleet.mcp.v1`;
+ * - `USER_NOT_FOUND`, `USER_NOT_ALLOWED`, `ACCOUNT_EXPIRED` or `PAM_PERMISSION_DENIED` when
+ *   the machine refuses the account, as for opening a session;
+ * - `MCP_START_FAILED` when the machine could not start MCP for the caller's account;
+ * - `MACHINE_TIMEOUT` when the machine did not answer in time.
+ * @summary Add or replace an MCP server
+ */
+export const updateMcpServerPathServerNameRegExp = new RegExp("^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$");
+export const UpdateMcpServerParams = zod.strictObject({
+    machineId: zod.uuid(),
+    serverName: zod
+        .string()
+        .regex(updateMcpServerPathServerNameRegExp)
+        .describe("The server's key in `mcpServers`: a letter or digit, then up to 63 letters, digits, `_`\nor `-`, without `__`, since the tools of all servers are named `<server>__<tool>` together"),
+});
+export const UpdateMcpServerBody = UpdateMcpServerRequest;
+/**
+ * Removes a server from the caller's MCP configuration on the machine and stops it. Removing
+ * one that is not configured succeeds. Requires `fleet:machines.login` on the machine.
+ *
+ * Fails as replacing a server does.
+ * @summary Remove an MCP server
+ */
+export const deleteMcpServerPathServerNameRegExp = new RegExp("^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$");
+export const DeleteMcpServerParams = zod.strictObject({
+    machineId: zod.uuid(),
+    serverName: zod
+        .string()
+        .regex(deleteMcpServerPathServerNameRegExp)
+        .describe("The server's key in `mcpServers`: a letter or digit, then up to 63 letters, digits, `_`\nor `-`, without `__`, since the tools of all servers are named `<server>__<tool>` together"),
+});
+export const deleteMcpServerQueryExpectedRevisionMax = 64;
+export const DeleteMcpServerQueryParams = zod.strictObject({
+    expected_revision: zod
+        .string()
+        .max(deleteMcpServerQueryExpectedRevisionMax)
+        .optional()
+        .describe("The configuration's `revision` as last read; absent only for one that was `missing`"),
+});
+/**
+ * Queries Agent's builtin tools and the caller's configured MCP servers live. No directory,
+ * result or image is cached. Requires fleet:machines.login; builtin capabilities retain
+ * their native policies and read-only restrictions. Ensures or reuses the caller's single
+ * open graphical session, without launching a desktop environment. The client instance is
+ * a UUID generated once per running client, not an authorization credential. Each request
+ * checks current IAM permissions and signs a short-lived control-only authorization.
+ * Tool arguments, results and images traverse Fleet with hop-by-hop TLS and are visible to
+ * Fleet. Existing desktop streaming remains end-to-end encrypted. TOOL_LIST_CHANGED means
+ * restart listing from the first page, never replay a CallTool. At most 100 tools per page.
+ * @summary List live tools available to the caller on a machine
+ */
+export const ListToolsParams = zod.strictObject({
+    machineId: zod.uuid(),
+});
+export const listToolsQuerySourceDefault = `all`;
+export const listToolsQueryMcpServerMax = 64;
+export const listToolsQueryQueryMax = 256;
+export const listToolsQueryReadOnlyDefault = false;
+export const listToolsQueryPageSizeDefault = 100;
+export const listToolsQueryPageSizeMax = 100;
+export const listToolsQueryPageTokenMax = 4096;
+export const ListToolsQueryParams = zod.strictObject({
+    client_instance_id: zod.uuid(),
+    source: zod.enum(["all", "builtin", "mcp"]).default(listToolsQuerySourceDefault),
+    mcp_server: zod.string().max(listToolsQueryMcpServerMax).optional(),
+    query: zod.string().max(listToolsQueryQueryMax).optional(),
+    read_only: zod.boolean().default(listToolsQueryReadOnlyDefault),
+    page_size: zod.int().min(1).max(listToolsQueryPageSizeMax).default(listToolsQueryPageSizeDefault),
+    page_token: zod.string().max(listToolsQueryPageTokenMax).optional(),
+});
+/**
+ * Uses the same current permissions, directory account and graphical session as list-tools.
+ * Listing is not a precondition: callers may use a previously discovered ToolRef, and this
+ * operation never sends a discovery request or refreshes schemas before executing it.
+ * A removed tool or MCP server returns TOOL_NOT_FOUND, as does a direct builtin computer.*
+ * call while virtual desktop capability is unavailable. Actual permission errors remain
+ * permission errors; a missing target window is not a missing tool. Use list-tools only when
+ * discovery or refresh is needed, and do not cache or reuse execution results.
+ * Source is explicit: MCP names never select or impersonate builtin tools. The arguments
+ * object is at most 256 KiB. The complete result is at most 8 MiB in the protobuf transport,
+ * with each encoded image at most 4 MiB; images are converted to base64 once at this JSON
+ * boundary, without recompression or persistence. Cancellation is propagated. A timeout,
+ * disconnect or failed response does not prove that side effects did not happen; do not
+ * automatically replay. operation_id only correlates live activity, not idempotency.
+ * @summary Call a live builtin or external MCP tool
+ */
+export const CallToolParams = zod.strictObject({
+    machineId: zod.uuid(),
+});
+export const CallToolBody = CallToolRequest;
+/**
+ * Checks current session viewing permission for each request and again before returning
+ * events. Subscribes only while this request is pending, returning on the first batch or
+ * after at most 20 idle seconds. At most 64 events, no offline queue, event database, cursor
+ * history or replay guarantee. Missing events never mean repeat an action. Coordinates
+ * are window-client-local (window_id=0 means canvas), not CSS or image pixels. The frontend
+ * applies its own zoom and DPI. Compare sequence only within the same instance_id.
+ * @summary Receive live tool activity for an authorized session
+ */
+export const pollToolActivitiesPathSessionIdMax = 40;
+export const pollToolActivitiesPathSessionIdRegExp = new RegExp("^[a-z0-9-]+$");
+export const PollToolActivitiesParams = zod.strictObject({
+    sessionId: zod
+        .string()
+        .min(1)
+        .max(pollToolActivitiesPathSessionIdMax)
+        .regex(pollToolActivitiesPathSessionIdRegExp),
+});
+/**
+ * Sends one JSON-RPC request of MCP to one of the caller's servers on the machine, such as
+ * `tools/call`, `resources/read` or `prompts/get`, and returns the server's response. The
+ * machine starts or connects to the server if it is not running, and handles its
+ * initialization itself. Before any such request, Fleet prepares or reuses the caller's
+ * ready lightweight account graphical session, including for resources and prompts; no full
+ * desktop environment is needed. A request still running when `timeout_seconds` passes is cancelled
+ * at the server. Requests the server makes of the client are answered as by a client that
+ * offers no sampling, elicitation or roots, and its notifications, such as of progress, are
+ * dropped. A response with a JSON-RPC error is a successful request. Neither the request nor
+ * the response is hidden from the platform. Requires `fleet:machines.login` on the machine.
+ *
+ * Fails with:
+ * - `MCP_SERVER_NOT_FOUND` when the server is not configured;
+ * - `MCP_SERVER_UNAVAILABLE` when it could not be started or reached, with
+ *   `metadata.failure`, an `McpServerFailure`;
+ * - `INVALID_ARGUMENT` when `request` is not one JSON-RPC request, such as a notification, or
+ *   is one of initialization;
+ * - `RESULT_TOO_LARGE` when the response is larger than 8 MiB;
+ * - `MACHINE_OFFLINE` when the machine is not connected and does not connect again in time;
+ * - `FEATURE_UNAVAILABLE` when the MCP, session or graphical backend is unavailable;
+ * - `SESSION_UNAVAILABLE` or `SESSION_CLOSED` when the account context is not ready or closing;
+ * - `USER_NOT_FOUND`, `USER_NOT_ALLOWED`, `ACCOUNT_EXPIRED` or `PAM_PERMISSION_DENIED` when
+ *   the machine refuses the account, as for opening a session;
+ * - `MCP_START_FAILED` when the machine could not start MCP for the caller's account;
+ * - `MACHINE_TIMEOUT` when the machine did not answer in time.
+ * @summary Send an MCP request to a server
+ */
+export const sendMcpRequestPathServerNameRegExp = new RegExp("^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$");
+export const SendMcpRequestParams = zod.strictObject({
+    machineId: zod.uuid(),
+    serverName: zod
+        .string()
+        .regex(sendMcpRequestPathServerNameRegExp)
+        .describe("The server's key in `mcpServers`: a letter or digit, then up to 63 letters, digits, `_`\nor `-`, without `__`, since the tools of all servers are named `<server>__<tool>` together"),
+});
+export const SendMcpRequestBody = SendMcpRequestRequest;
+/**
+ * Calls one tool of one of the caller's servers on the machine and returns its MCP
+ * `CallToolResult`. A tool that reports an error, with `isError`, is a successful request. A
+ * tool whose name cannot appear in a path is called with `send-mcp-request`. Neither the
+ * arguments nor the result is hidden from the platform. Requires `fleet:machines.login` on
+ * the machine.
+ *
+ * Fails as sending a request does, and with `MCP_REQUEST_FAILED` when the server answers
+ * with a JSON-RPC error, such as for a tool it does not offer or arguments it does not
+ * accept, with the error's `metadata.code` and `metadata.message`.
+ * @deprecated
+ * @summary Call an MCP tool
+ */
+export const callMcpToolPathServerNameRegExp = new RegExp("^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$");
+export const callMcpToolPathToolNameMax = 128;
+export const CallMcpToolParams = zod.strictObject({
+    machineId: zod.uuid(),
+    serverName: zod
+        .string()
+        .regex(callMcpToolPathServerNameRegExp)
+        .describe("The server's key in `mcpServers`: a letter or digit, then up to 63 letters, digits, `_`\nor `-`, without `__`, since the tools of all servers are named `<server>__<tool>` together"),
+    toolName: zod.string().min(1).max(callMcpToolPathToolNameMax),
+});
+export const CallMcpToolBody = CallMcpToolRequest;
+/**
+ * Returns the caller's automatic approval of their privilege requests on the machine. Fails
+ * with `PRIVILEGE_AUTO_APPROVAL_NOT_FOUND` while the caller is asked every time, including
+ * after its `expires_at` has passed.
+ * @summary Get the caller's automatic approval for a machine
+ */
+export const GetPrivilegeAutoApprovalParams = zod.strictObject({
+    machineId: zod.uuid(),
+});
+/**
+ * Has the caller's privilege requests on the machine decided without asking them, in
+ * `mode`, until `expires_at`, or until removed when `expires_at` is null, replacing any
+ * earlier automatic approval. `automatic_review` is recommended; with `always_approve` any
+ * program that runs as the account becomes root without anyone being asked. It applies to
+ * the caller's own account only, which is created if the caller has none yet, and only
+ * while they may become root on the machine. Fails with `INVALID_ARGUMENT` when
+ * `expires_at` has passed.
+ * @summary Decide the caller's privilege requests on a machine without asking
+ */
+export const UpdatePrivilegeAutoApprovalParams = zod.strictObject({
+    machineId: zod.uuid(),
+});
+export const UpdatePrivilegeAutoApprovalBody = UpdatePrivilegeAutoApprovalRequest;
+/**
+ * Removes it: the caller is asked about every later privilege request on the machine.
+ * Removing one that does not exist succeeds.
+ * @summary Remove the caller's automatic approval for a machine
+ */
+export const DeletePrivilegeAutoApprovalParams = zod.strictObject({
+    machineId: zod.uuid(),
+});
+/**
+ * Returns the caller's automatic approvals on the machines of the current project that are
+ * in effect, the most recently set first.
+ * @summary List the caller's automatic approvals
+ */
+export const listPrivilegeAutoApprovalsQueryPageDefault = 1;
+export const listPrivilegeAutoApprovalsQueryPageMax = 2147483647;
+export const listPrivilegeAutoApprovalsQueryPageSizeDefault = 50;
+export const listPrivilegeAutoApprovalsQueryPageSizeMax = 200;
+export const ListPrivilegeAutoApprovalsQueryParams = zod.strictObject({
+    page: zod
+        .int()
+        .min(1)
+        .max(listPrivilegeAutoApprovalsQueryPageMax)
+        .default(listPrivilegeAutoApprovalsQueryPageDefault)
+        .describe("1-based page number. Defaults to 1."),
+    page_size: zod
+        .int()
+        .min(1)
+        .max(listPrivilegeAutoApprovalsQueryPageSizeMax)
+        .default(listPrivilegeAutoApprovalsQueryPageSizeDefault)
+        .describe("Items per page. Defaults to 50; at most 200."),
+});
+/**
+ * Returns the caller's privilege requests on the project's machines, newest first. Requests
+ * are kept for 30 days.
+ * @summary List the caller's privilege requests
+ */
+export const listPrivilegeRequestsQueryPageDefault = 1;
+export const listPrivilegeRequestsQueryPageMax = 2147483647;
+export const listPrivilegeRequestsQueryPageSizeDefault = 50;
+export const listPrivilegeRequestsQueryPageSizeMax = 200;
+export const ListPrivilegeRequestsQueryParams = zod.strictObject({
+    page: zod
+        .int()
+        .min(1)
+        .max(listPrivilegeRequestsQueryPageMax)
+        .default(listPrivilegeRequestsQueryPageDefault)
+        .describe("1-based page number. Defaults to 1."),
+    page_size: zod
+        .int()
+        .min(1)
+        .max(listPrivilegeRequestsQueryPageSizeMax)
+        .default(listPrivilegeRequestsQueryPageSizeDefault)
+        .describe("Items per page. Defaults to 50; at most 200."),
+    state: zod
+        .enum(["pending", "approved", "denied", "expired", "cancelled"])
+        .optional()
+        .describe("Return only the requests in this state"),
+    machine_id: zod.uuid().optional().describe("Return only the requests on this machine"),
+});
+/**
+ * Returns one of the caller's privilege requests.
+ * @summary Get a privilege request
+ */
+export const GetPrivilegeRequestParams = zod.strictObject({
+    requestId: zod.uuid(),
+});
+/**
+ * Approves one of the caller's pending requests; the waiting sudo goes on as root. Fails with
+ * `PRIVILEGE_REQUEST_CLOSED` when the request is no longer pending, with `metadata.state`
+ * giving how it ended.
+ * @summary Approve a privilege request
+ */
+export const ApprovePrivilegeRequestParams = zod.strictObject({
+    requestId: zod.uuid(),
+});
+/**
+ * Denies one of the caller's pending requests; the waiting sudo fails and shows `reason`,
+ * when given, to whoever ran it. Fails with `PRIVILEGE_REQUEST_CLOSED` as for approving.
+ * @summary Deny a privilege request
+ */
+export const DenyPrivilegeRequestParams = zod.strictObject({
+    requestId: zod.uuid(),
+});
+export const DenyPrivilegeRequestBody = DenyPrivilegeRequestRequest;
+/**
+ * Returns the pending enrollment request whose pairing code matches, or no enrollment when
+ * none does. Mistyped codes are expected and are not an error. Letters are matched
+ * case-insensitively, `I` and `L` are read as `1`, `O` as `0`, and spaces and hyphens are
+ * ignored.
+ *
+ * Only requests that are still pending are found. A request is pending while its machine
+ * keeps polling; one it stops polling expires after a few hours.
+ *
+ * Requires `fleet:machines.manage`.
+ * @summary Find an enrollment request by its pairing code
+ */
+export const findEnrollmentByPairingCodeQueryPairingCodeMax = 32;
+export const FindEnrollmentByPairingCodeQueryParams = zod.strictObject({
+    pairing_code: zod
+        .string()
+        .min(1)
+        .max(findEnrollmentByPairingCodeQueryPairingCodeMax)
+        .describe("The code the machine shows, such as `7K2QM-9XWTD`"),
+});
+/**
+ * Adds the machine to the current project under the given name and returns it. The Agent
+ * learns the decision the next time it polls.
+ *
+ * A request that is no longer pending is rejected with `ENROLLMENT_NOT_PENDING`.
+ *
+ * Requires `fleet:machines.manage`.
+ * @summary Approve an enrollment request
+ */
+export const ApproveEnrollmentParams = zod.strictObject({
+    enrollmentId: zod.uuid(),
+});
+export const ApproveEnrollmentBody = ApproveEnrollmentRequest;
+/**
+ * Refuses the request. The decision is final for the machine's key: the Agent stops
+ * polling and reports that it was denied.
+ *
+ * A request that is no longer pending is rejected with `ENROLLMENT_NOT_PENDING`.
+ *
+ * Requires `fleet:machines.manage`.
+ * @summary Deny an enrollment request
+ */
+export const DenyEnrollmentParams = zod.strictObject({
+    enrollmentId: zod.uuid(),
+});
+/**
+ * Returns the registrations of the current project, newest first. Registrations are kept
+ * for 30 days.
+ *
+ * Requires `fleet:machines.manage`.
+ * @summary List machine registrations
+ */
+export const listMachineRegistrationsQueryPageDefault = 1;
+export const listMachineRegistrationsQueryPageMax = 2147483647;
+export const listMachineRegistrationsQueryPageSizeDefault = 50;
+export const listMachineRegistrationsQueryPageSizeMax = 200;
+export const ListMachineRegistrationsQueryParams = zod.strictObject({
+    page: zod
+        .int()
+        .min(1)
+        .max(listMachineRegistrationsQueryPageMax)
+        .default(listMachineRegistrationsQueryPageDefault)
+        .describe("1-based page number. Defaults to 1."),
+    page_size: zod
+        .int()
+        .min(1)
+        .max(listMachineRegistrationsQueryPageSizeMax)
+        .default(listMachineRegistrationsQueryPageSizeDefault)
+        .describe("Items per page. Defaults to 50; at most 200."),
+});
+/**
+ * Reserves a machine in the current project under the given name and returns the
+ * registration with a one-time token. A machine that presents the token when it enrolls
+ * joins the project as `registration.machine_id` without approval. The token is returned
+ * only in this response and cannot be read again.
+ *
+ * Requires `fleet:machines.manage`.
+ * @summary Create a machine registration
+ */
+export const CreateMachineRegistrationBody = CreateMachineRegistrationRequest;
+/**
+ * Requires `fleet:machines.manage`.
+ * @summary Get a machine registration
+ */
+export const GetMachineRegistrationParams = zod.strictObject({
+    registrationId: zod.uuid(),
+});
+/**
+ * Revokes the registration: its token no longer enrolls a machine. Revoking a registration
+ * that is already revoked or expired succeeds and changes nothing else. A registration that
+ * a machine has used is rejected with `MACHINE_REGISTRATION_USED`; to remove that machine,
+ * delete the machine.
+ *
+ * Requires `fleet:machines.manage`.
+ * @summary Revoke a machine registration
+ */
+export const DeleteMachineRegistrationParams = zod.strictObject({
+    registrationId: zod.uuid(),
+});
+/**
+ * Returns the accounts of the project's members, ordered by username. A member who has never
+ * been able to log in to a machine has no account yet.
+ * @summary List accounts
+ */
+export const listAccountsQueryPageDefault = 1;
+export const listAccountsQueryPageMax = 2147483647;
+export const listAccountsQueryPageSizeDefault = 50;
+export const listAccountsQueryPageSizeMax = 200;
+export const listAccountsQueryKeywordMax = 128;
+export const ListAccountsQueryParams = zod.strictObject({
+    page: zod
+        .int()
+        .min(1)
+        .max(listAccountsQueryPageMax)
+        .default(listAccountsQueryPageDefault)
+        .describe("1-based page number. Defaults to 1."),
+    page_size: zod
+        .int()
+        .min(1)
+        .max(listAccountsQueryPageSizeMax)
+        .default(listAccountsQueryPageSizeDefault)
+        .describe("Items per page. Defaults to 50; at most 200."),
+    user_id: zod.uuid().optional().describe("Return only the account of this member"),
+    keyword: zod
+        .string()
+        .max(listAccountsQueryKeywordMax)
+        .optional()
+        .describe("Match the username or the display name, case-insensitively"),
+});
+/**
+ * Returns the account of a member of the project.
+ * @summary Get an account
+ */
+export const GetAccountParams = zod.strictObject({
+    accountId: zod.uuid(),
+});
+/**
+ * Changes the caller's own account, only the fields present in the request. The account is
+ * the same in every project, and a new username takes effect on the machines of all of them
+ * within about a minute; the uid stays, so files keep their owner.
+ *
+ * Fails with:
+ * - `ACCOUNT_NOT_OWNED` when the account is another member's;
+ * - `DIRECTORY_NAME_TAKEN` when another account or a group uses the username.
+ * @summary Update an account
+ */
+export const UpdateAccountParams = zod.strictObject({
+    accountId: zod.uuid(),
+});
+export const UpdateAccountBody = UpdateAccountRequest;
+/**
+ * Returns the groups of the project's directory, ordered by name.
+ * @summary List groups
+ */
+export const listGroupsQueryPageDefault = 1;
+export const listGroupsQueryPageMax = 2147483647;
+export const listGroupsQueryPageSizeDefault = 50;
+export const listGroupsQueryPageSizeMax = 200;
+export const ListGroupsQueryParams = zod.strictObject({
+    page: zod
+        .int()
+        .min(1)
+        .max(listGroupsQueryPageMax)
+        .default(listGroupsQueryPageDefault)
+        .describe("1-based page number. Defaults to 1."),
+    page_size: zod
+        .int()
+        .min(1)
+        .max(listGroupsQueryPageSizeMax)
+        .default(listGroupsQueryPageSizeDefault)
+        .describe("Items per page. Defaults to 50; at most 200."),
+});
+/**
+ * Creates a group in the project's directory. It reaches the machines within about a minute.
+ *
+ * Fails with `DIRECTORY_NAME_TAKEN` when an account, or another group of the project, uses the
+ * name.
+ *
+ * Requires `fleet:directory.manage`.
+ * @summary Create a group
+ */
+export const CreateGroupBody = CreateGroupRequest;
+/**
+ * @summary Get a group
+ */
+export const GetGroupParams = zod.strictObject({
+    groupId: zod.uuid(),
+});
+/**
+ * The gid stays, so files keep their group. Fails with `DIRECTORY_NAME_TAKEN` as for creating
+ * a group.
+ *
+ * Requires `fleet:directory.manage`.
+ * @summary Rename a group
+ */
+export const UpdateGroupParams = zod.strictObject({
+    groupId: zod.uuid(),
+});
+export const UpdateGroupBody = UpdateGroupRequest;
+/**
+ * Removes the group from the directory. Machines stop resolving it within about a minute;
+ * files keep its gid.
+ *
+ * Requires `fleet:directory.manage`.
+ * @summary Delete a group
+ */
+export const DeleteGroupParams = zod.strictObject({
+    groupId: zod.uuid(),
+});
+/**
+ * Returns the accounts in the group, ordered by username.
+ * @summary List the members of a group
+ */
+export const ListGroupMembersParams = zod.strictObject({
+    groupId: zod.uuid(),
+});
+export const listGroupMembersQueryPageDefault = 1;
+export const listGroupMembersQueryPageMax = 2147483647;
+export const listGroupMembersQueryPageSizeDefault = 50;
+export const listGroupMembersQueryPageSizeMax = 200;
+export const ListGroupMembersQueryParams = zod.strictObject({
+    page: zod
+        .int()
+        .min(1)
+        .max(listGroupMembersQueryPageMax)
+        .default(listGroupMembersQueryPageDefault)
+        .describe("1-based page number. Defaults to 1."),
+    page_size: zod
+        .int()
+        .min(1)
+        .max(listGroupMembersQueryPageSizeMax)
+        .default(listGroupMembersQueryPageSizeDefault)
+        .describe("Items per page. Defaults to 50; at most 200."),
+});
+/**
+ * The account must be a member's. Fails with `GROUP_MEMBER_EXISTS` when the account is
+ * already in the group.
+ *
+ * Requires `fleet:directory.manage`.
+ * @summary Add an account to a group
+ */
+export const CreateGroupMemberParams = zod.strictObject({
+    groupId: zod.uuid(),
+});
+export const CreateGroupMemberBody = CreateGroupMemberRequest;
+/**
+ * Removing an account that is not in the group succeeds.
+ *
+ * Requires `fleet:directory.manage`.
+ * @summary Remove an account from a group
+ */
+export const DeleteGroupMemberParams = zod.strictObject({
+    groupId: zod.uuid(),
+    accountId: zod.uuid(),
+});
+/**
+ * Returns the sessions of the current project's machines, newest first. Closed sessions are
+ * omitted unless `include_closed` is true.
+ * @summary List sessions
+ */
+export const listSessionsQueryPageDefault = 1;
+export const listSessionsQueryPageMax = 2147483647;
+export const listSessionsQueryPageSizeDefault = 50;
+export const listSessionsQueryPageSizeMax = 200;
+export const listSessionsQueryIncludeClosedDefault = false;
+export const ListSessionsQueryParams = zod.strictObject({
+    page: zod
+        .int()
+        .min(1)
+        .max(listSessionsQueryPageMax)
+        .default(listSessionsQueryPageDefault)
+        .describe("1-based page number. Defaults to 1."),
+    page_size: zod
+        .int()
+        .min(1)
+        .max(listSessionsQueryPageSizeMax)
+        .default(listSessionsQueryPageSizeDefault)
+        .describe("Items per page. Defaults to 50; at most 200."),
+    machine_id: zod.uuid().optional().describe("Return only the sessions of this machine"),
+    user_id: zod.uuid().optional().describe("Return only the sessions of this member"),
+    include_closed: zod
+        .boolean()
+        .default(listSessionsQueryIncludeClosedDefault)
+        .describe("Include closed sessions; defaults to false"),
+});
+/**
+ * Opens a session for the caller on a machine, as the caller's account, and returns once it
+ * is ready. With `desktop` the session has a desktop. Without, Fleet first prepares or reuses
+ * the account's separate ready lightweight graphical session, then creates a terminal session
+ * with its own SID and lifetime; closing that terminal does not close the account context. Its
+ * one terminal runs the caller's login shell from the start, every participant attaches to
+ * that terminal, and the session ends when the shell exits; a caller who wants another
+ * terminal opens another session. Either kind also offers programs, files, ports, sound,
+ * devices, printers and privilege approvals. The account is created if the caller has none
+ * yet. Requires `fleet:machines.login` on the machine.
+ * All newly created graphical account sessions, including desktop-first FullDesktop and
+ * Seamless sessions, keep running when no viewer has joined or the last viewer disconnects.
+ * Configured maximum lifetime, resource limits and explicit close/terminate still apply.
+ * This create API has no client-selected idle policy; existing running policies are not
+ * silently rewritten when tools, commands or terminals reuse the account context.
+ *
+ * On a machine an account has at most one session with a desktop and at most 8 sessions in
+ * all. Sessions without a desktop run side by side, such as one for a program and one for a
+ * person; several participants can also share one session.
+ *
+ * Fails with:
+ * - `MACHINE_OFFLINE` when the machine is not connected and does not connect again in time;
+ * - `FEATURE_UNAVAILABLE` when the machine does not offer sessions or the graphical backend;
+ * - `SESSION_UNAVAILABLE` or `SESSION_CLOSED` when its shared account context is not ready or closing;
+ * - `USER_HAS_DESKTOP_SESSION` with `desktop` when the account already has a session with a
+ *   desktop on the machine, which `metadata.sessionId` names; connect to it instead;
+ * - `SESSION_LIMIT_REACHED` when the account already has 8 open sessions on the machine;
+ *   close one first;
+ * - `USER_NOT_FOUND`, `USER_NOT_ALLOWED`, `ACCOUNT_EXPIRED` or `PAM_PERMISSION_DENIED` when
+ *   the machine refuses the account, such as while it has not received the account yet or a
+ *   local account uses its name; `PAM_PERMISSION_DENIED` carries the machine's message in
+ *   `metadata.pamMessage`;
+ * - `SESSION_CONFLICT` with `desktop` when the account has a graphical session on the
+ *   machine that Fleet did not open;
+ * - `DISPLAY_UNAVAILABLE` or `SESSION_START_FAILED` when the machine could not start it;
+ * - `MACHINE_TIMEOUT` when the machine did not answer in time. The session may still open;
+ *   list the sessions before trying again.
+ * @summary Open a session
+ */
+export const CreateSessionBody = CreateSessionRequest;
+/**
+ * @summary Get a session
+ */
+export const getSessionPathSessionIdMax = 40;
+export const getSessionPathSessionIdRegExp = new RegExp("^[a-z0-9-]+$");
+export const GetSessionParams = zod.strictObject({
+    sessionId: zod
+        .string()
+        .min(1)
+        .max(getSessionPathSessionIdMax)
+        .regex(getSessionPathSessionIdRegExp),
+});
+/**
+ * Ends the session in order: its applications are asked to exit and get a grace period
+ * before the session is terminated. Returns once the session is closed. Closing a closed
+ * session succeeds.
+ *
+ * The owner may close their own session; closing another member's requires
+ * `fleet:sessions.manage`. Fails with `MACHINE_OFFLINE` or `MACHINE_TIMEOUT` as
+ * for opening a session.
+ * @summary Close a session
+ */
+export const closeSessionPathSessionIdMax = 40;
+export const closeSessionPathSessionIdRegExp = new RegExp("^[a-z0-9-]+$");
+export const CloseSessionParams = zod.strictObject({
+    sessionId: zod
+        .string()
+        .min(1)
+        .max(closeSessionPathSessionIdMax)
+        .regex(closeSessionPathSessionIdRegExp),
+});
+/**
+ * Ends the session at once, killing every process in it. Returns once the session is
+ * closed. Terminating a closed session succeeds.
+ *
+ * The owner may terminate their own session; terminating another member's requires
+ * `fleet:sessions.manage`. Fails with `MACHINE_OFFLINE` or `MACHINE_TIMEOUT` as
+ * for opening a session.
+ * @summary Terminate a session
+ */
+export const terminateSessionPathSessionIdMax = 40;
+export const terminateSessionPathSessionIdRegExp = new RegExp("^[a-z0-9-]+$");
+export const TerminateSessionParams = zod.strictObject({
+    sessionId: zod
+        .string()
+        .min(1)
+        .max(terminateSessionPathSessionIdMax)
+        .regex(terminateSessionPathSessionIdRegExp),
+});
+/**
+ * Returns the STUN and TURN servers for the PeerConnections the caller starts to the session,
+ * with TURN credentials of its own, and the policy for using them. Ask again once
+ * `expires_at` has passed; the credentials of a PeerConnection already relayed last longer.
+ *
+ * Requires that the caller may join the session, as for `create-participant`.
+ *
+ * Fails with:
+ * - `SESSION_CLOSED` when the session has ended;
+ * - `SESSION_ACCESS_DENIED` when the caller may not join the session.
+ * @summary Get the ICE servers for a session
+ */
+export const getSessionRtcConfigurationPathSessionIdMax = 40;
+export const getSessionRtcConfigurationPathSessionIdRegExp = new RegExp("^[a-z0-9-]+$");
+export const GetSessionRtcConfigurationParams = zod.strictObject({
+    sessionId: zod
+        .string()
+        .min(1)
+        .max(getSessionRtcConfigurationPathSessionIdMax)
+        .regex(getSessionRtcConfigurationPathSessionIdRegExp),
+});
+/**
+ * Admits one participant with the given public key to the session: signs its authorization,
+ * has the session accept it, and starts its first PeerConnection with the offer. The answer
+ * carries the participant, its authorization and the PeerConnection with the session's
+ * answer and the ICE candidates the session has passed so far; read its later candidates
+ * with `get-peer-connection`. The participant lasts while it is renewed.
+ *
+ * Joining again with the public key of one of the caller's participants of the session that
+ * has not ended, with the same `client_name`, `read_only` and `permissions`, returns that
+ * participant with a new PeerConnection for the offer, and the session gains no second
+ * participant: a request whose answer was lost, such as on an unreliable network, is sent
+ * again as it was. Its earlier PeerConnection, whose answer the client never received, is
+ * given up by the session once it fails.
+ *
+ * The owner of a session may operate it. Joining another member's session requires
+ * `fleet:sessions.view`, which admits watching only, or
+ * `fleet:sessions.control`, which also admits operating it. Each further capability
+ * of the session — file transfer, the clipboard, terminals and programs, port forwarding,
+ * devices and audio, printing, SSH agent forwarding, approving privilege requests and
+ * reading logs — is granted only with its permission; a participant that may only watch gets
+ * none of them. A request may ask for less: to watch only, or for some of the capabilities.
+ *
+ * Fails with the following, and then no participant was created:
+ * - `SESSION_CLOSED` when the session has ended;
+ * - `SESSION_ACCESS_DENIED` when the caller may not join the session;
+ * - `OFFER_INVALID` when the offer is not an SDP offer that names a SHA-256 DTLS fingerprint;
+ * - `SESSION_UNAVAILABLE` when the session's process is not connected and does not connect
+ *   again in time, or did not answer in time; try again after the error's `retry_delay`;
+ * - `PARTICIPANT_LIMIT_REACHED` when the session has as many participants as it admits;
+ * - `PARTICIPANT_REFUSED` when the session refused the participant;
+ * - `PARTICIPANT_KEY_IN_USE` when the public key belongs to a participant of the session that
+ *   another user holds, or that was created with another `client_name`, `read_only` or
+ *   `permissions`; join with a new key;
+ * - `PEER_CONNECTION_ABORTED` when the session gave up the PeerConnection; try again with a
+ *   new offer. The participant of a repeated request stays.
+ * @summary Join a session
+ */
+export const createParticipantPathSessionIdMax = 40;
+export const createParticipantPathSessionIdRegExp = new RegExp("^[a-z0-9-]+$");
+export const CreateParticipantParams = zod.strictObject({
+    sessionId: zod
+        .string()
+        .min(1)
+        .max(createParticipantPathSessionIdMax)
+        .regex(createParticipantPathSessionIdRegExp),
+});
+export const CreateParticipantBody = CreateParticipantRequest;
+/**
+ * Returns the participants of the session, in the order they joined.
+ * @summary List the participants of a session
+ */
+export const listSessionParticipantsPathSessionIdMax = 40;
+export const listSessionParticipantsPathSessionIdRegExp = new RegExp("^[a-z0-9-]+$");
+export const ListSessionParticipantsParams = zod.strictObject({
+    sessionId: zod
+        .string()
+        .min(1)
+        .max(listSessionParticipantsPathSessionIdMax)
+        .regex(listSessionParticipantsPathSessionIdRegExp),
+});
+/**
+ * Extends the participant's lease and returns renewed PeerAuthorizations for the
+ * PeerConnections whose current ones the request presents. The service sends them to the
+ * session as well, and the participant passes each one to the session over its PeerConnection
+ * (`Packet.peer_authorization` of the transport protocol), so that the lease holds while
+ * either path to the session is down. A
+ * presented authorization that the service did not sign for this participant, or whose
+ * PeerConnection has ended, is left out of the answer. When the participant's authorization
+ * nears its end, the answer carries a renewed one, which the session already holds.
+ *
+ * Only the participant's user may renew it.
+ *
+ * Fails with:
+ * - `PARTICIPANT_NOT_FOUND` when the participant has ended; create another;
+ * - `PARTICIPANT_PERMISSION_REVOKED` when a permission the participant was created with has
+ *   been revoked from the caller; it has ended, and another can be created with the
+ *   permissions the caller holds now;
+ * - `PROJECT_MEMBERSHIP_REQUIRED` when the caller is no longer a member of the project; the
+ *   participant has ended.
+ * @summary Renew a participant
+ */
+export const renewParticipantPathSessionIdMax = 40;
+export const renewParticipantPathSessionIdRegExp = new RegExp("^[a-z0-9-]+$");
+export const RenewParticipantParams = zod.strictObject({
+    sessionId: zod
+        .string()
+        .min(1)
+        .max(renewParticipantPathSessionIdMax)
+        .regex(renewParticipantPathSessionIdRegExp),
+    participantId: zod.int().min(1),
+});
+export const RenewParticipantBody = RenewParticipantRequest;
+/**
+ * Passes the participant's checkpoint for the next epoch to the session and returns the
+ * session's checkpoint for it: the `prepare` and `prepared` steps of `Migration` in
+ * `leaflow/fleet/transport/v1/transport.proto`. Repeating the step returns the same answer.
+ *
+ * Only the participant's user may migrate it.
+ *
+ * Fails with:
+ * - `PARTICIPANT_NOT_FOUND` when the participant has ended;
+ * - `CHECKPOINT_INVALID` when the checkpoint is not a serialized `Checkpoint`;
+ * - `SESSION_UNAVAILABLE` when the session's process is not connected and does not connect
+ *   again in time, or did not answer in time; try again after the error's `retry_delay`.
+ * @summary Prepare a migration
+ */
+export const prepareParticipantMigrationPathSessionIdMax = 40;
+export const prepareParticipantMigrationPathSessionIdRegExp = new RegExp("^[a-z0-9-]+$");
+export const PrepareParticipantMigrationParams = zod.strictObject({
+    sessionId: zod
+        .string()
+        .min(1)
+        .max(prepareParticipantMigrationPathSessionIdMax)
+        .regex(prepareParticipantMigrationPathSessionIdRegExp),
+    participantId: zod.int().min(1),
+});
+export const PrepareParticipantMigrationBody = MigrationStep;
+/**
+ * Commits the epoch the participant prepared and returns the session's checkpoint once it
+ * committed it: the `commit` and `committed` steps of `Migration` in
+ * `leaflow/fleet/transport/v1/transport.proto`. Repeating the step returns the same answer.
+ *
+ * Only the participant's user may migrate it.
+ *
+ * Fails with:
+ * - `PARTICIPANT_NOT_FOUND` when the participant has ended;
+ * - `CHECKPOINT_INVALID` when the checkpoint is not a serialized `Checkpoint`;
+ * - `SESSION_UNAVAILABLE` when the session's process is not connected and does not connect
+ *   again in time, or did not answer in time; try again after the error's `retry_delay`.
+ * @summary Commit a migration
+ */
+export const commitParticipantMigrationPathSessionIdMax = 40;
+export const commitParticipantMigrationPathSessionIdRegExp = new RegExp("^[a-z0-9-]+$");
+export const CommitParticipantMigrationParams = zod.strictObject({
+    sessionId: zod
+        .string()
+        .min(1)
+        .max(commitParticipantMigrationPathSessionIdMax)
+        .regex(commitParticipantMigrationPathSessionIdRegExp),
+    participantId: zod.int().min(1),
+});
+export const CommitParticipantMigrationBody = MigrationStep;
+/**
+ * Starts another PeerConnection of the participant with the offer, such as after a path
+ * failed, and returns the session's answer, the ICE candidates it has passed so far and the
+ * signed PeerAuthorization; read its later candidates with `get-peer-connection`. Move the
+ * participant's connection to it with
+ * `prepare-participant-migration` and `commit-participant-migration`.
+ *
+ * Only the participant's user may start one.
+ *
+ * Fails with:
+ * - `PARTICIPANT_NOT_FOUND` when the participant has ended;
+ * - `OFFER_INVALID` when the offer is not an SDP offer that names a SHA-256 DTLS fingerprint;
+ * - `RATE_LIMIT_EXCEEDED` when the participant started too many PeerConnections in the
+ *   last minute; try again after the error's `retry_delay`;
+ * - `SESSION_UNAVAILABLE` when the session's process is not connected and does not connect
+ *   again in time, or did not answer in time; try again after the error's `retry_delay`;
+ * - `PEER_CONNECTION_ABORTED` when the session gave up the PeerConnection; start another.
+ * @summary Start a PeerConnection
+ */
+export const createPeerConnectionPathSessionIdMax = 40;
+export const createPeerConnectionPathSessionIdRegExp = new RegExp("^[a-z0-9-]+$");
+export const CreatePeerConnectionParams = zod.strictObject({
+    sessionId: zod
+        .string()
+        .min(1)
+        .max(createPeerConnectionPathSessionIdMax)
+        .regex(createPeerConnectionPathSessionIdRegExp),
+    participantId: zod.int().min(1),
+});
+export const CreatePeerConnectionBody = CreatePeerConnectionRequest;
+/**
+ * Returns the PeerConnection with the ICE candidates the session has passed so far. The
+ * session passes its candidates as it gathers them (RFC 8838), so most arrive after the
+ * PeerConnection started: read it until `candidates_complete`, and add the candidates that
+ * are new since the last read to the PeerConnection. A client keeps those that arrive before
+ * it has set the answer as the remote description, and adds them once it has.
+ *
+ * With `known_candidates`, the request waits until the session has passed more candidates
+ * than that or reported the end of its candidates, for at most 20 seconds, and then returns
+ * the PeerConnection as it is.
+ *
+ * A PeerConnection can be read for 5 minutes after it started. Only the participant's user
+ * may read it.
+ *
+ * Fails with:
+ * - `PARTICIPANT_NOT_FOUND` when the participant has ended;
+ * - `PEER_CONNECTION_NOT_FOUND` when the participant has no such PeerConnection, it was
+ *   abandoned, the session gave it up, or it started more than 5 minutes ago.
+ * @summary Get a PeerConnection
+ */
+export const getPeerConnectionPathSessionIdMax = 40;
+export const getPeerConnectionPathSessionIdRegExp = new RegExp("^[a-z0-9-]+$");
+export const GetPeerConnectionParams = zod.strictObject({
+    sessionId: zod
+        .string()
+        .min(1)
+        .max(getPeerConnectionPathSessionIdMax)
+        .regex(getPeerConnectionPathSessionIdRegExp),
+    participantId: zod.int().min(1),
+    peerConnectionId: zod.uuid(),
+});
+export const getPeerConnectionQueryKnownCandidatesMin = 0;
+export const getPeerConnectionQueryKnownCandidatesMax = 64;
+export const GetPeerConnectionQueryParams = zod.strictObject({
+    known_candidates: zod
+        .int()
+        .min(getPeerConnectionQueryKnownCandidatesMin)
+        .max(getPeerConnectionQueryKnownCandidatesMax)
+        .optional()
+        .describe("The number of the session's candidates the caller already has. The request waits until\nthere are more or the session reported the end of its candidates, for at most 20\nseconds. Without it, the request returns at once."),
+});
+/**
+ * Tells the session to give up the PeerConnection and close it. Abandoning a PeerConnection
+ * that has ended succeeds.
+ *
+ * Only the participant's user may abandon it.
+ *
+ * Fails with `PARTICIPANT_NOT_FOUND` when the participant has ended.
+ * @summary Abandon a PeerConnection
+ */
+export const deletePeerConnectionPathSessionIdMax = 40;
+export const deletePeerConnectionPathSessionIdRegExp = new RegExp("^[a-z0-9-]+$");
+export const DeletePeerConnectionParams = zod.strictObject({
+    sessionId: zod
+        .string()
+        .min(1)
+        .max(deletePeerConnectionPathSessionIdMax)
+        .regex(deletePeerConnectionPathSessionIdRegExp),
+    participantId: zod.int().min(1),
+    peerConnectionId: zod.uuid(),
+});
+/**
+ * Passes the ICE candidates the participant gathered after its offer to the session, and with
+ * `end_of_candidates`, that it has gathered all (RFC 8838). The session ignores those of a
+ * PeerConnection that has ended.
+ *
+ * Only the participant's user may add them.
+ *
+ * Fails with:
+ * - `PARTICIPANT_NOT_FOUND` when the participant has ended;
+ * - `SESSION_UNAVAILABLE` when the session's process is not connected and does not connect
+ *   again in time; try again after the error's `retry_delay`.
+ * @summary Add ICE candidates to a PeerConnection
+ */
+export const createPeerConnectionCandidatesPathSessionIdMax = 40;
+export const createPeerConnectionCandidatesPathSessionIdRegExp = new RegExp("^[a-z0-9-]+$");
+export const CreatePeerConnectionCandidatesParams = zod.strictObject({
+    sessionId: zod
+        .string()
+        .min(1)
+        .max(createPeerConnectionCandidatesPathSessionIdMax)
+        .regex(createPeerConnectionCandidatesPathSessionIdRegExp),
+    participantId: zod.int().min(1),
+    peerConnectionId: zod.uuid(),
+});
+export const CreatePeerConnectionCandidatesBody = CreatePeerConnectionCandidatesRequest;
+/**
+ * Returns a participant of the session.
+ * @summary Get a participant of a session
+ */
+export const getParticipantPathSessionIdMax = 40;
+export const getParticipantPathSessionIdRegExp = new RegExp("^[a-z0-9-]+$");
+export const GetParticipantParams = zod.strictObject({
+    sessionId: zod
+        .string()
+        .min(1)
+        .max(getParticipantPathSessionIdMax)
+        .regex(getParticipantPathSessionIdRegExp),
+    participantId: zod.int().min(1),
+});
+/**
+ * Ends the participant: the session detaches it and closes its PeerConnections, and the
+ * session goes on. A participant leaves this way; others are disconnected this way.
+ *
+ * The participant's user and the owner of the session may end it; otherwise this
+ * requires `fleet:sessions.manage`.
+ * @summary End a participant
+ */
+export const deleteParticipantPathSessionIdMax = 40;
+export const deleteParticipantPathSessionIdRegExp = new RegExp("^[a-z0-9-]+$");
+export const DeleteParticipantParams = zod.strictObject({
+    sessionId: zod
+        .string()
+        .min(1)
+        .max(deleteParticipantPathSessionIdMax)
+        .regex(deleteParticipantPathSessionIdRegExp),
+    participantId: zod.int().min(1),
+});