@leaflow/sdk 0.200.0 → 0.201.0

package/dist/canopy/v1/generated/models.d.ts

@@ -179,10 +179,23 @@ export interface AudioCapabilities {
      */
     supports_stream: boolean | null;
 }
+/**
+ * Accepted durations are min + n * step seconds, up to max. Independent of per-second pricing.
+ */
+export interface VideoDurationRange {
+    /** @minimum 1 */
+    min: number;
+    /** @minimum 1 */
+    max: number;
+    /** @minimum 1 */
+    step: number;
+}
 /**
  * The video parameters this endpoint accepts. Video is asynchronous on every endpoint that supports it. Create returns a task, and the task is polled separately.
  */
 export interface VideoCapabilities {
+    /** Continuous duration capability. Mutually exclusive with nonempty seconds. */
+    duration_range?: VideoDurationRange | null;
     /**
      * Durations the upstream accepts, in seconds. Null means unknown.
      * @nullable

package/dist/canopy/v1/generated/validators/endpointCapabilities.zod.d.ts

@@ -68,6 +68,11 @@ export declare const EndpointCapabilities: zod.ZodObject<{
         supports_stream: zod.ZodNullable<zod.ZodBoolean>;
     }, zod.z.core.$strict>, zod.ZodNull]>>;
     video: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+        duration_range: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+            min: zod.ZodInt;
+            max: zod.ZodInt;
+            step: zod.ZodInt;
+        }, zod.z.core.$strict>, zod.ZodNull]>>;
         seconds: zod.ZodNullable<zod.ZodArray<zod.ZodInt>>;
         sizes: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;
         resolutions: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;

package/dist/canopy/v1/generated/validators/model.zod.d.ts

@@ -94,6 +94,11 @@ export declare const Model: zod.ZodObject<{
             supports_stream: zod.ZodNullable<zod.ZodBoolean>;
         }, zod.z.core.$strict>, zod.ZodNull]>>;
         video: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+            duration_range: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+                min: zod.ZodInt;
+                max: zod.ZodInt;
+                step: zod.ZodInt;
+            }, zod.z.core.$strict>, zod.ZodNull]>>;
             seconds: zod.ZodNullable<zod.ZodArray<zod.ZodInt>>;
             sizes: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;
             resolutions: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;

package/dist/canopy/v1/generated/validators/modelCapabilities.zod.d.ts

@@ -68,6 +68,11 @@ export declare const ModelCapabilities: zod.ZodRecord<zod.ZodString, zod.ZodObje
         supports_stream: zod.ZodNullable<zod.ZodBoolean>;
     }, zod.z.core.$strict>, zod.ZodNull]>>;
     video: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+        duration_range: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+            min: zod.ZodInt;
+            max: zod.ZodInt;
+            step: zod.ZodInt;
+        }, zod.z.core.$strict>, zod.ZodNull]>>;
         seconds: zod.ZodNullable<zod.ZodArray<zod.ZodInt>>;
         sizes: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;
         resolutions: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;

package/dist/canopy/v1/generated/validators/modelList.zod.d.ts

@@ -96,6 +96,11 @@ export declare const ModelList: zod.ZodObject<{
                 supports_stream: zod.ZodNullable<zod.ZodBoolean>;
             }, zod.z.core.$strict>, zod.ZodNull]>>;
             video: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+                duration_range: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+                    min: zod.ZodInt;
+                    max: zod.ZodInt;
+                    step: zod.ZodInt;
+                }, zod.z.core.$strict>, zod.ZodNull]>>;
                 seconds: zod.ZodNullable<zod.ZodArray<zod.ZodInt>>;
                 sizes: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;
                 resolutions: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;

package/dist/canopy/v1/generated/validators/modelListResponseBody.zod.d.ts

@@ -119,6 +119,11 @@ export declare const ModelListResponseBody: zod.ZodObject<{
                 supports_stream: zod.ZodNullable<zod.ZodBoolean>;
             }, zod.z.core.$strict>, zod.ZodNull]>>;
             video: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+                duration_range: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+                    min: zod.ZodInt;
+                    max: zod.ZodInt;
+                    step: zod.ZodInt;
+                }, zod.z.core.$strict>, zod.ZodNull]>>;
                 seconds: zod.ZodNullable<zod.ZodArray<zod.ZodInt>>;
                 sizes: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;
                 resolutions: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;

package/dist/canopy/v1/generated/validators/modelResource.zod.d.ts

@@ -118,6 +118,11 @@ export declare const ModelResource: zod.ZodObject<{
             supports_stream: zod.ZodNullable<zod.ZodBoolean>;
         }, zod.z.core.$strict>, zod.ZodNull]>>;
         video: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+            duration_range: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+                min: zod.ZodInt;
+                max: zod.ZodInt;
+                step: zod.ZodInt;
+            }, zod.z.core.$strict>, zod.ZodNull]>>;
             seconds: zod.ZodNullable<zod.ZodArray<zod.ZodInt>>;
             sizes: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;
             resolutions: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;

package/dist/canopy/v1/generated/validators/videoCapabilities.zod.d.ts

@@ -40,6 +40,11 @@
  */
 import * as zod from "zod";
 export declare const VideoCapabilities: zod.ZodObject<{
+    duration_range: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodObject<{
+        min: zod.ZodInt;
+        max: zod.ZodInt;
+        step: zod.ZodInt;
+    }, zod.z.core.$strict>, zod.ZodNull]>>;
     seconds: zod.ZodNullable<zod.ZodArray<zod.ZodInt>>;
     sizes: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;
     resolutions: zod.ZodNullable<zod.ZodArray<zod.ZodString>>;

package/dist/canopy/v1/generated/validators/videoCapabilities.zod.js

@@ -39,8 +39,13 @@
  * OpenAPI spec version: 1.0.0
  */
 import * as zod from "zod";
+import { VideoDurationRange } from "./videoDurationRange.zod.js";
 export const VideoCapabilities = zod
     .strictObject({
+    duration_range: zod
+        .union([VideoDurationRange, zod.null()])
+        .optional()
+        .describe("Continuous duration capability. Mutually exclusive with nonempty seconds."),
     seconds: zod
         .array(zod.int().min(1))
         .nullable()

package/dist/canopy/v1/generated/validators/videoDurationRange.zod.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Canopy API
+ * Canopy model inference, API keys, model catalogue, service enablement and recorded usage.
+ *
+ * Project inference is served on this host in each provider's own protocol:
+ *
+ * - OpenAI: `/v1/chat/completions`, `/v1/responses` and `/v1/embeddings`; use
+ *   `https://canopy.leaflow.cloud/v1` as the OpenAI SDK base URL.
+ * - Anthropic: `/v1/messages`; use `https://canopy.leaflow.cloud` as the Anthropic SDK base URL.
+ * - Gemini: `/v1beta/models/{model}:generateContent` and `:streamGenerateContent`.
+ *
+ * Canopy does not convert between protocols. A request is accepted only for a model whose
+ * `supported_endpoints` lists the endpoint it was sent to, and it is forwarded unchanged except for
+ * the model name and the credentials. Reasoning settings such as `reasoning_effort` are passed
+ * through as written; a model's `capabilities` lists the values its upstream accepts.
+ *
+ * Management operations use `/api/v1`. The management model catalogue names how each model is billed in Billing;
+ * `/v1/models` returns the OpenAI model format with Canopy capabilities and parameter limits.
+ *
+ * ## Authentication
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme.
+ *
+ * Management and project inference accept the same verified IAM scoped token. The token is the
+ * sole billing project authority; `OpenAI-Project` and historical identity headers cannot
+ * override it. These endpoints do not accept a Canopy API key. The separate API-key gateway
+ * accepts Canopy API keys and serves the same endpoints.
+ *
+ * ## Conventions
+ *
+ * - **The plaintext of an API key is returned once.** The `secret` appears in the response that issues it and is returned by no other endpoint. A key that has been lost has to be revoked and reissued.
+ * - **Disabling and revoking are distinct.** A disabled key may be enabled again at any time, while a revocation is irreversible and is intended for a key that has been exposed. Neither removes the record, and the usage the key accrued remains readable.
+ * - **A usage query must carry a time range**, spanning no more than 31 days, or 400 days for the usage timeline. `from` and `to` carry a timezone offset, which the server does not infer.
+ * - **The request and response bodies do not appear in the ledger.** They are not recorded. Quote the `upstream_request_id` from the response when reporting a problem.
+ * - **Usage may be estimated.** The upstream provider does not report usage on every request. Where it does not, `usage_source` is `estimated` and the figures are derived from the character classes of the payload, to within roughly fifteen per cent.
+ * - **The service is enabled before use.** A project enables the model platform once, through `create-service`; the forwarding endpoints refuse its requests until the service is `active`. Requests are then billed under the service's subscription by the tokens they use, at the rates Billing holds for each model's `billing`.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export declare const VideoDurationRange: zod.ZodObject<{
+    min: zod.ZodInt;
+    max: zod.ZodInt;
+    step: zod.ZodInt;
+}, zod.z.core.$strict>;
+export type VideoDurationRange = zod.input<typeof VideoDurationRange>;
+export type VideoDurationRangeOutput = zod.output<typeof VideoDurationRange>;

package/dist/canopy/v1/generated/validators/videoDurationRange.zod.js

@@ -0,0 +1,48 @@
+/**
+ * Generated by orval 🍺
+ * Do not edit manually.
+ * Leaflow Canopy API
+ * Canopy model inference, API keys, model catalogue, service enablement and recorded usage.
+ *
+ * Project inference is served on this host in each provider's own protocol:
+ *
+ * - OpenAI: `/v1/chat/completions`, `/v1/responses` and `/v1/embeddings`; use
+ *   `https://canopy.leaflow.cloud/v1` as the OpenAI SDK base URL.
+ * - Anthropic: `/v1/messages`; use `https://canopy.leaflow.cloud` as the Anthropic SDK base URL.
+ * - Gemini: `/v1beta/models/{model}:generateContent` and `:streamGenerateContent`.
+ *
+ * Canopy does not convert between protocols. A request is accepted only for a model whose
+ * `supported_endpoints` lists the endpoint it was sent to, and it is forwarded unchanged except for
+ * the model name and the credentials. Reasoning settings such as `reasoning_effort` are passed
+ * through as written; a model's `capabilities` lists the values its upstream accepts.
+ *
+ * Management operations use `/api/v1`. The management model catalogue names how each model is billed in Billing;
+ * `/v1/models` returns the OpenAI model format with Canopy capabilities and parameter limits.
+ *
+ * ## Authentication
+ *
+ * Every request carries a scoped token; see the `bearerAuth` security scheme.
+ *
+ * Management and project inference accept the same verified IAM scoped token. The token is the
+ * sole billing project authority; `OpenAI-Project` and historical identity headers cannot
+ * override it. These endpoints do not accept a Canopy API key. The separate API-key gateway
+ * accepts Canopy API keys and serves the same endpoints.
+ *
+ * ## Conventions
+ *
+ * - **The plaintext of an API key is returned once.** The `secret` appears in the response that issues it and is returned by no other endpoint. A key that has been lost has to be revoked and reissued.
+ * - **Disabling and revoking are distinct.** A disabled key may be enabled again at any time, while a revocation is irreversible and is intended for a key that has been exposed. Neither removes the record, and the usage the key accrued remains readable.
+ * - **A usage query must carry a time range**, spanning no more than 31 days, or 400 days for the usage timeline. `from` and `to` carry a timezone offset, which the server does not infer.
+ * - **The request and response bodies do not appear in the ledger.** They are not recorded. Quote the `upstream_request_id` from the response when reporting a problem.
+ * - **Usage may be estimated.** The upstream provider does not report usage on every request. Where it does not, `usage_source` is `estimated` and the figures are derived from the character classes of the payload, to within roughly fifteen per cent.
+ * - **The service is enabled before use.** A project enables the model platform once, through `create-service`; the forwarding endpoints refuse its requests until the service is `active`. Requests are then billed under the service's subscription by the tokens they use, at the rates Billing holds for each model's `billing`.
+ * OpenAPI spec version: 1.0.0
+ */
+import * as zod from "zod";
+export const VideoDurationRange = zod
+    .strictObject({
+    min: zod.int().min(1),
+    max: zod.int().min(1),
+    step: zod.int().min(1),
+})
+    .describe("Accepted durations are min + n * step seconds, up to max. Independent of per-second pricing.");

package/dist/fleet/v1/generated/functions.d.ts

@@ -83,11 +83,15 @@
  *   and remote ones it connects to;
  * - `leaflow.fleet.host.v1`: terminal sessions, with programs, files, ports, sound, devices,
  *   printers and privilege approvals;
- * - `leaflow.fleet.virtualdesktop.host.v1`: sessions with a desktop.
+ * - `leaflow.fleet.virtualdesktop.host.v1`: sessions with a graphical backend;
+ * - `leaflow.fleet.tool.v1`: live session tools. Builtin `computer.*` tools are exposed only while
+ *   the virtual desktop capability is actually available; MCP is a separate source.
  *
- * A machine installed without a desktop does not offer `leaflow.fleet.virtualdesktop.host.v1`. A
- * request that needs a feature the machine does not report available fails with
- * `FEATURE_UNAVAILABLE`, whose `metadata.feature` names the feature.
+ * A graphical backend does not require a full desktop environment. Terminal logins, commands
+ * and MCP server initialization prepare or reuse the account's lightweight graphical context,
+ * in addition to their own session or job. Configuration reads and writes do not initialize a
+ * server and do not require this preparation. A request that needs a feature the machine does
+ * not report available fails with `FEATURE_UNAVAILABLE`, whose `metadata.feature` names it.
  *
  * ## Directory
  *
@@ -238,7 +242,7 @@
  * revoked. A participant whose creation failed is not announced.
  * OpenAPI spec version: 1.0.0
  */
-import type { AccountList, AccountResource, ApproveEnrollmentRequest, CallMcpToolRequest, CallMcpToolResponse, CreateGroupMemberRequest, CreateGroupRequest, CreateMachineRegistrationRequest, CreateMachineRegistrationResponse, CreateParticipantRequest, CreateParticipantResponse, CreatePeerConnectionCandidatesRequest, CreatePeerConnectionRequest, CreateSessionRequest, DeleteMcpServerParams, DenyPrivilegeRequestRequest, EnrollmentResource, Error, FindEnrollmentByPairingCodeParams, FindEnrollmentResponse, GetPeerConnectionParams, GroupList, GroupResource, ListAccountsParams, ListGroupMembersParams, ListGroupsParams, ListMachineEventsParams, ListMachineRegistrationsParams, ListMachinesParams, ListMcpToolsParams, ListPrivilegeAutoApprovalsParams, ListPrivilegeRequestsParams, ListSessionsParams, MachineEventList, MachineList, MachineRegistrationList, MachineRegistrationResource, MachineResource, McpConfigurationFile, McpConfigurationResource, McpToolList, MigrationStep, ParticipantList, ParticipantResource, PeerConnection, PrivilegeAutoApprovalList, PrivilegeAutoApprovalResource, PrivilegeRequestList, PrivilegeRequestResource, RenewParticipantRequest, RenewParticipantResponse, ReplaceMcpConfigurationRequest, RtcConfiguration, RunCommandRequest, RunCommandResponse, SendMcpRequestRequest, SendMcpRequestResponse, SessionList, SessionResource, UpdateAccountRequest, UpdateGroupRequest, UpdateMachineRequest, UpdateMcpServerRequest, UpdateMcpServerResponse, UpdatePrivilegeAutoApprovalRequest } from "./models.js";
+import type { AccountList, AccountResource, ApproveEnrollmentRequest, CallMcpToolRequest, CallMcpToolResponse, CallToolRequest, CallToolResponse, CreateGroupMemberRequest, CreateGroupRequest, CreateMachineRegistrationRequest, CreateMachineRegistrationResponse, CreateParticipantRequest, CreateParticipantResponse, CreatePeerConnectionCandidatesRequest, CreatePeerConnectionRequest, CreateSessionRequest, DeleteMcpServerParams, DenyPrivilegeRequestRequest, EnrollmentResource, Error, FindEnrollmentByPairingCodeParams, FindEnrollmentResponse, GetPeerConnectionParams, GroupList, GroupResource, ListAccountsParams, ListGroupMembersParams, ListGroupsParams, ListMachineEventsParams, ListMachineRegistrationsParams, ListMachinesParams, ListMcpToolsParams, ListPrivilegeAutoApprovalsParams, ListPrivilegeRequestsParams, ListSessionsParams, ListToolsParams, MachineEventList, MachineList, MachineRegistrationList, MachineRegistrationResource, MachineResource, McpConfigurationFile, McpConfigurationResource, McpToolList, MigrationStep, ParticipantList, ParticipantResource, PeerConnection, PrivilegeAutoApprovalList, PrivilegeAutoApprovalResource, PrivilegeRequestList, PrivilegeRequestResource, RenewParticipantRequest, RenewParticipantResponse, ReplaceMcpConfigurationRequest, RtcConfiguration, RunCommandRequest, RunCommandResponse, SendMcpRequestRequest, SendMcpRequestResponse, SessionList, SessionResource, ToolActivityList, ToolList, UpdateAccountRequest, UpdateGroupRequest, UpdateMachineRequest, UpdateMcpServerRequest, UpdateMcpServerResponse, UpdatePrivilegeAutoApprovalRequest } from "./models.js";
 export type HTTPStatusCode1xx = 100 | 101 | 102 | 103;
 export type HTTPStatusCode2xx = 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207;
 export type HTTPStatusCode3xx = 300 | 301 | 302 | 303 | 304 | 305 | 307 | 308;
@@ -377,19 +381,23 @@ export declare const getRunMachineCommandUrl: (machineId: string) => string;
  * redirection and `&&` work; there is no terminal and no standard input. The machine admits
  * the account through PAM as for a login. The account is created if the caller has none yet.
  * A command that fails is still a successful request: its exit status is its result.
+ * Before starting it, Fleet prepares or reuses the account's ready lightweight graphical
+ * session, without starting a full desktop environment. The command has its own job scope;
+ * its timeout or exit must not close the account's graphical context.
  *
  * Inside the command, `sudo` works without a prompt while the caller has
  * `fleet:machines.admin` on the machine, and refuses otherwise.
  *
- * The request is held until the command ends, at most `timeout_seconds` and a few seconds
- * more. Neither the command nor its output is hidden from the platform: do not put secrets
+ * After graphical context preparation, the request is held until the command ends, at most
+ * `timeout_seconds` and a few seconds more. Neither the command nor its output is hidden from the platform: do not put secrets
  * into either.
  *
  * Requires `fleet:machines.login` on the machine.
  *
  * Fails with:
  * - `MACHINE_OFFLINE` when the machine is not connected and does not connect again in time;
- * - `FEATURE_UNAVAILABLE` when the machine does not offer `leaflow.fleet.command.v1`;
+ * - `FEATURE_UNAVAILABLE` when the command, session or graphical backend is unavailable;
+ * - `SESSION_UNAVAILABLE` or `SESSION_CLOSED` when the account context is not ready or closing;
  * - `USER_NOT_FOUND`, `USER_NOT_ALLOWED`, `ACCOUNT_EXPIRED` or `PAM_PERMISSION_DENIED` when
  *   the machine refuses the account, as for opening a session;
  * - `COMMAND_START_FAILED` when the shell could not start; nothing ran;
@@ -528,6 +536,94 @@ export declare const getDeleteMcpServerUrl: (machineId: string, serverName: stri
  * @summary Remove an MCP server
  */
 export declare const deleteMcpServer: (machineId: string, serverName: string, params?: DeleteMcpServerParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<deleteMcpServerResponse>;
+export type listToolsResponse200 = {
+    data: ToolList;
+    status: 200;
+};
+export type listToolsResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type listToolsResponseSuccess = listToolsResponse200 & {
+    headers: Headers;
+};
+export type listToolsResponseError = listToolsResponseDefault & {
+    headers: Headers;
+};
+export type listToolsResponse = listToolsResponseSuccess | listToolsResponseError;
+export declare const getListToolsUrl: (machineId: string, params: ListToolsParams) => string;
+/**
+ * Queries Agent's builtin tools and the caller's configured MCP servers live. No directory,
+ * result or image is cached. Requires fleet:machines.login; builtin capabilities retain
+ * their native policies and read-only restrictions. Ensures or reuses the caller's single
+ * open graphical session, without launching a desktop environment. The client instance is
+ * a UUID generated once per running client, not an authorization credential. Each request
+ * checks current IAM permissions and signs a short-lived control-only authorization.
+ * Tool arguments, results and images traverse Fleet with hop-by-hop TLS and are visible to
+ * Fleet. Existing desktop streaming remains end-to-end encrypted. TOOL_LIST_CHANGED means
+ * restart listing from the first page, never replay a CallTool. At most 100 tools per page.
+ * @summary List live tools available to the caller on a machine
+ */
+export declare const listTools: (machineId: string, params: ListToolsParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listToolsResponse>;
+export type callToolResponse200 = {
+    data: CallToolResponse;
+    status: 200;
+};
+export type callToolResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type callToolResponseSuccess = callToolResponse200 & {
+    headers: Headers;
+};
+export type callToolResponseError = callToolResponseDefault & {
+    headers: Headers;
+};
+export type callToolResponse = callToolResponseSuccess | callToolResponseError;
+export declare const getCallToolUrl: (machineId: string) => string;
+/**
+ * Uses the same current permissions, directory account and graphical session as listTools.
+ * Listing is not a precondition: callers may use a previously discovered ToolRef, and this
+ * operation never sends a discovery request or refreshes schemas before executing it.
+ * A removed tool or MCP server returns TOOL_NOT_FOUND, as does a direct builtin computer.*
+ * call while virtual desktop capability is unavailable. Actual permission errors remain
+ * permission errors; a missing target window is not a missing tool. Use listTools only when
+ * discovery or refresh is needed, and do not cache or reuse execution results.
+ * Source is explicit: MCP names never select or impersonate builtin tools. The arguments
+ * object is at most 256 KiB. The complete result is at most 8 MiB in the protobuf transport,
+ * with each encoded image at most 4 MiB; images are converted to base64 once at this JSON
+ * boundary, without recompression or persistence. Cancellation is propagated. A timeout,
+ * disconnect or failed response does not prove that side effects did not happen; do not
+ * automatically replay. operation_id only correlates live activity, not idempotency.
+ * @summary Call a live builtin or external MCP tool
+ */
+export declare const callTool: (machineId: string, callToolRequest: CallToolRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<callToolResponse>;
+export type pollToolActivitiesResponse200 = {
+    data: ToolActivityList;
+    status: 200;
+};
+export type pollToolActivitiesResponseDefault = {
+    data: Error;
+    status: Exclude<HTTPStatusCodes, 200>;
+};
+export type pollToolActivitiesResponseSuccess = pollToolActivitiesResponse200 & {
+    headers: Headers;
+};
+export type pollToolActivitiesResponseError = pollToolActivitiesResponseDefault & {
+    headers: Headers;
+};
+export type pollToolActivitiesResponse = pollToolActivitiesResponseSuccess | pollToolActivitiesResponseError;
+export declare const getPollToolActivitiesUrl: (sessionId: string) => string;
+/**
+ * Checks current session viewing permission for each request and again before returning
+ * events. Subscribes only while this request is pending, returning on the first batch or
+ * after at most 20 idle seconds. At most 64 events, no offline queue, event database, cursor
+ * history or replay guarantee. Missing events never mean repeat an action. Coordinates
+ * are window-client-local (window_id=0 means canvas), not CSS or image pixels. The frontend
+ * applies its own zoom and DPI. Compare sequence only within the same instance_id.
+ * @summary Receive live tool activity for an authorized session
+ */
+export declare const pollToolActivities: (sessionId: string, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<pollToolActivitiesResponse>;
 export type sendMcpRequestResponse200 = {
     data: SendMcpRequestResponse;
     status: 200;
@@ -548,7 +644,9 @@ export declare const getSendMcpRequestUrl: (machineId: string, serverName: strin
  * Sends one JSON-RPC request of MCP to one of the caller's servers on the machine, such as
  * `tools/call`, `resources/read` or `prompts/get`, and returns the server's response. The
  * machine starts or connects to the server if it is not running, and handles its
- * initialization itself; a request still running when `timeout_seconds` passes is cancelled
+ * initialization itself. Before any such request, Fleet prepares or reuses the caller's
+ * ready lightweight account graphical session, including for resources and prompts; no full
+ * desktop environment is needed. A request still running when `timeout_seconds` passes is cancelled
  * at the server. Requests the server makes of the client are answered as by a client that
  * offers no sampling, elicitation or roots, and its notifications, such as of progress, are
  * dropped. A response with a JSON-RPC error is a successful request. Neither the request nor
@@ -562,7 +660,8 @@ export declare const getSendMcpRequestUrl: (machineId: string, serverName: strin
  *   is one of initialization;
  * - `RESULT_TOO_LARGE` when the response is larger than 8 MiB;
  * - `MACHINE_OFFLINE` when the machine is not connected and does not connect again in time;
- * - `FEATURE_UNAVAILABLE` when the machine does not offer `leaflow.fleet.mcp.v1`;
+ * - `FEATURE_UNAVAILABLE` when the MCP, session or graphical backend is unavailable;
+ * - `SESSION_UNAVAILABLE` or `SESSION_CLOSED` when the account context is not ready or closing;
  * - `USER_NOT_FOUND`, `USER_NOT_ALLOWED`, `ACCOUNT_EXPIRED` or `PAM_PERMISSION_DENIED` when
  *   the machine refuses the account, as for opening a session;
  * - `MCP_START_FAILED` when the machine could not start MCP for the caller's account;
@@ -596,6 +695,7 @@ export declare const getCallMcpToolUrl: (machineId: string, serverName: string,
  * Fails as sending a request does, and with `MCP_REQUEST_FAILED` when the server answers
  * with a JSON-RPC error, such as for a tool it does not offer or arguments it does not
  * accept, with the error's `metadata.code` and `metadata.message`.
+ * @deprecated
  * @summary Call an MCP tool
  */
 export declare const callMcpTool: (machineId: string, serverName: string, toolName: string, callMcpToolRequest: CallMcpToolRequest, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<callMcpToolResponse>;
@@ -632,6 +732,7 @@ export declare const getListMcpToolsUrl: (machineId: string, params?: ListMcpToo
  *   the machine refuses the account, as for opening a session;
  * - `MCP_START_FAILED` when the machine could not start MCP for the caller's account;
  * - `MACHINE_TIMEOUT` when the machine did not answer in time.
+ * @deprecated
  * @summary List the caller's MCP tools on a machine
  */
 export declare const listMcpTools: (machineId: string, params?: ListMcpToolsParams, options?: RequestInit, fetchFn?: typeof globalThis.fetch) => Promise<listMcpToolsResponse>;
@@ -1288,12 +1389,19 @@ export type createSessionResponse = createSessionResponseSuccess | createSession
 export declare const getCreateSessionUrl: () => string;
 /**
  * Opens a session for the caller on a machine, as the caller's account, and returns once it
- * is ready. With `desktop` the session has a desktop. Without, it is a terminal session: its
+ * is ready. With `desktop` the session has a desktop. Without, Fleet first prepares or reuses
+ * the account's separate ready lightweight graphical session, then creates a terminal session
+ * with its own SID and lifetime; closing that terminal does not close the account context. Its
  * one terminal runs the caller's login shell from the start, every participant attaches to
  * that terminal, and the session ends when the shell exits; a caller who wants another
  * terminal opens another session. Either kind also offers programs, files, ports, sound,
  * devices, printers and privilege approvals. The account is created if the caller has none
  * yet. Requires `fleet:machines.login` on the machine.
+ * All newly created graphical account sessions, including desktop-first FullDesktop and
+ * Seamless sessions, keep running when no viewer has joined or the last viewer disconnects.
+ * Configured maximum lifetime, resource limits and explicit close/terminate still apply.
+ * This create API has no client-selected idle policy; existing running policies are not
+ * silently rewritten when tools, commands or terminals reuse the account context.
  *
  * On a machine an account has at most one session with a desktop and at most 8 sessions in
  * all. Sessions without a desktop run side by side, such as one for a program and one for a
@@ -1301,8 +1409,8 @@ export declare const getCreateSessionUrl: () => string;
  *
  * Fails with:
  * - `MACHINE_OFFLINE` when the machine is not connected and does not connect again in time;
- * - `FEATURE_UNAVAILABLE` when the machine does not offer sessions, or with `desktop`,
- *   desktops;
+ * - `FEATURE_UNAVAILABLE` when the machine does not offer sessions or the graphical backend;
+ * - `SESSION_UNAVAILABLE` or `SESSION_CLOSED` when its shared account context is not ready or closing;
  * - `USER_HAS_DESKTOP_SESSION` with `desktop` when the account already has a session with a
  *   desktop on the machine, which `metadata.sessionId` names; connect to it instead;
  * - `SESSION_LIMIT_REACHED` when the account already has 8 open sessions on the machine;