@leaflow/sdk 0.0.0-dev.51.g1857c7d → 0.0.0-dev.513.g3807ace

package/dist/fleet/v1/generated/functions.d.ts

@@ -0,0 +1,1857 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Fleet API
+ * Machines that run the Leaflow Fleet Agent (`leaflow-fleet-agent`): adding machines, the
+ * accounts and groups that log in to them, running commands, opening and closing sessions, with
+ * or without a desktop, and admitting participants to them.
+ *
+ * ## What this API sees
+ *
+ * This API coordinates. It admits participants to sessions and passes the signaling of their
+ * PeerConnections, but everything a session shows or receives — terminals, files, the screen,
+ * input, the clipboard, printing and privilege approvals on a participant — travels end to end
+ * between the participant and the session, encrypted with keys that never leave them. The
+ * platform sees which machine, which session and who is connected, and nothing of what happens
+ * inside.
+ *
+ * Commands and privilege requests decided on the platform are the exception: the platform passes
+ * a command and its output between the caller and the machine, and keeps the command line of a
+ * privilege request it asks the owner about; it sees both.
+ *
+ * ## Authentication
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme.
+ *
+ * **Neither the path nor the headers carry a `project_id`**: the current project is determined by
+ * the token.
+ *
+ * ## Adding a machine
+ *
+ * 1. Install the Agent and run `leaflow-fleet-agent daemon enroll` on the machine. The command
+ *    carries no secret. The machine shows a pairing code such as `7K2QM-9XWTD`.
+ * 2. Find the request with `GET /api/v1/enrollments:find?pairing_code=…`. Compare its `hostname`
+ *    and `source_address` with the machine in front of you: the pairing code is not a secret,
+ *    and anyone can request enrollment.
+ * 3. Approve it with `POST /api/v1/enrollments/{enrollmentId}:approve`. The machine joins the
+ *    current project within its next polling interval.
+ *
+ * ## Adding a machine without interaction
+ *
+ * A machine that is set up unattended, such as by cloud-init on first boot, joins with a
+ * registration token instead of a pairing code:
+ *
+ * 1. Create a registration with `POST /api/v1/machine-registrations`. It reserves a machine in
+ *    the current project under the given name and returns its `machine_id` and a `token`. The
+ *    token is returned only in this response.
+ * 2. Give the token to the machine in a file that only root can read, and run
+ *    `leaflow-fleet-agent daemon enroll --url <control endpoint> --token-file <path>`. The
+ *    machine joins the current project as `machine_id` at once, and the Agent deletes the file.
+ *
+ * A token enrolls one machine once, and only until the registration expires. Anyone who reads
+ * the token before the machine uses it can enroll a key of their own instead, so pass it only
+ * to the machine, keep its lifetime short, and compare the `public_key` of the used
+ * registration with the key the machine shows when that matters. Revoke a registration that
+ * will not be used with `DELETE /api/v1/machine-registrations/{registrationId}`.
+ *
+ * ## Trusting a machine's key
+ *
+ * Each machine has an Ed25519 key that it generates itself and that never leaves it. Participants
+ * verify that key end to end before they exchange any data with a session, so a client must
+ * decide which key belongs to a machine without relying on any party in between:
+ *
+ * - When approving an enrollment, recompute the pairing code from `public_key` and compare it
+ *   with the code the machine shows. The code is derived as documented for
+ *   `EnrollMachineResponse.pairing_code` in `leaflow/fleet/machine/v1/machine.proto`.
+ *   Approve only when they match, and remember the key for the machine.
+ * - On any other client, remember the key the first time it connects to the machine, and
+ *   refuse to continue whenever the machine later proves a different key. The fingerprint can
+ *   be compared with the one the Agent prints on the machine.
+ *
+ * A machine that is reinstalled enrolls again as a new machine with a new key.
+ *
+ * ## Features
+ *
+ * A machine reports what it offers in `features`, each named after the protocol package that
+ * defines it:
+ *
+ * - `leaflow.fleet.directory.v1`: the accounts of the project's members and the project's groups
+ *   exist on the machine; members log in over SSH with their keys and become root through sudo
+ *   as their permissions allow;
+ * - `leaflow.fleet.command.v1`: running commands;
+ * - `leaflow.fleet.mcp.v1`: the MCP servers each account configures on the machine, local ones
+ *   and remote ones it connects to;
+ * - `leaflow.fleet.host.v1`: terminal sessions, with programs, files, ports, sound, devices,
+ *   printers and privilege approvals;
+ * - `leaflow.fleet.virtualdesktop.host.v1`: sessions with a graphical backend;
+ * - `leaflow.fleet.tool.v1`: live session tools. Builtin `computer.*` tools are exposed only while
+ *   the virtual desktop capability is actually available; MCP is a separate source.
+ *
+ * A graphical backend does not require a full desktop environment. When the machine reports
+ * graphical capability available, terminal logins and commands prepare or reuse the account's
+ * lightweight graphical context, in addition to their own session or job. Without graphical
+ * capability, ordinary commands and terminal sessions run without creating a graphical context
+ * or injecting X environment variables. MCP server initialization prepares or reuses a graphical
+ * context; configuration reads and writes do not initialize a server or require this preparation.
+ * A request that needs a feature the machine does not report available fails with
+ * `FEATURE_UNAVAILABLE`, whose `metadata.feature` names it.
+ *
+ * ## Directory
+ *
+ * Every user has one account, as with Google Cloud OS Login: a username and a uid that are the
+ * same on every machine of every project. The account is created the first time the user may log
+ * in to a machine or opens a session; its username comes from the email address, such as
+ * `alice_example_com` for `alice@example.com`, and its owner can change it. A project's machines
+ * know the accounts of the project's members and the groups the project defines. A member who
+ * leaves the project can no longer log in, and files keep their owner.
+ *
+ * Who may log in to which machines, and who may become root there through sudo, are permissions
+ * of the project's roles: `fleet:machines.login` and `fleet:machines.admin`, each for all
+ * machines or for chosen ones. Changes reach the machines within about a minute, and every login
+ * and elevation is checked against the current permissions while the machine is connected. To
+ * keep a member out of some machines, deny them `fleet:machines.login` on those machines.
+ * Elevation through sudo is never approved by a password; see "Approving sudo".
+ *
+ * Members log in over SSH with the SSH keys of their own accounts (`/account/v1/me/ssh-keys` on
+ * the account API), while they may log in to the machine.
+ *
+ * Machines resolve directory accounts and groups themselves and never write them into their local
+ * account files. A local account or group that already uses a name or id of the directory keeps
+ * it, and the machine records the conflict among its events.
+ *
+ * ## Running commands
+ *
+ * `POST /api/v1/machines/{machineId}:runCommand` runs one command line on the machine as the
+ * caller's account, as `ssh machine 'command'` would, but without SSH: the machine needs no open
+ * port, no distributed key and no address the caller can reach. Like logging in, it requires
+ * `fleet:machines.login` on the machine. Inside the command, `sudo` works without a prompt for
+ * a caller with `fleet:machines.admin` on the machine: the request approves the elevation.
+ *
+ * ## MCP servers
+ *
+ * A machine that offers `leaflow.fleet.mcp.v1` reaches the MCP servers its accounts configure:
+ * servers it runs itself and remote servers it connects to. Each account configures them in
+ * `~/.local/share/leaflow/agent/mcp.json` in its home directory, in the `mcpServers` format other
+ * MCP clients use, by hand or through this API; the machine picks up every change by itself.
+ * The caller's servers run as the caller's account, and the requests below act on them only.
+ *
+ * The configuration stays on the machine. The values of `env` and `headers` often hold
+ * credentials: this API writes them, and they then pass through the platform, but never returns
+ * them. Arguments, URLs, tool arguments and tool results pass through the platform as they are.
+ *
+ * ## Approving sudo
+ *
+ * An account may become root through sudo on a machine while its user has
+ * `fleet:machines.admin` there. Each elevation is approved, in the first of these ways that
+ * applies:
+ *
+ * - inside a command run through this API, by the request itself;
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
+ * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
+ *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
+ *   to. A request nobody decides expires, and sudo fails.
+ *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
+ * Requests reach the user's devices as they happen through EventBus: the event
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
+ * pending requests.
+ *
+ * ## Connections that drop
+ *
+ * A machine's Agent and a session's process each keep a connection to the service, and on a poor
+ * network it may drop and come back within seconds. Requests do not fail for that:
+ *
+ * - A request that needs the machine or the session's process waits while it connects again,
+ *   for as long as the request would wait for its answer, and fails with `MACHINE_OFFLINE` or
+ *   `SESSION_UNAVAILABLE` only when it does not come back in that time.
+ * - What the machine or the session's process received before its connection dropped, such as a
+ *   command or a session being opened, goes on, and its result is returned once it has
+ *   connected again within that time.
+ *
+ * A machine stays `online` for up to a minute after its connection was lost, while its Agent
+ * connects again; a machine whose Agent stops is offline at once.
+ *
+ * ## Operations that do not exist
+ *
+ * Some resources lack an operation on purpose:
+ *
+ * - Accounts are created when they are first needed and are never deleted, so that files keep
+ *   their owner.
+ * - Enrollment requests are made only by machines.
+ * - A machine registration cannot be changed; revoke it and create another.
+ * - Machine events are a log: they are listed, never changed, and kept for 30 days.
+ * - A privilege request is decided only by the user whose account asks, or on a participant of
+ *   the session it comes from.
+ *
+ * ## Joining a session
+ *
+ * 1. Have an Ed25519 key, for as long as the client wants: one per participant or one kept by
+ *    the client. The private key must never leave the client; in a browser, use a
+ *    non-extractable WebCrypto key.
+ * 2. Get the ICE servers with `GET /api/v1/sessions/{sessionId}/rtc-configuration`, create a
+ *    PeerConnection with them and its data channels (`leaflow/fleet/transport/v1/transport.proto`)
+ *    and make an offer. Wait briefly for ICE candidates, such as until gathering completes or
+ *    one second has passed, so that the offer carries them.
+ * 3. Join with `POST /api/v1/sessions/{sessionId}/participants`, sending the public key and the
+ *    offer. The answer carries the participant's signed authorization, the keys the service
+ *    signs with, and the first PeerConnection: the session's SDP answer, the ICE candidates it
+ *    has passed so far and the signed PeerAuthorization. Pass candidates gathered later with
+ *    `POST …/participants/{participantId}/peer-connections/{peerConnectionId}/candidates`, and
+ *    read the session's later ones with
+ *    `GET …/participants/{participantId}/peer-connections/{peerConnectionId}` until
+ *    `candidates_complete`.
+ * 4. Renew the participant with `POST …/participants/{participantId}:renew` well before
+ *    `lease_expires_at`, every 15 seconds, presenting the PeerAuthorization of each
+ *    PeerConnection; the answer renews them. A participant whose lease runs out ends, and its
+ *    PeerConnections stop within 30 seconds of their last lease.
+ * 5. When a path fails, start another PeerConnection with
+ *    `POST …/participants/{participantId}/peer-connections` and move the connection to it with
+ *    `:prepareMigration` and `:commitMigration`. Abandon a PeerConnection that does not
+ *    connect with `DELETE …/peer-connections/{peerConnectionId}`.
+ * 6. Leave with `DELETE …/participants/{participantId}`.
+ *
+ * Signaling travels only through these requests; a participant holds no other connection to
+ * the service.
+ *
+ * What a participant may do in a session is decided when it is created, from the caller's
+ * permissions and what the request asks for, and does not change afterwards. Participants are not
+ * told apart by kind: a person in a browser and a program that operates the session are both
+ * participants, named by the `client_name` they choose, and either can be disconnected.
+ *
+ * Every participant that ends, including through `DELETE`, is announced through EventBus as
+ * `leaflow.fleet.participant.ended`, addressed to its user in the current project, with its
+ * `session_id`, `participant_id` (a decimal string) and `reason`: `left` when its user ended it,
+ * `removed` when someone else did, `lease_expired` when it was not renewed in time,
+ * `session_ended` when its session ended, `session_process_lost` when the session's process did
+ * not come back in time, `permission_revoked` when a permission it was created with was revoked
+ * from its user, `membership_ended` when its user is no longer a member of the project,
+ * `user_inactive` when its user's account was suspended or banned or its deletion was requested,
+ * `project_deletion_requested` when deletion of the project was requested, `machine_removed` when
+ * its machine was removed, or `key_revoked` when the key that signed its authorization was
+ * revoked. A participant whose creation failed is not announced.
+ * OpenAPI spec version: 1.0.0
+ */
+import type { AccountList, AccountResource, ApproveEnrollmentRequest, CallMcpToolRequest, CallMcpToolResponse, CallToolRequest, CallToolResponse, CreateGroupMemberRequest, CreateGroupRequest, CreateMachineRegistrationRequest, CreateMachineRegistrationResponse, CreateParticipantRequest, CreateParticipantResponse, CreatePeerConnectionCandidatesRequest, CreatePeerConnectionRequest, CreateSessionRequest, DeleteMcpServerParams, DenyPrivilegeRequestRequest, EnrollmentResource, Error, FindEnrollmentByPairingCodeParams, FindEnrollmentResponse, GetPeerConnectionParams, GroupList, GroupResource, ListAccountsParams, ListGroupMembersParams, ListGroupsParams, ListMachineEventsParams, ListMachineRegistrationsParams, ListMachinesParams, ListPrivilegeAutoApprovalsParams, ListPrivilegeRequestsParams, ListSessionsParams, ListToolsParams, MachineEventList, MachineList, MachineRegistrationList, MachineRegistrationResource, MachineResource, McpConfigurationFile, McpConfigurationResource, MigrationStep, ParticipantList, ParticipantResource, PeerConnection, PrivilegeAutoApprovalList, PrivilegeAutoApprovalResource, PrivilegeRequestList, PrivilegeRequestResource, RenewParticipantRequest, RenewParticipantResponse, ReplaceMcpConfigurationRequest, RtcConfiguration, RunCommandRequest, RunCommandResponse, SendMcpRequestRequest, SendMcpRequestResponse, SessionList, SessionResource, ToolActivityList, ToolList, UpdateAccountRequest, UpdateGroupRequest, UpdateMachineRequest, UpdateMcpServerRequest, UpdateMcpServerResponse, UpdatePrivilegeAutoApprovalRequest } from "./models.js";
+export type HTTPStatusCode1xx = 100 | 101 | 102 | 103;
+export type HTTPStatusCode2xx = 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207;
+export type HTTPStatusCode3xx = 300 | 301 | 302 | 303 | 304 | 305 | 307 | 308;
+export type HTTPStatusCode4xx = 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 419 | 420 | 421 | 422 | 423 | 424 | 426 | 428 | 429 | 431 | 451;
+export type HTTPStatusCode5xx = 500 | 501 | 502 | 503 | 504 | 505 | 507 | 511;
+export type HTTPStatusCodes = HTTPStatusCode1xx | HTTPStatusCode2xx | HTTPStatusCode3xx | HTTPStatusCode4xx | HTTPStatusCode5xx;
+export type listMachinesResponse200 = {
+    data: MachineList;
+    status: 200;
+};
+export type listMachinesResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type listMachinesResponseSuccess = listMachinesResponse200 & {
+    headers: Headers;
+};
+export type listMachinesResponseError = listMachinesResponseDefault & {
+    headers: Headers;
+};
+export type listMachinesResponse = listMachinesResponseSuccess | listMachinesResponseError;
+export declare const getListMachinesUrl: (params?: ListMachinesParams) => string;
+/**
+ * Returns the machines of the current project, newest first.
+ * @summary List machines
+ */
+export declare const listMachines: (params?: ListMachinesParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listMachinesResponse>;
+export type getMachineResponse200 = {
+    data: MachineResource;
+    status: 200;
+};
+export type getMachineResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type getMachineResponseSuccess = getMachineResponse200 & {
+    headers: Headers;
+};
+export type getMachineResponseError = getMachineResponseDefault & {
+    headers: Headers;
+};
+export type getMachineResponse = getMachineResponseSuccess | getMachineResponseError;
+export declare const getGetMachineUrl: (machineId: string) => string;
+/**
+ * @summary Get a machine
+ */
+export declare const getMachine: (machineId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<getMachineResponse>;
+export type updateMachineResponse200 = {
+    data: MachineResource;
+    status: 200;
+};
+export type updateMachineResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type updateMachineResponseSuccess = updateMachineResponse200 & {
+    headers: Headers;
+};
+export type updateMachineResponseError = updateMachineResponseDefault & {
+    headers: Headers;
+};
+export type updateMachineResponse = updateMachineResponseSuccess | updateMachineResponseError;
+export declare const getUpdateMachineUrl: (machineId: string) => string;
+/**
+ * Changes the machine's name. Requires `fleet:machines.manage`.
+ * @summary Update a machine
+ */
+export declare const updateMachine: (machineId: string, updateMachineRequest: UpdateMachineRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<updateMachineResponse>;
+export type deleteMachineResponse204 = {
+    data: void;
+    status: 204;
+};
+export type deleteMachineResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 204>;
+};
+export type deleteMachineResponseSuccess = deleteMachineResponse204 & {
+    headers: Headers;
+};
+export type deleteMachineResponseError = deleteMachineResponseDefault & {
+    headers: Headers;
+};
+export type deleteMachineResponse = deleteMachineResponseSuccess | deleteMachineResponseError;
+export declare const getDeleteMachineUrl: (machineId: string) => string;
+/**
+ * Removes the machine from the project. Every participant of its sessions is disconnected at
+ * once and the Agent is refused from then on; to use the machine again, enroll it again.
+ * Sessions still open on the machine can no longer be reached and end according to their own
+ * timeouts. Nothing on the machine is deleted.
+ *
+ * Requires `fleet:machines.manage`.
+ * @summary Remove a machine
+ */
+export declare const deleteMachine: (machineId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<deleteMachineResponse>;
+export type listMachineEventsResponse200 = {
+    data: MachineEventList;
+    status: 200;
+};
+export type listMachineEventsResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type listMachineEventsResponseSuccess = listMachineEventsResponse200 & {
+    headers: Headers;
+};
+export type listMachineEventsResponseError = listMachineEventsResponseDefault & {
+    headers: Headers;
+};
+export type listMachineEventsResponse = listMachineEventsResponseSuccess | listMachineEventsResponseError;
+export declare const getListMachineEventsUrl: (machineId: string, params?: ListMachineEventsParams) => string;
+/**
+ * Returns what the machine reported about itself, newest first, such as a directory account
+ * it does not serve because a local account uses its name. Events are kept for 30 days.
+ * @summary List the events of a machine
+ */
+export declare const listMachineEvents: (machineId: string, params?: ListMachineEventsParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listMachineEventsResponse>;
+export type runMachineCommandResponse200 = {
+    data: RunCommandResponse;
+    status: 200;
+};
+export type runMachineCommandResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type runMachineCommandResponseSuccess = runMachineCommandResponse200 & {
+    headers: Headers;
+};
+export type runMachineCommandResponseError = runMachineCommandResponseDefault & {
+    headers: Headers;
+};
+export type runMachineCommandResponse = runMachineCommandResponseSuccess | runMachineCommandResponseError;
+export declare const getRunMachineCommandUrl: (machineId: string) => string;
+/**
+ * Runs one command line on the machine as the caller's account, with its login shell, and
+ * returns once it exited or was killed, with its exit status and what it wrote. Pipes,
+ * redirection and `&&` work; there is no terminal and no standard input. The machine admits
+ * the account through PAM as for a login. The account is created if the caller has none yet.
+ * A command that fails is still a successful request: its exit status is its result.
+ * When the machine reports graphical capability available, Fleet first prepares or reuses
+ * the account's ready lightweight graphical session, without starting a full desktop
+ * environment. Otherwise the command runs without creating a graphical session or injecting
+ * X environment variables. The command has its own job scope; its timeout or exit must not
+ * close an existing account graphical context.
+ *
+ * Inside the command, `sudo` works without a prompt while the caller has
+ * `fleet:machines.admin` on the machine, and refuses otherwise.
+ *
+ * After any required context preparation, the request is held until the command ends, at most
+ * `timeout_seconds` and a few seconds more. Neither the command nor its output is hidden from the platform: do not put secrets
+ * into either.
+ *
+ * Requires `fleet:machines.login` on the machine.
+ *
+ * Fails with:
+ * - `MACHINE_OFFLINE` when the machine is not connected and does not connect again in time;
+ * - `FEATURE_UNAVAILABLE` when a required capability is unavailable; an absent graphical
+ *   backend alone does not block a command;
+ * - `SESSION_UNAVAILABLE` or `SESSION_CLOSED` when the account context is not ready or closing;
+ * - `USER_NOT_FOUND`, `USER_NOT_ALLOWED`, `ACCOUNT_EXPIRED` or `PAM_PERMISSION_DENIED` when
+ *   the machine refuses the account, as for opening a session;
+ * - `COMMAND_START_FAILED` when the shell could not start; nothing ran;
+ * - `COMMAND_LOST` when the machine lost the command while it ran. The command may have run
+ *   in part, and its output is lost;
+ * - `MACHINE_TIMEOUT` when the machine did not answer in time. The command may have run.
+ * @summary Run a command
+ */
+export declare const runMachineCommand: (machineId: string, runCommandRequest: RunCommandRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<runMachineCommandResponse>;
+export type getMcpConfigurationResponse200 = {
+    data: McpConfigurationResource;
+    status: 200;
+};
+export type getMcpConfigurationResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type getMcpConfigurationResponseSuccess = getMcpConfigurationResponse200 & {
+    headers: Headers;
+};
+export type getMcpConfigurationResponseError = getMcpConfigurationResponseDefault & {
+    headers: Headers;
+};
+export type getMcpConfigurationResponse = getMcpConfigurationResponseSuccess | getMcpConfigurationResponseError;
+export declare const getGetMcpConfigurationUrl: (machineId: string) => string;
+/**
+ * Returns the caller's MCP configuration file on the machine and every server in it, with
+ * what each is doing now. The values of `env` and `headers` are never returned, only their
+ * keys. Requires `fleet:machines.login` on the machine.
+ *
+ * Fails with:
+ * - `MACHINE_OFFLINE` when the machine is not connected and does not connect again in time;
+ * - `FEATURE_UNAVAILABLE` when the machine does not offer `leaflow.fleet.mcp.v1`;
+ * - `USER_NOT_FOUND`, `USER_NOT_ALLOWED`, `ACCOUNT_EXPIRED` or `PAM_PERMISSION_DENIED` when
+ *   the machine refuses the account, as for opening a session;
+ * - `MCP_START_FAILED` when the machine could not start MCP for the caller's account;
+ * - `MACHINE_TIMEOUT` when the machine did not answer in time.
+ * @summary Get the caller's MCP configuration on a machine
+ */
+export declare const getMcpConfiguration: (machineId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<getMcpConfigurationResponse>;
+export type replaceMcpConfigurationResponse200 = {
+    data: McpConfigurationFile;
+    status: 200;
+};
+export type replaceMcpConfigurationResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type replaceMcpConfigurationResponseSuccess = replaceMcpConfigurationResponse200 & {
+    headers: Headers;
+};
+export type replaceMcpConfigurationResponseError = replaceMcpConfigurationResponseDefault & {
+    headers: Headers;
+};
+export type replaceMcpConfigurationResponse = replaceMcpConfigurationResponseSuccess | replaceMcpConfigurationResponseError;
+export declare const getReplaceMcpConfigurationUrl: (machineId: string) => string;
+/**
+ * Replaces the caller's MCP configuration file on the machine as a whole, also one that cannot
+ * be read or is not valid. The machine starts the servers that were added, stops the ones
+ * that were removed and restarts the ones that changed when they are next used. The account
+ * is created if the caller has none yet. The content, secrets included, passes through the
+ * platform. Requires `fleet:machines.login` on the machine.
+ *
+ * Fails with:
+ * - `MCP_CONFIGURATION_CHANGED` when the file is no longer at `expected_revision`;
+ * - `MCP_CONFIGURATION_INVALID` when `content` is not an object with an object `mcpServers`,
+ *   with `metadata.line` and `metadata.column`;
+ * - `MCP_CONFIGURATION_WRITE_FAILED` when the machine could not write the file;
+ * - `MACHINE_OFFLINE` when the machine is not connected and does not connect again in time;
+ * - `FEATURE_UNAVAILABLE` when the machine does not offer `leaflow.fleet.mcp.v1`;
+ * - `USER_NOT_FOUND`, `USER_NOT_ALLOWED`, `ACCOUNT_EXPIRED` or `PAM_PERMISSION_DENIED` when
+ *   the machine refuses the account, as for opening a session;
+ * - `MCP_START_FAILED` when the machine could not start MCP for the caller's account;
+ * - `MACHINE_TIMEOUT` when the machine did not answer in time.
+ * @summary Replace the caller's MCP configuration on a machine
+ */
+export declare const replaceMcpConfiguration: (machineId: string, replaceMcpConfigurationRequest: ReplaceMcpConfigurationRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<replaceMcpConfigurationResponse>;
+export type updateMcpServerResponse200 = {
+    data: UpdateMcpServerResponse;
+    status: 200;
+};
+export type updateMcpServerResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type updateMcpServerResponseSuccess = updateMcpServerResponse200 & {
+    headers: Headers;
+};
+export type updateMcpServerResponseError = updateMcpServerResponseDefault & {
+    headers: Headers;
+};
+export type updateMcpServerResponse = updateMcpServerResponseSuccess | updateMcpServerResponseError;
+export declare const getUpdateMcpServerUrl: (machineId: string, serverName: string) => string;
+/**
+ * Adds a server to the caller's MCP configuration on the machine, or replaces the one with
+ * the same name. The values of `env` and `headers` the request gives, secrets included, pass
+ * through the platform; those named in `keep_env` and `keep_headers` stay as they are on the
+ * machine. The account is created if the caller has none yet. Requires
+ * `fleet:machines.login` on the machine.
+ *
+ * Fails with:
+ * - `MCP_CONFIGURATION_CHANGED` when the file is no longer at `expected_revision`;
+ * - `MCP_CONFIGURATION_INVALID` when the file cannot be read or is not valid; replace it
+ *   whole first;
+ * - `MCP_CONFIGURATION_WRITE_FAILED` when the machine could not write the file;
+ * - `MACHINE_OFFLINE` when the machine is not connected and does not connect again in time;
+ * - `FEATURE_UNAVAILABLE` when the machine does not offer `leaflow.fleet.mcp.v1`;
+ * - `USER_NOT_FOUND`, `USER_NOT_ALLOWED`, `ACCOUNT_EXPIRED` or `PAM_PERMISSION_DENIED` when
+ *   the machine refuses the account, as for opening a session;
+ * - `MCP_START_FAILED` when the machine could not start MCP for the caller's account;
+ * - `MACHINE_TIMEOUT` when the machine did not answer in time.
+ * @summary Add or replace an MCP server
+ */
+export declare const updateMcpServer: (machineId: string, serverName: string, updateMcpServerRequest: UpdateMcpServerRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<updateMcpServerResponse>;
+export type deleteMcpServerResponse200 = {
+    data: McpConfigurationFile;
+    status: 200;
+};
+export type deleteMcpServerResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type deleteMcpServerResponseSuccess = deleteMcpServerResponse200 & {
+    headers: Headers;
+};
+export type deleteMcpServerResponseError = deleteMcpServerResponseDefault & {
+    headers: Headers;
+};
+export type deleteMcpServerResponse = deleteMcpServerResponseSuccess | deleteMcpServerResponseError;
+export declare const getDeleteMcpServerUrl: (machineId: string, serverName: string, params?: DeleteMcpServerParams) => string;
+/**
+ * Removes a server from the caller's MCP configuration on the machine and stops it. Removing
+ * one that is not configured succeeds. Requires `fleet:machines.login` on the machine.
+ *
+ * Fails as replacing a server does.
+ * @summary Remove an MCP server
+ */
+export declare const deleteMcpServer: (machineId: string, serverName: string, params?: DeleteMcpServerParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<deleteMcpServerResponse>;
+export type listToolsResponse200 = {
+    data: ToolList;
+    status: 200;
+};
+export type listToolsResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type listToolsResponseSuccess = listToolsResponse200 & {
+    headers: Headers;
+};
+export type listToolsResponseError = listToolsResponseDefault & {
+    headers: Headers;
+};
+export type listToolsResponse = listToolsResponseSuccess | listToolsResponseError;
+export declare const getListToolsUrl: (machineId: string, params: ListToolsParams) => string;
+/**
+ * Queries Agent's builtin tools and the caller's configured MCP servers live. No directory,
+ * result or image is cached. Each tool has one callable name: builtin tools are named
+ * computer.*, MCP tools are named `<server>__<tool>`; source only filters the list and is not
+ * part of a tool's identity. Requires fleet:machines.login; builtin capabilities retain
+ * their native policies and read-only restrictions. Ensures or reuses the caller's single
+ * open graphical session, without launching a desktop environment. The client instance is
+ * a UUID generated once per running client, not an authorization credential. Each request
+ * checks current IAM permissions and signs a short-lived control-only authorization.
+ * Tool arguments, results and images traverse Fleet with hop-by-hop TLS and are visible to
+ * Fleet. Existing desktop streaming remains end-to-end encrypted. TOOL_LIST_CHANGED means
+ * restart listing from the first page, never replay a CallTool. At most 100 tools per page.
+ * @summary List live tools available to the caller on a machine
+ */
+export declare const listTools: (machineId: string, params: ListToolsParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listToolsResponse>;
+export type callToolResponse200 = {
+    data: CallToolResponse;
+    status: 200;
+};
+export type callToolResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type callToolResponseSuccess = callToolResponse200 & {
+    headers: Headers;
+};
+export type callToolResponseError = callToolResponseDefault & {
+    headers: Headers;
+};
+export type callToolResponse = callToolResponseSuccess | callToolResponseError;
+export declare const getCallToolUrl: (machineId: string) => string;
+/**
+ * Uses the same current permissions, directory account and graphical session as list-tools.
+ * Listing is not a precondition: callers may use a previously discovered tool name, and this
+ * operation never sends a discovery request or refreshes schemas before executing it.
+ * A removed tool or MCP server returns TOOL_NOT_FOUND, as does a direct builtin computer.*
+ * call while virtual desktop capability is unavailable. Actual permission errors remain
+ * permission errors; a missing target window is not a missing tool. Use list-tools only when
+ * discovery or refresh is needed, and do not cache or reuse execution results.
+ * The name selects exactly one tool: builtin tools are computer.*, MCP tools are
+ * `<server>__<tool>`. The arguments object is at most 256 KiB. The complete result is at most
+ * 8 MiB in the protobuf transport, with each encoded image at most 4 MiB; images are converted
+ * to base64 once at this JSON boundary, without recompression or persistence. Cancellation is
+ * propagated. A timeout, disconnect or failed response does not prove that side effects did
+ * not happen; do not automatically replay. operation_id only correlates live activity, not
+ * idempotency.
+ * @summary Call a live builtin or external MCP tool
+ */
+export declare const callTool: (machineId: string, callToolRequest: CallToolRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<callToolResponse>;
+export type pollToolActivitiesResponse200 = {
+    data: ToolActivityList;
+    status: 200;
+};
+export type pollToolActivitiesResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type pollToolActivitiesResponseSuccess = pollToolActivitiesResponse200 & {
+    headers: Headers;
+};
+export type pollToolActivitiesResponseError = pollToolActivitiesResponseDefault & {
+    headers: Headers;
+};
+export type pollToolActivitiesResponse = pollToolActivitiesResponseSuccess | pollToolActivitiesResponseError;
+export declare const getPollToolActivitiesUrl: (sessionId: string) => string;
+/**
+ * Checks current session viewing permission for each request and again before returning
+ * events. Subscribes only while this request is pending, returning on the first batch or
+ * after at most 20 idle seconds. At most 64 events, no offline queue, event database, cursor
+ * history or replay guarantee. Missing events never mean repeat an action. Coordinates
+ * are window-client-local (window_id=0 means canvas), not CSS or image pixels. The frontend
+ * applies its own zoom and DPI. Compare sequence only within the same instance_id.
+ * @summary Receive live tool activity for an authorized session
+ */
+export declare const pollToolActivities: (sessionId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<pollToolActivitiesResponse>;
+export type sendMcpRequestResponse200 = {
+    data: SendMcpRequestResponse;
+    status: 200;
+};
+export type sendMcpRequestResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type sendMcpRequestResponseSuccess = sendMcpRequestResponse200 & {
+    headers: Headers;
+};
+export type sendMcpRequestResponseError = sendMcpRequestResponseDefault & {
+    headers: Headers;
+};
+export type sendMcpRequestResponse = sendMcpRequestResponseSuccess | sendMcpRequestResponseError;
+export declare const getSendMcpRequestUrl: (machineId: string, serverName: string) => string;
+/**
+ * Sends one JSON-RPC request of MCP to one of the caller's servers on the machine, such as
+ * `tools/call`, `resources/read` or `prompts/get`, and returns the server's response. The
+ * machine starts or connects to the server if it is not running, and handles its
+ * initialization itself. Before any such request, Fleet prepares or reuses the caller's
+ * ready lightweight account graphical session, including for resources and prompts; no full
+ * desktop environment is needed. A request still running when `timeout_seconds` passes is cancelled
+ * at the server. Requests the server makes of the client are answered as by a client that
+ * offers no sampling, elicitation or roots, and its notifications, such as of progress, are
+ * dropped. A response with a JSON-RPC error is a successful request. Neither the request nor
+ * the response is hidden from the platform. Requires `fleet:machines.login` on the machine.
+ *
+ * Fails with:
+ * - `MCP_SERVER_NOT_FOUND` when the server is not configured;
+ * - `MCP_SERVER_UNAVAILABLE` when it could not be started or reached, with
+ *   `metadata.failure`, an `McpServerFailure`;
+ * - `INVALID_ARGUMENT` when `request` is not one JSON-RPC request, such as a notification, or
+ *   is one of initialization;
+ * - `RESULT_TOO_LARGE` when the response is larger than 8 MiB;
+ * - `MACHINE_OFFLINE` when the machine is not connected and does not connect again in time;
+ * - `FEATURE_UNAVAILABLE` when the MCP, session or graphical backend is unavailable;
+ * - `SESSION_UNAVAILABLE` or `SESSION_CLOSED` when the account context is not ready or closing;
+ * - `USER_NOT_FOUND`, `USER_NOT_ALLOWED`, `ACCOUNT_EXPIRED` or `PAM_PERMISSION_DENIED` when
+ *   the machine refuses the account, as for opening a session;
+ * - `MCP_START_FAILED` when the machine could not start MCP for the caller's account;
+ * - `MACHINE_TIMEOUT` when the machine did not answer in time.
+ * @summary Send an MCP request to a server
+ */
+export declare const sendMcpRequest: (machineId: string, serverName: string, sendMcpRequestRequest: SendMcpRequestRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<sendMcpRequestResponse>;
+export type callMcpToolResponse200 = {
+    data: CallMcpToolResponse;
+    status: 200;
+};
+export type callMcpToolResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type callMcpToolResponseSuccess = callMcpToolResponse200 & {
+    headers: Headers;
+};
+export type callMcpToolResponseError = callMcpToolResponseDefault & {
+    headers: Headers;
+};
+export type callMcpToolResponse = callMcpToolResponseSuccess | callMcpToolResponseError;
+export declare const getCallMcpToolUrl: (machineId: string, serverName: string, toolName: string) => string;
+/**
+ * Calls one tool of one of the caller's servers on the machine and returns its MCP
+ * `CallToolResult`. A tool that reports an error, with `isError`, is a successful request. A
+ * tool whose name cannot appear in a path is called with `send-mcp-request`. Neither the
+ * arguments nor the result is hidden from the platform. Requires `fleet:machines.login` on
+ * the machine.
+ *
+ * Fails as sending a request does, and with `MCP_REQUEST_FAILED` when the server answers
+ * with a JSON-RPC error, such as for a tool it does not offer or arguments it does not
+ * accept, with the error's `metadata.code` and `metadata.message`.
+ * @deprecated
+ * @summary Call an MCP tool
+ */
+export declare const callMcpTool: (machineId: string, serverName: string, toolName: string, callMcpToolRequest: CallMcpToolRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<callMcpToolResponse>;
+export type getPrivilegeAutoApprovalResponse200 = {
+    data: PrivilegeAutoApprovalResource;
+    status: 200;
+};
+export type getPrivilegeAutoApprovalResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type getPrivilegeAutoApprovalResponseSuccess = getPrivilegeAutoApprovalResponse200 & {
+    headers: Headers;
+};
+export type getPrivilegeAutoApprovalResponseError = getPrivilegeAutoApprovalResponseDefault & {
+    headers: Headers;
+};
+export type getPrivilegeAutoApprovalResponse = getPrivilegeAutoApprovalResponseSuccess | getPrivilegeAutoApprovalResponseError;
+export declare const getGetPrivilegeAutoApprovalUrl: (machineId: string) => string;
+/**
+ * Returns the caller's automatic approval of their privilege requests on the machine. Fails
+ * with `PRIVILEGE_AUTO_APPROVAL_NOT_FOUND` while the caller is asked every time, including
+ * after its `expires_at` has passed.
+ * @summary Get the caller's automatic approval for a machine
+ */
+export declare const getPrivilegeAutoApproval: (machineId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<getPrivilegeAutoApprovalResponse>;
+export type updatePrivilegeAutoApprovalResponse200 = {
+    data: PrivilegeAutoApprovalResource;
+    status: 200;
+};
+export type updatePrivilegeAutoApprovalResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type updatePrivilegeAutoApprovalResponseSuccess = updatePrivilegeAutoApprovalResponse200 & {
+    headers: Headers;
+};
+export type updatePrivilegeAutoApprovalResponseError = updatePrivilegeAutoApprovalResponseDefault & {
+    headers: Headers;
+};
+export type updatePrivilegeAutoApprovalResponse = updatePrivilegeAutoApprovalResponseSuccess | updatePrivilegeAutoApprovalResponseError;
+export declare const getUpdatePrivilegeAutoApprovalUrl: (machineId: string) => string;
+/**
+ * Has the caller's privilege requests on the machine decided without asking them, in
+ * `mode`, until `expires_at`, or until removed when `expires_at` is null, replacing any
+ * earlier automatic approval. `automatic_review` is recommended; with `always_approve` any
+ * program that runs as the account becomes root without anyone being asked. It applies to
+ * the caller's own account only, which is created if the caller has none yet, and only
+ * while they may become root on the machine. Fails with `INVALID_ARGUMENT` when
+ * `expires_at` has passed.
+ * @summary Decide the caller's privilege requests on a machine without asking
+ */
+export declare const updatePrivilegeAutoApproval: (machineId: string, updatePrivilegeAutoApprovalRequest: UpdatePrivilegeAutoApprovalRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<updatePrivilegeAutoApprovalResponse>;
+export type deletePrivilegeAutoApprovalResponse204 = {
+    data: void;
+    status: 204;
+};
+export type deletePrivilegeAutoApprovalResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 204>;
+};
+export type deletePrivilegeAutoApprovalResponseSuccess = deletePrivilegeAutoApprovalResponse204 & {
+    headers: Headers;
+};
+export type deletePrivilegeAutoApprovalResponseError = deletePrivilegeAutoApprovalResponseDefault & {
+    headers: Headers;
+};
+export type deletePrivilegeAutoApprovalResponse = deletePrivilegeAutoApprovalResponseSuccess | deletePrivilegeAutoApprovalResponseError;
+export declare const getDeletePrivilegeAutoApprovalUrl: (machineId: string) => string;
+/**
+ * Removes it: the caller is asked about every later privilege request on the machine.
+ * Removing one that does not exist succeeds.
+ * @summary Remove the caller's automatic approval for a machine
+ */
+export declare const deletePrivilegeAutoApproval: (machineId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<deletePrivilegeAutoApprovalResponse>;
+export type listPrivilegeAutoApprovalsResponse200 = {
+    data: PrivilegeAutoApprovalList;
+    status: 200;
+};
+export type listPrivilegeAutoApprovalsResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type listPrivilegeAutoApprovalsResponseSuccess = listPrivilegeAutoApprovalsResponse200 & {
+    headers: Headers;
+};
+export type listPrivilegeAutoApprovalsResponseError = listPrivilegeAutoApprovalsResponseDefault & {
+    headers: Headers;
+};
+export type listPrivilegeAutoApprovalsResponse = listPrivilegeAutoApprovalsResponseSuccess | listPrivilegeAutoApprovalsResponseError;
+export declare const getListPrivilegeAutoApprovalsUrl: (params?: ListPrivilegeAutoApprovalsParams) => string;
+/**
+ * Returns the caller's automatic approvals on the machines of the current project that are
+ * in effect, the most recently set first.
+ * @summary List the caller's automatic approvals
+ */
+export declare const listPrivilegeAutoApprovals: (params?: ListPrivilegeAutoApprovalsParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listPrivilegeAutoApprovalsResponse>;
+export type listPrivilegeRequestsResponse200 = {
+    data: PrivilegeRequestList;
+    status: 200;
+};
+export type listPrivilegeRequestsResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type listPrivilegeRequestsResponseSuccess = listPrivilegeRequestsResponse200 & {
+    headers: Headers;
+};
+export type listPrivilegeRequestsResponseError = listPrivilegeRequestsResponseDefault & {
+    headers: Headers;
+};
+export type listPrivilegeRequestsResponse = listPrivilegeRequestsResponseSuccess | listPrivilegeRequestsResponseError;
+export declare const getListPrivilegeRequestsUrl: (params?: ListPrivilegeRequestsParams) => string;
+/**
+ * Returns the caller's privilege requests on the project's machines, newest first. Requests
+ * are kept for 30 days.
+ * @summary List the caller's privilege requests
+ */
+export declare const listPrivilegeRequests: (params?: ListPrivilegeRequestsParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listPrivilegeRequestsResponse>;
+export type getPrivilegeRequestResponse200 = {
+    data: PrivilegeRequestResource;
+    status: 200;
+};
+export type getPrivilegeRequestResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type getPrivilegeRequestResponseSuccess = getPrivilegeRequestResponse200 & {
+    headers: Headers;
+};
+export type getPrivilegeRequestResponseError = getPrivilegeRequestResponseDefault & {
+    headers: Headers;
+};
+export type getPrivilegeRequestResponse = getPrivilegeRequestResponseSuccess | getPrivilegeRequestResponseError;
+export declare const getGetPrivilegeRequestUrl: (requestId: string) => string;
+/**
+ * Returns one of the caller's privilege requests.
+ * @summary Get a privilege request
+ */
+export declare const getPrivilegeRequest: (requestId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<getPrivilegeRequestResponse>;
+export type approvePrivilegeRequestResponse200 = {
+    data: PrivilegeRequestResource;
+    status: 200;
+};
+export type approvePrivilegeRequestResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type approvePrivilegeRequestResponseSuccess = approvePrivilegeRequestResponse200 & {
+    headers: Headers;
+};
+export type approvePrivilegeRequestResponseError = approvePrivilegeRequestResponseDefault & {
+    headers: Headers;
+};
+export type approvePrivilegeRequestResponse = approvePrivilegeRequestResponseSuccess | approvePrivilegeRequestResponseError;
+export declare const getApprovePrivilegeRequestUrl: (requestId: string) => string;
+/**
+ * Approves one of the caller's pending requests; the waiting sudo goes on as root. Fails with
+ * `PRIVILEGE_REQUEST_CLOSED` when the request is no longer pending, with `metadata.state`
+ * giving how it ended.
+ * @summary Approve a privilege request
+ */
+export declare const approvePrivilegeRequest: (requestId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<approvePrivilegeRequestResponse>;
+export type denyPrivilegeRequestResponse200 = {
+    data: PrivilegeRequestResource;
+    status: 200;
+};
+export type denyPrivilegeRequestResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type denyPrivilegeRequestResponseSuccess = denyPrivilegeRequestResponse200 & {
+    headers: Headers;
+};
+export type denyPrivilegeRequestResponseError = denyPrivilegeRequestResponseDefault & {
+    headers: Headers;
+};
+export type denyPrivilegeRequestResponse = denyPrivilegeRequestResponseSuccess | denyPrivilegeRequestResponseError;
+export declare const getDenyPrivilegeRequestUrl: (requestId: string) => string;
+/**
+ * Denies one of the caller's pending requests; the waiting sudo fails and shows `reason`,
+ * when given, to whoever ran it. Fails with `PRIVILEGE_REQUEST_CLOSED` as for approving.
+ * @summary Deny a privilege request
+ */
+export declare const denyPrivilegeRequest: (requestId: string, denyPrivilegeRequestRequest?: DenyPrivilegeRequestRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<denyPrivilegeRequestResponse>;
+export type findEnrollmentByPairingCodeResponse200 = {
+    data: FindEnrollmentResponse;
+    status: 200;
+};
+export type findEnrollmentByPairingCodeResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type findEnrollmentByPairingCodeResponseSuccess = findEnrollmentByPairingCodeResponse200 & {
+    headers: Headers;
+};
+export type findEnrollmentByPairingCodeResponseError = findEnrollmentByPairingCodeResponseDefault & {
+    headers: Headers;
+};
+export type findEnrollmentByPairingCodeResponse = findEnrollmentByPairingCodeResponseSuccess | findEnrollmentByPairingCodeResponseError;
+export declare const getFindEnrollmentByPairingCodeUrl: (params: FindEnrollmentByPairingCodeParams) => string;
+/**
+ * Returns the pending enrollment request whose pairing code matches, or no enrollment when
+ * none does. Mistyped codes are expected and are not an error. Letters are matched
+ * case-insensitively, `I` and `L` are read as `1`, `O` as `0`, and spaces and hyphens are
+ * ignored.
+ *
+ * Only requests that are still pending are found. A request is pending while its machine
+ * keeps polling; one it stops polling expires after a few hours.
+ *
+ * Requires `fleet:machines.manage`.
+ * @summary Find an enrollment request by its pairing code
+ */
+export declare const findEnrollmentByPairingCode: (params: FindEnrollmentByPairingCodeParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<findEnrollmentByPairingCodeResponse>;
+export type approveEnrollmentResponse201 = {
+    data: MachineResource;
+    status: 201;
+};
+export type approveEnrollmentResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 201>;
+};
+export type approveEnrollmentResponseSuccess = approveEnrollmentResponse201 & {
+    headers: Headers;
+};
+export type approveEnrollmentResponseError = approveEnrollmentResponseDefault & {
+    headers: Headers;
+};
+export type approveEnrollmentResponse = approveEnrollmentResponseSuccess | approveEnrollmentResponseError;
+export declare const getApproveEnrollmentUrl: (enrollmentId: string) => string;
+/**
+ * Adds the machine to the current project under the given name and returns it. The Agent
+ * learns the decision the next time it polls.
+ *
+ * A request that is no longer pending is rejected with `ENROLLMENT_NOT_PENDING`.
+ *
+ * Requires `fleet:machines.manage`.
+ * @summary Approve an enrollment request
+ */
+export declare const approveEnrollment: (enrollmentId: string, approveEnrollmentRequest: ApproveEnrollmentRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<approveEnrollmentResponse>;
+export type denyEnrollmentResponse200 = {
+    data: EnrollmentResource;
+    status: 200;
+};
+export type denyEnrollmentResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type denyEnrollmentResponseSuccess = denyEnrollmentResponse200 & {
+    headers: Headers;
+};
+export type denyEnrollmentResponseError = denyEnrollmentResponseDefault & {
+    headers: Headers;
+};
+export type denyEnrollmentResponse = denyEnrollmentResponseSuccess | denyEnrollmentResponseError;
+export declare const getDenyEnrollmentUrl: (enrollmentId: string) => string;
+/**
+ * Refuses the request. The decision is final for the machine's key: the Agent stops
+ * polling and reports that it was denied.
+ *
+ * A request that is no longer pending is rejected with `ENROLLMENT_NOT_PENDING`.
+ *
+ * Requires `fleet:machines.manage`.
+ * @summary Deny an enrollment request
+ */
+export declare const denyEnrollment: (enrollmentId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<denyEnrollmentResponse>;
+export type listMachineRegistrationsResponse200 = {
+    data: MachineRegistrationList;
+    status: 200;
+};
+export type listMachineRegistrationsResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type listMachineRegistrationsResponseSuccess = listMachineRegistrationsResponse200 & {
+    headers: Headers;
+};
+export type listMachineRegistrationsResponseError = listMachineRegistrationsResponseDefault & {
+    headers: Headers;
+};
+export type listMachineRegistrationsResponse = listMachineRegistrationsResponseSuccess | listMachineRegistrationsResponseError;
+export declare const getListMachineRegistrationsUrl: (params?: ListMachineRegistrationsParams) => string;
+/**
+ * Returns the registrations of the current project, newest first. Registrations are kept
+ * for 30 days.
+ *
+ * Requires `fleet:machines.manage`.
+ * @summary List machine registrations
+ */
+export declare const listMachineRegistrations: (params?: ListMachineRegistrationsParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listMachineRegistrationsResponse>;
+export type createMachineRegistrationResponse201 = {
+    data: CreateMachineRegistrationResponse;
+    status: 201;
+};
+export type createMachineRegistrationResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 201>;
+};
+export type createMachineRegistrationResponseSuccess = createMachineRegistrationResponse201 & {
+    headers: Headers;
+};
+export type createMachineRegistrationResponseError = createMachineRegistrationResponseDefault & {
+    headers: Headers;
+};
+export type createMachineRegistrationResponse = createMachineRegistrationResponseSuccess | createMachineRegistrationResponseError;
+export declare const getCreateMachineRegistrationUrl: () => string;
+/**
+ * Reserves a machine in the current project under the given name and returns the
+ * registration with a one-time token. A machine that presents the token when it enrolls
+ * joins the project as `registration.machine_id` without approval. The token is returned
+ * only in this response and cannot be read again.
+ *
+ * Requires `fleet:machines.manage`.
+ * @summary Create a machine registration
+ */
+export declare const createMachineRegistration: (createMachineRegistrationRequest: CreateMachineRegistrationRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<createMachineRegistrationResponse>;
+export type getMachineRegistrationResponse200 = {
+    data: MachineRegistrationResource;
+    status: 200;
+};
+export type getMachineRegistrationResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type getMachineRegistrationResponseSuccess = getMachineRegistrationResponse200 & {
+    headers: Headers;
+};
+export type getMachineRegistrationResponseError = getMachineRegistrationResponseDefault & {
+    headers: Headers;
+};
+export type getMachineRegistrationResponse = getMachineRegistrationResponseSuccess | getMachineRegistrationResponseError;
+export declare const getGetMachineRegistrationUrl: (registrationId: string) => string;
+/**
+ * Requires `fleet:machines.manage`.
+ * @summary Get a machine registration
+ */
+export declare const getMachineRegistration: (registrationId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<getMachineRegistrationResponse>;
+export type deleteMachineRegistrationResponse204 = {
+    data: void;
+    status: 204;
+};
+export type deleteMachineRegistrationResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 204>;
+};
+export type deleteMachineRegistrationResponseSuccess = deleteMachineRegistrationResponse204 & {
+    headers: Headers;
+};
+export type deleteMachineRegistrationResponseError = deleteMachineRegistrationResponseDefault & {
+    headers: Headers;
+};
+export type deleteMachineRegistrationResponse = deleteMachineRegistrationResponseSuccess | deleteMachineRegistrationResponseError;
+export declare const getDeleteMachineRegistrationUrl: (registrationId: string) => string;
+/**
+ * Revokes the registration: its token no longer enrolls a machine. Revoking a registration
+ * that is already revoked or expired succeeds and changes nothing else. A registration that
+ * a machine has used is rejected with `MACHINE_REGISTRATION_USED`; to remove that machine,
+ * delete the machine.
+ *
+ * Requires `fleet:machines.manage`.
+ * @summary Revoke a machine registration
+ */
+export declare const deleteMachineRegistration: (registrationId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<deleteMachineRegistrationResponse>;
+export type listAccountsResponse200 = {
+    data: AccountList;
+    status: 200;
+};
+export type listAccountsResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type listAccountsResponseSuccess = listAccountsResponse200 & {
+    headers: Headers;
+};
+export type listAccountsResponseError = listAccountsResponseDefault & {
+    headers: Headers;
+};
+export type listAccountsResponse = listAccountsResponseSuccess | listAccountsResponseError;
+export declare const getListAccountsUrl: (params?: ListAccountsParams) => string;
+/**
+ * Returns the accounts of the project's members, ordered by username. A member who has never
+ * been able to log in to a machine has no account yet.
+ * @summary List accounts
+ */
+export declare const listAccounts: (params?: ListAccountsParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listAccountsResponse>;
+export type getAccountResponse200 = {
+    data: AccountResource;
+    status: 200;
+};
+export type getAccountResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type getAccountResponseSuccess = getAccountResponse200 & {
+    headers: Headers;
+};
+export type getAccountResponseError = getAccountResponseDefault & {
+    headers: Headers;
+};
+export type getAccountResponse = getAccountResponseSuccess | getAccountResponseError;
+export declare const getGetAccountUrl: (accountId: string) => string;
+/**
+ * Returns the account of a member of the project.
+ * @summary Get an account
+ */
+export declare const getAccount: (accountId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<getAccountResponse>;
+export type updateAccountResponse200 = {
+    data: AccountResource;
+    status: 200;
+};
+export type updateAccountResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type updateAccountResponseSuccess = updateAccountResponse200 & {
+    headers: Headers;
+};
+export type updateAccountResponseError = updateAccountResponseDefault & {
+    headers: Headers;
+};
+export type updateAccountResponse = updateAccountResponseSuccess | updateAccountResponseError;
+export declare const getUpdateAccountUrl: (accountId: string) => string;
+/**
+ * Changes the caller's own account, only the fields present in the request. The account is
+ * the same in every project, and a new username takes effect on the machines of all of them
+ * within about a minute; the uid stays, so files keep their owner.
+ *
+ * Fails with:
+ * - `ACCOUNT_NOT_OWNED` when the account is another member's;
+ * - `DIRECTORY_NAME_TAKEN` when another account or a group uses the username.
+ * @summary Update an account
+ */
+export declare const updateAccount: (accountId: string, updateAccountRequest: UpdateAccountRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<updateAccountResponse>;
+export type listGroupsResponse200 = {
+    data: GroupList;
+    status: 200;
+};
+export type listGroupsResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type listGroupsResponseSuccess = listGroupsResponse200 & {
+    headers: Headers;
+};
+export type listGroupsResponseError = listGroupsResponseDefault & {
+    headers: Headers;
+};
+export type listGroupsResponse = listGroupsResponseSuccess | listGroupsResponseError;
+export declare const getListGroupsUrl: (params?: ListGroupsParams) => string;
+/**
+ * Returns the groups of the project's directory, ordered by name.
+ * @summary List groups
+ */
+export declare const listGroups: (params?: ListGroupsParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listGroupsResponse>;
+export type createGroupResponse201 = {
+    data: GroupResource;
+    status: 201;
+};
+export type createGroupResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 201>;
+};
+export type createGroupResponseSuccess = createGroupResponse201 & {
+    headers: Headers;
+};
+export type createGroupResponseError = createGroupResponseDefault & {
+    headers: Headers;
+};
+export type createGroupResponse = createGroupResponseSuccess | createGroupResponseError;
+export declare const getCreateGroupUrl: () => string;
+/**
+ * Creates a group in the project's directory. It reaches the machines within about a minute.
+ *
+ * Fails with `DIRECTORY_NAME_TAKEN` when an account, or another group of the project, uses the
+ * name.
+ *
+ * Requires `fleet:directory.manage`.
+ * @summary Create a group
+ */
+export declare const createGroup: (createGroupRequest: CreateGroupRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<createGroupResponse>;
+export type getGroupResponse200 = {
+    data: GroupResource;
+    status: 200;
+};
+export type getGroupResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type getGroupResponseSuccess = getGroupResponse200 & {
+    headers: Headers;
+};
+export type getGroupResponseError = getGroupResponseDefault & {
+    headers: Headers;
+};
+export type getGroupResponse = getGroupResponseSuccess | getGroupResponseError;
+export declare const getGetGroupUrl: (groupId: string) => string;
+/**
+ * @summary Get a group
+ */
+export declare const getGroup: (groupId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<getGroupResponse>;
+export type updateGroupResponse200 = {
+    data: GroupResource;
+    status: 200;
+};
+export type updateGroupResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type updateGroupResponseSuccess = updateGroupResponse200 & {
+    headers: Headers;
+};
+export type updateGroupResponseError = updateGroupResponseDefault & {
+    headers: Headers;
+};
+export type updateGroupResponse = updateGroupResponseSuccess | updateGroupResponseError;
+export declare const getUpdateGroupUrl: (groupId: string) => string;
+/**
+ * The gid stays, so files keep their group. Fails with `DIRECTORY_NAME_TAKEN` as for creating
+ * a group.
+ *
+ * Requires `fleet:directory.manage`.
+ * @summary Rename a group
+ */
+export declare const updateGroup: (groupId: string, updateGroupRequest: UpdateGroupRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<updateGroupResponse>;
+export type deleteGroupResponse204 = {
+    data: void;
+    status: 204;
+};
+export type deleteGroupResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 204>;
+};
+export type deleteGroupResponseSuccess = deleteGroupResponse204 & {
+    headers: Headers;
+};
+export type deleteGroupResponseError = deleteGroupResponseDefault & {
+    headers: Headers;
+};
+export type deleteGroupResponse = deleteGroupResponseSuccess | deleteGroupResponseError;
+export declare const getDeleteGroupUrl: (groupId: string) => string;
+/**
+ * Removes the group from the directory. Machines stop resolving it within about a minute;
+ * files keep its gid.
+ *
+ * Requires `fleet:directory.manage`.
+ * @summary Delete a group
+ */
+export declare const deleteGroup: (groupId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<deleteGroupResponse>;
+export type listGroupMembersResponse200 = {
+    data: AccountList;
+    status: 200;
+};
+export type listGroupMembersResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type listGroupMembersResponseSuccess = listGroupMembersResponse200 & {
+    headers: Headers;
+};
+export type listGroupMembersResponseError = listGroupMembersResponseDefault & {
+    headers: Headers;
+};
+export type listGroupMembersResponse = listGroupMembersResponseSuccess | listGroupMembersResponseError;
+export declare const getListGroupMembersUrl: (groupId: string, params?: ListGroupMembersParams) => string;
+/**
+ * Returns the accounts in the group, ordered by username.
+ * @summary List the members of a group
+ */
+export declare const listGroupMembers: (groupId: string, params?: ListGroupMembersParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listGroupMembersResponse>;
+export type createGroupMemberResponse201 = {
+    data: AccountResource;
+    status: 201;
+};
+export type createGroupMemberResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 201>;
+};
+export type createGroupMemberResponseSuccess = createGroupMemberResponse201 & {
+    headers: Headers;
+};
+export type createGroupMemberResponseError = createGroupMemberResponseDefault & {
+    headers: Headers;
+};
+export type createGroupMemberResponse = createGroupMemberResponseSuccess | createGroupMemberResponseError;
+export declare const getCreateGroupMemberUrl: (groupId: string) => string;
+/**
+ * The account must be a member's. Fails with `GROUP_MEMBER_EXISTS` when the account is
+ * already in the group.
+ *
+ * Requires `fleet:directory.manage`.
+ * @summary Add an account to a group
+ */
+export declare const createGroupMember: (groupId: string, createGroupMemberRequest: CreateGroupMemberRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<createGroupMemberResponse>;
+export type deleteGroupMemberResponse204 = {
+    data: void;
+    status: 204;
+};
+export type deleteGroupMemberResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 204>;
+};
+export type deleteGroupMemberResponseSuccess = deleteGroupMemberResponse204 & {
+    headers: Headers;
+};
+export type deleteGroupMemberResponseError = deleteGroupMemberResponseDefault & {
+    headers: Headers;
+};
+export type deleteGroupMemberResponse = deleteGroupMemberResponseSuccess | deleteGroupMemberResponseError;
+export declare const getDeleteGroupMemberUrl: (groupId: string, accountId: string) => string;
+/**
+ * Removing an account that is not in the group succeeds.
+ *
+ * Requires `fleet:directory.manage`.
+ * @summary Remove an account from a group
+ */
+export declare const deleteGroupMember: (groupId: string, accountId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<deleteGroupMemberResponse>;
+export type listSessionsResponse200 = {
+    data: SessionList;
+    status: 200;
+};
+export type listSessionsResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type listSessionsResponseSuccess = listSessionsResponse200 & {
+    headers: Headers;
+};
+export type listSessionsResponseError = listSessionsResponseDefault & {
+    headers: Headers;
+};
+export type listSessionsResponse = listSessionsResponseSuccess | listSessionsResponseError;
+export declare const getListSessionsUrl: (params?: ListSessionsParams) => string;
+/**
+ * Returns the sessions of the current project's machines, newest first. Closed sessions are
+ * omitted unless `include_closed` is true.
+ * @summary List sessions
+ */
+export declare const listSessions: (params?: ListSessionsParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listSessionsResponse>;
+export type createSessionResponse201 = {
+    data: SessionResource;
+    status: 201;
+};
+export type createSessionResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 201>;
+};
+export type createSessionResponseSuccess = createSessionResponse201 & {
+    headers: Headers;
+};
+export type createSessionResponseError = createSessionResponseDefault & {
+    headers: Headers;
+};
+export type createSessionResponse = createSessionResponseSuccess | createSessionResponseError;
+export declare const getCreateSessionUrl: () => string;
+/**
+ * Opens a session for the caller on a machine, as the caller's account, and returns once it
+ * is ready. With `desktop` the session requires graphical capability and has a desktop.
+ * Without `desktop`, Fleet creates a terminal session with its own SID and lifetime. If
+ * graphical capability is available, Fleet first prepares or reuses the account's separate
+ * ready lightweight graphical session; otherwise the terminal runs without creating a
+ * graphical context or injecting X environment variables. Closing a terminal does not close
+ * an existing account graphical context. Its one terminal runs the caller's login shell from
+ * the start, every participant attaches to
+ * that terminal, and the session ends when the shell exits; a caller who wants another
+ * terminal opens another session. Either kind also offers programs, files, ports, sound,
+ * devices, printers and privilege approvals. The account is created if the caller has none
+ * yet. Requires `fleet:machines.login` on the machine.
+ * All newly created graphical account sessions, including desktop-first FullDesktop and
+ * Seamless sessions, keep running when no viewer has joined or the last viewer disconnects.
+ * Configured maximum lifetime, resource limits and explicit close/terminate still apply.
+ * This create API has no client-selected idle policy; existing running policies are not
+ * silently rewritten when tools, commands or terminals reuse the account context.
+ *
+ * On a machine an account has at most one session with a desktop and at most 8 sessions in
+ * all. Sessions without a desktop run side by side, such as one for a program and one for a
+ * person; several participants can also share one session.
+ *
+ * Fails with:
+ * - `MACHINE_OFFLINE` when the machine is not connected and does not connect again in time;
+ * - `FEATURE_UNAVAILABLE` when the machine does not offer the requested session capability;
+ *   a terminal-only request does not require a graphical backend;
+ * - `SESSION_UNAVAILABLE` or `SESSION_CLOSED` when its shared account context is not ready or closing;
+ * - `USER_HAS_DESKTOP_SESSION` with `desktop` when the account already has a session with a
+ *   desktop on the machine, which `metadata.sessionId` names; connect to it instead;
+ * - `SESSION_LIMIT_REACHED` when the account already has 8 open sessions on the machine;
+ *   close one first;
+ * - `USER_NOT_FOUND`, `USER_NOT_ALLOWED`, `ACCOUNT_EXPIRED` or `PAM_PERMISSION_DENIED` when
+ *   the machine refuses the account, such as while it has not received the account yet or a
+ *   local account uses its name; `PAM_PERMISSION_DENIED` carries the machine's message in
+ *   `metadata.pamMessage`;
+ * - `SESSION_CONFLICT` with `desktop` when the account has a graphical session on the
+ *   machine that Fleet did not open;
+ * - `DISPLAY_UNAVAILABLE` or `SESSION_START_FAILED` when the machine could not start it;
+ * - `MACHINE_TIMEOUT` when the machine did not answer in time. The session may still open;
+ *   list the sessions before trying again.
+ * @summary Open a session
+ */
+export declare const createSession: (createSessionRequest: CreateSessionRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<createSessionResponse>;
+export type getSessionResponse200 = {
+    data: SessionResource;
+    status: 200;
+};
+export type getSessionResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type getSessionResponseSuccess = getSessionResponse200 & {
+    headers: Headers;
+};
+export type getSessionResponseError = getSessionResponseDefault & {
+    headers: Headers;
+};
+export type getSessionResponse = getSessionResponseSuccess | getSessionResponseError;
+export declare const getGetSessionUrl: (sessionId: string) => string;
+/**
+ * @summary Get a session
+ */
+export declare const getSession: (sessionId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<getSessionResponse>;
+export type closeSessionResponse200 = {
+    data: SessionResource;
+    status: 200;
+};
+export type closeSessionResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type closeSessionResponseSuccess = closeSessionResponse200 & {
+    headers: Headers;
+};
+export type closeSessionResponseError = closeSessionResponseDefault & {
+    headers: Headers;
+};
+export type closeSessionResponse = closeSessionResponseSuccess | closeSessionResponseError;
+export declare const getCloseSessionUrl: (sessionId: string) => string;
+/**
+ * Ends the session in order: its applications are asked to exit and get a grace period
+ * before the session is terminated. Returns once the session is closed. Closing a closed
+ * session succeeds.
+ *
+ * The owner may close their own session; closing another member's requires
+ * `fleet:sessions.manage`. Fails with `MACHINE_OFFLINE` or `MACHINE_TIMEOUT` as
+ * for opening a session.
+ * @summary Close a session
+ */
+export declare const closeSession: (sessionId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<closeSessionResponse>;
+export type terminateSessionResponse200 = {
+    data: SessionResource;
+    status: 200;
+};
+export type terminateSessionResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type terminateSessionResponseSuccess = terminateSessionResponse200 & {
+    headers: Headers;
+};
+export type terminateSessionResponseError = terminateSessionResponseDefault & {
+    headers: Headers;
+};
+export type terminateSessionResponse = terminateSessionResponseSuccess | terminateSessionResponseError;
+export declare const getTerminateSessionUrl: (sessionId: string) => string;
+/**
+ * Ends the session at once, killing every process in it. Returns once the session is
+ * closed. Terminating a closed session succeeds.
+ *
+ * The owner may terminate their own session; terminating another member's requires
+ * `fleet:sessions.manage`. Fails with `MACHINE_OFFLINE` or `MACHINE_TIMEOUT` as
+ * for opening a session.
+ * @summary Terminate a session
+ */
+export declare const terminateSession: (sessionId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<terminateSessionResponse>;
+export type getSessionRtcConfigurationResponse200 = {
+    data: RtcConfiguration;
+    status: 200;
+};
+export type getSessionRtcConfigurationResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type getSessionRtcConfigurationResponseSuccess = getSessionRtcConfigurationResponse200 & {
+    headers: Headers;
+};
+export type getSessionRtcConfigurationResponseError = getSessionRtcConfigurationResponseDefault & {
+    headers: Headers;
+};
+export type getSessionRtcConfigurationResponse = getSessionRtcConfigurationResponseSuccess | getSessionRtcConfigurationResponseError;
+export declare const getGetSessionRtcConfigurationUrl: (sessionId: string) => string;
+/**
+ * Returns the STUN and TURN servers for the PeerConnections the caller starts to the session,
+ * with TURN credentials of its own, and the policy for using them. Ask again once
+ * `expires_at` has passed; the credentials of a PeerConnection already relayed last longer.
+ *
+ * Requires that the caller may join the session, as for `create-participant`.
+ *
+ * Fails with:
+ * - `SESSION_CLOSED` when the session has ended;
+ * - `SESSION_ACCESS_DENIED` when the caller may not join the session.
+ * @summary Get the ICE servers for a session
+ */
+export declare const getSessionRtcConfiguration: (sessionId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<getSessionRtcConfigurationResponse>;
+export type createParticipantResponse201 = {
+    data: CreateParticipantResponse;
+    status: 201;
+};
+export type createParticipantResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 201>;
+};
+export type createParticipantResponseSuccess = createParticipantResponse201 & {
+    headers: Headers;
+};
+export type createParticipantResponseError = createParticipantResponseDefault & {
+    headers: Headers;
+};
+export type createParticipantResponse = createParticipantResponseSuccess | createParticipantResponseError;
+export declare const getCreateParticipantUrl: (sessionId: string) => string;
+/**
+ * Admits one participant with the given public key to the session: signs its authorization,
+ * has the session accept it, and starts its first PeerConnection with the offer. The answer
+ * carries the participant, its authorization and the PeerConnection with the session's
+ * answer and the ICE candidates the session has passed so far; read its later candidates
+ * with `get-peer-connection`. The participant lasts while it is renewed.
+ *
+ * Joining again with the public key of one of the caller's participants of the session that
+ * has not ended, with the same `client_name`, `read_only` and `permissions`, returns that
+ * participant with a new PeerConnection for the offer, and the session gains no second
+ * participant: a request whose answer was lost, such as on an unreliable network, is sent
+ * again as it was. Its earlier PeerConnection, whose answer the client never received, is
+ * given up by the session once it fails.
+ *
+ * The owner of a session may operate it. Joining another member's session requires
+ * `fleet:sessions.view`, which admits watching only, or
+ * `fleet:sessions.control`, which also admits operating it. Each further capability
+ * of the session — file transfer, the clipboard, terminals and programs, port forwarding,
+ * devices and audio, printing, SSH agent forwarding, approving privilege requests and
+ * reading logs — is granted only with its permission; a participant that may only watch gets
+ * none of them. A request may ask for less: to watch only, or for some of the capabilities.
+ *
+ * Fails with the following, and then no participant was created:
+ * - `SESSION_CLOSED` when the session has ended;
+ * - `SESSION_ACCESS_DENIED` when the caller may not join the session;
+ * - `OFFER_INVALID` when the offer is not an SDP offer that names a SHA-256 DTLS fingerprint;
+ * - `SESSION_UNAVAILABLE` when the session's process is not connected and does not connect
+ *   again in time, or did not answer in time; try again after the error's `retry_delay`;
+ * - `PARTICIPANT_LIMIT_REACHED` when the session has as many participants as it admits;
+ * - `PARTICIPANT_REFUSED` when the session refused the participant;
+ * - `PARTICIPANT_KEY_IN_USE` when the public key belongs to a participant of the session that
+ *   another user holds, or that was created with another `client_name`, `read_only` or
+ *   `permissions`; join with a new key;
+ * - `PEER_CONNECTION_ABORTED` when the session gave up the PeerConnection; try again with a
+ *   new offer. The participant of a repeated request stays.
+ * @summary Join a session
+ */
+export declare const createParticipant: (sessionId: string, createParticipantRequest: CreateParticipantRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<createParticipantResponse>;
+export type listSessionParticipantsResponse200 = {
+    data: ParticipantList;
+    status: 200;
+};
+export type listSessionParticipantsResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type listSessionParticipantsResponseSuccess = listSessionParticipantsResponse200 & {
+    headers: Headers;
+};
+export type listSessionParticipantsResponseError = listSessionParticipantsResponseDefault & {
+    headers: Headers;
+};
+export type listSessionParticipantsResponse = listSessionParticipantsResponseSuccess | listSessionParticipantsResponseError;
+export declare const getListSessionParticipantsUrl: (sessionId: string) => string;
+/**
+ * Returns the participants of the session, in the order they joined.
+ * @summary List the participants of a session
+ */
+export declare const listSessionParticipants: (sessionId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listSessionParticipantsResponse>;
+export type renewParticipantResponse200 = {
+    data: RenewParticipantResponse;
+    status: 200;
+};
+export type renewParticipantResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type renewParticipantResponseSuccess = renewParticipantResponse200 & {
+    headers: Headers;
+};
+export type renewParticipantResponseError = renewParticipantResponseDefault & {
+    headers: Headers;
+};
+export type renewParticipantResponse = renewParticipantResponseSuccess | renewParticipantResponseError;
+export declare const getRenewParticipantUrl: (sessionId: string, participantId: number) => string;
+/**
+ * Extends the participant's lease and returns renewed PeerAuthorizations for the
+ * PeerConnections whose current ones the request presents. The service sends them to the
+ * session as well, and the participant passes each one to the session over its PeerConnection
+ * (`Packet.peer_authorization` of the transport protocol), so that the lease holds while
+ * either path to the session is down. A
+ * presented authorization that the service did not sign for this participant, or whose
+ * PeerConnection has ended, is left out of the answer. When the participant's authorization
+ * nears its end, the answer carries a renewed one, which the session already holds.
+ *
+ * Only the participant's user may renew it.
+ *
+ * Fails with:
+ * - `PARTICIPANT_NOT_FOUND` when the participant has ended; create another;
+ * - `PARTICIPANT_PERMISSION_REVOKED` when a permission the participant was created with has
+ *   been revoked from the caller; it has ended, and another can be created with the
+ *   permissions the caller holds now;
+ * - `PROJECT_MEMBERSHIP_REQUIRED` when the caller is no longer a member of the project; the
+ *   participant has ended.
+ * @summary Renew a participant
+ */
+export declare const renewParticipant: (sessionId: string, participantId: number, renewParticipantRequest: RenewParticipantRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<renewParticipantResponse>;
+export type prepareParticipantMigrationResponse200 = {
+    data: MigrationStep;
+    status: 200;
+};
+export type prepareParticipantMigrationResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type prepareParticipantMigrationResponseSuccess = prepareParticipantMigrationResponse200 & {
+    headers: Headers;
+};
+export type prepareParticipantMigrationResponseError = prepareParticipantMigrationResponseDefault & {
+    headers: Headers;
+};
+export type prepareParticipantMigrationResponse = prepareParticipantMigrationResponseSuccess | prepareParticipantMigrationResponseError;
+export declare const getPrepareParticipantMigrationUrl: (sessionId: string, participantId: number) => string;
+/**
+ * Passes the participant's checkpoint for the next epoch to the session and returns the
+ * session's checkpoint for it: the `prepare` and `prepared` steps of `Migration` in
+ * `leaflow/fleet/transport/v1/transport.proto`. Repeating the step returns the same answer.
+ *
+ * Only the participant's user may migrate it.
+ *
+ * Fails with:
+ * - `PARTICIPANT_NOT_FOUND` when the participant has ended;
+ * - `CHECKPOINT_INVALID` when the checkpoint is not a serialized `Checkpoint`;
+ * - `SESSION_UNAVAILABLE` when the session's process is not connected and does not connect
+ *   again in time, or did not answer in time; try again after the error's `retry_delay`.
+ * @summary Prepare a migration
+ */
+export declare const prepareParticipantMigration: (sessionId: string, participantId: number, migrationStep: MigrationStep, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<prepareParticipantMigrationResponse>;
+export type commitParticipantMigrationResponse200 = {
+    data: MigrationStep;
+    status: 200;
+};
+export type commitParticipantMigrationResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type commitParticipantMigrationResponseSuccess = commitParticipantMigrationResponse200 & {
+    headers: Headers;
+};
+export type commitParticipantMigrationResponseError = commitParticipantMigrationResponseDefault & {
+    headers: Headers;
+};
+export type commitParticipantMigrationResponse = commitParticipantMigrationResponseSuccess | commitParticipantMigrationResponseError;
+export declare const getCommitParticipantMigrationUrl: (sessionId: string, participantId: number) => string;
+/**
+ * Commits the epoch the participant prepared and returns the session's checkpoint once it
+ * committed it: the `commit` and `committed` steps of `Migration` in
+ * `leaflow/fleet/transport/v1/transport.proto`. Repeating the step returns the same answer.
+ *
+ * Only the participant's user may migrate it.
+ *
+ * Fails with:
+ * - `PARTICIPANT_NOT_FOUND` when the participant has ended;
+ * - `CHECKPOINT_INVALID` when the checkpoint is not a serialized `Checkpoint`;
+ * - `SESSION_UNAVAILABLE` when the session's process is not connected and does not connect
+ *   again in time, or did not answer in time; try again after the error's `retry_delay`.
+ * @summary Commit a migration
+ */
+export declare const commitParticipantMigration: (sessionId: string, participantId: number, migrationStep: MigrationStep, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<commitParticipantMigrationResponse>;
+export type createPeerConnectionResponse201 = {
+    data: PeerConnection;
+    status: 201;
+};
+export type createPeerConnectionResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 201>;
+};
+export type createPeerConnectionResponseSuccess = createPeerConnectionResponse201 & {
+    headers: Headers;
+};
+export type createPeerConnectionResponseError = createPeerConnectionResponseDefault & {
+    headers: Headers;
+};
+export type createPeerConnectionResponse = createPeerConnectionResponseSuccess | createPeerConnectionResponseError;
+export declare const getCreatePeerConnectionUrl: (sessionId: string, participantId: number) => string;
+/**
+ * Starts another PeerConnection of the participant with the offer, such as after a path
+ * failed, and returns the session's answer, the ICE candidates it has passed so far and the
+ * signed PeerAuthorization; read its later candidates with `get-peer-connection`. Move the
+ * participant's connection to it with
+ * `prepare-participant-migration` and `commit-participant-migration`.
+ *
+ * Only the participant's user may start one.
+ *
+ * Fails with:
+ * - `PARTICIPANT_NOT_FOUND` when the participant has ended;
+ * - `OFFER_INVALID` when the offer is not an SDP offer that names a SHA-256 DTLS fingerprint;
+ * - `RATE_LIMIT_EXCEEDED` when the participant started too many PeerConnections in the
+ *   last minute; try again after the error's `retry_delay`;
+ * - `SESSION_UNAVAILABLE` when the session's process is not connected and does not connect
+ *   again in time, or did not answer in time; try again after the error's `retry_delay`;
+ * - `PEER_CONNECTION_ABORTED` when the session gave up the PeerConnection; start another.
+ * @summary Start a PeerConnection
+ */
+export declare const createPeerConnection: (sessionId: string, participantId: number, createPeerConnectionRequest: CreatePeerConnectionRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<createPeerConnectionResponse>;
+export type getPeerConnectionResponse200 = {
+    data: PeerConnection;
+    status: 200;
+};
+export type getPeerConnectionResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type getPeerConnectionResponseSuccess = getPeerConnectionResponse200 & {
+    headers: Headers;
+};
+export type getPeerConnectionResponseError = getPeerConnectionResponseDefault & {
+    headers: Headers;
+};
+export type getPeerConnectionResponse = getPeerConnectionResponseSuccess | getPeerConnectionResponseError;
+export declare const getGetPeerConnectionUrl: (sessionId: string, participantId: number, peerConnectionId: string, params?: GetPeerConnectionParams) => string;
+/**
+ * Returns the PeerConnection with the ICE candidates the session has passed so far. The
+ * session passes its candidates as it gathers them (RFC 8838), so most arrive after the
+ * PeerConnection started: read it until `candidates_complete`, and add the candidates that
+ * are new since the last read to the PeerConnection. A client keeps those that arrive before
+ * it has set the answer as the remote description, and adds them once it has.
+ *
+ * With `known_candidates`, the request waits until the session has passed more candidates
+ * than that or reported the end of its candidates, for at most 20 seconds, and then returns
+ * the PeerConnection as it is.
+ *
+ * A PeerConnection can be read for 5 minutes after it started. Only the participant's user
+ * may read it.
+ *
+ * Fails with:
+ * - `PARTICIPANT_NOT_FOUND` when the participant has ended;
+ * - `PEER_CONNECTION_NOT_FOUND` when the participant has no such PeerConnection, it was
+ *   abandoned, the session gave it up, or it started more than 5 minutes ago.
+ * @summary Get a PeerConnection
+ */
+export declare const getPeerConnection: (sessionId: string, participantId: number, peerConnectionId: string, params?: GetPeerConnectionParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<getPeerConnectionResponse>;
+export type deletePeerConnectionResponse204 = {
+    data: void;
+    status: 204;
+};
+export type deletePeerConnectionResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 204>;
+};
+export type deletePeerConnectionResponseSuccess = deletePeerConnectionResponse204 & {
+    headers: Headers;
+};
+export type deletePeerConnectionResponseError = deletePeerConnectionResponseDefault & {
+    headers: Headers;
+};
+export type deletePeerConnectionResponse = deletePeerConnectionResponseSuccess | deletePeerConnectionResponseError;
+export declare const getDeletePeerConnectionUrl: (sessionId: string, participantId: number, peerConnectionId: string) => string;
+/**
+ * Tells the session to give up the PeerConnection and close it. Abandoning a PeerConnection
+ * that has ended succeeds.
+ *
+ * Only the participant's user may abandon it.
+ *
+ * Fails with `PARTICIPANT_NOT_FOUND` when the participant has ended.
+ * @summary Abandon a PeerConnection
+ */
+export declare const deletePeerConnection: (sessionId: string, participantId: number, peerConnectionId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<deletePeerConnectionResponse>;
+export type createPeerConnectionCandidatesResponse204 = {
+    data: void;
+    status: 204;
+};
+export type createPeerConnectionCandidatesResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 204>;
+};
+export type createPeerConnectionCandidatesResponseSuccess = createPeerConnectionCandidatesResponse204 & {
+    headers: Headers;
+};
+export type createPeerConnectionCandidatesResponseError = createPeerConnectionCandidatesResponseDefault & {
+    headers: Headers;
+};
+export type createPeerConnectionCandidatesResponse = createPeerConnectionCandidatesResponseSuccess | createPeerConnectionCandidatesResponseError;
+export declare const getCreatePeerConnectionCandidatesUrl: (sessionId: string, participantId: number, peerConnectionId: string) => string;
+/**
+ * Passes the ICE candidates the participant gathered after its offer to the session, and with
+ * `end_of_candidates`, that it has gathered all (RFC 8838). The session ignores those of a
+ * PeerConnection that has ended.
+ *
+ * Only the participant's user may add them.
+ *
+ * Fails with:
+ * - `PARTICIPANT_NOT_FOUND` when the participant has ended;
+ * - `SESSION_UNAVAILABLE` when the session's process is not connected and does not connect
+ *   again in time; try again after the error's `retry_delay`.
+ * @summary Add ICE candidates to a PeerConnection
+ */
+export declare const createPeerConnectionCandidates: (sessionId: string, participantId: number, peerConnectionId: string, createPeerConnectionCandidatesRequest: CreatePeerConnectionCandidatesRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<createPeerConnectionCandidatesResponse>;
+export type getParticipantResponse200 = {
+    data: ParticipantResource;
+    status: 200;
+};
+export type getParticipantResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type getParticipantResponseSuccess = getParticipantResponse200 & {
+    headers: Headers;
+};
+export type getParticipantResponseError = getParticipantResponseDefault & {
+    headers: Headers;
+};
+export type getParticipantResponse = getParticipantResponseSuccess | getParticipantResponseError;
+export declare const getGetParticipantUrl: (sessionId: string, participantId: number) => string;
+/**
+ * Returns a participant of the session.
+ * @summary Get a participant of a session
+ */
+export declare const getParticipant: (sessionId: string, participantId: number, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<getParticipantResponse>;
+export type deleteParticipantResponse204 = {
+    data: void;
+    status: 204;
+};
+export type deleteParticipantResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 204>;
+};
+export type deleteParticipantResponseSuccess = deleteParticipantResponse204 & {
+    headers: Headers;
+};
+export type deleteParticipantResponseError = deleteParticipantResponseDefault & {
+    headers: Headers;
+};
+export type deleteParticipantResponse = deleteParticipantResponseSuccess | deleteParticipantResponseError;
+export declare const getDeleteParticipantUrl: (sessionId: string, participantId: number) => string;
+/**
+ * Ends the participant: the session detaches it and closes its PeerConnections, and the
+ * session goes on. A participant leaves this way; others are disconnected this way.
+ *
+ * The participant's user and the owner of the session may end it; otherwise this
+ * requires `fleet:sessions.manage`.
+ * @summary End a participant
+ */
+export declare const deleteParticipant: (sessionId: string, participantId: number, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<deleteParticipantResponse>;