diff --git a/.gitattributes b/.gitattributes
index 29587f87c3b5b..25e3302a42b40 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -8,3 +8,4 @@ docs/theme/js/theme.js linguist-vendored=false
 *_pb.d.ts linguist-generated
 *_pb.ts linguist-generated
 *_pb.grpc-*.ts linguist-generated
+*_pb.client.ts linguist-generated
diff --git a/buf-ts.gen.yaml b/buf-ts.gen.yaml
index b071c061c073c..1a91c918b634d 100644
--- a/buf-ts.gen.yaml
+++ b/buf-ts.gen.yaml
@@ -1,13 +1,13 @@
-version: v1
-plugins:
-  - name: typescript
-    out: gen/proto/ts
-    opt: long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
-    path:
-      - npm
-      - exec
-      - --yes
-      - --package=@protobuf-ts/plugin@2.9.3
-      - --
-      - protoc-gen-ts
-    strategy: all
+version: v1
+plugins:
+  - name: typescript
+    out: gen/proto/ts
+    opt: long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+    path:
+      - npm
+      - exec
+      - --yes
+      - --package=@protobuf-ts/plugin@2.9.3
+      - --
+      - protoc-gen-ts
+    strategy: all
diff --git a/gen/proto/ts/google/protobuf/descriptor_pb.ts b/gen/proto/ts/google/protobuf/descriptor_pb.ts
index 8fef6a8d9d882..723f0d97d1466 100644
--- a/gen/proto/ts/google/protobuf/descriptor_pb.ts
+++ b/gen/proto/ts/google/protobuf/descriptor_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "google/protobuf/descriptor.proto" (package "google.protobuf", syntax proto2)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/google/protobuf/duration_pb.ts b/gen/proto/ts/google/protobuf/duration_pb.ts
index 5f07ed652a25a..bb7570d77a656 100644
--- a/gen/proto/ts/google/protobuf/duration_pb.ts
+++ b/gen/proto/ts/google/protobuf/duration_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "google/protobuf/duration.proto" (package "google.protobuf", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/google/protobuf/empty_pb.ts b/gen/proto/ts/google/protobuf/empty_pb.ts
index 19cf9f8511daf..bd29d7a6f5118 100644
--- a/gen/proto/ts/google/protobuf/empty_pb.ts
+++ b/gen/proto/ts/google/protobuf/empty_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "google/protobuf/empty.proto" (package "google.protobuf", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/google/protobuf/timestamp_pb.ts b/gen/proto/ts/google/protobuf/timestamp_pb.ts
index 58d6243515cbf..bcf2a502d4c47 100644
--- a/gen/proto/ts/google/protobuf/timestamp_pb.ts
+++ b/gen/proto/ts/google/protobuf/timestamp_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "google/protobuf/timestamp.proto" (package "google.protobuf", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1/teleport_pb.grpc-client.ts b/gen/proto/ts/prehog/v1/teleport_pb.client.ts
similarity index 54%
rename from gen/proto/ts/prehog/v1/teleport_pb.grpc-client.ts
rename to gen/proto/ts/prehog/v1/teleport_pb.client.ts
index ac0e793af3a00..f5bd040856195 100644
--- a/gen/proto/ts/prehog/v1/teleport_pb.grpc-client.ts
+++ b/gen/proto/ts/prehog/v1/teleport_pb.client.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1/teleport.proto" (package "prehog.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -21,12 +21,14 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 //
+import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
+import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
 import { TeleportReportingService } from "./teleport_pb";
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
+import { stackIntercept } from "@protobuf-ts/runtime-rpc";
 import type { SubmitUsageReportsResponse } from "./teleport_pb";
 import type { SubmitUsageReportsRequest } from "./teleport_pb";
-import * as grpc from "@grpc/grpc-js";
+import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
+import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
 /**
  * @generated from protobuf service prehog.v1.TeleportReportingService
  */
@@ -44,19 +46,16 @@ export interface ITeleportReportingServiceClient {
      *
      * @generated from protobuf rpc: SubmitUsageReports(prehog.v1.SubmitUsageReportsRequest) returns (prehog.v1.SubmitUsageReportsResponse);
      */
-    submitUsageReports(input: SubmitUsageReportsRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: SubmitUsageReportsResponse) => void): grpc.ClientUnaryCall;
-    submitUsageReports(input: SubmitUsageReportsRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: SubmitUsageReportsResponse) => void): grpc.ClientUnaryCall;
-    submitUsageReports(input: SubmitUsageReportsRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: SubmitUsageReportsResponse) => void): grpc.ClientUnaryCall;
-    submitUsageReports(input: SubmitUsageReportsRequest, callback: (err: grpc.ServiceError | null, value?: SubmitUsageReportsResponse) => void): grpc.ClientUnaryCall;
+    submitUsageReports(input: SubmitUsageReportsRequest, options?: RpcOptions): UnaryCall<SubmitUsageReportsRequest, SubmitUsageReportsResponse>;
 }
 /**
  * @generated from protobuf service prehog.v1.TeleportReportingService
  */
-export class TeleportReportingServiceClient extends grpc.Client implements ITeleportReportingServiceClient {
-    private readonly _binaryOptions: Partial<BinaryReadOptions & BinaryWriteOptions>;
-    constructor(address: string, credentials: grpc.ChannelCredentials, options: grpc.ClientOptions = {}, binaryOptions: Partial<BinaryReadOptions & BinaryWriteOptions> = {}) {
-        super(address, credentials, options);
-        this._binaryOptions = binaryOptions;
+export class TeleportReportingServiceClient implements ITeleportReportingServiceClient, ServiceInfo {
+    typeName = TeleportReportingService.typeName;
+    methods = TeleportReportingService.methods;
+    options = TeleportReportingService.options;
+    constructor(private readonly _transport: RpcTransport) {
     }
     /**
      * encodes and forwards usage reports to the PostHog event database; each
@@ -71,8 +70,8 @@ export class TeleportReportingServiceClient extends grpc.Client implements ITele
      *
      * @generated from protobuf rpc: SubmitUsageReports(prehog.v1.SubmitUsageReportsRequest) returns (prehog.v1.SubmitUsageReportsResponse);
      */
-    submitUsageReports(input: SubmitUsageReportsRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: SubmitUsageReportsResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: SubmitUsageReportsResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: SubmitUsageReportsResponse) => void)): grpc.ClientUnaryCall {
-        const method = TeleportReportingService.methods[0];
-        return this.makeUnaryRequest<SubmitUsageReportsRequest, SubmitUsageReportsResponse>(`/${TeleportReportingService.typeName}/${method.name}`, (value: SubmitUsageReportsRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): SubmitUsageReportsResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
+    submitUsageReports(input: SubmitUsageReportsRequest, options?: RpcOptions): UnaryCall<SubmitUsageReportsRequest, SubmitUsageReportsResponse> {
+        const method = this.methods[0], opt = this._transport.mergeOptions(options);
+        return stackIntercept<SubmitUsageReportsRequest, SubmitUsageReportsResponse>("unary", this._transport, method, opt, input);
     }
 }
diff --git a/gen/proto/ts/prehog/v1/teleport_pb.grpc-server.ts b/gen/proto/ts/prehog/v1/teleport_pb.grpc-server.ts
index dd82f58fbe9f9..19affccf5c328 100644
--- a/gen/proto/ts/prehog/v1/teleport_pb.grpc-server.ts
+++ b/gen/proto/ts/prehog/v1/teleport_pb.grpc-server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1/teleport.proto" (package "prehog.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1/teleport_pb.ts b/gen/proto/ts/prehog/v1/teleport_pb.ts
index e88cf4a2b88bf..a7b63ce987896 100644
--- a/gen/proto/ts/prehog/v1/teleport_pb.ts
+++ b/gen/proto/ts/prehog/v1/teleport_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1/teleport.proto" (package "prehog.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1alpha/connect_pb.client.ts b/gen/proto/ts/prehog/v1alpha/connect_pb.client.ts
new file mode 100644
index 0000000000000..4413810d3c1f1
--- /dev/null
+++ b/gen/proto/ts/prehog/v1alpha/connect_pb.client.ts
@@ -0,0 +1,57 @@
+/* eslint-disable */
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated from protobuf file "prehog/v1alpha/connect.proto" (package "prehog.v1alpha", syntax proto3)
+// tslint:disable
+// @ts-nocheck
+//
+//
+// Teleport
+// Copyright (C) 2023  Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
+import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
+import { ConnectReportingService } from "./connect_pb";
+import { stackIntercept } from "@protobuf-ts/runtime-rpc";
+import type { SubmitConnectEventResponse } from "./connect_pb";
+import type { SubmitConnectEventRequest } from "./connect_pb";
+import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
+import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
+/**
+ * @generated from protobuf service prehog.v1alpha.ConnectReportingService
+ */
+export interface IConnectReportingServiceClient {
+    /**
+     * @generated from protobuf rpc: SubmitConnectEvent(prehog.v1alpha.SubmitConnectEventRequest) returns (prehog.v1alpha.SubmitConnectEventResponse);
+     */
+    submitConnectEvent(input: SubmitConnectEventRequest, options?: RpcOptions): UnaryCall<SubmitConnectEventRequest, SubmitConnectEventResponse>;
+}
+/**
+ * @generated from protobuf service prehog.v1alpha.ConnectReportingService
+ */
+export class ConnectReportingServiceClient implements IConnectReportingServiceClient, ServiceInfo {
+    typeName = ConnectReportingService.typeName;
+    methods = ConnectReportingService.methods;
+    options = ConnectReportingService.options;
+    constructor(private readonly _transport: RpcTransport) {
+    }
+    /**
+     * @generated from protobuf rpc: SubmitConnectEvent(prehog.v1alpha.SubmitConnectEventRequest) returns (prehog.v1alpha.SubmitConnectEventResponse);
+     */
+    submitConnectEvent(input: SubmitConnectEventRequest, options?: RpcOptions): UnaryCall<SubmitConnectEventRequest, SubmitConnectEventResponse> {
+        const method = this.methods[0], opt = this._transport.mergeOptions(options);
+        return stackIntercept<SubmitConnectEventRequest, SubmitConnectEventResponse>("unary", this._transport, method, opt, input);
+    }
+}
diff --git a/gen/proto/ts/prehog/v1alpha/connect_pb.grpc-client.ts b/gen/proto/ts/prehog/v1alpha/connect_pb.grpc-client.ts
deleted file mode 100644
index 8c23af5b4c02f..0000000000000
--- a/gen/proto/ts/prehog/v1alpha/connect_pb.grpc-client.ts
+++ /dev/null
@@ -1,58 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
-// @generated from protobuf file "prehog/v1alpha/connect.proto" (package "prehog.v1alpha", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-//
-// Teleport
-// Copyright (C) 2023  Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-//
-import { ConnectReportingService } from "./connect_pb";
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { SubmitConnectEventResponse } from "./connect_pb";
-import type { SubmitConnectEventRequest } from "./connect_pb";
-import * as grpc from "@grpc/grpc-js";
-/**
- * @generated from protobuf service prehog.v1alpha.ConnectReportingService
- */
-export interface IConnectReportingServiceClient {
-    /**
-     * @generated from protobuf rpc: SubmitConnectEvent(prehog.v1alpha.SubmitConnectEventRequest) returns (prehog.v1alpha.SubmitConnectEventResponse);
-     */
-    submitConnectEvent(input: SubmitConnectEventRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: SubmitConnectEventResponse) => void): grpc.ClientUnaryCall;
-    submitConnectEvent(input: SubmitConnectEventRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: SubmitConnectEventResponse) => void): grpc.ClientUnaryCall;
-    submitConnectEvent(input: SubmitConnectEventRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: SubmitConnectEventResponse) => void): grpc.ClientUnaryCall;
-    submitConnectEvent(input: SubmitConnectEventRequest, callback: (err: grpc.ServiceError | null, value?: SubmitConnectEventResponse) => void): grpc.ClientUnaryCall;
-}
-/**
- * @generated from protobuf service prehog.v1alpha.ConnectReportingService
- */
-export class ConnectReportingServiceClient extends grpc.Client implements IConnectReportingServiceClient {
-    private readonly _binaryOptions: Partial<BinaryReadOptions & BinaryWriteOptions>;
-    constructor(address: string, credentials: grpc.ChannelCredentials, options: grpc.ClientOptions = {}, binaryOptions: Partial<BinaryReadOptions & BinaryWriteOptions> = {}) {
-        super(address, credentials, options);
-        this._binaryOptions = binaryOptions;
-    }
-    /**
-     * @generated from protobuf rpc: SubmitConnectEvent(prehog.v1alpha.SubmitConnectEventRequest) returns (prehog.v1alpha.SubmitConnectEventResponse);
-     */
-    submitConnectEvent(input: SubmitConnectEventRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: SubmitConnectEventResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: SubmitConnectEventResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: SubmitConnectEventResponse) => void)): grpc.ClientUnaryCall {
-        const method = ConnectReportingService.methods[0];
-        return this.makeUnaryRequest<SubmitConnectEventRequest, SubmitConnectEventResponse>(`/${ConnectReportingService.typeName}/${method.name}`, (value: SubmitConnectEventRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): SubmitConnectEventResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-}
diff --git a/gen/proto/ts/prehog/v1alpha/connect_pb.grpc-server.ts b/gen/proto/ts/prehog/v1alpha/connect_pb.grpc-server.ts
index acb24bc61f5a5..8dcfc212c7d26 100644
--- a/gen/proto/ts/prehog/v1alpha/connect_pb.grpc-server.ts
+++ b/gen/proto/ts/prehog/v1alpha/connect_pb.grpc-server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1alpha/connect.proto" (package "prehog.v1alpha", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1alpha/connect_pb.ts b/gen/proto/ts/prehog/v1alpha/connect_pb.ts
index b4c5028c73699..ff25fae53db57 100644
--- a/gen/proto/ts/prehog/v1alpha/connect_pb.ts
+++ b/gen/proto/ts/prehog/v1alpha/connect_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1alpha/connect.proto" (package "prehog.v1alpha", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1alpha/tbot_pb.client.ts b/gen/proto/ts/prehog/v1alpha/tbot_pb.client.ts
new file mode 100644
index 0000000000000..6a19de046d1fb
--- /dev/null
+++ b/gen/proto/ts/prehog/v1alpha/tbot_pb.client.ts
@@ -0,0 +1,57 @@
+/* eslint-disable */
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated from protobuf file "prehog/v1alpha/tbot.proto" (package "prehog.v1alpha", syntax proto3)
+// tslint:disable
+// @ts-nocheck
+//
+//
+// Teleport
+// Copyright (C) 2023  Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
+import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
+import { TbotReportingService } from "./tbot_pb";
+import { stackIntercept } from "@protobuf-ts/runtime-rpc";
+import type { SubmitTbotEventResponse } from "./tbot_pb";
+import type { SubmitTbotEventRequest } from "./tbot_pb";
+import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
+import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
+/**
+ * @generated from protobuf service prehog.v1alpha.TbotReportingService
+ */
+export interface ITbotReportingServiceClient {
+    /**
+     * @generated from protobuf rpc: SubmitTbotEvent(prehog.v1alpha.SubmitTbotEventRequest) returns (prehog.v1alpha.SubmitTbotEventResponse);
+     */
+    submitTbotEvent(input: SubmitTbotEventRequest, options?: RpcOptions): UnaryCall<SubmitTbotEventRequest, SubmitTbotEventResponse>;
+}
+/**
+ * @generated from protobuf service prehog.v1alpha.TbotReportingService
+ */
+export class TbotReportingServiceClient implements ITbotReportingServiceClient, ServiceInfo {
+    typeName = TbotReportingService.typeName;
+    methods = TbotReportingService.methods;
+    options = TbotReportingService.options;
+    constructor(private readonly _transport: RpcTransport) {
+    }
+    /**
+     * @generated from protobuf rpc: SubmitTbotEvent(prehog.v1alpha.SubmitTbotEventRequest) returns (prehog.v1alpha.SubmitTbotEventResponse);
+     */
+    submitTbotEvent(input: SubmitTbotEventRequest, options?: RpcOptions): UnaryCall<SubmitTbotEventRequest, SubmitTbotEventResponse> {
+        const method = this.methods[0], opt = this._transport.mergeOptions(options);
+        return stackIntercept<SubmitTbotEventRequest, SubmitTbotEventResponse>("unary", this._transport, method, opt, input);
+    }
+}
diff --git a/gen/proto/ts/prehog/v1alpha/tbot_pb.grpc-client.ts b/gen/proto/ts/prehog/v1alpha/tbot_pb.grpc-client.ts
deleted file mode 100644
index e45aa73120e62..0000000000000
--- a/gen/proto/ts/prehog/v1alpha/tbot_pb.grpc-client.ts
+++ /dev/null
@@ -1,58 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
-// @generated from protobuf file "prehog/v1alpha/tbot.proto" (package "prehog.v1alpha", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-//
-// Teleport
-// Copyright (C) 2023  Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-//
-import { TbotReportingService } from "./tbot_pb";
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { SubmitTbotEventResponse } from "./tbot_pb";
-import type { SubmitTbotEventRequest } from "./tbot_pb";
-import * as grpc from "@grpc/grpc-js";
-/**
- * @generated from protobuf service prehog.v1alpha.TbotReportingService
- */
-export interface ITbotReportingServiceClient {
-    /**
-     * @generated from protobuf rpc: SubmitTbotEvent(prehog.v1alpha.SubmitTbotEventRequest) returns (prehog.v1alpha.SubmitTbotEventResponse);
-     */
-    submitTbotEvent(input: SubmitTbotEventRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: SubmitTbotEventResponse) => void): grpc.ClientUnaryCall;
-    submitTbotEvent(input: SubmitTbotEventRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: SubmitTbotEventResponse) => void): grpc.ClientUnaryCall;
-    submitTbotEvent(input: SubmitTbotEventRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: SubmitTbotEventResponse) => void): grpc.ClientUnaryCall;
-    submitTbotEvent(input: SubmitTbotEventRequest, callback: (err: grpc.ServiceError | null, value?: SubmitTbotEventResponse) => void): grpc.ClientUnaryCall;
-}
-/**
- * @generated from protobuf service prehog.v1alpha.TbotReportingService
- */
-export class TbotReportingServiceClient extends grpc.Client implements ITbotReportingServiceClient {
-    private readonly _binaryOptions: Partial<BinaryReadOptions & BinaryWriteOptions>;
-    constructor(address: string, credentials: grpc.ChannelCredentials, options: grpc.ClientOptions = {}, binaryOptions: Partial<BinaryReadOptions & BinaryWriteOptions> = {}) {
-        super(address, credentials, options);
-        this._binaryOptions = binaryOptions;
-    }
-    /**
-     * @generated from protobuf rpc: SubmitTbotEvent(prehog.v1alpha.SubmitTbotEventRequest) returns (prehog.v1alpha.SubmitTbotEventResponse);
-     */
-    submitTbotEvent(input: SubmitTbotEventRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: SubmitTbotEventResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: SubmitTbotEventResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: SubmitTbotEventResponse) => void)): grpc.ClientUnaryCall {
-        const method = TbotReportingService.methods[0];
-        return this.makeUnaryRequest<SubmitTbotEventRequest, SubmitTbotEventResponse>(`/${TbotReportingService.typeName}/${method.name}`, (value: SubmitTbotEventRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): SubmitTbotEventResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-}
diff --git a/gen/proto/ts/prehog/v1alpha/tbot_pb.grpc-server.ts b/gen/proto/ts/prehog/v1alpha/tbot_pb.grpc-server.ts
index baa4f634e854c..88302425bac5e 100644
--- a/gen/proto/ts/prehog/v1alpha/tbot_pb.grpc-server.ts
+++ b/gen/proto/ts/prehog/v1alpha/tbot_pb.grpc-server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1alpha/tbot.proto" (package "prehog.v1alpha", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1alpha/tbot_pb.ts b/gen/proto/ts/prehog/v1alpha/tbot_pb.ts
index 294a8bfe3eac5..0b0863121b6e7 100644
--- a/gen/proto/ts/prehog/v1alpha/tbot_pb.ts
+++ b/gen/proto/ts/prehog/v1alpha/tbot_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1alpha/tbot.proto" (package "prehog.v1alpha", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1alpha/teleport_pb.client.ts b/gen/proto/ts/prehog/v1alpha/teleport_pb.client.ts
new file mode 100644
index 0000000000000..3fc202395c860
--- /dev/null
+++ b/gen/proto/ts/prehog/v1alpha/teleport_pb.client.ts
@@ -0,0 +1,109 @@
+/* eslint-disable */
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated from protobuf file "prehog/v1alpha/teleport.proto" (package "prehog.v1alpha", syntax proto3)
+// tslint:disable
+// @ts-nocheck
+//
+//
+// Teleport
+// Copyright (C) 2023  Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
+import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
+import { TeleportReportingService } from "./teleport_pb";
+import type { HelloTeleportResponse } from "./teleport_pb";
+import type { HelloTeleportRequest } from "./teleport_pb";
+import type { SubmitEventsResponse } from "./teleport_pb";
+import type { SubmitEventsRequest } from "./teleport_pb";
+import { stackIntercept } from "@protobuf-ts/runtime-rpc";
+import type { SubmitEventResponse } from "./teleport_pb";
+import type { SubmitEventRequest } from "./teleport_pb";
+import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
+import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
+/**
+ * @generated from protobuf service prehog.v1alpha.TeleportReportingService
+ */
+export interface ITeleportReportingServiceClient {
+    /**
+     * equivalent to SubmitEvents with a single event, should be unused by now
+     *
+     * @deprecated
+     * @generated from protobuf rpc: SubmitEvent(prehog.v1alpha.SubmitEventRequest) returns (prehog.v1alpha.SubmitEventResponse);
+     */
+    submitEvent(input: SubmitEventRequest, options?: RpcOptions): UnaryCall<SubmitEventRequest, SubmitEventResponse>;
+    /**
+     * encodes and forwards usage events to the PostHog event database; each
+     * event is annotated with some properties that depend on the identity of the
+     * caller:
+     * - tp.account_id (UUID in string form, can be empty if missing from the
+     *   license)
+     * - tp.license_name (should always be a UUID)
+     * - tp.license_authority (name of the authority that signed the license file
+     *   used for authentication)
+     * - tp.is_cloud (boolean)
+     *
+     * @generated from protobuf rpc: SubmitEvents(prehog.v1alpha.SubmitEventsRequest) returns (prehog.v1alpha.SubmitEventsResponse);
+     */
+    submitEvents(input: SubmitEventsRequest, options?: RpcOptions): UnaryCall<SubmitEventsRequest, SubmitEventsResponse>;
+    /**
+     * @generated from protobuf rpc: HelloTeleport(prehog.v1alpha.HelloTeleportRequest) returns (prehog.v1alpha.HelloTeleportResponse);
+     */
+    helloTeleport(input: HelloTeleportRequest, options?: RpcOptions): UnaryCall<HelloTeleportRequest, HelloTeleportResponse>;
+}
+/**
+ * @generated from protobuf service prehog.v1alpha.TeleportReportingService
+ */
+export class TeleportReportingServiceClient implements ITeleportReportingServiceClient, ServiceInfo {
+    typeName = TeleportReportingService.typeName;
+    methods = TeleportReportingService.methods;
+    options = TeleportReportingService.options;
+    constructor(private readonly _transport: RpcTransport) {
+    }
+    /**
+     * equivalent to SubmitEvents with a single event, should be unused by now
+     *
+     * @deprecated
+     * @generated from protobuf rpc: SubmitEvent(prehog.v1alpha.SubmitEventRequest) returns (prehog.v1alpha.SubmitEventResponse);
+     */
+    submitEvent(input: SubmitEventRequest, options?: RpcOptions): UnaryCall<SubmitEventRequest, SubmitEventResponse> {
+        const method = this.methods[0], opt = this._transport.mergeOptions(options);
+        return stackIntercept<SubmitEventRequest, SubmitEventResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * encodes and forwards usage events to the PostHog event database; each
+     * event is annotated with some properties that depend on the identity of the
+     * caller:
+     * - tp.account_id (UUID in string form, can be empty if missing from the
+     *   license)
+     * - tp.license_name (should always be a UUID)
+     * - tp.license_authority (name of the authority that signed the license file
+     *   used for authentication)
+     * - tp.is_cloud (boolean)
+     *
+     * @generated from protobuf rpc: SubmitEvents(prehog.v1alpha.SubmitEventsRequest) returns (prehog.v1alpha.SubmitEventsResponse);
+     */
+    submitEvents(input: SubmitEventsRequest, options?: RpcOptions): UnaryCall<SubmitEventsRequest, SubmitEventsResponse> {
+        const method = this.methods[1], opt = this._transport.mergeOptions(options);
+        return stackIntercept<SubmitEventsRequest, SubmitEventsResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * @generated from protobuf rpc: HelloTeleport(prehog.v1alpha.HelloTeleportRequest) returns (prehog.v1alpha.HelloTeleportResponse);
+     */
+    helloTeleport(input: HelloTeleportRequest, options?: RpcOptions): UnaryCall<HelloTeleportRequest, HelloTeleportResponse> {
+        const method = this.methods[2], opt = this._transport.mergeOptions(options);
+        return stackIntercept<HelloTeleportRequest, HelloTeleportResponse>("unary", this._transport, method, opt, input);
+    }
+}
diff --git a/gen/proto/ts/prehog/v1alpha/teleport_pb.grpc-client.ts b/gen/proto/ts/prehog/v1alpha/teleport_pb.grpc-client.ts
deleted file mode 100644
index 8d84a4839ab2c..0000000000000
--- a/gen/proto/ts/prehog/v1alpha/teleport_pb.grpc-client.ts
+++ /dev/null
@@ -1,116 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
-// @generated from protobuf file "prehog/v1alpha/teleport.proto" (package "prehog.v1alpha", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-//
-// Teleport
-// Copyright (C) 2023  Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-//
-import { TeleportReportingService } from "./teleport_pb";
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { HelloTeleportResponse } from "./teleport_pb";
-import type { HelloTeleportRequest } from "./teleport_pb";
-import type { SubmitEventsResponse } from "./teleport_pb";
-import type { SubmitEventsRequest } from "./teleport_pb";
-import type { SubmitEventResponse } from "./teleport_pb";
-import type { SubmitEventRequest } from "./teleport_pb";
-import * as grpc from "@grpc/grpc-js";
-/**
- * @generated from protobuf service prehog.v1alpha.TeleportReportingService
- */
-export interface ITeleportReportingServiceClient {
-    /**
-     * equivalent to SubmitEvents with a single event, should be unused by now
-     *
-     * @deprecated
-     * @generated from protobuf rpc: SubmitEvent(prehog.v1alpha.SubmitEventRequest) returns (prehog.v1alpha.SubmitEventResponse);
-     */
-    submitEvent(input: SubmitEventRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: SubmitEventResponse) => void): grpc.ClientUnaryCall;
-    submitEvent(input: SubmitEventRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: SubmitEventResponse) => void): grpc.ClientUnaryCall;
-    submitEvent(input: SubmitEventRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: SubmitEventResponse) => void): grpc.ClientUnaryCall;
-    submitEvent(input: SubmitEventRequest, callback: (err: grpc.ServiceError | null, value?: SubmitEventResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * encodes and forwards usage events to the PostHog event database; each
-     * event is annotated with some properties that depend on the identity of the
-     * caller:
-     * - tp.account_id (UUID in string form, can be empty if missing from the
-     *   license)
-     * - tp.license_name (should always be a UUID)
-     * - tp.license_authority (name of the authority that signed the license file
-     *   used for authentication)
-     * - tp.is_cloud (boolean)
-     *
-     * @generated from protobuf rpc: SubmitEvents(prehog.v1alpha.SubmitEventsRequest) returns (prehog.v1alpha.SubmitEventsResponse);
-     */
-    submitEvents(input: SubmitEventsRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: SubmitEventsResponse) => void): grpc.ClientUnaryCall;
-    submitEvents(input: SubmitEventsRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: SubmitEventsResponse) => void): grpc.ClientUnaryCall;
-    submitEvents(input: SubmitEventsRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: SubmitEventsResponse) => void): grpc.ClientUnaryCall;
-    submitEvents(input: SubmitEventsRequest, callback: (err: grpc.ServiceError | null, value?: SubmitEventsResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * @generated from protobuf rpc: HelloTeleport(prehog.v1alpha.HelloTeleportRequest) returns (prehog.v1alpha.HelloTeleportResponse);
-     */
-    helloTeleport(input: HelloTeleportRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: HelloTeleportResponse) => void): grpc.ClientUnaryCall;
-    helloTeleport(input: HelloTeleportRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: HelloTeleportResponse) => void): grpc.ClientUnaryCall;
-    helloTeleport(input: HelloTeleportRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: HelloTeleportResponse) => void): grpc.ClientUnaryCall;
-    helloTeleport(input: HelloTeleportRequest, callback: (err: grpc.ServiceError | null, value?: HelloTeleportResponse) => void): grpc.ClientUnaryCall;
-}
-/**
- * @generated from protobuf service prehog.v1alpha.TeleportReportingService
- */
-export class TeleportReportingServiceClient extends grpc.Client implements ITeleportReportingServiceClient {
-    private readonly _binaryOptions: Partial<BinaryReadOptions & BinaryWriteOptions>;
-    constructor(address: string, credentials: grpc.ChannelCredentials, options: grpc.ClientOptions = {}, binaryOptions: Partial<BinaryReadOptions & BinaryWriteOptions> = {}) {
-        super(address, credentials, options);
-        this._binaryOptions = binaryOptions;
-    }
-    /**
-     * equivalent to SubmitEvents with a single event, should be unused by now
-     *
-     * @deprecated
-     * @generated from protobuf rpc: SubmitEvent(prehog.v1alpha.SubmitEventRequest) returns (prehog.v1alpha.SubmitEventResponse);
-     */
-    submitEvent(input: SubmitEventRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: SubmitEventResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: SubmitEventResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: SubmitEventResponse) => void)): grpc.ClientUnaryCall {
-        const method = TeleportReportingService.methods[0];
-        return this.makeUnaryRequest<SubmitEventRequest, SubmitEventResponse>(`/${TeleportReportingService.typeName}/${method.name}`, (value: SubmitEventRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): SubmitEventResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * encodes and forwards usage events to the PostHog event database; each
-     * event is annotated with some properties that depend on the identity of the
-     * caller:
-     * - tp.account_id (UUID in string form, can be empty if missing from the
-     *   license)
-     * - tp.license_name (should always be a UUID)
-     * - tp.license_authority (name of the authority that signed the license file
-     *   used for authentication)
-     * - tp.is_cloud (boolean)
-     *
-     * @generated from protobuf rpc: SubmitEvents(prehog.v1alpha.SubmitEventsRequest) returns (prehog.v1alpha.SubmitEventsResponse);
-     */
-    submitEvents(input: SubmitEventsRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: SubmitEventsResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: SubmitEventsResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: SubmitEventsResponse) => void)): grpc.ClientUnaryCall {
-        const method = TeleportReportingService.methods[1];
-        return this.makeUnaryRequest<SubmitEventsRequest, SubmitEventsResponse>(`/${TeleportReportingService.typeName}/${method.name}`, (value: SubmitEventsRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): SubmitEventsResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * @generated from protobuf rpc: HelloTeleport(prehog.v1alpha.HelloTeleportRequest) returns (prehog.v1alpha.HelloTeleportResponse);
-     */
-    helloTeleport(input: HelloTeleportRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: HelloTeleportResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: HelloTeleportResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: HelloTeleportResponse) => void)): grpc.ClientUnaryCall {
-        const method = TeleportReportingService.methods[2];
-        return this.makeUnaryRequest<HelloTeleportRequest, HelloTeleportResponse>(`/${TeleportReportingService.typeName}/${method.name}`, (value: HelloTeleportRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): HelloTeleportResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-}
diff --git a/gen/proto/ts/prehog/v1alpha/teleport_pb.grpc-server.ts b/gen/proto/ts/prehog/v1alpha/teleport_pb.grpc-server.ts
index 754fc9bbb9acb..bbd6bddd6013c 100644
--- a/gen/proto/ts/prehog/v1alpha/teleport_pb.grpc-server.ts
+++ b/gen/proto/ts/prehog/v1alpha/teleport_pb.grpc-server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1alpha/teleport.proto" (package "prehog.v1alpha", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/prehog/v1alpha/teleport_pb.ts b/gen/proto/ts/prehog/v1alpha/teleport_pb.ts
index 2ee8e6f0f3053..7a1b3be117cb9 100644
--- a/gen/proto/ts/prehog/v1alpha/teleport_pb.ts
+++ b/gen/proto/ts/prehog/v1alpha/teleport_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "prehog/v1alpha/teleport.proto" (package "prehog.v1alpha", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/accesslist/v1/accesslist_pb.ts b/gen/proto/ts/teleport/accesslist/v1/accesslist_pb.ts
index 23aa8986ff6a1..d4cda17115390 100644
--- a/gen/proto/ts/teleport/accesslist/v1/accesslist_pb.ts
+++ b/gen/proto/ts/teleport/accesslist/v1/accesslist_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/accesslist/v1/accesslist.proto" (package "teleport.accesslist.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.client.ts b/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.client.ts
new file mode 100644
index 0000000000000..52f44b8f241c1
--- /dev/null
+++ b/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.client.ts
@@ -0,0 +1,434 @@
+/* eslint-disable */
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated from protobuf file "teleport/accesslist/v1/accesslist_service.proto" (package "teleport.accesslist.v1", syntax proto3)
+// tslint:disable
+// @ts-nocheck
+//
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
+import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
+import { AccessListService } from "./accesslist_service_pb";
+import type { GetSuggestedAccessListsResponse } from "./accesslist_service_pb";
+import type { GetSuggestedAccessListsRequest } from "./accesslist_service_pb";
+import type { AccessRequestPromoteResponse } from "./accesslist_service_pb";
+import type { AccessRequestPromoteRequest } from "./accesslist_service_pb";
+import type { DeleteAccessListReviewRequest } from "./accesslist_service_pb";
+import type { CreateAccessListReviewResponse } from "./accesslist_service_pb";
+import type { CreateAccessListReviewRequest } from "./accesslist_service_pb";
+import type { ListAllAccessListReviewsResponse } from "./accesslist_service_pb";
+import type { ListAllAccessListReviewsRequest } from "./accesslist_service_pb";
+import type { ListAccessListReviewsResponse } from "./accesslist_service_pb";
+import type { ListAccessListReviewsRequest } from "./accesslist_service_pb";
+import type { UpsertAccessListWithMembersResponse } from "./accesslist_service_pb";
+import type { UpsertAccessListWithMembersRequest } from "./accesslist_service_pb";
+import type { DeleteAllAccessListMembersRequest } from "./accesslist_service_pb";
+import type { DeleteAllAccessListMembersForAccessListRequest } from "./accesslist_service_pb";
+import type { DeleteAccessListMemberRequest } from "./accesslist_service_pb";
+import type { UpsertAccessListMemberRequest } from "./accesslist_service_pb";
+import type { Member } from "./accesslist_pb";
+import type { GetAccessListMemberRequest } from "./accesslist_service_pb";
+import type { ListAllAccessListMembersResponse } from "./accesslist_service_pb";
+import type { ListAllAccessListMembersRequest } from "./accesslist_service_pb";
+import type { ListAccessListMembersResponse } from "./accesslist_service_pb";
+import type { ListAccessListMembersRequest } from "./accesslist_service_pb";
+import type { CountAccessListMembersResponse } from "./accesslist_service_pb";
+import type { CountAccessListMembersRequest } from "./accesslist_service_pb";
+import type { GetAccessListsToReviewResponse } from "./accesslist_service_pb";
+import type { GetAccessListsToReviewRequest } from "./accesslist_service_pb";
+import type { DeleteAllAccessListsRequest } from "./accesslist_service_pb";
+import type { Empty } from "../../../google/protobuf/empty_pb";
+import type { DeleteAccessListRequest } from "./accesslist_service_pb";
+import type { UpsertAccessListRequest } from "./accesslist_service_pb";
+import type { AccessList } from "./accesslist_pb";
+import type { GetAccessListRequest } from "./accesslist_service_pb";
+import type { ListAccessListsResponse } from "./accesslist_service_pb";
+import type { ListAccessListsRequest } from "./accesslist_service_pb";
+import { stackIntercept } from "@protobuf-ts/runtime-rpc";
+import type { GetAccessListsResponse } from "./accesslist_service_pb";
+import type { GetAccessListsRequest } from "./accesslist_service_pb";
+import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
+import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
+/**
+ * AccessListService provides CRUD methods for Access List resources.
+ *
+ * @generated from protobuf service teleport.accesslist.v1.AccessListService
+ */
+export interface IAccessListServiceClient {
+    /**
+     * GetAccessLists returns a list of all access lists.
+     *
+     * @generated from protobuf rpc: GetAccessLists(teleport.accesslist.v1.GetAccessListsRequest) returns (teleport.accesslist.v1.GetAccessListsResponse);
+     */
+    getAccessLists(input: GetAccessListsRequest, options?: RpcOptions): UnaryCall<GetAccessListsRequest, GetAccessListsResponse>;
+    /**
+     * ListAccessLists returns a paginated list of all access lists.
+     *
+     * @generated from protobuf rpc: ListAccessLists(teleport.accesslist.v1.ListAccessListsRequest) returns (teleport.accesslist.v1.ListAccessListsResponse);
+     */
+    listAccessLists(input: ListAccessListsRequest, options?: RpcOptions): UnaryCall<ListAccessListsRequest, ListAccessListsResponse>;
+    /**
+     * GetAccessList returns the specified access list resource.
+     *
+     * @generated from protobuf rpc: GetAccessList(teleport.accesslist.v1.GetAccessListRequest) returns (teleport.accesslist.v1.AccessList);
+     */
+    getAccessList(input: GetAccessListRequest, options?: RpcOptions): UnaryCall<GetAccessListRequest, AccessList>;
+    /**
+     * UpsertAccessList creates or updates an access list resource.
+     *
+     * @generated from protobuf rpc: UpsertAccessList(teleport.accesslist.v1.UpsertAccessListRequest) returns (teleport.accesslist.v1.AccessList);
+     */
+    upsertAccessList(input: UpsertAccessListRequest, options?: RpcOptions): UnaryCall<UpsertAccessListRequest, AccessList>;
+    /**
+     * DeleteAccessList hard deletes the specified access list resource.
+     *
+     * @generated from protobuf rpc: DeleteAccessList(teleport.accesslist.v1.DeleteAccessListRequest) returns (google.protobuf.Empty);
+     */
+    deleteAccessList(input: DeleteAccessListRequest, options?: RpcOptions): UnaryCall<DeleteAccessListRequest, Empty>;
+    /**
+     * DeleteAllAccessLists hard deletes all access lists.
+     *
+     * @generated from protobuf rpc: DeleteAllAccessLists(teleport.accesslist.v1.DeleteAllAccessListsRequest) returns (google.protobuf.Empty);
+     */
+    deleteAllAccessLists(input: DeleteAllAccessListsRequest, options?: RpcOptions): UnaryCall<DeleteAllAccessListsRequest, Empty>;
+    /**
+     * GetAccessListsToReview will return access lists that need to be reviewed by
+     * the current user.
+     *
+     * @generated from protobuf rpc: GetAccessListsToReview(teleport.accesslist.v1.GetAccessListsToReviewRequest) returns (teleport.accesslist.v1.GetAccessListsToReviewResponse);
+     */
+    getAccessListsToReview(input: GetAccessListsToReviewRequest, options?: RpcOptions): UnaryCall<GetAccessListsToReviewRequest, GetAccessListsToReviewResponse>;
+    /**
+     * CountAccessListMembers returns the count of access list members in an
+     * access list.
+     *
+     * @generated from protobuf rpc: CountAccessListMembers(teleport.accesslist.v1.CountAccessListMembersRequest) returns (teleport.accesslist.v1.CountAccessListMembersResponse);
+     */
+    countAccessListMembers(input: CountAccessListMembersRequest, options?: RpcOptions): UnaryCall<CountAccessListMembersRequest, CountAccessListMembersResponse>;
+    /**
+     * ListAccessListMembers returns a paginated list of all access list members.
+     *
+     * @generated from protobuf rpc: ListAccessListMembers(teleport.accesslist.v1.ListAccessListMembersRequest) returns (teleport.accesslist.v1.ListAccessListMembersResponse);
+     */
+    listAccessListMembers(input: ListAccessListMembersRequest, options?: RpcOptions): UnaryCall<ListAccessListMembersRequest, ListAccessListMembersResponse>;
+    /**
+     * ListAllAccessListMembers returns a paginated list of all access list
+     * members for all access lists.
+     *
+     * @generated from protobuf rpc: ListAllAccessListMembers(teleport.accesslist.v1.ListAllAccessListMembersRequest) returns (teleport.accesslist.v1.ListAllAccessListMembersResponse);
+     */
+    listAllAccessListMembers(input: ListAllAccessListMembersRequest, options?: RpcOptions): UnaryCall<ListAllAccessListMembersRequest, ListAllAccessListMembersResponse>;
+    /**
+     * GetAccessListMember returns the specified access list member resource.
+     *
+     * @generated from protobuf rpc: GetAccessListMember(teleport.accesslist.v1.GetAccessListMemberRequest) returns (teleport.accesslist.v1.Member);
+     */
+    getAccessListMember(input: GetAccessListMemberRequest, options?: RpcOptions): UnaryCall<GetAccessListMemberRequest, Member>;
+    /**
+     * UpsertAccessListMember creates or updates an access list member resource.
+     *
+     * @generated from protobuf rpc: UpsertAccessListMember(teleport.accesslist.v1.UpsertAccessListMemberRequest) returns (teleport.accesslist.v1.Member);
+     */
+    upsertAccessListMember(input: UpsertAccessListMemberRequest, options?: RpcOptions): UnaryCall<UpsertAccessListMemberRequest, Member>;
+    /**
+     * DeleteAccessListMember hard deletes the specified access list member
+     * resource.
+     *
+     * @generated from protobuf rpc: DeleteAccessListMember(teleport.accesslist.v1.DeleteAccessListMemberRequest) returns (google.protobuf.Empty);
+     */
+    deleteAccessListMember(input: DeleteAccessListMemberRequest, options?: RpcOptions): UnaryCall<DeleteAccessListMemberRequest, Empty>;
+    /**
+     * DeleteAllAccessListMembers hard deletes all access list members for an
+     * access list.
+     *
+     * @generated from protobuf rpc: DeleteAllAccessListMembersForAccessList(teleport.accesslist.v1.DeleteAllAccessListMembersForAccessListRequest) returns (google.protobuf.Empty);
+     */
+    deleteAllAccessListMembersForAccessList(input: DeleteAllAccessListMembersForAccessListRequest, options?: RpcOptions): UnaryCall<DeleteAllAccessListMembersForAccessListRequest, Empty>;
+    /**
+     * DeleteAllAccessListMembers hard deletes all access list members for an
+     * access list.
+     *
+     * @generated from protobuf rpc: DeleteAllAccessListMembers(teleport.accesslist.v1.DeleteAllAccessListMembersRequest) returns (google.protobuf.Empty);
+     */
+    deleteAllAccessListMembers(input: DeleteAllAccessListMembersRequest, options?: RpcOptions): UnaryCall<DeleteAllAccessListMembersRequest, Empty>;
+    /**
+     * UpsertAccessListWithMembers creates or updates an access list with members.
+     *
+     * @generated from protobuf rpc: UpsertAccessListWithMembers(teleport.accesslist.v1.UpsertAccessListWithMembersRequest) returns (teleport.accesslist.v1.UpsertAccessListWithMembersResponse);
+     */
+    upsertAccessListWithMembers(input: UpsertAccessListWithMembersRequest, options?: RpcOptions): UnaryCall<UpsertAccessListWithMembersRequest, UpsertAccessListWithMembersResponse>;
+    /**
+     * ListAccessListReviews will list access list reviews for a particular access
+     * list.
+     *
+     * @generated from protobuf rpc: ListAccessListReviews(teleport.accesslist.v1.ListAccessListReviewsRequest) returns (teleport.accesslist.v1.ListAccessListReviewsResponse);
+     */
+    listAccessListReviews(input: ListAccessListReviewsRequest, options?: RpcOptions): UnaryCall<ListAccessListReviewsRequest, ListAccessListReviewsResponse>;
+    /**
+     * ListAllAccessListReviews will list access list reviews for all access
+     * lists.
+     *
+     * @generated from protobuf rpc: ListAllAccessListReviews(teleport.accesslist.v1.ListAllAccessListReviewsRequest) returns (teleport.accesslist.v1.ListAllAccessListReviewsResponse);
+     */
+    listAllAccessListReviews(input: ListAllAccessListReviewsRequest, options?: RpcOptions): UnaryCall<ListAllAccessListReviewsRequest, ListAllAccessListReviewsResponse>;
+    /**
+     * CreateAccessListReview will create a new review for an access list. It will
+     * also modify the original access list and its members depending on the
+     * details of the review.
+     *
+     * @generated from protobuf rpc: CreateAccessListReview(teleport.accesslist.v1.CreateAccessListReviewRequest) returns (teleport.accesslist.v1.CreateAccessListReviewResponse);
+     */
+    createAccessListReview(input: CreateAccessListReviewRequest, options?: RpcOptions): UnaryCall<CreateAccessListReviewRequest, CreateAccessListReviewResponse>;
+    /**
+     * DeleteAccessListReview will delete an access list review from the backend.
+     *
+     * @generated from protobuf rpc: DeleteAccessListReview(teleport.accesslist.v1.DeleteAccessListReviewRequest) returns (google.protobuf.Empty);
+     */
+    deleteAccessListReview(input: DeleteAccessListReviewRequest, options?: RpcOptions): UnaryCall<DeleteAccessListReviewRequest, Empty>;
+    /**
+     * AccessRequestPromote promotes an access request to an access list.
+     *
+     * @generated from protobuf rpc: AccessRequestPromote(teleport.accesslist.v1.AccessRequestPromoteRequest) returns (teleport.accesslist.v1.AccessRequestPromoteResponse);
+     */
+    accessRequestPromote(input: AccessRequestPromoteRequest, options?: RpcOptions): UnaryCall<AccessRequestPromoteRequest, AccessRequestPromoteResponse>;
+    /**
+     * GetSuggestedAccessLists returns suggested access lists for an access
+     * request.
+     *
+     * @generated from protobuf rpc: GetSuggestedAccessLists(teleport.accesslist.v1.GetSuggestedAccessListsRequest) returns (teleport.accesslist.v1.GetSuggestedAccessListsResponse);
+     */
+    getSuggestedAccessLists(input: GetSuggestedAccessListsRequest, options?: RpcOptions): UnaryCall<GetSuggestedAccessListsRequest, GetSuggestedAccessListsResponse>;
+}
+/**
+ * AccessListService provides CRUD methods for Access List resources.
+ *
+ * @generated from protobuf service teleport.accesslist.v1.AccessListService
+ */
+export class AccessListServiceClient implements IAccessListServiceClient, ServiceInfo {
+    typeName = AccessListService.typeName;
+    methods = AccessListService.methods;
+    options = AccessListService.options;
+    constructor(private readonly _transport: RpcTransport) {
+    }
+    /**
+     * GetAccessLists returns a list of all access lists.
+     *
+     * @generated from protobuf rpc: GetAccessLists(teleport.accesslist.v1.GetAccessListsRequest) returns (teleport.accesslist.v1.GetAccessListsResponse);
+     */
+    getAccessLists(input: GetAccessListsRequest, options?: RpcOptions): UnaryCall<GetAccessListsRequest, GetAccessListsResponse> {
+        const method = this.methods[0], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetAccessListsRequest, GetAccessListsResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * ListAccessLists returns a paginated list of all access lists.
+     *
+     * @generated from protobuf rpc: ListAccessLists(teleport.accesslist.v1.ListAccessListsRequest) returns (teleport.accesslist.v1.ListAccessListsResponse);
+     */
+    listAccessLists(input: ListAccessListsRequest, options?: RpcOptions): UnaryCall<ListAccessListsRequest, ListAccessListsResponse> {
+        const method = this.methods[1], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ListAccessListsRequest, ListAccessListsResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * GetAccessList returns the specified access list resource.
+     *
+     * @generated from protobuf rpc: GetAccessList(teleport.accesslist.v1.GetAccessListRequest) returns (teleport.accesslist.v1.AccessList);
+     */
+    getAccessList(input: GetAccessListRequest, options?: RpcOptions): UnaryCall<GetAccessListRequest, AccessList> {
+        const method = this.methods[2], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetAccessListRequest, AccessList>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * UpsertAccessList creates or updates an access list resource.
+     *
+     * @generated from protobuf rpc: UpsertAccessList(teleport.accesslist.v1.UpsertAccessListRequest) returns (teleport.accesslist.v1.AccessList);
+     */
+    upsertAccessList(input: UpsertAccessListRequest, options?: RpcOptions): UnaryCall<UpsertAccessListRequest, AccessList> {
+        const method = this.methods[3], opt = this._transport.mergeOptions(options);
+        return stackIntercept<UpsertAccessListRequest, AccessList>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * DeleteAccessList hard deletes the specified access list resource.
+     *
+     * @generated from protobuf rpc: DeleteAccessList(teleport.accesslist.v1.DeleteAccessListRequest) returns (google.protobuf.Empty);
+     */
+    deleteAccessList(input: DeleteAccessListRequest, options?: RpcOptions): UnaryCall<DeleteAccessListRequest, Empty> {
+        const method = this.methods[4], opt = this._transport.mergeOptions(options);
+        return stackIntercept<DeleteAccessListRequest, Empty>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * DeleteAllAccessLists hard deletes all access lists.
+     *
+     * @generated from protobuf rpc: DeleteAllAccessLists(teleport.accesslist.v1.DeleteAllAccessListsRequest) returns (google.protobuf.Empty);
+     */
+    deleteAllAccessLists(input: DeleteAllAccessListsRequest, options?: RpcOptions): UnaryCall<DeleteAllAccessListsRequest, Empty> {
+        const method = this.methods[5], opt = this._transport.mergeOptions(options);
+        return stackIntercept<DeleteAllAccessListsRequest, Empty>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * GetAccessListsToReview will return access lists that need to be reviewed by
+     * the current user.
+     *
+     * @generated from protobuf rpc: GetAccessListsToReview(teleport.accesslist.v1.GetAccessListsToReviewRequest) returns (teleport.accesslist.v1.GetAccessListsToReviewResponse);
+     */
+    getAccessListsToReview(input: GetAccessListsToReviewRequest, options?: RpcOptions): UnaryCall<GetAccessListsToReviewRequest, GetAccessListsToReviewResponse> {
+        const method = this.methods[6], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetAccessListsToReviewRequest, GetAccessListsToReviewResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * CountAccessListMembers returns the count of access list members in an
+     * access list.
+     *
+     * @generated from protobuf rpc: CountAccessListMembers(teleport.accesslist.v1.CountAccessListMembersRequest) returns (teleport.accesslist.v1.CountAccessListMembersResponse);
+     */
+    countAccessListMembers(input: CountAccessListMembersRequest, options?: RpcOptions): UnaryCall<CountAccessListMembersRequest, CountAccessListMembersResponse> {
+        const method = this.methods[7], opt = this._transport.mergeOptions(options);
+        return stackIntercept<CountAccessListMembersRequest, CountAccessListMembersResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * ListAccessListMembers returns a paginated list of all access list members.
+     *
+     * @generated from protobuf rpc: ListAccessListMembers(teleport.accesslist.v1.ListAccessListMembersRequest) returns (teleport.accesslist.v1.ListAccessListMembersResponse);
+     */
+    listAccessListMembers(input: ListAccessListMembersRequest, options?: RpcOptions): UnaryCall<ListAccessListMembersRequest, ListAccessListMembersResponse> {
+        const method = this.methods[8], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ListAccessListMembersRequest, ListAccessListMembersResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * ListAllAccessListMembers returns a paginated list of all access list
+     * members for all access lists.
+     *
+     * @generated from protobuf rpc: ListAllAccessListMembers(teleport.accesslist.v1.ListAllAccessListMembersRequest) returns (teleport.accesslist.v1.ListAllAccessListMembersResponse);
+     */
+    listAllAccessListMembers(input: ListAllAccessListMembersRequest, options?: RpcOptions): UnaryCall<ListAllAccessListMembersRequest, ListAllAccessListMembersResponse> {
+        const method = this.methods[9], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ListAllAccessListMembersRequest, ListAllAccessListMembersResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * GetAccessListMember returns the specified access list member resource.
+     *
+     * @generated from protobuf rpc: GetAccessListMember(teleport.accesslist.v1.GetAccessListMemberRequest) returns (teleport.accesslist.v1.Member);
+     */
+    getAccessListMember(input: GetAccessListMemberRequest, options?: RpcOptions): UnaryCall<GetAccessListMemberRequest, Member> {
+        const method = this.methods[10], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetAccessListMemberRequest, Member>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * UpsertAccessListMember creates or updates an access list member resource.
+     *
+     * @generated from protobuf rpc: UpsertAccessListMember(teleport.accesslist.v1.UpsertAccessListMemberRequest) returns (teleport.accesslist.v1.Member);
+     */
+    upsertAccessListMember(input: UpsertAccessListMemberRequest, options?: RpcOptions): UnaryCall<UpsertAccessListMemberRequest, Member> {
+        const method = this.methods[11], opt = this._transport.mergeOptions(options);
+        return stackIntercept<UpsertAccessListMemberRequest, Member>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * DeleteAccessListMember hard deletes the specified access list member
+     * resource.
+     *
+     * @generated from protobuf rpc: DeleteAccessListMember(teleport.accesslist.v1.DeleteAccessListMemberRequest) returns (google.protobuf.Empty);
+     */
+    deleteAccessListMember(input: DeleteAccessListMemberRequest, options?: RpcOptions): UnaryCall<DeleteAccessListMemberRequest, Empty> {
+        const method = this.methods[12], opt = this._transport.mergeOptions(options);
+        return stackIntercept<DeleteAccessListMemberRequest, Empty>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * DeleteAllAccessListMembers hard deletes all access list members for an
+     * access list.
+     *
+     * @generated from protobuf rpc: DeleteAllAccessListMembersForAccessList(teleport.accesslist.v1.DeleteAllAccessListMembersForAccessListRequest) returns (google.protobuf.Empty);
+     */
+    deleteAllAccessListMembersForAccessList(input: DeleteAllAccessListMembersForAccessListRequest, options?: RpcOptions): UnaryCall<DeleteAllAccessListMembersForAccessListRequest, Empty> {
+        const method = this.methods[13], opt = this._transport.mergeOptions(options);
+        return stackIntercept<DeleteAllAccessListMembersForAccessListRequest, Empty>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * DeleteAllAccessListMembers hard deletes all access list members for an
+     * access list.
+     *
+     * @generated from protobuf rpc: DeleteAllAccessListMembers(teleport.accesslist.v1.DeleteAllAccessListMembersRequest) returns (google.protobuf.Empty);
+     */
+    deleteAllAccessListMembers(input: DeleteAllAccessListMembersRequest, options?: RpcOptions): UnaryCall<DeleteAllAccessListMembersRequest, Empty> {
+        const method = this.methods[14], opt = this._transport.mergeOptions(options);
+        return stackIntercept<DeleteAllAccessListMembersRequest, Empty>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * UpsertAccessListWithMembers creates or updates an access list with members.
+     *
+     * @generated from protobuf rpc: UpsertAccessListWithMembers(teleport.accesslist.v1.UpsertAccessListWithMembersRequest) returns (teleport.accesslist.v1.UpsertAccessListWithMembersResponse);
+     */
+    upsertAccessListWithMembers(input: UpsertAccessListWithMembersRequest, options?: RpcOptions): UnaryCall<UpsertAccessListWithMembersRequest, UpsertAccessListWithMembersResponse> {
+        const method = this.methods[15], opt = this._transport.mergeOptions(options);
+        return stackIntercept<UpsertAccessListWithMembersRequest, UpsertAccessListWithMembersResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * ListAccessListReviews will list access list reviews for a particular access
+     * list.
+     *
+     * @generated from protobuf rpc: ListAccessListReviews(teleport.accesslist.v1.ListAccessListReviewsRequest) returns (teleport.accesslist.v1.ListAccessListReviewsResponse);
+     */
+    listAccessListReviews(input: ListAccessListReviewsRequest, options?: RpcOptions): UnaryCall<ListAccessListReviewsRequest, ListAccessListReviewsResponse> {
+        const method = this.methods[16], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ListAccessListReviewsRequest, ListAccessListReviewsResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * ListAllAccessListReviews will list access list reviews for all access
+     * lists.
+     *
+     * @generated from protobuf rpc: ListAllAccessListReviews(teleport.accesslist.v1.ListAllAccessListReviewsRequest) returns (teleport.accesslist.v1.ListAllAccessListReviewsResponse);
+     */
+    listAllAccessListReviews(input: ListAllAccessListReviewsRequest, options?: RpcOptions): UnaryCall<ListAllAccessListReviewsRequest, ListAllAccessListReviewsResponse> {
+        const method = this.methods[17], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ListAllAccessListReviewsRequest, ListAllAccessListReviewsResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * CreateAccessListReview will create a new review for an access list. It will
+     * also modify the original access list and its members depending on the
+     * details of the review.
+     *
+     * @generated from protobuf rpc: CreateAccessListReview(teleport.accesslist.v1.CreateAccessListReviewRequest) returns (teleport.accesslist.v1.CreateAccessListReviewResponse);
+     */
+    createAccessListReview(input: CreateAccessListReviewRequest, options?: RpcOptions): UnaryCall<CreateAccessListReviewRequest, CreateAccessListReviewResponse> {
+        const method = this.methods[18], opt = this._transport.mergeOptions(options);
+        return stackIntercept<CreateAccessListReviewRequest, CreateAccessListReviewResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * DeleteAccessListReview will delete an access list review from the backend.
+     *
+     * @generated from protobuf rpc: DeleteAccessListReview(teleport.accesslist.v1.DeleteAccessListReviewRequest) returns (google.protobuf.Empty);
+     */
+    deleteAccessListReview(input: DeleteAccessListReviewRequest, options?: RpcOptions): UnaryCall<DeleteAccessListReviewRequest, Empty> {
+        const method = this.methods[19], opt = this._transport.mergeOptions(options);
+        return stackIntercept<DeleteAccessListReviewRequest, Empty>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * AccessRequestPromote promotes an access request to an access list.
+     *
+     * @generated from protobuf rpc: AccessRequestPromote(teleport.accesslist.v1.AccessRequestPromoteRequest) returns (teleport.accesslist.v1.AccessRequestPromoteResponse);
+     */
+    accessRequestPromote(input: AccessRequestPromoteRequest, options?: RpcOptions): UnaryCall<AccessRequestPromoteRequest, AccessRequestPromoteResponse> {
+        const method = this.methods[20], opt = this._transport.mergeOptions(options);
+        return stackIntercept<AccessRequestPromoteRequest, AccessRequestPromoteResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * GetSuggestedAccessLists returns suggested access lists for an access
+     * request.
+     *
+     * @generated from protobuf rpc: GetSuggestedAccessLists(teleport.accesslist.v1.GetSuggestedAccessListsRequest) returns (teleport.accesslist.v1.GetSuggestedAccessListsResponse);
+     */
+    getSuggestedAccessLists(input: GetSuggestedAccessListsRequest, options?: RpcOptions): UnaryCall<GetSuggestedAccessListsRequest, GetSuggestedAccessListsResponse> {
+        const method = this.methods[21], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetSuggestedAccessListsRequest, GetSuggestedAccessListsResponse>("unary", this._transport, method, opt, input);
+    }
+}
diff --git a/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.grpc-client.ts b/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.grpc-client.ts
deleted file mode 100644
index 48a0d394d9ece..0000000000000
--- a/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.grpc-client.ts
+++ /dev/null
@@ -1,498 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/accesslist/v1/accesslist_service.proto" (package "teleport.accesslist.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2023 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import { AccessListService } from "./accesslist_service_pb";
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { GetSuggestedAccessListsResponse } from "./accesslist_service_pb";
-import type { GetSuggestedAccessListsRequest } from "./accesslist_service_pb";
-import type { AccessRequestPromoteResponse } from "./accesslist_service_pb";
-import type { AccessRequestPromoteRequest } from "./accesslist_service_pb";
-import type { DeleteAccessListReviewRequest } from "./accesslist_service_pb";
-import type { CreateAccessListReviewResponse } from "./accesslist_service_pb";
-import type { CreateAccessListReviewRequest } from "./accesslist_service_pb";
-import type { ListAllAccessListReviewsResponse } from "./accesslist_service_pb";
-import type { ListAllAccessListReviewsRequest } from "./accesslist_service_pb";
-import type { ListAccessListReviewsResponse } from "./accesslist_service_pb";
-import type { ListAccessListReviewsRequest } from "./accesslist_service_pb";
-import type { UpsertAccessListWithMembersResponse } from "./accesslist_service_pb";
-import type { UpsertAccessListWithMembersRequest } from "./accesslist_service_pb";
-import type { DeleteAllAccessListMembersRequest } from "./accesslist_service_pb";
-import type { DeleteAllAccessListMembersForAccessListRequest } from "./accesslist_service_pb";
-import type { DeleteAccessListMemberRequest } from "./accesslist_service_pb";
-import type { UpsertAccessListMemberRequest } from "./accesslist_service_pb";
-import type { Member } from "./accesslist_pb";
-import type { GetAccessListMemberRequest } from "./accesslist_service_pb";
-import type { ListAllAccessListMembersResponse } from "./accesslist_service_pb";
-import type { ListAllAccessListMembersRequest } from "./accesslist_service_pb";
-import type { ListAccessListMembersResponse } from "./accesslist_service_pb";
-import type { ListAccessListMembersRequest } from "./accesslist_service_pb";
-import type { CountAccessListMembersResponse } from "./accesslist_service_pb";
-import type { CountAccessListMembersRequest } from "./accesslist_service_pb";
-import type { GetAccessListsToReviewResponse } from "./accesslist_service_pb";
-import type { GetAccessListsToReviewRequest } from "./accesslist_service_pb";
-import type { DeleteAllAccessListsRequest } from "./accesslist_service_pb";
-import type { Empty } from "../../../google/protobuf/empty_pb";
-import type { DeleteAccessListRequest } from "./accesslist_service_pb";
-import type { UpsertAccessListRequest } from "./accesslist_service_pb";
-import type { AccessList } from "./accesslist_pb";
-import type { GetAccessListRequest } from "./accesslist_service_pb";
-import type { ListAccessListsResponse } from "./accesslist_service_pb";
-import type { ListAccessListsRequest } from "./accesslist_service_pb";
-import type { GetAccessListsResponse } from "./accesslist_service_pb";
-import type { GetAccessListsRequest } from "./accesslist_service_pb";
-import * as grpc from "@grpc/grpc-js";
-/**
- * AccessListService provides CRUD methods for Access List resources.
- *
- * @generated from protobuf service teleport.accesslist.v1.AccessListService
- */
-export interface IAccessListServiceClient {
-    /**
-     * GetAccessLists returns a list of all access lists.
-     *
-     * @generated from protobuf rpc: GetAccessLists(teleport.accesslist.v1.GetAccessListsRequest) returns (teleport.accesslist.v1.GetAccessListsResponse);
-     */
-    getAccessLists(input: GetAccessListsRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetAccessListsResponse) => void): grpc.ClientUnaryCall;
-    getAccessLists(input: GetAccessListsRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: GetAccessListsResponse) => void): grpc.ClientUnaryCall;
-    getAccessLists(input: GetAccessListsRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetAccessListsResponse) => void): grpc.ClientUnaryCall;
-    getAccessLists(input: GetAccessListsRequest, callback: (err: grpc.ServiceError | null, value?: GetAccessListsResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * ListAccessLists returns a paginated list of all access lists.
-     *
-     * @generated from protobuf rpc: ListAccessLists(teleport.accesslist.v1.ListAccessListsRequest) returns (teleport.accesslist.v1.ListAccessListsResponse);
-     */
-    listAccessLists(input: ListAccessListsRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListAccessListsResponse) => void): grpc.ClientUnaryCall;
-    listAccessLists(input: ListAccessListsRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: ListAccessListsResponse) => void): grpc.ClientUnaryCall;
-    listAccessLists(input: ListAccessListsRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListAccessListsResponse) => void): grpc.ClientUnaryCall;
-    listAccessLists(input: ListAccessListsRequest, callback: (err: grpc.ServiceError | null, value?: ListAccessListsResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * GetAccessList returns the specified access list resource.
-     *
-     * @generated from protobuf rpc: GetAccessList(teleport.accesslist.v1.GetAccessListRequest) returns (teleport.accesslist.v1.AccessList);
-     */
-    getAccessList(input: GetAccessListRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: AccessList) => void): grpc.ClientUnaryCall;
-    getAccessList(input: GetAccessListRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: AccessList) => void): grpc.ClientUnaryCall;
-    getAccessList(input: GetAccessListRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: AccessList) => void): grpc.ClientUnaryCall;
-    getAccessList(input: GetAccessListRequest, callback: (err: grpc.ServiceError | null, value?: AccessList) => void): grpc.ClientUnaryCall;
-    /**
-     * UpsertAccessList creates or updates an access list resource.
-     *
-     * @generated from protobuf rpc: UpsertAccessList(teleport.accesslist.v1.UpsertAccessListRequest) returns (teleport.accesslist.v1.AccessList);
-     */
-    upsertAccessList(input: UpsertAccessListRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: AccessList) => void): grpc.ClientUnaryCall;
-    upsertAccessList(input: UpsertAccessListRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: AccessList) => void): grpc.ClientUnaryCall;
-    upsertAccessList(input: UpsertAccessListRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: AccessList) => void): grpc.ClientUnaryCall;
-    upsertAccessList(input: UpsertAccessListRequest, callback: (err: grpc.ServiceError | null, value?: AccessList) => void): grpc.ClientUnaryCall;
-    /**
-     * DeleteAccessList hard deletes the specified access list resource.
-     *
-     * @generated from protobuf rpc: DeleteAccessList(teleport.accesslist.v1.DeleteAccessListRequest) returns (google.protobuf.Empty);
-     */
-    deleteAccessList(input: DeleteAccessListRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAccessList(input: DeleteAccessListRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAccessList(input: DeleteAccessListRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAccessList(input: DeleteAccessListRequest, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    /**
-     * DeleteAllAccessLists hard deletes all access lists.
-     *
-     * @generated from protobuf rpc: DeleteAllAccessLists(teleport.accesslist.v1.DeleteAllAccessListsRequest) returns (google.protobuf.Empty);
-     */
-    deleteAllAccessLists(input: DeleteAllAccessListsRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAllAccessLists(input: DeleteAllAccessListsRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAllAccessLists(input: DeleteAllAccessListsRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAllAccessLists(input: DeleteAllAccessListsRequest, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    /**
-     * GetAccessListsToReview will return access lists that need to be reviewed by
-     * the current user.
-     *
-     * @generated from protobuf rpc: GetAccessListsToReview(teleport.accesslist.v1.GetAccessListsToReviewRequest) returns (teleport.accesslist.v1.GetAccessListsToReviewResponse);
-     */
-    getAccessListsToReview(input: GetAccessListsToReviewRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetAccessListsToReviewResponse) => void): grpc.ClientUnaryCall;
-    getAccessListsToReview(input: GetAccessListsToReviewRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: GetAccessListsToReviewResponse) => void): grpc.ClientUnaryCall;
-    getAccessListsToReview(input: GetAccessListsToReviewRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetAccessListsToReviewResponse) => void): grpc.ClientUnaryCall;
-    getAccessListsToReview(input: GetAccessListsToReviewRequest, callback: (err: grpc.ServiceError | null, value?: GetAccessListsToReviewResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * CountAccessListMembers returns the count of access list members in an
-     * access list.
-     *
-     * @generated from protobuf rpc: CountAccessListMembers(teleport.accesslist.v1.CountAccessListMembersRequest) returns (teleport.accesslist.v1.CountAccessListMembersResponse);
-     */
-    countAccessListMembers(input: CountAccessListMembersRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: CountAccessListMembersResponse) => void): grpc.ClientUnaryCall;
-    countAccessListMembers(input: CountAccessListMembersRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: CountAccessListMembersResponse) => void): grpc.ClientUnaryCall;
-    countAccessListMembers(input: CountAccessListMembersRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: CountAccessListMembersResponse) => void): grpc.ClientUnaryCall;
-    countAccessListMembers(input: CountAccessListMembersRequest, callback: (err: grpc.ServiceError | null, value?: CountAccessListMembersResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * ListAccessListMembers returns a paginated list of all access list members.
-     *
-     * @generated from protobuf rpc: ListAccessListMembers(teleport.accesslist.v1.ListAccessListMembersRequest) returns (teleport.accesslist.v1.ListAccessListMembersResponse);
-     */
-    listAccessListMembers(input: ListAccessListMembersRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListAccessListMembersResponse) => void): grpc.ClientUnaryCall;
-    listAccessListMembers(input: ListAccessListMembersRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: ListAccessListMembersResponse) => void): grpc.ClientUnaryCall;
-    listAccessListMembers(input: ListAccessListMembersRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListAccessListMembersResponse) => void): grpc.ClientUnaryCall;
-    listAccessListMembers(input: ListAccessListMembersRequest, callback: (err: grpc.ServiceError | null, value?: ListAccessListMembersResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * ListAllAccessListMembers returns a paginated list of all access list
-     * members for all access lists.
-     *
-     * @generated from protobuf rpc: ListAllAccessListMembers(teleport.accesslist.v1.ListAllAccessListMembersRequest) returns (teleport.accesslist.v1.ListAllAccessListMembersResponse);
-     */
-    listAllAccessListMembers(input: ListAllAccessListMembersRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListAllAccessListMembersResponse) => void): grpc.ClientUnaryCall;
-    listAllAccessListMembers(input: ListAllAccessListMembersRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: ListAllAccessListMembersResponse) => void): grpc.ClientUnaryCall;
-    listAllAccessListMembers(input: ListAllAccessListMembersRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListAllAccessListMembersResponse) => void): grpc.ClientUnaryCall;
-    listAllAccessListMembers(input: ListAllAccessListMembersRequest, callback: (err: grpc.ServiceError | null, value?: ListAllAccessListMembersResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * GetAccessListMember returns the specified access list member resource.
-     *
-     * @generated from protobuf rpc: GetAccessListMember(teleport.accesslist.v1.GetAccessListMemberRequest) returns (teleport.accesslist.v1.Member);
-     */
-    getAccessListMember(input: GetAccessListMemberRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Member) => void): grpc.ClientUnaryCall;
-    getAccessListMember(input: GetAccessListMemberRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: Member) => void): grpc.ClientUnaryCall;
-    getAccessListMember(input: GetAccessListMemberRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Member) => void): grpc.ClientUnaryCall;
-    getAccessListMember(input: GetAccessListMemberRequest, callback: (err: grpc.ServiceError | null, value?: Member) => void): grpc.ClientUnaryCall;
-    /**
-     * UpsertAccessListMember creates or updates an access list member resource.
-     *
-     * @generated from protobuf rpc: UpsertAccessListMember(teleport.accesslist.v1.UpsertAccessListMemberRequest) returns (teleport.accesslist.v1.Member);
-     */
-    upsertAccessListMember(input: UpsertAccessListMemberRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Member) => void): grpc.ClientUnaryCall;
-    upsertAccessListMember(input: UpsertAccessListMemberRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: Member) => void): grpc.ClientUnaryCall;
-    upsertAccessListMember(input: UpsertAccessListMemberRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Member) => void): grpc.ClientUnaryCall;
-    upsertAccessListMember(input: UpsertAccessListMemberRequest, callback: (err: grpc.ServiceError | null, value?: Member) => void): grpc.ClientUnaryCall;
-    /**
-     * DeleteAccessListMember hard deletes the specified access list member
-     * resource.
-     *
-     * @generated from protobuf rpc: DeleteAccessListMember(teleport.accesslist.v1.DeleteAccessListMemberRequest) returns (google.protobuf.Empty);
-     */
-    deleteAccessListMember(input: DeleteAccessListMemberRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAccessListMember(input: DeleteAccessListMemberRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAccessListMember(input: DeleteAccessListMemberRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAccessListMember(input: DeleteAccessListMemberRequest, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    /**
-     * DeleteAllAccessListMembers hard deletes all access list members for an
-     * access list.
-     *
-     * @generated from protobuf rpc: DeleteAllAccessListMembersForAccessList(teleport.accesslist.v1.DeleteAllAccessListMembersForAccessListRequest) returns (google.protobuf.Empty);
-     */
-    deleteAllAccessListMembersForAccessList(input: DeleteAllAccessListMembersForAccessListRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAllAccessListMembersForAccessList(input: DeleteAllAccessListMembersForAccessListRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAllAccessListMembersForAccessList(input: DeleteAllAccessListMembersForAccessListRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAllAccessListMembersForAccessList(input: DeleteAllAccessListMembersForAccessListRequest, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    /**
-     * DeleteAllAccessListMembers hard deletes all access list members for an
-     * access list.
-     *
-     * @generated from protobuf rpc: DeleteAllAccessListMembers(teleport.accesslist.v1.DeleteAllAccessListMembersRequest) returns (google.protobuf.Empty);
-     */
-    deleteAllAccessListMembers(input: DeleteAllAccessListMembersRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAllAccessListMembers(input: DeleteAllAccessListMembersRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAllAccessListMembers(input: DeleteAllAccessListMembersRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAllAccessListMembers(input: DeleteAllAccessListMembersRequest, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    /**
-     * UpsertAccessListWithMembers creates or updates an access list with members.
-     *
-     * @generated from protobuf rpc: UpsertAccessListWithMembers(teleport.accesslist.v1.UpsertAccessListWithMembersRequest) returns (teleport.accesslist.v1.UpsertAccessListWithMembersResponse);
-     */
-    upsertAccessListWithMembers(input: UpsertAccessListWithMembersRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: UpsertAccessListWithMembersResponse) => void): grpc.ClientUnaryCall;
-    upsertAccessListWithMembers(input: UpsertAccessListWithMembersRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: UpsertAccessListWithMembersResponse) => void): grpc.ClientUnaryCall;
-    upsertAccessListWithMembers(input: UpsertAccessListWithMembersRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: UpsertAccessListWithMembersResponse) => void): grpc.ClientUnaryCall;
-    upsertAccessListWithMembers(input: UpsertAccessListWithMembersRequest, callback: (err: grpc.ServiceError | null, value?: UpsertAccessListWithMembersResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * ListAccessListReviews will list access list reviews for a particular access
-     * list.
-     *
-     * @generated from protobuf rpc: ListAccessListReviews(teleport.accesslist.v1.ListAccessListReviewsRequest) returns (teleport.accesslist.v1.ListAccessListReviewsResponse);
-     */
-    listAccessListReviews(input: ListAccessListReviewsRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListAccessListReviewsResponse) => void): grpc.ClientUnaryCall;
-    listAccessListReviews(input: ListAccessListReviewsRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: ListAccessListReviewsResponse) => void): grpc.ClientUnaryCall;
-    listAccessListReviews(input: ListAccessListReviewsRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListAccessListReviewsResponse) => void): grpc.ClientUnaryCall;
-    listAccessListReviews(input: ListAccessListReviewsRequest, callback: (err: grpc.ServiceError | null, value?: ListAccessListReviewsResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * ListAllAccessListReviews will list access list reviews for all access
-     * lists.
-     *
-     * @generated from protobuf rpc: ListAllAccessListReviews(teleport.accesslist.v1.ListAllAccessListReviewsRequest) returns (teleport.accesslist.v1.ListAllAccessListReviewsResponse);
-     */
-    listAllAccessListReviews(input: ListAllAccessListReviewsRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListAllAccessListReviewsResponse) => void): grpc.ClientUnaryCall;
-    listAllAccessListReviews(input: ListAllAccessListReviewsRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: ListAllAccessListReviewsResponse) => void): grpc.ClientUnaryCall;
-    listAllAccessListReviews(input: ListAllAccessListReviewsRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListAllAccessListReviewsResponse) => void): grpc.ClientUnaryCall;
-    listAllAccessListReviews(input: ListAllAccessListReviewsRequest, callback: (err: grpc.ServiceError | null, value?: ListAllAccessListReviewsResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * CreateAccessListReview will create a new review for an access list. It will
-     * also modify the original access list and its members depending on the
-     * details of the review.
-     *
-     * @generated from protobuf rpc: CreateAccessListReview(teleport.accesslist.v1.CreateAccessListReviewRequest) returns (teleport.accesslist.v1.CreateAccessListReviewResponse);
-     */
-    createAccessListReview(input: CreateAccessListReviewRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: CreateAccessListReviewResponse) => void): grpc.ClientUnaryCall;
-    createAccessListReview(input: CreateAccessListReviewRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: CreateAccessListReviewResponse) => void): grpc.ClientUnaryCall;
-    createAccessListReview(input: CreateAccessListReviewRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: CreateAccessListReviewResponse) => void): grpc.ClientUnaryCall;
-    createAccessListReview(input: CreateAccessListReviewRequest, callback: (err: grpc.ServiceError | null, value?: CreateAccessListReviewResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * DeleteAccessListReview will delete an access list review from the backend.
-     *
-     * @generated from protobuf rpc: DeleteAccessListReview(teleport.accesslist.v1.DeleteAccessListReviewRequest) returns (google.protobuf.Empty);
-     */
-    deleteAccessListReview(input: DeleteAccessListReviewRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAccessListReview(input: DeleteAccessListReviewRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAccessListReview(input: DeleteAccessListReviewRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    deleteAccessListReview(input: DeleteAccessListReviewRequest, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    /**
-     * AccessRequestPromote promotes an access request to an access list.
-     *
-     * @generated from protobuf rpc: AccessRequestPromote(teleport.accesslist.v1.AccessRequestPromoteRequest) returns (teleport.accesslist.v1.AccessRequestPromoteResponse);
-     */
-    accessRequestPromote(input: AccessRequestPromoteRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: AccessRequestPromoteResponse) => void): grpc.ClientUnaryCall;
-    accessRequestPromote(input: AccessRequestPromoteRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: AccessRequestPromoteResponse) => void): grpc.ClientUnaryCall;
-    accessRequestPromote(input: AccessRequestPromoteRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: AccessRequestPromoteResponse) => void): grpc.ClientUnaryCall;
-    accessRequestPromote(input: AccessRequestPromoteRequest, callback: (err: grpc.ServiceError | null, value?: AccessRequestPromoteResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * GetSuggestedAccessLists returns suggested access lists for an access
-     * request.
-     *
-     * @generated from protobuf rpc: GetSuggestedAccessLists(teleport.accesslist.v1.GetSuggestedAccessListsRequest) returns (teleport.accesslist.v1.GetSuggestedAccessListsResponse);
-     */
-    getSuggestedAccessLists(input: GetSuggestedAccessListsRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetSuggestedAccessListsResponse) => void): grpc.ClientUnaryCall;
-    getSuggestedAccessLists(input: GetSuggestedAccessListsRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: GetSuggestedAccessListsResponse) => void): grpc.ClientUnaryCall;
-    getSuggestedAccessLists(input: GetSuggestedAccessListsRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetSuggestedAccessListsResponse) => void): grpc.ClientUnaryCall;
-    getSuggestedAccessLists(input: GetSuggestedAccessListsRequest, callback: (err: grpc.ServiceError | null, value?: GetSuggestedAccessListsResponse) => void): grpc.ClientUnaryCall;
-}
-/**
- * AccessListService provides CRUD methods for Access List resources.
- *
- * @generated from protobuf service teleport.accesslist.v1.AccessListService
- */
-export class AccessListServiceClient extends grpc.Client implements IAccessListServiceClient {
-    private readonly _binaryOptions: Partial<BinaryReadOptions & BinaryWriteOptions>;
-    constructor(address: string, credentials: grpc.ChannelCredentials, options: grpc.ClientOptions = {}, binaryOptions: Partial<BinaryReadOptions & BinaryWriteOptions> = {}) {
-        super(address, credentials, options);
-        this._binaryOptions = binaryOptions;
-    }
-    /**
-     * GetAccessLists returns a list of all access lists.
-     *
-     * @generated from protobuf rpc: GetAccessLists(teleport.accesslist.v1.GetAccessListsRequest) returns (teleport.accesslist.v1.GetAccessListsResponse);
-     */
-    getAccessLists(input: GetAccessListsRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetAccessListsResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetAccessListsResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: GetAccessListsResponse) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[0];
-        return this.makeUnaryRequest<GetAccessListsRequest, GetAccessListsResponse>(`/${AccessListService.typeName}/${method.name}`, (value: GetAccessListsRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): GetAccessListsResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * ListAccessLists returns a paginated list of all access lists.
-     *
-     * @generated from protobuf rpc: ListAccessLists(teleport.accesslist.v1.ListAccessListsRequest) returns (teleport.accesslist.v1.ListAccessListsResponse);
-     */
-    listAccessLists(input: ListAccessListsRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListAccessListsResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListAccessListsResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: ListAccessListsResponse) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[1];
-        return this.makeUnaryRequest<ListAccessListsRequest, ListAccessListsResponse>(`/${AccessListService.typeName}/${method.name}`, (value: ListAccessListsRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): ListAccessListsResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * GetAccessList returns the specified access list resource.
-     *
-     * @generated from protobuf rpc: GetAccessList(teleport.accesslist.v1.GetAccessListRequest) returns (teleport.accesslist.v1.AccessList);
-     */
-    getAccessList(input: GetAccessListRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: AccessList) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: AccessList) => void), callback?: ((err: grpc.ServiceError | null, value?: AccessList) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[2];
-        return this.makeUnaryRequest<GetAccessListRequest, AccessList>(`/${AccessListService.typeName}/${method.name}`, (value: GetAccessListRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): AccessList => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * UpsertAccessList creates or updates an access list resource.
-     *
-     * @generated from protobuf rpc: UpsertAccessList(teleport.accesslist.v1.UpsertAccessListRequest) returns (teleport.accesslist.v1.AccessList);
-     */
-    upsertAccessList(input: UpsertAccessListRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: AccessList) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: AccessList) => void), callback?: ((err: grpc.ServiceError | null, value?: AccessList) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[3];
-        return this.makeUnaryRequest<UpsertAccessListRequest, AccessList>(`/${AccessListService.typeName}/${method.name}`, (value: UpsertAccessListRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): AccessList => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * DeleteAccessList hard deletes the specified access list resource.
-     *
-     * @generated from protobuf rpc: DeleteAccessList(teleport.accesslist.v1.DeleteAccessListRequest) returns (google.protobuf.Empty);
-     */
-    deleteAccessList(input: DeleteAccessListRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Empty) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Empty) => void), callback?: ((err: grpc.ServiceError | null, value?: Empty) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[4];
-        return this.makeUnaryRequest<DeleteAccessListRequest, Empty>(`/${AccessListService.typeName}/${method.name}`, (value: DeleteAccessListRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): Empty => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * DeleteAllAccessLists hard deletes all access lists.
-     *
-     * @generated from protobuf rpc: DeleteAllAccessLists(teleport.accesslist.v1.DeleteAllAccessListsRequest) returns (google.protobuf.Empty);
-     */
-    deleteAllAccessLists(input: DeleteAllAccessListsRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Empty) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Empty) => void), callback?: ((err: grpc.ServiceError | null, value?: Empty) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[5];
-        return this.makeUnaryRequest<DeleteAllAccessListsRequest, Empty>(`/${AccessListService.typeName}/${method.name}`, (value: DeleteAllAccessListsRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): Empty => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * GetAccessListsToReview will return access lists that need to be reviewed by
-     * the current user.
-     *
-     * @generated from protobuf rpc: GetAccessListsToReview(teleport.accesslist.v1.GetAccessListsToReviewRequest) returns (teleport.accesslist.v1.GetAccessListsToReviewResponse);
-     */
-    getAccessListsToReview(input: GetAccessListsToReviewRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetAccessListsToReviewResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetAccessListsToReviewResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: GetAccessListsToReviewResponse) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[6];
-        return this.makeUnaryRequest<GetAccessListsToReviewRequest, GetAccessListsToReviewResponse>(`/${AccessListService.typeName}/${method.name}`, (value: GetAccessListsToReviewRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): GetAccessListsToReviewResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * CountAccessListMembers returns the count of access list members in an
-     * access list.
-     *
-     * @generated from protobuf rpc: CountAccessListMembers(teleport.accesslist.v1.CountAccessListMembersRequest) returns (teleport.accesslist.v1.CountAccessListMembersResponse);
-     */
-    countAccessListMembers(input: CountAccessListMembersRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: CountAccessListMembersResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: CountAccessListMembersResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: CountAccessListMembersResponse) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[7];
-        return this.makeUnaryRequest<CountAccessListMembersRequest, CountAccessListMembersResponse>(`/${AccessListService.typeName}/${method.name}`, (value: CountAccessListMembersRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): CountAccessListMembersResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * ListAccessListMembers returns a paginated list of all access list members.
-     *
-     * @generated from protobuf rpc: ListAccessListMembers(teleport.accesslist.v1.ListAccessListMembersRequest) returns (teleport.accesslist.v1.ListAccessListMembersResponse);
-     */
-    listAccessListMembers(input: ListAccessListMembersRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListAccessListMembersResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListAccessListMembersResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: ListAccessListMembersResponse) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[8];
-        return this.makeUnaryRequest<ListAccessListMembersRequest, ListAccessListMembersResponse>(`/${AccessListService.typeName}/${method.name}`, (value: ListAccessListMembersRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): ListAccessListMembersResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * ListAllAccessListMembers returns a paginated list of all access list
-     * members for all access lists.
-     *
-     * @generated from protobuf rpc: ListAllAccessListMembers(teleport.accesslist.v1.ListAllAccessListMembersRequest) returns (teleport.accesslist.v1.ListAllAccessListMembersResponse);
-     */
-    listAllAccessListMembers(input: ListAllAccessListMembersRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListAllAccessListMembersResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListAllAccessListMembersResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: ListAllAccessListMembersResponse) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[9];
-        return this.makeUnaryRequest<ListAllAccessListMembersRequest, ListAllAccessListMembersResponse>(`/${AccessListService.typeName}/${method.name}`, (value: ListAllAccessListMembersRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): ListAllAccessListMembersResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * GetAccessListMember returns the specified access list member resource.
-     *
-     * @generated from protobuf rpc: GetAccessListMember(teleport.accesslist.v1.GetAccessListMemberRequest) returns (teleport.accesslist.v1.Member);
-     */
-    getAccessListMember(input: GetAccessListMemberRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Member) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Member) => void), callback?: ((err: grpc.ServiceError | null, value?: Member) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[10];
-        return this.makeUnaryRequest<GetAccessListMemberRequest, Member>(`/${AccessListService.typeName}/${method.name}`, (value: GetAccessListMemberRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): Member => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * UpsertAccessListMember creates or updates an access list member resource.
-     *
-     * @generated from protobuf rpc: UpsertAccessListMember(teleport.accesslist.v1.UpsertAccessListMemberRequest) returns (teleport.accesslist.v1.Member);
-     */
-    upsertAccessListMember(input: UpsertAccessListMemberRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Member) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Member) => void), callback?: ((err: grpc.ServiceError | null, value?: Member) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[11];
-        return this.makeUnaryRequest<UpsertAccessListMemberRequest, Member>(`/${AccessListService.typeName}/${method.name}`, (value: UpsertAccessListMemberRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): Member => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * DeleteAccessListMember hard deletes the specified access list member
-     * resource.
-     *
-     * @generated from protobuf rpc: DeleteAccessListMember(teleport.accesslist.v1.DeleteAccessListMemberRequest) returns (google.protobuf.Empty);
-     */
-    deleteAccessListMember(input: DeleteAccessListMemberRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Empty) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Empty) => void), callback?: ((err: grpc.ServiceError | null, value?: Empty) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[12];
-        return this.makeUnaryRequest<DeleteAccessListMemberRequest, Empty>(`/${AccessListService.typeName}/${method.name}`, (value: DeleteAccessListMemberRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): Empty => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * DeleteAllAccessListMembers hard deletes all access list members for an
-     * access list.
-     *
-     * @generated from protobuf rpc: DeleteAllAccessListMembersForAccessList(teleport.accesslist.v1.DeleteAllAccessListMembersForAccessListRequest) returns (google.protobuf.Empty);
-     */
-    deleteAllAccessListMembersForAccessList(input: DeleteAllAccessListMembersForAccessListRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Empty) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Empty) => void), callback?: ((err: grpc.ServiceError | null, value?: Empty) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[13];
-        return this.makeUnaryRequest<DeleteAllAccessListMembersForAccessListRequest, Empty>(`/${AccessListService.typeName}/${method.name}`, (value: DeleteAllAccessListMembersForAccessListRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): Empty => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * DeleteAllAccessListMembers hard deletes all access list members for an
-     * access list.
-     *
-     * @generated from protobuf rpc: DeleteAllAccessListMembers(teleport.accesslist.v1.DeleteAllAccessListMembersRequest) returns (google.protobuf.Empty);
-     */
-    deleteAllAccessListMembers(input: DeleteAllAccessListMembersRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Empty) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Empty) => void), callback?: ((err: grpc.ServiceError | null, value?: Empty) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[14];
-        return this.makeUnaryRequest<DeleteAllAccessListMembersRequest, Empty>(`/${AccessListService.typeName}/${method.name}`, (value: DeleteAllAccessListMembersRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): Empty => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * UpsertAccessListWithMembers creates or updates an access list with members.
-     *
-     * @generated from protobuf rpc: UpsertAccessListWithMembers(teleport.accesslist.v1.UpsertAccessListWithMembersRequest) returns (teleport.accesslist.v1.UpsertAccessListWithMembersResponse);
-     */
-    upsertAccessListWithMembers(input: UpsertAccessListWithMembersRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: UpsertAccessListWithMembersResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: UpsertAccessListWithMembersResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: UpsertAccessListWithMembersResponse) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[15];
-        return this.makeUnaryRequest<UpsertAccessListWithMembersRequest, UpsertAccessListWithMembersResponse>(`/${AccessListService.typeName}/${method.name}`, (value: UpsertAccessListWithMembersRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): UpsertAccessListWithMembersResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * ListAccessListReviews will list access list reviews for a particular access
-     * list.
-     *
-     * @generated from protobuf rpc: ListAccessListReviews(teleport.accesslist.v1.ListAccessListReviewsRequest) returns (teleport.accesslist.v1.ListAccessListReviewsResponse);
-     */
-    listAccessListReviews(input: ListAccessListReviewsRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListAccessListReviewsResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListAccessListReviewsResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: ListAccessListReviewsResponse) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[16];
-        return this.makeUnaryRequest<ListAccessListReviewsRequest, ListAccessListReviewsResponse>(`/${AccessListService.typeName}/${method.name}`, (value: ListAccessListReviewsRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): ListAccessListReviewsResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * ListAllAccessListReviews will list access list reviews for all access
-     * lists.
-     *
-     * @generated from protobuf rpc: ListAllAccessListReviews(teleport.accesslist.v1.ListAllAccessListReviewsRequest) returns (teleport.accesslist.v1.ListAllAccessListReviewsResponse);
-     */
-    listAllAccessListReviews(input: ListAllAccessListReviewsRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListAllAccessListReviewsResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListAllAccessListReviewsResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: ListAllAccessListReviewsResponse) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[17];
-        return this.makeUnaryRequest<ListAllAccessListReviewsRequest, ListAllAccessListReviewsResponse>(`/${AccessListService.typeName}/${method.name}`, (value: ListAllAccessListReviewsRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): ListAllAccessListReviewsResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * CreateAccessListReview will create a new review for an access list. It will
-     * also modify the original access list and its members depending on the
-     * details of the review.
-     *
-     * @generated from protobuf rpc: CreateAccessListReview(teleport.accesslist.v1.CreateAccessListReviewRequest) returns (teleport.accesslist.v1.CreateAccessListReviewResponse);
-     */
-    createAccessListReview(input: CreateAccessListReviewRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: CreateAccessListReviewResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: CreateAccessListReviewResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: CreateAccessListReviewResponse) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[18];
-        return this.makeUnaryRequest<CreateAccessListReviewRequest, CreateAccessListReviewResponse>(`/${AccessListService.typeName}/${method.name}`, (value: CreateAccessListReviewRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): CreateAccessListReviewResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * DeleteAccessListReview will delete an access list review from the backend.
-     *
-     * @generated from protobuf rpc: DeleteAccessListReview(teleport.accesslist.v1.DeleteAccessListReviewRequest) returns (google.protobuf.Empty);
-     */
-    deleteAccessListReview(input: DeleteAccessListReviewRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Empty) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Empty) => void), callback?: ((err: grpc.ServiceError | null, value?: Empty) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[19];
-        return this.makeUnaryRequest<DeleteAccessListReviewRequest, Empty>(`/${AccessListService.typeName}/${method.name}`, (value: DeleteAccessListReviewRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): Empty => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * AccessRequestPromote promotes an access request to an access list.
-     *
-     * @generated from protobuf rpc: AccessRequestPromote(teleport.accesslist.v1.AccessRequestPromoteRequest) returns (teleport.accesslist.v1.AccessRequestPromoteResponse);
-     */
-    accessRequestPromote(input: AccessRequestPromoteRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: AccessRequestPromoteResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: AccessRequestPromoteResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: AccessRequestPromoteResponse) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[20];
-        return this.makeUnaryRequest<AccessRequestPromoteRequest, AccessRequestPromoteResponse>(`/${AccessListService.typeName}/${method.name}`, (value: AccessRequestPromoteRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): AccessRequestPromoteResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * GetSuggestedAccessLists returns suggested access lists for an access
-     * request.
-     *
-     * @generated from protobuf rpc: GetSuggestedAccessLists(teleport.accesslist.v1.GetSuggestedAccessListsRequest) returns (teleport.accesslist.v1.GetSuggestedAccessListsResponse);
-     */
-    getSuggestedAccessLists(input: GetSuggestedAccessListsRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetSuggestedAccessListsResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetSuggestedAccessListsResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: GetSuggestedAccessListsResponse) => void)): grpc.ClientUnaryCall {
-        const method = AccessListService.methods[21];
-        return this.makeUnaryRequest<GetSuggestedAccessListsRequest, GetSuggestedAccessListsResponse>(`/${AccessListService.typeName}/${method.name}`, (value: GetSuggestedAccessListsRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): GetSuggestedAccessListsResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-}
diff --git a/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.grpc-server.ts b/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.grpc-server.ts
index 29cec5264e796..9559e8db63b24 100644
--- a/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.grpc-server.ts
+++ b/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.grpc-server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/accesslist/v1/accesslist_service.proto" (package "teleport.accesslist.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.ts b/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.ts
index 1b1e7872a6b87..0bcf05f877f3d 100644
--- a/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.ts
+++ b/gen/proto/ts/teleport/accesslist/v1/accesslist_service_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/accesslist/v1/accesslist_service.proto" (package "teleport.accesslist.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/header/v1/metadata_pb.ts b/gen/proto/ts/teleport/header/v1/metadata_pb.ts
index a6efa06e168ca..6e8d155108698 100644
--- a/gen/proto/ts/teleport/header/v1/metadata_pb.ts
+++ b/gen/proto/ts/teleport/header/v1/metadata_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/header/v1/metadata.proto" (package "teleport.header.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/header/v1/resourceheader_pb.ts b/gen/proto/ts/teleport/header/v1/resourceheader_pb.ts
index 72b493317d117..5b050c9064d0d 100644
--- a/gen/proto/ts/teleport/header/v1/resourceheader_pb.ts
+++ b/gen/proto/ts/teleport/header/v1/resourceheader_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/header/v1/resourceheader.proto" (package "teleport.header.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/access_request_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/access_request_pb.ts
index 6d397a16bbd13..41ab0cbcd00ec 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/access_request_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/access_request_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/access_request.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/app_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/app_pb.ts
index 6705c650256f2..132ad39c7b229 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/app_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/app_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/app.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/auth_settings_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/auth_settings_pb.ts
index b1ee9810bdd4b..da10c4801b9c7 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/auth_settings_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/auth_settings_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/auth_settings.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/cluster_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/cluster_pb.ts
index d8b71be887936..817774b40d487 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/cluster_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/cluster_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/cluster.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/database_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/database_pb.ts
index c2867d4b84e61..e70fe4b2d642f 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/database_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/database_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/database.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/gateway_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/gateway_pb.ts
index 97548b542556e..223c7083eb2a2 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/gateway_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/gateway_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/gateway.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/kube_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/kube_pb.ts
index ccd336350c625..bbbc8fbc39f21 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/kube_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/kube_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/kube.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/label_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/label_pb.ts
index 8c41b3de777aa..faa5641b84869 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/label_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/label_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/label.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/server_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/server_pb.ts
index df8918903069d..9f4966c09e56f 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/server_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/server_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/server.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.client.ts b/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.client.ts
new file mode 100644
index 0000000000000..0cd2a68158fd8
--- /dev/null
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.client.ts
@@ -0,0 +1,800 @@
+/* eslint-disable */
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated from protobuf file "teleport/lib/teleterm/v1/service.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
+// tslint:disable
+// @ts-nocheck
+//
+//
+// Teleport
+// Copyright (C) 2023  Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
+import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
+import { TerminalService } from "./service_pb";
+import type { UpdateUserPreferencesResponse } from "./service_pb";
+import type { UpdateUserPreferencesRequest } from "./service_pb";
+import type { GetUserPreferencesResponse } from "./service_pb";
+import type { GetUserPreferencesRequest } from "./service_pb";
+import type { ListUnifiedResourcesResponse } from "./service_pb";
+import type { ListUnifiedResourcesRequest } from "./service_pb";
+import type { GetConnectMyComputerNodeNameResponse } from "./service_pb";
+import type { GetConnectMyComputerNodeNameRequest } from "./service_pb";
+import type { DeleteConnectMyComputerNodeResponse } from "./service_pb";
+import type { DeleteConnectMyComputerNodeRequest } from "./service_pb";
+import type { WaitForConnectMyComputerNodeJoinResponse } from "./service_pb";
+import type { WaitForConnectMyComputerNodeJoinRequest } from "./service_pb";
+import type { CreateConnectMyComputerNodeTokenResponse } from "./service_pb";
+import type { CreateConnectMyComputerNodeTokenRequest } from "./service_pb";
+import type { CreateConnectMyComputerRoleResponse } from "./service_pb";
+import type { CreateConnectMyComputerRoleRequest } from "./service_pb";
+import type { UpdateHeadlessAuthenticationStateResponse } from "./service_pb";
+import type { UpdateHeadlessAuthenticationStateRequest } from "./service_pb";
+import type { ReportUsageEventRequest } from "./usage_events_pb";
+import type { FileTransferProgress } from "./service_pb";
+import type { FileTransferRequest } from "./service_pb";
+import type { ServerStreamingCall } from "@protobuf-ts/runtime-rpc";
+import type { LogoutRequest } from "./service_pb";
+import type { LoginPasswordlessResponse } from "./service_pb";
+import type { LoginPasswordlessRequest } from "./service_pb";
+import type { DuplexStreamingCall } from "@protobuf-ts/runtime-rpc";
+import type { LoginRequest } from "./service_pb";
+import type { GetClusterRequest } from "./service_pb";
+import type { AuthSettings } from "./auth_settings_pb";
+import type { GetAuthSettingsRequest } from "./service_pb";
+import type { SetGatewayLocalPortRequest } from "./service_pb";
+import type { SetGatewayTargetSubresourceNameRequest } from "./service_pb";
+import type { RemoveGatewayRequest } from "./service_pb";
+import type { Gateway } from "./gateway_pb";
+import type { CreateGatewayRequest } from "./service_pb";
+import type { ListGatewaysResponse } from "./service_pb";
+import type { ListGatewaysRequest } from "./service_pb";
+import type { RemoveClusterRequest } from "./service_pb";
+import type { Cluster } from "./cluster_pb";
+import type { AddClusterRequest } from "./service_pb";
+import type { GetAppsResponse } from "./service_pb";
+import type { GetAppsRequest } from "./service_pb";
+import type { GetKubesResponse } from "./service_pb";
+import type { GetKubesRequest } from "./service_pb";
+import type { GetSuggestedAccessListsResponse } from "./service_pb";
+import type { GetSuggestedAccessListsRequest } from "./service_pb";
+import type { PromoteAccessRequestResponse } from "./service_pb";
+import type { PromoteAccessRequestRequest } from "./service_pb";
+import type { AssumeRoleRequest } from "./service_pb";
+import type { GetRequestableRolesResponse } from "./service_pb";
+import type { GetRequestableRolesRequest } from "./service_pb";
+import type { ReviewAccessRequestResponse } from "./service_pb";
+import type { ReviewAccessRequestRequest } from "./service_pb";
+import type { CreateAccessRequestResponse } from "./service_pb";
+import type { CreateAccessRequestRequest } from "./service_pb";
+import type { EmptyResponse } from "./service_pb";
+import type { DeleteAccessRequestRequest } from "./service_pb";
+import type { GetAccessRequestResponse } from "./service_pb";
+import type { GetAccessRequestRequest } from "./service_pb";
+import type { GetAccessRequestsResponse } from "./service_pb";
+import type { GetAccessRequestsRequest } from "./service_pb";
+import type { GetServersResponse } from "./service_pb";
+import type { GetServersRequest } from "./service_pb";
+import type { ListDatabaseUsersResponse } from "./service_pb";
+import type { ListDatabaseUsersRequest } from "./service_pb";
+import type { GetDatabasesResponse } from "./service_pb";
+import type { GetDatabasesRequest } from "./service_pb";
+import type { ListLeafClustersRequest } from "./service_pb";
+import type { ListClustersResponse } from "./service_pb";
+import type { ListClustersRequest } from "./service_pb";
+import { stackIntercept } from "@protobuf-ts/runtime-rpc";
+import type { UpdateTshdEventsServerAddressResponse } from "./service_pb";
+import type { UpdateTshdEventsServerAddressRequest } from "./service_pb";
+import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
+import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
+/**
+ * TerminalService is used by the Electron app to communicate with the tsh daemon.
+ *
+ * While we aim to preserve backwards compatibility in order to satisfy CI checks and follow the
+ * proto practices used within the company, this service is not guaranteed to be stable across
+ * versions. The packaging process of Teleport Connect ensures that the server and the client use
+ * the same version of the service.
+ *
+ * @generated from protobuf service teleport.lib.teleterm.v1.TerminalService
+ */
+export interface ITerminalServiceClient {
+    /**
+     * UpdateTshdEventsServerAddress lets the Electron app update the address the tsh daemon is
+     * supposed to use when connecting to the tshd events gRPC service. This RPC needs to be made
+     * before any other from this service.
+     *
+     * The service is supposed to return a response from this call only after the client is ready.
+     *
+     * @generated from protobuf rpc: UpdateTshdEventsServerAddress(teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressRequest) returns (teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressResponse);
+     */
+    updateTshdEventsServerAddress(input: UpdateTshdEventsServerAddressRequest, options?: RpcOptions): UnaryCall<UpdateTshdEventsServerAddressRequest, UpdateTshdEventsServerAddressResponse>;
+    /**
+     * ListRootClusters lists root clusters
+     * Does not include detailed cluster information that would require a network request.
+     *
+     * @generated from protobuf rpc: ListRootClusters(teleport.lib.teleterm.v1.ListClustersRequest) returns (teleport.lib.teleterm.v1.ListClustersResponse);
+     */
+    listRootClusters(input: ListClustersRequest, options?: RpcOptions): UnaryCall<ListClustersRequest, ListClustersResponse>;
+    /**
+     * ListLeafClusters lists leaf clusters
+     * Does not include detailed cluster information that would require a network request.
+     *
+     * @generated from protobuf rpc: ListLeafClusters(teleport.lib.teleterm.v1.ListLeafClustersRequest) returns (teleport.lib.teleterm.v1.ListClustersResponse);
+     */
+    listLeafClusters(input: ListLeafClustersRequest, options?: RpcOptions): UnaryCall<ListLeafClustersRequest, ListClustersResponse>;
+    /**
+     * GetDatabases returns a filtered and paginated list of databases
+     *
+     * @generated from protobuf rpc: GetDatabases(teleport.lib.teleterm.v1.GetDatabasesRequest) returns (teleport.lib.teleterm.v1.GetDatabasesResponse);
+     */
+    getDatabases(input: GetDatabasesRequest, options?: RpcOptions): UnaryCall<GetDatabasesRequest, GetDatabasesResponse>;
+    /**
+     * ListDatabaseUsers lists allowed users for the given database based on the role set.
+     *
+     * @generated from protobuf rpc: ListDatabaseUsers(teleport.lib.teleterm.v1.ListDatabaseUsersRequest) returns (teleport.lib.teleterm.v1.ListDatabaseUsersResponse);
+     */
+    listDatabaseUsers(input: ListDatabaseUsersRequest, options?: RpcOptions): UnaryCall<ListDatabaseUsersRequest, ListDatabaseUsersResponse>;
+    /**
+     * GetServers returns filtered, sorted, and paginated servers
+     *
+     * @generated from protobuf rpc: GetServers(teleport.lib.teleterm.v1.GetServersRequest) returns (teleport.lib.teleterm.v1.GetServersResponse);
+     */
+    getServers(input: GetServersRequest, options?: RpcOptions): UnaryCall<GetServersRequest, GetServersResponse>;
+    /**
+     * GetAccessRequests lists filtered AccessRequests
+     *
+     * @generated from protobuf rpc: GetAccessRequests(teleport.lib.teleterm.v1.GetAccessRequestsRequest) returns (teleport.lib.teleterm.v1.GetAccessRequestsResponse);
+     */
+    getAccessRequests(input: GetAccessRequestsRequest, options?: RpcOptions): UnaryCall<GetAccessRequestsRequest, GetAccessRequestsResponse>;
+    /**
+     * GetAccessRequest retreives a single Access Request
+     *
+     * @generated from protobuf rpc: GetAccessRequest(teleport.lib.teleterm.v1.GetAccessRequestRequest) returns (teleport.lib.teleterm.v1.GetAccessRequestResponse);
+     */
+    getAccessRequest(input: GetAccessRequestRequest, options?: RpcOptions): UnaryCall<GetAccessRequestRequest, GetAccessRequestResponse>;
+    /**
+     * DeleteAccessRequest deletes the access request by id
+     *
+     * @generated from protobuf rpc: DeleteAccessRequest(teleport.lib.teleterm.v1.DeleteAccessRequestRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
+     */
+    deleteAccessRequest(input: DeleteAccessRequestRequest, options?: RpcOptions): UnaryCall<DeleteAccessRequestRequest, EmptyResponse>;
+    /**
+     * CreateAccessRequest creates an access request
+     *
+     * @generated from protobuf rpc: CreateAccessRequest(teleport.lib.teleterm.v1.CreateAccessRequestRequest) returns (teleport.lib.teleterm.v1.CreateAccessRequestResponse);
+     */
+    createAccessRequest(input: CreateAccessRequestRequest, options?: RpcOptions): UnaryCall<CreateAccessRequestRequest, CreateAccessRequestResponse>;
+    /**
+     * ReviewAccessRequest submits a review for an Access Request
+     *
+     * @generated from protobuf rpc: ReviewAccessRequest(teleport.lib.teleterm.v1.ReviewAccessRequestRequest) returns (teleport.lib.teleterm.v1.ReviewAccessRequestResponse);
+     */
+    reviewAccessRequest(input: ReviewAccessRequestRequest, options?: RpcOptions): UnaryCall<ReviewAccessRequestRequest, ReviewAccessRequestResponse>;
+    /**
+     * GetRequestableRoles gets all requestable roles
+     *
+     * @generated from protobuf rpc: GetRequestableRoles(teleport.lib.teleterm.v1.GetRequestableRolesRequest) returns (teleport.lib.teleterm.v1.GetRequestableRolesResponse);
+     */
+    getRequestableRoles(input: GetRequestableRolesRequest, options?: RpcOptions): UnaryCall<GetRequestableRolesRequest, GetRequestableRolesResponse>;
+    /**
+     * AssumeRole assumes the role of the given access request
+     *
+     * @generated from protobuf rpc: AssumeRole(teleport.lib.teleterm.v1.AssumeRoleRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
+     */
+    assumeRole(input: AssumeRoleRequest, options?: RpcOptions): UnaryCall<AssumeRoleRequest, EmptyResponse>;
+    /**
+     * PromoteAccessRequest promotes an access request to an access list.
+     *
+     * @generated from protobuf rpc: PromoteAccessRequest(teleport.lib.teleterm.v1.PromoteAccessRequestRequest) returns (teleport.lib.teleterm.v1.PromoteAccessRequestResponse);
+     */
+    promoteAccessRequest(input: PromoteAccessRequestRequest, options?: RpcOptions): UnaryCall<PromoteAccessRequestRequest, PromoteAccessRequestResponse>;
+    /**
+     * GetSuggestedAccessLists returns suggested access lists for an access request.
+     *
+     * @generated from protobuf rpc: GetSuggestedAccessLists(teleport.lib.teleterm.v1.GetSuggestedAccessListsRequest) returns (teleport.lib.teleterm.v1.GetSuggestedAccessListsResponse);
+     */
+    getSuggestedAccessLists(input: GetSuggestedAccessListsRequest, options?: RpcOptions): UnaryCall<GetSuggestedAccessListsRequest, GetSuggestedAccessListsResponse>;
+    /**
+     * GetKubes returns filtered, sorted, and paginated kubes
+     *
+     * @generated from protobuf rpc: GetKubes(teleport.lib.teleterm.v1.GetKubesRequest) returns (teleport.lib.teleterm.v1.GetKubesResponse);
+     */
+    getKubes(input: GetKubesRequest, options?: RpcOptions): UnaryCall<GetKubesRequest, GetKubesResponse>;
+    /**
+     * GetApps returns a filtered and paginated list of apps.
+     *
+     * @generated from protobuf rpc: GetApps(teleport.lib.teleterm.v1.GetAppsRequest) returns (teleport.lib.teleterm.v1.GetAppsResponse);
+     */
+    getApps(input: GetAppsRequest, options?: RpcOptions): UnaryCall<GetAppsRequest, GetAppsResponse>;
+    /**
+     * AddCluster adds a cluster to profile
+     *
+     * @generated from protobuf rpc: AddCluster(teleport.lib.teleterm.v1.AddClusterRequest) returns (teleport.lib.teleterm.v1.Cluster);
+     */
+    addCluster(input: AddClusterRequest, options?: RpcOptions): UnaryCall<AddClusterRequest, Cluster>;
+    /**
+     * RemoveCluster removes a cluster from profile
+     *
+     * @generated from protobuf rpc: RemoveCluster(teleport.lib.teleterm.v1.RemoveClusterRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
+     */
+    removeCluster(input: RemoveClusterRequest, options?: RpcOptions): UnaryCall<RemoveClusterRequest, EmptyResponse>;
+    /**
+     * ListGateways lists gateways
+     *
+     * @generated from protobuf rpc: ListGateways(teleport.lib.teleterm.v1.ListGatewaysRequest) returns (teleport.lib.teleterm.v1.ListGatewaysResponse);
+     */
+    listGateways(input: ListGatewaysRequest, options?: RpcOptions): UnaryCall<ListGatewaysRequest, ListGatewaysResponse>;
+    /**
+     * CreateGateway creates a gateway
+     *
+     * @generated from protobuf rpc: CreateGateway(teleport.lib.teleterm.v1.CreateGatewayRequest) returns (teleport.lib.teleterm.v1.Gateway);
+     */
+    createGateway(input: CreateGatewayRequest, options?: RpcOptions): UnaryCall<CreateGatewayRequest, Gateway>;
+    /**
+     * RemoveGateway removes a gateway
+     *
+     * @generated from protobuf rpc: RemoveGateway(teleport.lib.teleterm.v1.RemoveGatewayRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
+     */
+    removeGateway(input: RemoveGatewayRequest, options?: RpcOptions): UnaryCall<RemoveGatewayRequest, EmptyResponse>;
+    /**
+     * SetGatewayTargetSubresourceName changes the TargetSubresourceName field of gateway.Gateway
+     * and returns the updated version of gateway.Gateway.
+     *
+     * In Connect this is used to update the db name of a db connection along with the CLI command.
+     *
+     * @generated from protobuf rpc: SetGatewayTargetSubresourceName(teleport.lib.teleterm.v1.SetGatewayTargetSubresourceNameRequest) returns (teleport.lib.teleterm.v1.Gateway);
+     */
+    setGatewayTargetSubresourceName(input: SetGatewayTargetSubresourceNameRequest, options?: RpcOptions): UnaryCall<SetGatewayTargetSubresourceNameRequest, Gateway>;
+    /**
+     * SetGatewayLocalPort starts a new gateway on the new port, stops the old gateway and then
+     * assigns the URI of the old gateway to the new one. It does so without fetching a new db cert.
+     *
+     * @generated from protobuf rpc: SetGatewayLocalPort(teleport.lib.teleterm.v1.SetGatewayLocalPortRequest) returns (teleport.lib.teleterm.v1.Gateway);
+     */
+    setGatewayLocalPort(input: SetGatewayLocalPortRequest, options?: RpcOptions): UnaryCall<SetGatewayLocalPortRequest, Gateway>;
+    /**
+     * GetAuthSettings returns cluster auth settigns
+     *
+     * @generated from protobuf rpc: GetAuthSettings(teleport.lib.teleterm.v1.GetAuthSettingsRequest) returns (teleport.lib.teleterm.v1.AuthSettings);
+     */
+    getAuthSettings(input: GetAuthSettingsRequest, options?: RpcOptions): UnaryCall<GetAuthSettingsRequest, AuthSettings>;
+    /**
+     * GetCluster returns cluster. Makes a network request and includes detailed
+     * information about enterprise features availabed on the connected auth server
+     *
+     * @generated from protobuf rpc: GetCluster(teleport.lib.teleterm.v1.GetClusterRequest) returns (teleport.lib.teleterm.v1.Cluster);
+     */
+    getCluster(input: GetClusterRequest, options?: RpcOptions): UnaryCall<GetClusterRequest, Cluster>;
+    /**
+     * Login logs in a user to a cluster
+     *
+     * @generated from protobuf rpc: Login(teleport.lib.teleterm.v1.LoginRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
+     */
+    login(input: LoginRequest, options?: RpcOptions): UnaryCall<LoginRequest, EmptyResponse>;
+    /**
+     * LoginPasswordless logs in a user to a cluster passwordlessly.
+     *
+     * The RPC is streaming both ways and the message sequence example for hardware keys are:
+     * (-> means client-to-server, <- means server-to-client)
+     *
+     * Hardware keys:
+     * -> Init
+     * <- Send PasswordlessPrompt enum TAP to choose a device
+     * -> Receive TAP device response
+     * <- Send PasswordlessPrompt enum PIN
+     * -> Receive PIN response
+     * <- Send PasswordlessPrompt enum RETAP to confirm
+     * -> Receive RETAP device response
+     * <- Send list of credentials (e.g. usernames) associated with device
+     * -> Receive the index number associated with the selected credential in list
+     * <- End
+     *
+     * @generated from protobuf rpc: LoginPasswordless(stream teleport.lib.teleterm.v1.LoginPasswordlessRequest) returns (stream teleport.lib.teleterm.v1.LoginPasswordlessResponse);
+     */
+    loginPasswordless(options?: RpcOptions): DuplexStreamingCall<LoginPasswordlessRequest, LoginPasswordlessResponse>;
+    /**
+     * ClusterLogin logs out a user from cluster
+     *
+     * @generated from protobuf rpc: Logout(teleport.lib.teleterm.v1.LogoutRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
+     */
+    logout(input: LogoutRequest, options?: RpcOptions): UnaryCall<LogoutRequest, EmptyResponse>;
+    /**
+     * TransferFile sends a request to download/upload a file
+     *
+     * @generated from protobuf rpc: TransferFile(teleport.lib.teleterm.v1.FileTransferRequest) returns (stream teleport.lib.teleterm.v1.FileTransferProgress);
+     */
+    transferFile(input: FileTransferRequest, options?: RpcOptions): ServerStreamingCall<FileTransferRequest, FileTransferProgress>;
+    /**
+     * ReportUsageEvent allows to send usage events that are then anonymized and forwarded to prehog
+     *
+     * @generated from protobuf rpc: ReportUsageEvent(teleport.lib.teleterm.v1.ReportUsageEventRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
+     */
+    reportUsageEvent(input: ReportUsageEventRequest, options?: RpcOptions): UnaryCall<ReportUsageEventRequest, EmptyResponse>;
+    /**
+     * UpdateHeadlessAuthenticationState updates a headless authentication resource's state.
+     * An MFA challenge will be prompted when approving a headless authentication.
+     *
+     * @generated from protobuf rpc: UpdateHeadlessAuthenticationState(teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateRequest) returns (teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateResponse);
+     */
+    updateHeadlessAuthenticationState(input: UpdateHeadlessAuthenticationStateRequest, options?: RpcOptions): UnaryCall<UpdateHeadlessAuthenticationStateRequest, UpdateHeadlessAuthenticationStateResponse>;
+    /**
+     * CreateConnectMyComputerRole creates a role which allows access to nodes with the label
+     * teleport.dev/connect-my-computer/owner: <cluster user> and allows logging in to those nodes as
+     * the current system user.
+     *
+     * @generated from protobuf rpc: CreateConnectMyComputerRole(teleport.lib.teleterm.v1.CreateConnectMyComputerRoleRequest) returns (teleport.lib.teleterm.v1.CreateConnectMyComputerRoleResponse);
+     */
+    createConnectMyComputerRole(input: CreateConnectMyComputerRoleRequest, options?: RpcOptions): UnaryCall<CreateConnectMyComputerRoleRequest, CreateConnectMyComputerRoleResponse>;
+    /**
+     * CreateConnectMyComputerNodeToken creates a node join token that is valid for 5 minutes
+     *
+     * @generated from protobuf rpc: CreateConnectMyComputerNodeToken(teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenRequest) returns (teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenResponse);
+     */
+    createConnectMyComputerNodeToken(input: CreateConnectMyComputerNodeTokenRequest, options?: RpcOptions): UnaryCall<CreateConnectMyComputerNodeTokenRequest, CreateConnectMyComputerNodeTokenResponse>;
+    /**
+     * WaitForConnectMyComputerNodeJoin sets up a watcher and returns a response only after detecting
+     * that the Connect My Computer node for the particular cluster has joined the cluster (the
+     * OpPut event).
+     *
+     * This RPC times out by itself after a minute to prevent the request from hanging forever, in
+     * case the client didn't set a deadline or doesn't abort the request.
+     *
+     * @generated from protobuf rpc: WaitForConnectMyComputerNodeJoin(teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinRequest) returns (teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinResponse);
+     */
+    waitForConnectMyComputerNodeJoin(input: WaitForConnectMyComputerNodeJoinRequest, options?: RpcOptions): UnaryCall<WaitForConnectMyComputerNodeJoinRequest, WaitForConnectMyComputerNodeJoinResponse>;
+    /**
+     * DeleteConnectMyComputerNode deletes the Connect My Computer node.
+     *
+     * @generated from protobuf rpc: DeleteConnectMyComputerNode(teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeRequest) returns (teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeResponse);
+     */
+    deleteConnectMyComputerNode(input: DeleteConnectMyComputerNodeRequest, options?: RpcOptions): UnaryCall<DeleteConnectMyComputerNodeRequest, DeleteConnectMyComputerNodeResponse>;
+    /**
+     * GetConnectMyComputerNodeName reads the Connect My Computer node name (UUID) from a disk.
+     *
+     * @generated from protobuf rpc: GetConnectMyComputerNodeName(teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameRequest) returns (teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameResponse);
+     */
+    getConnectMyComputerNodeName(input: GetConnectMyComputerNodeNameRequest, options?: RpcOptions): UnaryCall<GetConnectMyComputerNodeNameRequest, GetConnectMyComputerNodeNameResponse>;
+    /**
+     * ListUnifiedResources retrieves a paginated list of all resource types displayable in the UI.
+     *
+     * @generated from protobuf rpc: ListUnifiedResources(teleport.lib.teleterm.v1.ListUnifiedResourcesRequest) returns (teleport.lib.teleterm.v1.ListUnifiedResourcesResponse);
+     */
+    listUnifiedResources(input: ListUnifiedResourcesRequest, options?: RpcOptions): UnaryCall<ListUnifiedResourcesRequest, ListUnifiedResourcesResponse>;
+    /**
+     * GetUserPreferences returns the combined (root + leaf cluster) preferences for a given user.
+     *
+     * @generated from protobuf rpc: GetUserPreferences(teleport.lib.teleterm.v1.GetUserPreferencesRequest) returns (teleport.lib.teleterm.v1.GetUserPreferencesResponse);
+     */
+    getUserPreferences(input: GetUserPreferencesRequest, options?: RpcOptions): UnaryCall<GetUserPreferencesRequest, GetUserPreferencesResponse>;
+    /**
+     * UpdateUserPreferences updates the preferences for a given user in appropriate root and leaf clusters.
+     * Only the properties that are set (cluster_preferences, unified_resource_preferences) will be updated.
+     *
+     * @generated from protobuf rpc: UpdateUserPreferences(teleport.lib.teleterm.v1.UpdateUserPreferencesRequest) returns (teleport.lib.teleterm.v1.UpdateUserPreferencesResponse);
+     */
+    updateUserPreferences(input: UpdateUserPreferencesRequest, options?: RpcOptions): UnaryCall<UpdateUserPreferencesRequest, UpdateUserPreferencesResponse>;
+}
+/**
+ * TerminalService is used by the Electron app to communicate with the tsh daemon.
+ *
+ * While we aim to preserve backwards compatibility in order to satisfy CI checks and follow the
+ * proto practices used within the company, this service is not guaranteed to be stable across
+ * versions. The packaging process of Teleport Connect ensures that the server and the client use
+ * the same version of the service.
+ *
+ * @generated from protobuf service teleport.lib.teleterm.v1.TerminalService
+ */
+export class TerminalServiceClient implements ITerminalServiceClient, ServiceInfo {
+    typeName = TerminalService.typeName;
+    methods = TerminalService.methods;
+    options = TerminalService.options;
+    constructor(private readonly _transport: RpcTransport) {
+    }
+    /**
+     * UpdateTshdEventsServerAddress lets the Electron app update the address the tsh daemon is
+     * supposed to use when connecting to the tshd events gRPC service. This RPC needs to be made
+     * before any other from this service.
+     *
+     * The service is supposed to return a response from this call only after the client is ready.
+     *
+     * @generated from protobuf rpc: UpdateTshdEventsServerAddress(teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressRequest) returns (teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressResponse);
+     */
+    updateTshdEventsServerAddress(input: UpdateTshdEventsServerAddressRequest, options?: RpcOptions): UnaryCall<UpdateTshdEventsServerAddressRequest, UpdateTshdEventsServerAddressResponse> {
+        const method = this.methods[0], opt = this._transport.mergeOptions(options);
+        return stackIntercept<UpdateTshdEventsServerAddressRequest, UpdateTshdEventsServerAddressResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * ListRootClusters lists root clusters
+     * Does not include detailed cluster information that would require a network request.
+     *
+     * @generated from protobuf rpc: ListRootClusters(teleport.lib.teleterm.v1.ListClustersRequest) returns (teleport.lib.teleterm.v1.ListClustersResponse);
+     */
+    listRootClusters(input: ListClustersRequest, options?: RpcOptions): UnaryCall<ListClustersRequest, ListClustersResponse> {
+        const method = this.methods[1], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ListClustersRequest, ListClustersResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * ListLeafClusters lists leaf clusters
+     * Does not include detailed cluster information that would require a network request.
+     *
+     * @generated from protobuf rpc: ListLeafClusters(teleport.lib.teleterm.v1.ListLeafClustersRequest) returns (teleport.lib.teleterm.v1.ListClustersResponse);
+     */
+    listLeafClusters(input: ListLeafClustersRequest, options?: RpcOptions): UnaryCall<ListLeafClustersRequest, ListClustersResponse> {
+        const method = this.methods[2], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ListLeafClustersRequest, ListClustersResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * GetDatabases returns a filtered and paginated list of databases
+     *
+     * @generated from protobuf rpc: GetDatabases(teleport.lib.teleterm.v1.GetDatabasesRequest) returns (teleport.lib.teleterm.v1.GetDatabasesResponse);
+     */
+    getDatabases(input: GetDatabasesRequest, options?: RpcOptions): UnaryCall<GetDatabasesRequest, GetDatabasesResponse> {
+        const method = this.methods[3], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetDatabasesRequest, GetDatabasesResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * ListDatabaseUsers lists allowed users for the given database based on the role set.
+     *
+     * @generated from protobuf rpc: ListDatabaseUsers(teleport.lib.teleterm.v1.ListDatabaseUsersRequest) returns (teleport.lib.teleterm.v1.ListDatabaseUsersResponse);
+     */
+    listDatabaseUsers(input: ListDatabaseUsersRequest, options?: RpcOptions): UnaryCall<ListDatabaseUsersRequest, ListDatabaseUsersResponse> {
+        const method = this.methods[4], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ListDatabaseUsersRequest, ListDatabaseUsersResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * GetServers returns filtered, sorted, and paginated servers
+     *
+     * @generated from protobuf rpc: GetServers(teleport.lib.teleterm.v1.GetServersRequest) returns (teleport.lib.teleterm.v1.GetServersResponse);
+     */
+    getServers(input: GetServersRequest, options?: RpcOptions): UnaryCall<GetServersRequest, GetServersResponse> {
+        const method = this.methods[5], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetServersRequest, GetServersResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * GetAccessRequests lists filtered AccessRequests
+     *
+     * @generated from protobuf rpc: GetAccessRequests(teleport.lib.teleterm.v1.GetAccessRequestsRequest) returns (teleport.lib.teleterm.v1.GetAccessRequestsResponse);
+     */
+    getAccessRequests(input: GetAccessRequestsRequest, options?: RpcOptions): UnaryCall<GetAccessRequestsRequest, GetAccessRequestsResponse> {
+        const method = this.methods[6], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetAccessRequestsRequest, GetAccessRequestsResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * GetAccessRequest retreives a single Access Request
+     *
+     * @generated from protobuf rpc: GetAccessRequest(teleport.lib.teleterm.v1.GetAccessRequestRequest) returns (teleport.lib.teleterm.v1.GetAccessRequestResponse);
+     */
+    getAccessRequest(input: GetAccessRequestRequest, options?: RpcOptions): UnaryCall<GetAccessRequestRequest, GetAccessRequestResponse> {
+        const method = this.methods[7], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetAccessRequestRequest, GetAccessRequestResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * DeleteAccessRequest deletes the access request by id
+     *
+     * @generated from protobuf rpc: DeleteAccessRequest(teleport.lib.teleterm.v1.DeleteAccessRequestRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
+     */
+    deleteAccessRequest(input: DeleteAccessRequestRequest, options?: RpcOptions): UnaryCall<DeleteAccessRequestRequest, EmptyResponse> {
+        const method = this.methods[8], opt = this._transport.mergeOptions(options);
+        return stackIntercept<DeleteAccessRequestRequest, EmptyResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * CreateAccessRequest creates an access request
+     *
+     * @generated from protobuf rpc: CreateAccessRequest(teleport.lib.teleterm.v1.CreateAccessRequestRequest) returns (teleport.lib.teleterm.v1.CreateAccessRequestResponse);
+     */
+    createAccessRequest(input: CreateAccessRequestRequest, options?: RpcOptions): UnaryCall<CreateAccessRequestRequest, CreateAccessRequestResponse> {
+        const method = this.methods[9], opt = this._transport.mergeOptions(options);
+        return stackIntercept<CreateAccessRequestRequest, CreateAccessRequestResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * ReviewAccessRequest submits a review for an Access Request
+     *
+     * @generated from protobuf rpc: ReviewAccessRequest(teleport.lib.teleterm.v1.ReviewAccessRequestRequest) returns (teleport.lib.teleterm.v1.ReviewAccessRequestResponse);
+     */
+    reviewAccessRequest(input: ReviewAccessRequestRequest, options?: RpcOptions): UnaryCall<ReviewAccessRequestRequest, ReviewAccessRequestResponse> {
+        const method = this.methods[10], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ReviewAccessRequestRequest, ReviewAccessRequestResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * GetRequestableRoles gets all requestable roles
+     *
+     * @generated from protobuf rpc: GetRequestableRoles(teleport.lib.teleterm.v1.GetRequestableRolesRequest) returns (teleport.lib.teleterm.v1.GetRequestableRolesResponse);
+     */
+    getRequestableRoles(input: GetRequestableRolesRequest, options?: RpcOptions): UnaryCall<GetRequestableRolesRequest, GetRequestableRolesResponse> {
+        const method = this.methods[11], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetRequestableRolesRequest, GetRequestableRolesResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * AssumeRole assumes the role of the given access request
+     *
+     * @generated from protobuf rpc: AssumeRole(teleport.lib.teleterm.v1.AssumeRoleRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
+     */
+    assumeRole(input: AssumeRoleRequest, options?: RpcOptions): UnaryCall<AssumeRoleRequest, EmptyResponse> {
+        const method = this.methods[12], opt = this._transport.mergeOptions(options);
+        return stackIntercept<AssumeRoleRequest, EmptyResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * PromoteAccessRequest promotes an access request to an access list.
+     *
+     * @generated from protobuf rpc: PromoteAccessRequest(teleport.lib.teleterm.v1.PromoteAccessRequestRequest) returns (teleport.lib.teleterm.v1.PromoteAccessRequestResponse);
+     */
+    promoteAccessRequest(input: PromoteAccessRequestRequest, options?: RpcOptions): UnaryCall<PromoteAccessRequestRequest, PromoteAccessRequestResponse> {
+        const method = this.methods[13], opt = this._transport.mergeOptions(options);
+        return stackIntercept<PromoteAccessRequestRequest, PromoteAccessRequestResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * GetSuggestedAccessLists returns suggested access lists for an access request.
+     *
+     * @generated from protobuf rpc: GetSuggestedAccessLists(teleport.lib.teleterm.v1.GetSuggestedAccessListsRequest) returns (teleport.lib.teleterm.v1.GetSuggestedAccessListsResponse);
+     */
+    getSuggestedAccessLists(input: GetSuggestedAccessListsRequest, options?: RpcOptions): UnaryCall<GetSuggestedAccessListsRequest, GetSuggestedAccessListsResponse> {
+        const method = this.methods[14], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetSuggestedAccessListsRequest, GetSuggestedAccessListsResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * GetKubes returns filtered, sorted, and paginated kubes
+     *
+     * @generated from protobuf rpc: GetKubes(teleport.lib.teleterm.v1.GetKubesRequest) returns (teleport.lib.teleterm.v1.GetKubesResponse);
+     */
+    getKubes(input: GetKubesRequest, options?: RpcOptions): UnaryCall<GetKubesRequest, GetKubesResponse> {
+        const method = this.methods[15], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetKubesRequest, GetKubesResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * GetApps returns a filtered and paginated list of apps.
+     *
+     * @generated from protobuf rpc: GetApps(teleport.lib.teleterm.v1.GetAppsRequest) returns (teleport.lib.teleterm.v1.GetAppsResponse);
+     */
+    getApps(input: GetAppsRequest, options?: RpcOptions): UnaryCall<GetAppsRequest, GetAppsResponse> {
+        const method = this.methods[16], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetAppsRequest, GetAppsResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * AddCluster adds a cluster to profile
+     *
+     * @generated from protobuf rpc: AddCluster(teleport.lib.teleterm.v1.AddClusterRequest) returns (teleport.lib.teleterm.v1.Cluster);
+     */
+    addCluster(input: AddClusterRequest, options?: RpcOptions): UnaryCall<AddClusterRequest, Cluster> {
+        const method = this.methods[17], opt = this._transport.mergeOptions(options);
+        return stackIntercept<AddClusterRequest, Cluster>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * RemoveCluster removes a cluster from profile
+     *
+     * @generated from protobuf rpc: RemoveCluster(teleport.lib.teleterm.v1.RemoveClusterRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
+     */
+    removeCluster(input: RemoveClusterRequest, options?: RpcOptions): UnaryCall<RemoveClusterRequest, EmptyResponse> {
+        const method = this.methods[18], opt = this._transport.mergeOptions(options);
+        return stackIntercept<RemoveClusterRequest, EmptyResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * ListGateways lists gateways
+     *
+     * @generated from protobuf rpc: ListGateways(teleport.lib.teleterm.v1.ListGatewaysRequest) returns (teleport.lib.teleterm.v1.ListGatewaysResponse);
+     */
+    listGateways(input: ListGatewaysRequest, options?: RpcOptions): UnaryCall<ListGatewaysRequest, ListGatewaysResponse> {
+        const method = this.methods[19], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ListGatewaysRequest, ListGatewaysResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * CreateGateway creates a gateway
+     *
+     * @generated from protobuf rpc: CreateGateway(teleport.lib.teleterm.v1.CreateGatewayRequest) returns (teleport.lib.teleterm.v1.Gateway);
+     */
+    createGateway(input: CreateGatewayRequest, options?: RpcOptions): UnaryCall<CreateGatewayRequest, Gateway> {
+        const method = this.methods[20], opt = this._transport.mergeOptions(options);
+        return stackIntercept<CreateGatewayRequest, Gateway>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * RemoveGateway removes a gateway
+     *
+     * @generated from protobuf rpc: RemoveGateway(teleport.lib.teleterm.v1.RemoveGatewayRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
+     */
+    removeGateway(input: RemoveGatewayRequest, options?: RpcOptions): UnaryCall<RemoveGatewayRequest, EmptyResponse> {
+        const method = this.methods[21], opt = this._transport.mergeOptions(options);
+        return stackIntercept<RemoveGatewayRequest, EmptyResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * SetGatewayTargetSubresourceName changes the TargetSubresourceName field of gateway.Gateway
+     * and returns the updated version of gateway.Gateway.
+     *
+     * In Connect this is used to update the db name of a db connection along with the CLI command.
+     *
+     * @generated from protobuf rpc: SetGatewayTargetSubresourceName(teleport.lib.teleterm.v1.SetGatewayTargetSubresourceNameRequest) returns (teleport.lib.teleterm.v1.Gateway);
+     */
+    setGatewayTargetSubresourceName(input: SetGatewayTargetSubresourceNameRequest, options?: RpcOptions): UnaryCall<SetGatewayTargetSubresourceNameRequest, Gateway> {
+        const method = this.methods[22], opt = this._transport.mergeOptions(options);
+        return stackIntercept<SetGatewayTargetSubresourceNameRequest, Gateway>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * SetGatewayLocalPort starts a new gateway on the new port, stops the old gateway and then
+     * assigns the URI of the old gateway to the new one. It does so without fetching a new db cert.
+     *
+     * @generated from protobuf rpc: SetGatewayLocalPort(teleport.lib.teleterm.v1.SetGatewayLocalPortRequest) returns (teleport.lib.teleterm.v1.Gateway);
+     */
+    setGatewayLocalPort(input: SetGatewayLocalPortRequest, options?: RpcOptions): UnaryCall<SetGatewayLocalPortRequest, Gateway> {
+        const method = this.methods[23], opt = this._transport.mergeOptions(options);
+        return stackIntercept<SetGatewayLocalPortRequest, Gateway>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * GetAuthSettings returns cluster auth settigns
+     *
+     * @generated from protobuf rpc: GetAuthSettings(teleport.lib.teleterm.v1.GetAuthSettingsRequest) returns (teleport.lib.teleterm.v1.AuthSettings);
+     */
+    getAuthSettings(input: GetAuthSettingsRequest, options?: RpcOptions): UnaryCall<GetAuthSettingsRequest, AuthSettings> {
+        const method = this.methods[24], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetAuthSettingsRequest, AuthSettings>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * GetCluster returns cluster. Makes a network request and includes detailed
+     * information about enterprise features availabed on the connected auth server
+     *
+     * @generated from protobuf rpc: GetCluster(teleport.lib.teleterm.v1.GetClusterRequest) returns (teleport.lib.teleterm.v1.Cluster);
+     */
+    getCluster(input: GetClusterRequest, options?: RpcOptions): UnaryCall<GetClusterRequest, Cluster> {
+        const method = this.methods[25], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetClusterRequest, Cluster>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * Login logs in a user to a cluster
+     *
+     * @generated from protobuf rpc: Login(teleport.lib.teleterm.v1.LoginRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
+     */
+    login(input: LoginRequest, options?: RpcOptions): UnaryCall<LoginRequest, EmptyResponse> {
+        const method = this.methods[26], opt = this._transport.mergeOptions(options);
+        return stackIntercept<LoginRequest, EmptyResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * LoginPasswordless logs in a user to a cluster passwordlessly.
+     *
+     * The RPC is streaming both ways and the message sequence example for hardware keys are:
+     * (-> means client-to-server, <- means server-to-client)
+     *
+     * Hardware keys:
+     * -> Init
+     * <- Send PasswordlessPrompt enum TAP to choose a device
+     * -> Receive TAP device response
+     * <- Send PasswordlessPrompt enum PIN
+     * -> Receive PIN response
+     * <- Send PasswordlessPrompt enum RETAP to confirm
+     * -> Receive RETAP device response
+     * <- Send list of credentials (e.g. usernames) associated with device
+     * -> Receive the index number associated with the selected credential in list
+     * <- End
+     *
+     * @generated from protobuf rpc: LoginPasswordless(stream teleport.lib.teleterm.v1.LoginPasswordlessRequest) returns (stream teleport.lib.teleterm.v1.LoginPasswordlessResponse);
+     */
+    loginPasswordless(options?: RpcOptions): DuplexStreamingCall<LoginPasswordlessRequest, LoginPasswordlessResponse> {
+        const method = this.methods[27], opt = this._transport.mergeOptions(options);
+        return stackIntercept<LoginPasswordlessRequest, LoginPasswordlessResponse>("duplex", this._transport, method, opt);
+    }
+    /**
+     * ClusterLogin logs out a user from cluster
+     *
+     * @generated from protobuf rpc: Logout(teleport.lib.teleterm.v1.LogoutRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
+     */
+    logout(input: LogoutRequest, options?: RpcOptions): UnaryCall<LogoutRequest, EmptyResponse> {
+        const method = this.methods[28], opt = this._transport.mergeOptions(options);
+        return stackIntercept<LogoutRequest, EmptyResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * TransferFile sends a request to download/upload a file
+     *
+     * @generated from protobuf rpc: TransferFile(teleport.lib.teleterm.v1.FileTransferRequest) returns (stream teleport.lib.teleterm.v1.FileTransferProgress);
+     */
+    transferFile(input: FileTransferRequest, options?: RpcOptions): ServerStreamingCall<FileTransferRequest, FileTransferProgress> {
+        const method = this.methods[29], opt = this._transport.mergeOptions(options);
+        return stackIntercept<FileTransferRequest, FileTransferProgress>("serverStreaming", this._transport, method, opt, input);
+    }
+    /**
+     * ReportUsageEvent allows to send usage events that are then anonymized and forwarded to prehog
+     *
+     * @generated from protobuf rpc: ReportUsageEvent(teleport.lib.teleterm.v1.ReportUsageEventRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
+     */
+    reportUsageEvent(input: ReportUsageEventRequest, options?: RpcOptions): UnaryCall<ReportUsageEventRequest, EmptyResponse> {
+        const method = this.methods[30], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ReportUsageEventRequest, EmptyResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * UpdateHeadlessAuthenticationState updates a headless authentication resource's state.
+     * An MFA challenge will be prompted when approving a headless authentication.
+     *
+     * @generated from protobuf rpc: UpdateHeadlessAuthenticationState(teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateRequest) returns (teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateResponse);
+     */
+    updateHeadlessAuthenticationState(input: UpdateHeadlessAuthenticationStateRequest, options?: RpcOptions): UnaryCall<UpdateHeadlessAuthenticationStateRequest, UpdateHeadlessAuthenticationStateResponse> {
+        const method = this.methods[31], opt = this._transport.mergeOptions(options);
+        return stackIntercept<UpdateHeadlessAuthenticationStateRequest, UpdateHeadlessAuthenticationStateResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * CreateConnectMyComputerRole creates a role which allows access to nodes with the label
+     * teleport.dev/connect-my-computer/owner: <cluster user> and allows logging in to those nodes as
+     * the current system user.
+     *
+     * @generated from protobuf rpc: CreateConnectMyComputerRole(teleport.lib.teleterm.v1.CreateConnectMyComputerRoleRequest) returns (teleport.lib.teleterm.v1.CreateConnectMyComputerRoleResponse);
+     */
+    createConnectMyComputerRole(input: CreateConnectMyComputerRoleRequest, options?: RpcOptions): UnaryCall<CreateConnectMyComputerRoleRequest, CreateConnectMyComputerRoleResponse> {
+        const method = this.methods[32], opt = this._transport.mergeOptions(options);
+        return stackIntercept<CreateConnectMyComputerRoleRequest, CreateConnectMyComputerRoleResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * CreateConnectMyComputerNodeToken creates a node join token that is valid for 5 minutes
+     *
+     * @generated from protobuf rpc: CreateConnectMyComputerNodeToken(teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenRequest) returns (teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenResponse);
+     */
+    createConnectMyComputerNodeToken(input: CreateConnectMyComputerNodeTokenRequest, options?: RpcOptions): UnaryCall<CreateConnectMyComputerNodeTokenRequest, CreateConnectMyComputerNodeTokenResponse> {
+        const method = this.methods[33], opt = this._transport.mergeOptions(options);
+        return stackIntercept<CreateConnectMyComputerNodeTokenRequest, CreateConnectMyComputerNodeTokenResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * WaitForConnectMyComputerNodeJoin sets up a watcher and returns a response only after detecting
+     * that the Connect My Computer node for the particular cluster has joined the cluster (the
+     * OpPut event).
+     *
+     * This RPC times out by itself after a minute to prevent the request from hanging forever, in
+     * case the client didn't set a deadline or doesn't abort the request.
+     *
+     * @generated from protobuf rpc: WaitForConnectMyComputerNodeJoin(teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinRequest) returns (teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinResponse);
+     */
+    waitForConnectMyComputerNodeJoin(input: WaitForConnectMyComputerNodeJoinRequest, options?: RpcOptions): UnaryCall<WaitForConnectMyComputerNodeJoinRequest, WaitForConnectMyComputerNodeJoinResponse> {
+        const method = this.methods[34], opt = this._transport.mergeOptions(options);
+        return stackIntercept<WaitForConnectMyComputerNodeJoinRequest, WaitForConnectMyComputerNodeJoinResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * DeleteConnectMyComputerNode deletes the Connect My Computer node.
+     *
+     * @generated from protobuf rpc: DeleteConnectMyComputerNode(teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeRequest) returns (teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeResponse);
+     */
+    deleteConnectMyComputerNode(input: DeleteConnectMyComputerNodeRequest, options?: RpcOptions): UnaryCall<DeleteConnectMyComputerNodeRequest, DeleteConnectMyComputerNodeResponse> {
+        const method = this.methods[35], opt = this._transport.mergeOptions(options);
+        return stackIntercept<DeleteConnectMyComputerNodeRequest, DeleteConnectMyComputerNodeResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * GetConnectMyComputerNodeName reads the Connect My Computer node name (UUID) from a disk.
+     *
+     * @generated from protobuf rpc: GetConnectMyComputerNodeName(teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameRequest) returns (teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameResponse);
+     */
+    getConnectMyComputerNodeName(input: GetConnectMyComputerNodeNameRequest, options?: RpcOptions): UnaryCall<GetConnectMyComputerNodeNameRequest, GetConnectMyComputerNodeNameResponse> {
+        const method = this.methods[36], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetConnectMyComputerNodeNameRequest, GetConnectMyComputerNodeNameResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * ListUnifiedResources retrieves a paginated list of all resource types displayable in the UI.
+     *
+     * @generated from protobuf rpc: ListUnifiedResources(teleport.lib.teleterm.v1.ListUnifiedResourcesRequest) returns (teleport.lib.teleterm.v1.ListUnifiedResourcesResponse);
+     */
+    listUnifiedResources(input: ListUnifiedResourcesRequest, options?: RpcOptions): UnaryCall<ListUnifiedResourcesRequest, ListUnifiedResourcesResponse> {
+        const method = this.methods[37], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ListUnifiedResourcesRequest, ListUnifiedResourcesResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * GetUserPreferences returns the combined (root + leaf cluster) preferences for a given user.
+     *
+     * @generated from protobuf rpc: GetUserPreferences(teleport.lib.teleterm.v1.GetUserPreferencesRequest) returns (teleport.lib.teleterm.v1.GetUserPreferencesResponse);
+     */
+    getUserPreferences(input: GetUserPreferencesRequest, options?: RpcOptions): UnaryCall<GetUserPreferencesRequest, GetUserPreferencesResponse> {
+        const method = this.methods[38], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetUserPreferencesRequest, GetUserPreferencesResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * UpdateUserPreferences updates the preferences for a given user in appropriate root and leaf clusters.
+     * Only the properties that are set (cluster_preferences, unified_resource_preferences) will be updated.
+     *
+     * @generated from protobuf rpc: UpdateUserPreferences(teleport.lib.teleterm.v1.UpdateUserPreferencesRequest) returns (teleport.lib.teleterm.v1.UpdateUserPreferencesResponse);
+     */
+    updateUserPreferences(input: UpdateUserPreferencesRequest, options?: RpcOptions): UnaryCall<UpdateUserPreferencesRequest, UpdateUserPreferencesResponse> {
+        const method = this.methods[39], opt = this._transport.mergeOptions(options);
+        return stackIntercept<UpdateUserPreferencesRequest, UpdateUserPreferencesResponse>("unary", this._transport, method, opt, input);
+    }
+}
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.grpc-client.ts b/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.grpc-client.ts
deleted file mode 100644
index 37759463d075f..0000000000000
--- a/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.grpc-client.ts
+++ /dev/null
@@ -1,912 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/lib/teleterm/v1/service.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-//
-// Teleport
-// Copyright (C) 2023  Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-//
-import { TerminalService } from "./service_pb";
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { UpdateUserPreferencesResponse } from "./service_pb";
-import type { UpdateUserPreferencesRequest } from "./service_pb";
-import type { GetUserPreferencesResponse } from "./service_pb";
-import type { GetUserPreferencesRequest } from "./service_pb";
-import type { ListUnifiedResourcesResponse } from "./service_pb";
-import type { ListUnifiedResourcesRequest } from "./service_pb";
-import type { GetConnectMyComputerNodeNameResponse } from "./service_pb";
-import type { GetConnectMyComputerNodeNameRequest } from "./service_pb";
-import type { DeleteConnectMyComputerNodeResponse } from "./service_pb";
-import type { DeleteConnectMyComputerNodeRequest } from "./service_pb";
-import type { WaitForConnectMyComputerNodeJoinResponse } from "./service_pb";
-import type { WaitForConnectMyComputerNodeJoinRequest } from "./service_pb";
-import type { CreateConnectMyComputerNodeTokenResponse } from "./service_pb";
-import type { CreateConnectMyComputerNodeTokenRequest } from "./service_pb";
-import type { CreateConnectMyComputerRoleResponse } from "./service_pb";
-import type { CreateConnectMyComputerRoleRequest } from "./service_pb";
-import type { UpdateHeadlessAuthenticationStateResponse } from "./service_pb";
-import type { UpdateHeadlessAuthenticationStateRequest } from "./service_pb";
-import type { ReportUsageEventRequest } from "./usage_events_pb";
-import type { FileTransferProgress } from "./service_pb";
-import type { FileTransferRequest } from "./service_pb";
-import type { LogoutRequest } from "./service_pb";
-import type { LoginPasswordlessResponse } from "./service_pb";
-import type { LoginPasswordlessRequest } from "./service_pb";
-import type { LoginRequest } from "./service_pb";
-import type { GetClusterRequest } from "./service_pb";
-import type { AuthSettings } from "./auth_settings_pb";
-import type { GetAuthSettingsRequest } from "./service_pb";
-import type { SetGatewayLocalPortRequest } from "./service_pb";
-import type { SetGatewayTargetSubresourceNameRequest } from "./service_pb";
-import type { RemoveGatewayRequest } from "./service_pb";
-import type { Gateway } from "./gateway_pb";
-import type { CreateGatewayRequest } from "./service_pb";
-import type { ListGatewaysResponse } from "./service_pb";
-import type { ListGatewaysRequest } from "./service_pb";
-import type { RemoveClusterRequest } from "./service_pb";
-import type { Cluster } from "./cluster_pb";
-import type { AddClusterRequest } from "./service_pb";
-import type { GetAppsResponse } from "./service_pb";
-import type { GetAppsRequest } from "./service_pb";
-import type { GetKubesResponse } from "./service_pb";
-import type { GetKubesRequest } from "./service_pb";
-import type { GetSuggestedAccessListsResponse } from "./service_pb";
-import type { GetSuggestedAccessListsRequest } from "./service_pb";
-import type { PromoteAccessRequestResponse } from "./service_pb";
-import type { PromoteAccessRequestRequest } from "./service_pb";
-import type { AssumeRoleRequest } from "./service_pb";
-import type { GetRequestableRolesResponse } from "./service_pb";
-import type { GetRequestableRolesRequest } from "./service_pb";
-import type { ReviewAccessRequestResponse } from "./service_pb";
-import type { ReviewAccessRequestRequest } from "./service_pb";
-import type { CreateAccessRequestResponse } from "./service_pb";
-import type { CreateAccessRequestRequest } from "./service_pb";
-import type { EmptyResponse } from "./service_pb";
-import type { DeleteAccessRequestRequest } from "./service_pb";
-import type { GetAccessRequestResponse } from "./service_pb";
-import type { GetAccessRequestRequest } from "./service_pb";
-import type { GetAccessRequestsResponse } from "./service_pb";
-import type { GetAccessRequestsRequest } from "./service_pb";
-import type { GetServersResponse } from "./service_pb";
-import type { GetServersRequest } from "./service_pb";
-import type { ListDatabaseUsersResponse } from "./service_pb";
-import type { ListDatabaseUsersRequest } from "./service_pb";
-import type { GetDatabasesResponse } from "./service_pb";
-import type { GetDatabasesRequest } from "./service_pb";
-import type { ListLeafClustersRequest } from "./service_pb";
-import type { ListClustersResponse } from "./service_pb";
-import type { ListClustersRequest } from "./service_pb";
-import type { UpdateTshdEventsServerAddressResponse } from "./service_pb";
-import type { UpdateTshdEventsServerAddressRequest } from "./service_pb";
-import * as grpc from "@grpc/grpc-js";
-/**
- * TerminalService is used by the Electron app to communicate with the tsh daemon.
- *
- * While we aim to preserve backwards compatibility in order to satisfy CI checks and follow the
- * proto practices used within the company, this service is not guaranteed to be stable across
- * versions. The packaging process of Teleport Connect ensures that the server and the client use
- * the same version of the service.
- *
- * @generated from protobuf service teleport.lib.teleterm.v1.TerminalService
- */
-export interface ITerminalServiceClient {
-    /**
-     * UpdateTshdEventsServerAddress lets the Electron app update the address the tsh daemon is
-     * supposed to use when connecting to the tshd events gRPC service. This RPC needs to be made
-     * before any other from this service.
-     *
-     * The service is supposed to return a response from this call only after the client is ready.
-     *
-     * @generated from protobuf rpc: UpdateTshdEventsServerAddress(teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressRequest) returns (teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressResponse);
-     */
-    updateTshdEventsServerAddress(input: UpdateTshdEventsServerAddressRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: UpdateTshdEventsServerAddressResponse) => void): grpc.ClientUnaryCall;
-    updateTshdEventsServerAddress(input: UpdateTshdEventsServerAddressRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: UpdateTshdEventsServerAddressResponse) => void): grpc.ClientUnaryCall;
-    updateTshdEventsServerAddress(input: UpdateTshdEventsServerAddressRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: UpdateTshdEventsServerAddressResponse) => void): grpc.ClientUnaryCall;
-    updateTshdEventsServerAddress(input: UpdateTshdEventsServerAddressRequest, callback: (err: grpc.ServiceError | null, value?: UpdateTshdEventsServerAddressResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * ListRootClusters lists root clusters
-     * Does not include detailed cluster information that would require a network request.
-     *
-     * @generated from protobuf rpc: ListRootClusters(teleport.lib.teleterm.v1.ListClustersRequest) returns (teleport.lib.teleterm.v1.ListClustersResponse);
-     */
-    listRootClusters(input: ListClustersRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListClustersResponse) => void): grpc.ClientUnaryCall;
-    listRootClusters(input: ListClustersRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: ListClustersResponse) => void): grpc.ClientUnaryCall;
-    listRootClusters(input: ListClustersRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListClustersResponse) => void): grpc.ClientUnaryCall;
-    listRootClusters(input: ListClustersRequest, callback: (err: grpc.ServiceError | null, value?: ListClustersResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * ListLeafClusters lists leaf clusters
-     * Does not include detailed cluster information that would require a network request.
-     *
-     * @generated from protobuf rpc: ListLeafClusters(teleport.lib.teleterm.v1.ListLeafClustersRequest) returns (teleport.lib.teleterm.v1.ListClustersResponse);
-     */
-    listLeafClusters(input: ListLeafClustersRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListClustersResponse) => void): grpc.ClientUnaryCall;
-    listLeafClusters(input: ListLeafClustersRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: ListClustersResponse) => void): grpc.ClientUnaryCall;
-    listLeafClusters(input: ListLeafClustersRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListClustersResponse) => void): grpc.ClientUnaryCall;
-    listLeafClusters(input: ListLeafClustersRequest, callback: (err: grpc.ServiceError | null, value?: ListClustersResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * GetDatabases returns a filtered and paginated list of databases
-     *
-     * @generated from protobuf rpc: GetDatabases(teleport.lib.teleterm.v1.GetDatabasesRequest) returns (teleport.lib.teleterm.v1.GetDatabasesResponse);
-     */
-    getDatabases(input: GetDatabasesRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetDatabasesResponse) => void): grpc.ClientUnaryCall;
-    getDatabases(input: GetDatabasesRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: GetDatabasesResponse) => void): grpc.ClientUnaryCall;
-    getDatabases(input: GetDatabasesRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetDatabasesResponse) => void): grpc.ClientUnaryCall;
-    getDatabases(input: GetDatabasesRequest, callback: (err: grpc.ServiceError | null, value?: GetDatabasesResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * ListDatabaseUsers lists allowed users for the given database based on the role set.
-     *
-     * @generated from protobuf rpc: ListDatabaseUsers(teleport.lib.teleterm.v1.ListDatabaseUsersRequest) returns (teleport.lib.teleterm.v1.ListDatabaseUsersResponse);
-     */
-    listDatabaseUsers(input: ListDatabaseUsersRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListDatabaseUsersResponse) => void): grpc.ClientUnaryCall;
-    listDatabaseUsers(input: ListDatabaseUsersRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: ListDatabaseUsersResponse) => void): grpc.ClientUnaryCall;
-    listDatabaseUsers(input: ListDatabaseUsersRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListDatabaseUsersResponse) => void): grpc.ClientUnaryCall;
-    listDatabaseUsers(input: ListDatabaseUsersRequest, callback: (err: grpc.ServiceError | null, value?: ListDatabaseUsersResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * GetServers returns filtered, sorted, and paginated servers
-     *
-     * @generated from protobuf rpc: GetServers(teleport.lib.teleterm.v1.GetServersRequest) returns (teleport.lib.teleterm.v1.GetServersResponse);
-     */
-    getServers(input: GetServersRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetServersResponse) => void): grpc.ClientUnaryCall;
-    getServers(input: GetServersRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: GetServersResponse) => void): grpc.ClientUnaryCall;
-    getServers(input: GetServersRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetServersResponse) => void): grpc.ClientUnaryCall;
-    getServers(input: GetServersRequest, callback: (err: grpc.ServiceError | null, value?: GetServersResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * GetAccessRequests lists filtered AccessRequests
-     *
-     * @generated from protobuf rpc: GetAccessRequests(teleport.lib.teleterm.v1.GetAccessRequestsRequest) returns (teleport.lib.teleterm.v1.GetAccessRequestsResponse);
-     */
-    getAccessRequests(input: GetAccessRequestsRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetAccessRequestsResponse) => void): grpc.ClientUnaryCall;
-    getAccessRequests(input: GetAccessRequestsRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: GetAccessRequestsResponse) => void): grpc.ClientUnaryCall;
-    getAccessRequests(input: GetAccessRequestsRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetAccessRequestsResponse) => void): grpc.ClientUnaryCall;
-    getAccessRequests(input: GetAccessRequestsRequest, callback: (err: grpc.ServiceError | null, value?: GetAccessRequestsResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * GetAccessRequest retreives a single Access Request
-     *
-     * @generated from protobuf rpc: GetAccessRequest(teleport.lib.teleterm.v1.GetAccessRequestRequest) returns (teleport.lib.teleterm.v1.GetAccessRequestResponse);
-     */
-    getAccessRequest(input: GetAccessRequestRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetAccessRequestResponse) => void): grpc.ClientUnaryCall;
-    getAccessRequest(input: GetAccessRequestRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: GetAccessRequestResponse) => void): grpc.ClientUnaryCall;
-    getAccessRequest(input: GetAccessRequestRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetAccessRequestResponse) => void): grpc.ClientUnaryCall;
-    getAccessRequest(input: GetAccessRequestRequest, callback: (err: grpc.ServiceError | null, value?: GetAccessRequestResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * DeleteAccessRequest deletes the access request by id
-     *
-     * @generated from protobuf rpc: DeleteAccessRequest(teleport.lib.teleterm.v1.DeleteAccessRequestRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
-     */
-    deleteAccessRequest(input: DeleteAccessRequestRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    deleteAccessRequest(input: DeleteAccessRequestRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    deleteAccessRequest(input: DeleteAccessRequestRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    deleteAccessRequest(input: DeleteAccessRequestRequest, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * CreateAccessRequest creates an access request
-     *
-     * @generated from protobuf rpc: CreateAccessRequest(teleport.lib.teleterm.v1.CreateAccessRequestRequest) returns (teleport.lib.teleterm.v1.CreateAccessRequestResponse);
-     */
-    createAccessRequest(input: CreateAccessRequestRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: CreateAccessRequestResponse) => void): grpc.ClientUnaryCall;
-    createAccessRequest(input: CreateAccessRequestRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: CreateAccessRequestResponse) => void): grpc.ClientUnaryCall;
-    createAccessRequest(input: CreateAccessRequestRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: CreateAccessRequestResponse) => void): grpc.ClientUnaryCall;
-    createAccessRequest(input: CreateAccessRequestRequest, callback: (err: grpc.ServiceError | null, value?: CreateAccessRequestResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * ReviewAccessRequest submits a review for an Access Request
-     *
-     * @generated from protobuf rpc: ReviewAccessRequest(teleport.lib.teleterm.v1.ReviewAccessRequestRequest) returns (teleport.lib.teleterm.v1.ReviewAccessRequestResponse);
-     */
-    reviewAccessRequest(input: ReviewAccessRequestRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ReviewAccessRequestResponse) => void): grpc.ClientUnaryCall;
-    reviewAccessRequest(input: ReviewAccessRequestRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: ReviewAccessRequestResponse) => void): grpc.ClientUnaryCall;
-    reviewAccessRequest(input: ReviewAccessRequestRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ReviewAccessRequestResponse) => void): grpc.ClientUnaryCall;
-    reviewAccessRequest(input: ReviewAccessRequestRequest, callback: (err: grpc.ServiceError | null, value?: ReviewAccessRequestResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * GetRequestableRoles gets all requestable roles
-     *
-     * @generated from protobuf rpc: GetRequestableRoles(teleport.lib.teleterm.v1.GetRequestableRolesRequest) returns (teleport.lib.teleterm.v1.GetRequestableRolesResponse);
-     */
-    getRequestableRoles(input: GetRequestableRolesRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetRequestableRolesResponse) => void): grpc.ClientUnaryCall;
-    getRequestableRoles(input: GetRequestableRolesRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: GetRequestableRolesResponse) => void): grpc.ClientUnaryCall;
-    getRequestableRoles(input: GetRequestableRolesRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetRequestableRolesResponse) => void): grpc.ClientUnaryCall;
-    getRequestableRoles(input: GetRequestableRolesRequest, callback: (err: grpc.ServiceError | null, value?: GetRequestableRolesResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * AssumeRole assumes the role of the given access request
-     *
-     * @generated from protobuf rpc: AssumeRole(teleport.lib.teleterm.v1.AssumeRoleRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
-     */
-    assumeRole(input: AssumeRoleRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    assumeRole(input: AssumeRoleRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    assumeRole(input: AssumeRoleRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    assumeRole(input: AssumeRoleRequest, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * PromoteAccessRequest promotes an access request to an access list.
-     *
-     * @generated from protobuf rpc: PromoteAccessRequest(teleport.lib.teleterm.v1.PromoteAccessRequestRequest) returns (teleport.lib.teleterm.v1.PromoteAccessRequestResponse);
-     */
-    promoteAccessRequest(input: PromoteAccessRequestRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: PromoteAccessRequestResponse) => void): grpc.ClientUnaryCall;
-    promoteAccessRequest(input: PromoteAccessRequestRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: PromoteAccessRequestResponse) => void): grpc.ClientUnaryCall;
-    promoteAccessRequest(input: PromoteAccessRequestRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: PromoteAccessRequestResponse) => void): grpc.ClientUnaryCall;
-    promoteAccessRequest(input: PromoteAccessRequestRequest, callback: (err: grpc.ServiceError | null, value?: PromoteAccessRequestResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * GetSuggestedAccessLists returns suggested access lists for an access request.
-     *
-     * @generated from protobuf rpc: GetSuggestedAccessLists(teleport.lib.teleterm.v1.GetSuggestedAccessListsRequest) returns (teleport.lib.teleterm.v1.GetSuggestedAccessListsResponse);
-     */
-    getSuggestedAccessLists(input: GetSuggestedAccessListsRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetSuggestedAccessListsResponse) => void): grpc.ClientUnaryCall;
-    getSuggestedAccessLists(input: GetSuggestedAccessListsRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: GetSuggestedAccessListsResponse) => void): grpc.ClientUnaryCall;
-    getSuggestedAccessLists(input: GetSuggestedAccessListsRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetSuggestedAccessListsResponse) => void): grpc.ClientUnaryCall;
-    getSuggestedAccessLists(input: GetSuggestedAccessListsRequest, callback: (err: grpc.ServiceError | null, value?: GetSuggestedAccessListsResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * GetKubes returns filtered, sorted, and paginated kubes
-     *
-     * @generated from protobuf rpc: GetKubes(teleport.lib.teleterm.v1.GetKubesRequest) returns (teleport.lib.teleterm.v1.GetKubesResponse);
-     */
-    getKubes(input: GetKubesRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetKubesResponse) => void): grpc.ClientUnaryCall;
-    getKubes(input: GetKubesRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: GetKubesResponse) => void): grpc.ClientUnaryCall;
-    getKubes(input: GetKubesRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetKubesResponse) => void): grpc.ClientUnaryCall;
-    getKubes(input: GetKubesRequest, callback: (err: grpc.ServiceError | null, value?: GetKubesResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * GetApps returns a filtered and paginated list of apps.
-     *
-     * @generated from protobuf rpc: GetApps(teleport.lib.teleterm.v1.GetAppsRequest) returns (teleport.lib.teleterm.v1.GetAppsResponse);
-     */
-    getApps(input: GetAppsRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetAppsResponse) => void): grpc.ClientUnaryCall;
-    getApps(input: GetAppsRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: GetAppsResponse) => void): grpc.ClientUnaryCall;
-    getApps(input: GetAppsRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetAppsResponse) => void): grpc.ClientUnaryCall;
-    getApps(input: GetAppsRequest, callback: (err: grpc.ServiceError | null, value?: GetAppsResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * AddCluster adds a cluster to profile
-     *
-     * @generated from protobuf rpc: AddCluster(teleport.lib.teleterm.v1.AddClusterRequest) returns (teleport.lib.teleterm.v1.Cluster);
-     */
-    addCluster(input: AddClusterRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Cluster) => void): grpc.ClientUnaryCall;
-    addCluster(input: AddClusterRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: Cluster) => void): grpc.ClientUnaryCall;
-    addCluster(input: AddClusterRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Cluster) => void): grpc.ClientUnaryCall;
-    addCluster(input: AddClusterRequest, callback: (err: grpc.ServiceError | null, value?: Cluster) => void): grpc.ClientUnaryCall;
-    /**
-     * RemoveCluster removes a cluster from profile
-     *
-     * @generated from protobuf rpc: RemoveCluster(teleport.lib.teleterm.v1.RemoveClusterRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
-     */
-    removeCluster(input: RemoveClusterRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    removeCluster(input: RemoveClusterRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    removeCluster(input: RemoveClusterRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    removeCluster(input: RemoveClusterRequest, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * ListGateways lists gateways
-     *
-     * @generated from protobuf rpc: ListGateways(teleport.lib.teleterm.v1.ListGatewaysRequest) returns (teleport.lib.teleterm.v1.ListGatewaysResponse);
-     */
-    listGateways(input: ListGatewaysRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListGatewaysResponse) => void): grpc.ClientUnaryCall;
-    listGateways(input: ListGatewaysRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: ListGatewaysResponse) => void): grpc.ClientUnaryCall;
-    listGateways(input: ListGatewaysRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListGatewaysResponse) => void): grpc.ClientUnaryCall;
-    listGateways(input: ListGatewaysRequest, callback: (err: grpc.ServiceError | null, value?: ListGatewaysResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * CreateGateway creates a gateway
-     *
-     * @generated from protobuf rpc: CreateGateway(teleport.lib.teleterm.v1.CreateGatewayRequest) returns (teleport.lib.teleterm.v1.Gateway);
-     */
-    createGateway(input: CreateGatewayRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Gateway) => void): grpc.ClientUnaryCall;
-    createGateway(input: CreateGatewayRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: Gateway) => void): grpc.ClientUnaryCall;
-    createGateway(input: CreateGatewayRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Gateway) => void): grpc.ClientUnaryCall;
-    createGateway(input: CreateGatewayRequest, callback: (err: grpc.ServiceError | null, value?: Gateway) => void): grpc.ClientUnaryCall;
-    /**
-     * RemoveGateway removes a gateway
-     *
-     * @generated from protobuf rpc: RemoveGateway(teleport.lib.teleterm.v1.RemoveGatewayRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
-     */
-    removeGateway(input: RemoveGatewayRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    removeGateway(input: RemoveGatewayRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    removeGateway(input: RemoveGatewayRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    removeGateway(input: RemoveGatewayRequest, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * SetGatewayTargetSubresourceName changes the TargetSubresourceName field of gateway.Gateway
-     * and returns the updated version of gateway.Gateway.
-     *
-     * In Connect this is used to update the db name of a db connection along with the CLI command.
-     *
-     * @generated from protobuf rpc: SetGatewayTargetSubresourceName(teleport.lib.teleterm.v1.SetGatewayTargetSubresourceNameRequest) returns (teleport.lib.teleterm.v1.Gateway);
-     */
-    setGatewayTargetSubresourceName(input: SetGatewayTargetSubresourceNameRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Gateway) => void): grpc.ClientUnaryCall;
-    setGatewayTargetSubresourceName(input: SetGatewayTargetSubresourceNameRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: Gateway) => void): grpc.ClientUnaryCall;
-    setGatewayTargetSubresourceName(input: SetGatewayTargetSubresourceNameRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Gateway) => void): grpc.ClientUnaryCall;
-    setGatewayTargetSubresourceName(input: SetGatewayTargetSubresourceNameRequest, callback: (err: grpc.ServiceError | null, value?: Gateway) => void): grpc.ClientUnaryCall;
-    /**
-     * SetGatewayLocalPort starts a new gateway on the new port, stops the old gateway and then
-     * assigns the URI of the old gateway to the new one. It does so without fetching a new db cert.
-     *
-     * @generated from protobuf rpc: SetGatewayLocalPort(teleport.lib.teleterm.v1.SetGatewayLocalPortRequest) returns (teleport.lib.teleterm.v1.Gateway);
-     */
-    setGatewayLocalPort(input: SetGatewayLocalPortRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Gateway) => void): grpc.ClientUnaryCall;
-    setGatewayLocalPort(input: SetGatewayLocalPortRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: Gateway) => void): grpc.ClientUnaryCall;
-    setGatewayLocalPort(input: SetGatewayLocalPortRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Gateway) => void): grpc.ClientUnaryCall;
-    setGatewayLocalPort(input: SetGatewayLocalPortRequest, callback: (err: grpc.ServiceError | null, value?: Gateway) => void): grpc.ClientUnaryCall;
-    /**
-     * GetAuthSettings returns cluster auth settigns
-     *
-     * @generated from protobuf rpc: GetAuthSettings(teleport.lib.teleterm.v1.GetAuthSettingsRequest) returns (teleport.lib.teleterm.v1.AuthSettings);
-     */
-    getAuthSettings(input: GetAuthSettingsRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: AuthSettings) => void): grpc.ClientUnaryCall;
-    getAuthSettings(input: GetAuthSettingsRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: AuthSettings) => void): grpc.ClientUnaryCall;
-    getAuthSettings(input: GetAuthSettingsRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: AuthSettings) => void): grpc.ClientUnaryCall;
-    getAuthSettings(input: GetAuthSettingsRequest, callback: (err: grpc.ServiceError | null, value?: AuthSettings) => void): grpc.ClientUnaryCall;
-    /**
-     * GetCluster returns cluster. Makes a network request and includes detailed
-     * information about enterprise features availabed on the connected auth server
-     *
-     * @generated from protobuf rpc: GetCluster(teleport.lib.teleterm.v1.GetClusterRequest) returns (teleport.lib.teleterm.v1.Cluster);
-     */
-    getCluster(input: GetClusterRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Cluster) => void): grpc.ClientUnaryCall;
-    getCluster(input: GetClusterRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: Cluster) => void): grpc.ClientUnaryCall;
-    getCluster(input: GetClusterRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Cluster) => void): grpc.ClientUnaryCall;
-    getCluster(input: GetClusterRequest, callback: (err: grpc.ServiceError | null, value?: Cluster) => void): grpc.ClientUnaryCall;
-    /**
-     * Login logs in a user to a cluster
-     *
-     * @generated from protobuf rpc: Login(teleport.lib.teleterm.v1.LoginRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
-     */
-    login(input: LoginRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    login(input: LoginRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    login(input: LoginRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    login(input: LoginRequest, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * LoginPasswordless logs in a user to a cluster passwordlessly.
-     *
-     * The RPC is streaming both ways and the message sequence example for hardware keys are:
-     * (-> means client-to-server, <- means server-to-client)
-     *
-     * Hardware keys:
-     * -> Init
-     * <- Send PasswordlessPrompt enum TAP to choose a device
-     * -> Receive TAP device response
-     * <- Send PasswordlessPrompt enum PIN
-     * -> Receive PIN response
-     * <- Send PasswordlessPrompt enum RETAP to confirm
-     * -> Receive RETAP device response
-     * <- Send list of credentials (e.g. usernames) associated with device
-     * -> Receive the index number associated with the selected credential in list
-     * <- End
-     *
-     * @generated from protobuf rpc: LoginPasswordless(stream teleport.lib.teleterm.v1.LoginPasswordlessRequest) returns (stream teleport.lib.teleterm.v1.LoginPasswordlessResponse);
-     */
-    loginPasswordless(metadata: grpc.Metadata, options?: grpc.CallOptions): grpc.ClientDuplexStream<LoginPasswordlessRequest, LoginPasswordlessResponse>;
-    loginPasswordless(options?: grpc.CallOptions): grpc.ClientDuplexStream<LoginPasswordlessRequest, LoginPasswordlessResponse>;
-    /**
-     * ClusterLogin logs out a user from cluster
-     *
-     * @generated from protobuf rpc: Logout(teleport.lib.teleterm.v1.LogoutRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
-     */
-    logout(input: LogoutRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    logout(input: LogoutRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    logout(input: LogoutRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    logout(input: LogoutRequest, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * TransferFile sends a request to download/upload a file
-     *
-     * @generated from protobuf rpc: TransferFile(teleport.lib.teleterm.v1.FileTransferRequest) returns (stream teleport.lib.teleterm.v1.FileTransferProgress);
-     */
-    transferFile(input: FileTransferRequest, metadata?: grpc.Metadata, options?: grpc.CallOptions): grpc.ClientReadableStream<FileTransferProgress>;
-    transferFile(input: FileTransferRequest, options?: grpc.CallOptions): grpc.ClientReadableStream<FileTransferProgress>;
-    /**
-     * ReportUsageEvent allows to send usage events that are then anonymized and forwarded to prehog
-     *
-     * @generated from protobuf rpc: ReportUsageEvent(teleport.lib.teleterm.v1.ReportUsageEventRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
-     */
-    reportUsageEvent(input: ReportUsageEventRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    reportUsageEvent(input: ReportUsageEventRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    reportUsageEvent(input: ReportUsageEventRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    reportUsageEvent(input: ReportUsageEventRequest, callback: (err: grpc.ServiceError | null, value?: EmptyResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * UpdateHeadlessAuthenticationState updates a headless authentication resource's state.
-     * An MFA challenge will be prompted when approving a headless authentication.
-     *
-     * @generated from protobuf rpc: UpdateHeadlessAuthenticationState(teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateRequest) returns (teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateResponse);
-     */
-    updateHeadlessAuthenticationState(input: UpdateHeadlessAuthenticationStateRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: UpdateHeadlessAuthenticationStateResponse) => void): grpc.ClientUnaryCall;
-    updateHeadlessAuthenticationState(input: UpdateHeadlessAuthenticationStateRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: UpdateHeadlessAuthenticationStateResponse) => void): grpc.ClientUnaryCall;
-    updateHeadlessAuthenticationState(input: UpdateHeadlessAuthenticationStateRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: UpdateHeadlessAuthenticationStateResponse) => void): grpc.ClientUnaryCall;
-    updateHeadlessAuthenticationState(input: UpdateHeadlessAuthenticationStateRequest, callback: (err: grpc.ServiceError | null, value?: UpdateHeadlessAuthenticationStateResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * CreateConnectMyComputerRole creates a role which allows access to nodes with the label
-     * teleport.dev/connect-my-computer/owner: <cluster user> and allows logging in to those nodes as
-     * the current system user.
-     *
-     * @generated from protobuf rpc: CreateConnectMyComputerRole(teleport.lib.teleterm.v1.CreateConnectMyComputerRoleRequest) returns (teleport.lib.teleterm.v1.CreateConnectMyComputerRoleResponse);
-     */
-    createConnectMyComputerRole(input: CreateConnectMyComputerRoleRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: CreateConnectMyComputerRoleResponse) => void): grpc.ClientUnaryCall;
-    createConnectMyComputerRole(input: CreateConnectMyComputerRoleRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: CreateConnectMyComputerRoleResponse) => void): grpc.ClientUnaryCall;
-    createConnectMyComputerRole(input: CreateConnectMyComputerRoleRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: CreateConnectMyComputerRoleResponse) => void): grpc.ClientUnaryCall;
-    createConnectMyComputerRole(input: CreateConnectMyComputerRoleRequest, callback: (err: grpc.ServiceError | null, value?: CreateConnectMyComputerRoleResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * CreateConnectMyComputerNodeToken creates a node join token that is valid for 5 minutes
-     *
-     * @generated from protobuf rpc: CreateConnectMyComputerNodeToken(teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenRequest) returns (teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenResponse);
-     */
-    createConnectMyComputerNodeToken(input: CreateConnectMyComputerNodeTokenRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: CreateConnectMyComputerNodeTokenResponse) => void): grpc.ClientUnaryCall;
-    createConnectMyComputerNodeToken(input: CreateConnectMyComputerNodeTokenRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: CreateConnectMyComputerNodeTokenResponse) => void): grpc.ClientUnaryCall;
-    createConnectMyComputerNodeToken(input: CreateConnectMyComputerNodeTokenRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: CreateConnectMyComputerNodeTokenResponse) => void): grpc.ClientUnaryCall;
-    createConnectMyComputerNodeToken(input: CreateConnectMyComputerNodeTokenRequest, callback: (err: grpc.ServiceError | null, value?: CreateConnectMyComputerNodeTokenResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * WaitForConnectMyComputerNodeJoin sets up a watcher and returns a response only after detecting
-     * that the Connect My Computer node for the particular cluster has joined the cluster (the
-     * OpPut event).
-     *
-     * This RPC times out by itself after a minute to prevent the request from hanging forever, in
-     * case the client didn't set a deadline or doesn't abort the request.
-     *
-     * @generated from protobuf rpc: WaitForConnectMyComputerNodeJoin(teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinRequest) returns (teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinResponse);
-     */
-    waitForConnectMyComputerNodeJoin(input: WaitForConnectMyComputerNodeJoinRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: WaitForConnectMyComputerNodeJoinResponse) => void): grpc.ClientUnaryCall;
-    waitForConnectMyComputerNodeJoin(input: WaitForConnectMyComputerNodeJoinRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: WaitForConnectMyComputerNodeJoinResponse) => void): grpc.ClientUnaryCall;
-    waitForConnectMyComputerNodeJoin(input: WaitForConnectMyComputerNodeJoinRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: WaitForConnectMyComputerNodeJoinResponse) => void): grpc.ClientUnaryCall;
-    waitForConnectMyComputerNodeJoin(input: WaitForConnectMyComputerNodeJoinRequest, callback: (err: grpc.ServiceError | null, value?: WaitForConnectMyComputerNodeJoinResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * DeleteConnectMyComputerNode deletes the Connect My Computer node.
-     *
-     * @generated from protobuf rpc: DeleteConnectMyComputerNode(teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeRequest) returns (teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeResponse);
-     */
-    deleteConnectMyComputerNode(input: DeleteConnectMyComputerNodeRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: DeleteConnectMyComputerNodeResponse) => void): grpc.ClientUnaryCall;
-    deleteConnectMyComputerNode(input: DeleteConnectMyComputerNodeRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: DeleteConnectMyComputerNodeResponse) => void): grpc.ClientUnaryCall;
-    deleteConnectMyComputerNode(input: DeleteConnectMyComputerNodeRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: DeleteConnectMyComputerNodeResponse) => void): grpc.ClientUnaryCall;
-    deleteConnectMyComputerNode(input: DeleteConnectMyComputerNodeRequest, callback: (err: grpc.ServiceError | null, value?: DeleteConnectMyComputerNodeResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * GetConnectMyComputerNodeName reads the Connect My Computer node name (UUID) from a disk.
-     *
-     * @generated from protobuf rpc: GetConnectMyComputerNodeName(teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameRequest) returns (teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameResponse);
-     */
-    getConnectMyComputerNodeName(input: GetConnectMyComputerNodeNameRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetConnectMyComputerNodeNameResponse) => void): grpc.ClientUnaryCall;
-    getConnectMyComputerNodeName(input: GetConnectMyComputerNodeNameRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: GetConnectMyComputerNodeNameResponse) => void): grpc.ClientUnaryCall;
-    getConnectMyComputerNodeName(input: GetConnectMyComputerNodeNameRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetConnectMyComputerNodeNameResponse) => void): grpc.ClientUnaryCall;
-    getConnectMyComputerNodeName(input: GetConnectMyComputerNodeNameRequest, callback: (err: grpc.ServiceError | null, value?: GetConnectMyComputerNodeNameResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * ListUnifiedResources retrieves a paginated list of all resource types displayable in the UI.
-     *
-     * @generated from protobuf rpc: ListUnifiedResources(teleport.lib.teleterm.v1.ListUnifiedResourcesRequest) returns (teleport.lib.teleterm.v1.ListUnifiedResourcesResponse);
-     */
-    listUnifiedResources(input: ListUnifiedResourcesRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListUnifiedResourcesResponse) => void): grpc.ClientUnaryCall;
-    listUnifiedResources(input: ListUnifiedResourcesRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: ListUnifiedResourcesResponse) => void): grpc.ClientUnaryCall;
-    listUnifiedResources(input: ListUnifiedResourcesRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ListUnifiedResourcesResponse) => void): grpc.ClientUnaryCall;
-    listUnifiedResources(input: ListUnifiedResourcesRequest, callback: (err: grpc.ServiceError | null, value?: ListUnifiedResourcesResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * GetUserPreferences returns the combined (root + leaf cluster) preferences for a given user.
-     *
-     * @generated from protobuf rpc: GetUserPreferences(teleport.lib.teleterm.v1.GetUserPreferencesRequest) returns (teleport.lib.teleterm.v1.GetUserPreferencesResponse);
-     */
-    getUserPreferences(input: GetUserPreferencesRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetUserPreferencesResponse) => void): grpc.ClientUnaryCall;
-    getUserPreferences(input: GetUserPreferencesRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: GetUserPreferencesResponse) => void): grpc.ClientUnaryCall;
-    getUserPreferences(input: GetUserPreferencesRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetUserPreferencesResponse) => void): grpc.ClientUnaryCall;
-    getUserPreferences(input: GetUserPreferencesRequest, callback: (err: grpc.ServiceError | null, value?: GetUserPreferencesResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * UpdateUserPreferences updates the preferences for a given user in appropriate root and leaf clusters.
-     * Only the properties that are set (cluster_preferences, unified_resource_preferences) will be updated.
-     *
-     * @generated from protobuf rpc: UpdateUserPreferences(teleport.lib.teleterm.v1.UpdateUserPreferencesRequest) returns (teleport.lib.teleterm.v1.UpdateUserPreferencesResponse);
-     */
-    updateUserPreferences(input: UpdateUserPreferencesRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: UpdateUserPreferencesResponse) => void): grpc.ClientUnaryCall;
-    updateUserPreferences(input: UpdateUserPreferencesRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: UpdateUserPreferencesResponse) => void): grpc.ClientUnaryCall;
-    updateUserPreferences(input: UpdateUserPreferencesRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: UpdateUserPreferencesResponse) => void): grpc.ClientUnaryCall;
-    updateUserPreferences(input: UpdateUserPreferencesRequest, callback: (err: grpc.ServiceError | null, value?: UpdateUserPreferencesResponse) => void): grpc.ClientUnaryCall;
-}
-/**
- * TerminalService is used by the Electron app to communicate with the tsh daemon.
- *
- * While we aim to preserve backwards compatibility in order to satisfy CI checks and follow the
- * proto practices used within the company, this service is not guaranteed to be stable across
- * versions. The packaging process of Teleport Connect ensures that the server and the client use
- * the same version of the service.
- *
- * @generated from protobuf service teleport.lib.teleterm.v1.TerminalService
- */
-export class TerminalServiceClient extends grpc.Client implements ITerminalServiceClient {
-    private readonly _binaryOptions: Partial<BinaryReadOptions & BinaryWriteOptions>;
-    constructor(address: string, credentials: grpc.ChannelCredentials, options: grpc.ClientOptions = {}, binaryOptions: Partial<BinaryReadOptions & BinaryWriteOptions> = {}) {
-        super(address, credentials, options);
-        this._binaryOptions = binaryOptions;
-    }
-    /**
-     * UpdateTshdEventsServerAddress lets the Electron app update the address the tsh daemon is
-     * supposed to use when connecting to the tshd events gRPC service. This RPC needs to be made
-     * before any other from this service.
-     *
-     * The service is supposed to return a response from this call only after the client is ready.
-     *
-     * @generated from protobuf rpc: UpdateTshdEventsServerAddress(teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressRequest) returns (teleport.lib.teleterm.v1.UpdateTshdEventsServerAddressResponse);
-     */
-    updateTshdEventsServerAddress(input: UpdateTshdEventsServerAddressRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: UpdateTshdEventsServerAddressResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: UpdateTshdEventsServerAddressResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: UpdateTshdEventsServerAddressResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[0];
-        return this.makeUnaryRequest<UpdateTshdEventsServerAddressRequest, UpdateTshdEventsServerAddressResponse>(`/${TerminalService.typeName}/${method.name}`, (value: UpdateTshdEventsServerAddressRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): UpdateTshdEventsServerAddressResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * ListRootClusters lists root clusters
-     * Does not include detailed cluster information that would require a network request.
-     *
-     * @generated from protobuf rpc: ListRootClusters(teleport.lib.teleterm.v1.ListClustersRequest) returns (teleport.lib.teleterm.v1.ListClustersResponse);
-     */
-    listRootClusters(input: ListClustersRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListClustersResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListClustersResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: ListClustersResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[1];
-        return this.makeUnaryRequest<ListClustersRequest, ListClustersResponse>(`/${TerminalService.typeName}/${method.name}`, (value: ListClustersRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): ListClustersResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * ListLeafClusters lists leaf clusters
-     * Does not include detailed cluster information that would require a network request.
-     *
-     * @generated from protobuf rpc: ListLeafClusters(teleport.lib.teleterm.v1.ListLeafClustersRequest) returns (teleport.lib.teleterm.v1.ListClustersResponse);
-     */
-    listLeafClusters(input: ListLeafClustersRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListClustersResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListClustersResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: ListClustersResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[2];
-        return this.makeUnaryRequest<ListLeafClustersRequest, ListClustersResponse>(`/${TerminalService.typeName}/${method.name}`, (value: ListLeafClustersRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): ListClustersResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * GetDatabases returns a filtered and paginated list of databases
-     *
-     * @generated from protobuf rpc: GetDatabases(teleport.lib.teleterm.v1.GetDatabasesRequest) returns (teleport.lib.teleterm.v1.GetDatabasesResponse);
-     */
-    getDatabases(input: GetDatabasesRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetDatabasesResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetDatabasesResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: GetDatabasesResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[3];
-        return this.makeUnaryRequest<GetDatabasesRequest, GetDatabasesResponse>(`/${TerminalService.typeName}/${method.name}`, (value: GetDatabasesRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): GetDatabasesResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * ListDatabaseUsers lists allowed users for the given database based on the role set.
-     *
-     * @generated from protobuf rpc: ListDatabaseUsers(teleport.lib.teleterm.v1.ListDatabaseUsersRequest) returns (teleport.lib.teleterm.v1.ListDatabaseUsersResponse);
-     */
-    listDatabaseUsers(input: ListDatabaseUsersRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListDatabaseUsersResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListDatabaseUsersResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: ListDatabaseUsersResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[4];
-        return this.makeUnaryRequest<ListDatabaseUsersRequest, ListDatabaseUsersResponse>(`/${TerminalService.typeName}/${method.name}`, (value: ListDatabaseUsersRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): ListDatabaseUsersResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * GetServers returns filtered, sorted, and paginated servers
-     *
-     * @generated from protobuf rpc: GetServers(teleport.lib.teleterm.v1.GetServersRequest) returns (teleport.lib.teleterm.v1.GetServersResponse);
-     */
-    getServers(input: GetServersRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetServersResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetServersResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: GetServersResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[5];
-        return this.makeUnaryRequest<GetServersRequest, GetServersResponse>(`/${TerminalService.typeName}/${method.name}`, (value: GetServersRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): GetServersResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * GetAccessRequests lists filtered AccessRequests
-     *
-     * @generated from protobuf rpc: GetAccessRequests(teleport.lib.teleterm.v1.GetAccessRequestsRequest) returns (teleport.lib.teleterm.v1.GetAccessRequestsResponse);
-     */
-    getAccessRequests(input: GetAccessRequestsRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetAccessRequestsResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetAccessRequestsResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: GetAccessRequestsResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[6];
-        return this.makeUnaryRequest<GetAccessRequestsRequest, GetAccessRequestsResponse>(`/${TerminalService.typeName}/${method.name}`, (value: GetAccessRequestsRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): GetAccessRequestsResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * GetAccessRequest retreives a single Access Request
-     *
-     * @generated from protobuf rpc: GetAccessRequest(teleport.lib.teleterm.v1.GetAccessRequestRequest) returns (teleport.lib.teleterm.v1.GetAccessRequestResponse);
-     */
-    getAccessRequest(input: GetAccessRequestRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetAccessRequestResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetAccessRequestResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: GetAccessRequestResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[7];
-        return this.makeUnaryRequest<GetAccessRequestRequest, GetAccessRequestResponse>(`/${TerminalService.typeName}/${method.name}`, (value: GetAccessRequestRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): GetAccessRequestResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * DeleteAccessRequest deletes the access request by id
-     *
-     * @generated from protobuf rpc: DeleteAccessRequest(teleport.lib.teleterm.v1.DeleteAccessRequestRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
-     */
-    deleteAccessRequest(input: DeleteAccessRequestRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: EmptyResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: EmptyResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: EmptyResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[8];
-        return this.makeUnaryRequest<DeleteAccessRequestRequest, EmptyResponse>(`/${TerminalService.typeName}/${method.name}`, (value: DeleteAccessRequestRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): EmptyResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * CreateAccessRequest creates an access request
-     *
-     * @generated from protobuf rpc: CreateAccessRequest(teleport.lib.teleterm.v1.CreateAccessRequestRequest) returns (teleport.lib.teleterm.v1.CreateAccessRequestResponse);
-     */
-    createAccessRequest(input: CreateAccessRequestRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: CreateAccessRequestResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: CreateAccessRequestResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: CreateAccessRequestResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[9];
-        return this.makeUnaryRequest<CreateAccessRequestRequest, CreateAccessRequestResponse>(`/${TerminalService.typeName}/${method.name}`, (value: CreateAccessRequestRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): CreateAccessRequestResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * ReviewAccessRequest submits a review for an Access Request
-     *
-     * @generated from protobuf rpc: ReviewAccessRequest(teleport.lib.teleterm.v1.ReviewAccessRequestRequest) returns (teleport.lib.teleterm.v1.ReviewAccessRequestResponse);
-     */
-    reviewAccessRequest(input: ReviewAccessRequestRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ReviewAccessRequestResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ReviewAccessRequestResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: ReviewAccessRequestResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[10];
-        return this.makeUnaryRequest<ReviewAccessRequestRequest, ReviewAccessRequestResponse>(`/${TerminalService.typeName}/${method.name}`, (value: ReviewAccessRequestRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): ReviewAccessRequestResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * GetRequestableRoles gets all requestable roles
-     *
-     * @generated from protobuf rpc: GetRequestableRoles(teleport.lib.teleterm.v1.GetRequestableRolesRequest) returns (teleport.lib.teleterm.v1.GetRequestableRolesResponse);
-     */
-    getRequestableRoles(input: GetRequestableRolesRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetRequestableRolesResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetRequestableRolesResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: GetRequestableRolesResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[11];
-        return this.makeUnaryRequest<GetRequestableRolesRequest, GetRequestableRolesResponse>(`/${TerminalService.typeName}/${method.name}`, (value: GetRequestableRolesRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): GetRequestableRolesResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * AssumeRole assumes the role of the given access request
-     *
-     * @generated from protobuf rpc: AssumeRole(teleport.lib.teleterm.v1.AssumeRoleRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
-     */
-    assumeRole(input: AssumeRoleRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: EmptyResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: EmptyResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: EmptyResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[12];
-        return this.makeUnaryRequest<AssumeRoleRequest, EmptyResponse>(`/${TerminalService.typeName}/${method.name}`, (value: AssumeRoleRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): EmptyResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * PromoteAccessRequest promotes an access request to an access list.
-     *
-     * @generated from protobuf rpc: PromoteAccessRequest(teleport.lib.teleterm.v1.PromoteAccessRequestRequest) returns (teleport.lib.teleterm.v1.PromoteAccessRequestResponse);
-     */
-    promoteAccessRequest(input: PromoteAccessRequestRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: PromoteAccessRequestResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: PromoteAccessRequestResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: PromoteAccessRequestResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[13];
-        return this.makeUnaryRequest<PromoteAccessRequestRequest, PromoteAccessRequestResponse>(`/${TerminalService.typeName}/${method.name}`, (value: PromoteAccessRequestRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): PromoteAccessRequestResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * GetSuggestedAccessLists returns suggested access lists for an access request.
-     *
-     * @generated from protobuf rpc: GetSuggestedAccessLists(teleport.lib.teleterm.v1.GetSuggestedAccessListsRequest) returns (teleport.lib.teleterm.v1.GetSuggestedAccessListsResponse);
-     */
-    getSuggestedAccessLists(input: GetSuggestedAccessListsRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetSuggestedAccessListsResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetSuggestedAccessListsResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: GetSuggestedAccessListsResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[14];
-        return this.makeUnaryRequest<GetSuggestedAccessListsRequest, GetSuggestedAccessListsResponse>(`/${TerminalService.typeName}/${method.name}`, (value: GetSuggestedAccessListsRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): GetSuggestedAccessListsResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * GetKubes returns filtered, sorted, and paginated kubes
-     *
-     * @generated from protobuf rpc: GetKubes(teleport.lib.teleterm.v1.GetKubesRequest) returns (teleport.lib.teleterm.v1.GetKubesResponse);
-     */
-    getKubes(input: GetKubesRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetKubesResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetKubesResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: GetKubesResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[15];
-        return this.makeUnaryRequest<GetKubesRequest, GetKubesResponse>(`/${TerminalService.typeName}/${method.name}`, (value: GetKubesRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): GetKubesResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * GetApps returns a filtered and paginated list of apps.
-     *
-     * @generated from protobuf rpc: GetApps(teleport.lib.teleterm.v1.GetAppsRequest) returns (teleport.lib.teleterm.v1.GetAppsResponse);
-     */
-    getApps(input: GetAppsRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetAppsResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetAppsResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: GetAppsResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[16];
-        return this.makeUnaryRequest<GetAppsRequest, GetAppsResponse>(`/${TerminalService.typeName}/${method.name}`, (value: GetAppsRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): GetAppsResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * AddCluster adds a cluster to profile
-     *
-     * @generated from protobuf rpc: AddCluster(teleport.lib.teleterm.v1.AddClusterRequest) returns (teleport.lib.teleterm.v1.Cluster);
-     */
-    addCluster(input: AddClusterRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Cluster) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Cluster) => void), callback?: ((err: grpc.ServiceError | null, value?: Cluster) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[17];
-        return this.makeUnaryRequest<AddClusterRequest, Cluster>(`/${TerminalService.typeName}/${method.name}`, (value: AddClusterRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): Cluster => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * RemoveCluster removes a cluster from profile
-     *
-     * @generated from protobuf rpc: RemoveCluster(teleport.lib.teleterm.v1.RemoveClusterRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
-     */
-    removeCluster(input: RemoveClusterRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: EmptyResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: EmptyResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: EmptyResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[18];
-        return this.makeUnaryRequest<RemoveClusterRequest, EmptyResponse>(`/${TerminalService.typeName}/${method.name}`, (value: RemoveClusterRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): EmptyResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * ListGateways lists gateways
-     *
-     * @generated from protobuf rpc: ListGateways(teleport.lib.teleterm.v1.ListGatewaysRequest) returns (teleport.lib.teleterm.v1.ListGatewaysResponse);
-     */
-    listGateways(input: ListGatewaysRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListGatewaysResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListGatewaysResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: ListGatewaysResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[19];
-        return this.makeUnaryRequest<ListGatewaysRequest, ListGatewaysResponse>(`/${TerminalService.typeName}/${method.name}`, (value: ListGatewaysRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): ListGatewaysResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * CreateGateway creates a gateway
-     *
-     * @generated from protobuf rpc: CreateGateway(teleport.lib.teleterm.v1.CreateGatewayRequest) returns (teleport.lib.teleterm.v1.Gateway);
-     */
-    createGateway(input: CreateGatewayRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Gateway) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Gateway) => void), callback?: ((err: grpc.ServiceError | null, value?: Gateway) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[20];
-        return this.makeUnaryRequest<CreateGatewayRequest, Gateway>(`/${TerminalService.typeName}/${method.name}`, (value: CreateGatewayRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): Gateway => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * RemoveGateway removes a gateway
-     *
-     * @generated from protobuf rpc: RemoveGateway(teleport.lib.teleterm.v1.RemoveGatewayRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
-     */
-    removeGateway(input: RemoveGatewayRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: EmptyResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: EmptyResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: EmptyResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[21];
-        return this.makeUnaryRequest<RemoveGatewayRequest, EmptyResponse>(`/${TerminalService.typeName}/${method.name}`, (value: RemoveGatewayRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): EmptyResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * SetGatewayTargetSubresourceName changes the TargetSubresourceName field of gateway.Gateway
-     * and returns the updated version of gateway.Gateway.
-     *
-     * In Connect this is used to update the db name of a db connection along with the CLI command.
-     *
-     * @generated from protobuf rpc: SetGatewayTargetSubresourceName(teleport.lib.teleterm.v1.SetGatewayTargetSubresourceNameRequest) returns (teleport.lib.teleterm.v1.Gateway);
-     */
-    setGatewayTargetSubresourceName(input: SetGatewayTargetSubresourceNameRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Gateway) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Gateway) => void), callback?: ((err: grpc.ServiceError | null, value?: Gateway) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[22];
-        return this.makeUnaryRequest<SetGatewayTargetSubresourceNameRequest, Gateway>(`/${TerminalService.typeName}/${method.name}`, (value: SetGatewayTargetSubresourceNameRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): Gateway => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * SetGatewayLocalPort starts a new gateway on the new port, stops the old gateway and then
-     * assigns the URI of the old gateway to the new one. It does so without fetching a new db cert.
-     *
-     * @generated from protobuf rpc: SetGatewayLocalPort(teleport.lib.teleterm.v1.SetGatewayLocalPortRequest) returns (teleport.lib.teleterm.v1.Gateway);
-     */
-    setGatewayLocalPort(input: SetGatewayLocalPortRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Gateway) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Gateway) => void), callback?: ((err: grpc.ServiceError | null, value?: Gateway) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[23];
-        return this.makeUnaryRequest<SetGatewayLocalPortRequest, Gateway>(`/${TerminalService.typeName}/${method.name}`, (value: SetGatewayLocalPortRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): Gateway => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * GetAuthSettings returns cluster auth settigns
-     *
-     * @generated from protobuf rpc: GetAuthSettings(teleport.lib.teleterm.v1.GetAuthSettingsRequest) returns (teleport.lib.teleterm.v1.AuthSettings);
-     */
-    getAuthSettings(input: GetAuthSettingsRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: AuthSettings) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: AuthSettings) => void), callback?: ((err: grpc.ServiceError | null, value?: AuthSettings) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[24];
-        return this.makeUnaryRequest<GetAuthSettingsRequest, AuthSettings>(`/${TerminalService.typeName}/${method.name}`, (value: GetAuthSettingsRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): AuthSettings => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * GetCluster returns cluster. Makes a network request and includes detailed
-     * information about enterprise features availabed on the connected auth server
-     *
-     * @generated from protobuf rpc: GetCluster(teleport.lib.teleterm.v1.GetClusterRequest) returns (teleport.lib.teleterm.v1.Cluster);
-     */
-    getCluster(input: GetClusterRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Cluster) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Cluster) => void), callback?: ((err: grpc.ServiceError | null, value?: Cluster) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[25];
-        return this.makeUnaryRequest<GetClusterRequest, Cluster>(`/${TerminalService.typeName}/${method.name}`, (value: GetClusterRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): Cluster => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * Login logs in a user to a cluster
-     *
-     * @generated from protobuf rpc: Login(teleport.lib.teleterm.v1.LoginRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
-     */
-    login(input: LoginRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: EmptyResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: EmptyResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: EmptyResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[26];
-        return this.makeUnaryRequest<LoginRequest, EmptyResponse>(`/${TerminalService.typeName}/${method.name}`, (value: LoginRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): EmptyResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * LoginPasswordless logs in a user to a cluster passwordlessly.
-     *
-     * The RPC is streaming both ways and the message sequence example for hardware keys are:
-     * (-> means client-to-server, <- means server-to-client)
-     *
-     * Hardware keys:
-     * -> Init
-     * <- Send PasswordlessPrompt enum TAP to choose a device
-     * -> Receive TAP device response
-     * <- Send PasswordlessPrompt enum PIN
-     * -> Receive PIN response
-     * <- Send PasswordlessPrompt enum RETAP to confirm
-     * -> Receive RETAP device response
-     * <- Send list of credentials (e.g. usernames) associated with device
-     * -> Receive the index number associated with the selected credential in list
-     * <- End
-     *
-     * @generated from protobuf rpc: LoginPasswordless(stream teleport.lib.teleterm.v1.LoginPasswordlessRequest) returns (stream teleport.lib.teleterm.v1.LoginPasswordlessResponse);
-     */
-    loginPasswordless(metadata?: grpc.Metadata | grpc.CallOptions, options?: grpc.CallOptions): grpc.ClientDuplexStream<LoginPasswordlessRequest, LoginPasswordlessResponse> {
-        const method = TerminalService.methods[27];
-        return this.makeBidiStreamRequest<LoginPasswordlessRequest, LoginPasswordlessResponse>(`/${TerminalService.typeName}/${method.name}`, (value: LoginPasswordlessRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): LoginPasswordlessResponse => method.O.fromBinary(value, this._binaryOptions), (metadata as any), options);
-    }
-    /**
-     * ClusterLogin logs out a user from cluster
-     *
-     * @generated from protobuf rpc: Logout(teleport.lib.teleterm.v1.LogoutRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
-     */
-    logout(input: LogoutRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: EmptyResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: EmptyResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: EmptyResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[28];
-        return this.makeUnaryRequest<LogoutRequest, EmptyResponse>(`/${TerminalService.typeName}/${method.name}`, (value: LogoutRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): EmptyResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * TransferFile sends a request to download/upload a file
-     *
-     * @generated from protobuf rpc: TransferFile(teleport.lib.teleterm.v1.FileTransferRequest) returns (stream teleport.lib.teleterm.v1.FileTransferProgress);
-     */
-    transferFile(input: FileTransferRequest, metadata?: grpc.Metadata | grpc.CallOptions, options?: grpc.CallOptions): grpc.ClientReadableStream<FileTransferProgress> {
-        const method = TerminalService.methods[29];
-        return this.makeServerStreamRequest<FileTransferRequest, FileTransferProgress>(`/${TerminalService.typeName}/${method.name}`, (value: FileTransferRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): FileTransferProgress => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), options);
-    }
-    /**
-     * ReportUsageEvent allows to send usage events that are then anonymized and forwarded to prehog
-     *
-     * @generated from protobuf rpc: ReportUsageEvent(teleport.lib.teleterm.v1.ReportUsageEventRequest) returns (teleport.lib.teleterm.v1.EmptyResponse);
-     */
-    reportUsageEvent(input: ReportUsageEventRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: EmptyResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: EmptyResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: EmptyResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[30];
-        return this.makeUnaryRequest<ReportUsageEventRequest, EmptyResponse>(`/${TerminalService.typeName}/${method.name}`, (value: ReportUsageEventRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): EmptyResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * UpdateHeadlessAuthenticationState updates a headless authentication resource's state.
-     * An MFA challenge will be prompted when approving a headless authentication.
-     *
-     * @generated from protobuf rpc: UpdateHeadlessAuthenticationState(teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateRequest) returns (teleport.lib.teleterm.v1.UpdateHeadlessAuthenticationStateResponse);
-     */
-    updateHeadlessAuthenticationState(input: UpdateHeadlessAuthenticationStateRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: UpdateHeadlessAuthenticationStateResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: UpdateHeadlessAuthenticationStateResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: UpdateHeadlessAuthenticationStateResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[31];
-        return this.makeUnaryRequest<UpdateHeadlessAuthenticationStateRequest, UpdateHeadlessAuthenticationStateResponse>(`/${TerminalService.typeName}/${method.name}`, (value: UpdateHeadlessAuthenticationStateRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): UpdateHeadlessAuthenticationStateResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * CreateConnectMyComputerRole creates a role which allows access to nodes with the label
-     * teleport.dev/connect-my-computer/owner: <cluster user> and allows logging in to those nodes as
-     * the current system user.
-     *
-     * @generated from protobuf rpc: CreateConnectMyComputerRole(teleport.lib.teleterm.v1.CreateConnectMyComputerRoleRequest) returns (teleport.lib.teleterm.v1.CreateConnectMyComputerRoleResponse);
-     */
-    createConnectMyComputerRole(input: CreateConnectMyComputerRoleRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: CreateConnectMyComputerRoleResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: CreateConnectMyComputerRoleResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: CreateConnectMyComputerRoleResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[32];
-        return this.makeUnaryRequest<CreateConnectMyComputerRoleRequest, CreateConnectMyComputerRoleResponse>(`/${TerminalService.typeName}/${method.name}`, (value: CreateConnectMyComputerRoleRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): CreateConnectMyComputerRoleResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * CreateConnectMyComputerNodeToken creates a node join token that is valid for 5 minutes
-     *
-     * @generated from protobuf rpc: CreateConnectMyComputerNodeToken(teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenRequest) returns (teleport.lib.teleterm.v1.CreateConnectMyComputerNodeTokenResponse);
-     */
-    createConnectMyComputerNodeToken(input: CreateConnectMyComputerNodeTokenRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: CreateConnectMyComputerNodeTokenResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: CreateConnectMyComputerNodeTokenResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: CreateConnectMyComputerNodeTokenResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[33];
-        return this.makeUnaryRequest<CreateConnectMyComputerNodeTokenRequest, CreateConnectMyComputerNodeTokenResponse>(`/${TerminalService.typeName}/${method.name}`, (value: CreateConnectMyComputerNodeTokenRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): CreateConnectMyComputerNodeTokenResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * WaitForConnectMyComputerNodeJoin sets up a watcher and returns a response only after detecting
-     * that the Connect My Computer node for the particular cluster has joined the cluster (the
-     * OpPut event).
-     *
-     * This RPC times out by itself after a minute to prevent the request from hanging forever, in
-     * case the client didn't set a deadline or doesn't abort the request.
-     *
-     * @generated from protobuf rpc: WaitForConnectMyComputerNodeJoin(teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinRequest) returns (teleport.lib.teleterm.v1.WaitForConnectMyComputerNodeJoinResponse);
-     */
-    waitForConnectMyComputerNodeJoin(input: WaitForConnectMyComputerNodeJoinRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: WaitForConnectMyComputerNodeJoinResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: WaitForConnectMyComputerNodeJoinResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: WaitForConnectMyComputerNodeJoinResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[34];
-        return this.makeUnaryRequest<WaitForConnectMyComputerNodeJoinRequest, WaitForConnectMyComputerNodeJoinResponse>(`/${TerminalService.typeName}/${method.name}`, (value: WaitForConnectMyComputerNodeJoinRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): WaitForConnectMyComputerNodeJoinResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * DeleteConnectMyComputerNode deletes the Connect My Computer node.
-     *
-     * @generated from protobuf rpc: DeleteConnectMyComputerNode(teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeRequest) returns (teleport.lib.teleterm.v1.DeleteConnectMyComputerNodeResponse);
-     */
-    deleteConnectMyComputerNode(input: DeleteConnectMyComputerNodeRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: DeleteConnectMyComputerNodeResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: DeleteConnectMyComputerNodeResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: DeleteConnectMyComputerNodeResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[35];
-        return this.makeUnaryRequest<DeleteConnectMyComputerNodeRequest, DeleteConnectMyComputerNodeResponse>(`/${TerminalService.typeName}/${method.name}`, (value: DeleteConnectMyComputerNodeRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): DeleteConnectMyComputerNodeResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * GetConnectMyComputerNodeName reads the Connect My Computer node name (UUID) from a disk.
-     *
-     * @generated from protobuf rpc: GetConnectMyComputerNodeName(teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameRequest) returns (teleport.lib.teleterm.v1.GetConnectMyComputerNodeNameResponse);
-     */
-    getConnectMyComputerNodeName(input: GetConnectMyComputerNodeNameRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetConnectMyComputerNodeNameResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetConnectMyComputerNodeNameResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: GetConnectMyComputerNodeNameResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[36];
-        return this.makeUnaryRequest<GetConnectMyComputerNodeNameRequest, GetConnectMyComputerNodeNameResponse>(`/${TerminalService.typeName}/${method.name}`, (value: GetConnectMyComputerNodeNameRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): GetConnectMyComputerNodeNameResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * ListUnifiedResources retrieves a paginated list of all resource types displayable in the UI.
-     *
-     * @generated from protobuf rpc: ListUnifiedResources(teleport.lib.teleterm.v1.ListUnifiedResourcesRequest) returns (teleport.lib.teleterm.v1.ListUnifiedResourcesResponse);
-     */
-    listUnifiedResources(input: ListUnifiedResourcesRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListUnifiedResourcesResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ListUnifiedResourcesResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: ListUnifiedResourcesResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[37];
-        return this.makeUnaryRequest<ListUnifiedResourcesRequest, ListUnifiedResourcesResponse>(`/${TerminalService.typeName}/${method.name}`, (value: ListUnifiedResourcesRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): ListUnifiedResourcesResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * GetUserPreferences returns the combined (root + leaf cluster) preferences for a given user.
-     *
-     * @generated from protobuf rpc: GetUserPreferences(teleport.lib.teleterm.v1.GetUserPreferencesRequest) returns (teleport.lib.teleterm.v1.GetUserPreferencesResponse);
-     */
-    getUserPreferences(input: GetUserPreferencesRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetUserPreferencesResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetUserPreferencesResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: GetUserPreferencesResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[38];
-        return this.makeUnaryRequest<GetUserPreferencesRequest, GetUserPreferencesResponse>(`/${TerminalService.typeName}/${method.name}`, (value: GetUserPreferencesRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): GetUserPreferencesResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * UpdateUserPreferences updates the preferences for a given user in appropriate root and leaf clusters.
-     * Only the properties that are set (cluster_preferences, unified_resource_preferences) will be updated.
-     *
-     * @generated from protobuf rpc: UpdateUserPreferences(teleport.lib.teleterm.v1.UpdateUserPreferencesRequest) returns (teleport.lib.teleterm.v1.UpdateUserPreferencesResponse);
-     */
-    updateUserPreferences(input: UpdateUserPreferencesRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: UpdateUserPreferencesResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: UpdateUserPreferencesResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: UpdateUserPreferencesResponse) => void)): grpc.ClientUnaryCall {
-        const method = TerminalService.methods[39];
-        return this.makeUnaryRequest<UpdateUserPreferencesRequest, UpdateUserPreferencesResponse>(`/${TerminalService.typeName}/${method.name}`, (value: UpdateUserPreferencesRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): UpdateUserPreferencesResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-}
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.grpc-server.ts b/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.grpc-server.ts
index 85cad83efa7f3..a3304e5ef58d5 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.grpc-server.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.grpc-server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/service.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.ts
index 3ce45eea9a74a..22c9057c2d638 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/service_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/service.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.client.ts b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.client.ts
new file mode 100644
index 0000000000000..40a0e7d7abea8
--- /dev/null
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.client.ts
@@ -0,0 +1,126 @@
+/* eslint-disable */
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated from protobuf file "teleport/lib/teleterm/v1/tshd_events_service.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
+// tslint:disable
+// @ts-nocheck
+//
+//
+// Teleport
+// Copyright (C) 2023  Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
+import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
+import { TshdEventsService } from "./tshd_events_service_pb";
+import type { PromptMFAResponse } from "./tshd_events_service_pb";
+import type { PromptMFARequest } from "./tshd_events_service_pb";
+import type { SendPendingHeadlessAuthenticationResponse } from "./tshd_events_service_pb";
+import type { SendPendingHeadlessAuthenticationRequest } from "./tshd_events_service_pb";
+import type { SendNotificationResponse } from "./tshd_events_service_pb";
+import type { SendNotificationRequest } from "./tshd_events_service_pb";
+import { stackIntercept } from "@protobuf-ts/runtime-rpc";
+import type { ReloginResponse } from "./tshd_events_service_pb";
+import type { ReloginRequest } from "./tshd_events_service_pb";
+import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
+import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
+/**
+ * TshdEventsService is served by the Electron app. The tsh daemon calls this service to notify the
+ * app about actions that happen outside of the app itself.
+ *
+ * @generated from protobuf service teleport.lib.teleterm.v1.TshdEventsService
+ */
+export interface ITshdEventsServiceClient {
+    /**
+     * Relogin makes the Electron app display a login modal for the specific root cluster. The request
+     * returns a response after the relogin procedure has been successfully finished.
+     *
+     * @generated from protobuf rpc: Relogin(teleport.lib.teleterm.v1.ReloginRequest) returns (teleport.lib.teleterm.v1.ReloginResponse);
+     */
+    relogin(input: ReloginRequest, options?: RpcOptions): UnaryCall<ReloginRequest, ReloginResponse>;
+    /**
+     * SendNotification causes the Electron app to display a notification in the UI. The request
+     * accepts a specific message rather than a generic string so that the Electron is in control as
+     * to what message is displayed and how exactly it looks.
+     *
+     * @generated from protobuf rpc: SendNotification(teleport.lib.teleterm.v1.SendNotificationRequest) returns (teleport.lib.teleterm.v1.SendNotificationResponse);
+     */
+    sendNotification(input: SendNotificationRequest, options?: RpcOptions): UnaryCall<SendNotificationRequest, SendNotificationResponse>;
+    /**
+     * SendPendingHeadlessAuthentication notifies the Electron app of a pending headless authentication,
+     * which it can use to initiate headless authentication resolution in the UI.
+     *
+     * @generated from protobuf rpc: SendPendingHeadlessAuthentication(teleport.lib.teleterm.v1.SendPendingHeadlessAuthenticationRequest) returns (teleport.lib.teleterm.v1.SendPendingHeadlessAuthenticationResponse);
+     */
+    sendPendingHeadlessAuthentication(input: SendPendingHeadlessAuthenticationRequest, options?: RpcOptions): UnaryCall<SendPendingHeadlessAuthenticationRequest, SendPendingHeadlessAuthenticationResponse>;
+    /**
+     * PromptMFA notifies the Electron app that the daemon is waiting for the user to answer an MFA prompt.
+     *
+     * @generated from protobuf rpc: PromptMFA(teleport.lib.teleterm.v1.PromptMFARequest) returns (teleport.lib.teleterm.v1.PromptMFAResponse);
+     */
+    promptMFA(input: PromptMFARequest, options?: RpcOptions): UnaryCall<PromptMFARequest, PromptMFAResponse>;
+}
+/**
+ * TshdEventsService is served by the Electron app. The tsh daemon calls this service to notify the
+ * app about actions that happen outside of the app itself.
+ *
+ * @generated from protobuf service teleport.lib.teleterm.v1.TshdEventsService
+ */
+export class TshdEventsServiceClient implements ITshdEventsServiceClient, ServiceInfo {
+    typeName = TshdEventsService.typeName;
+    methods = TshdEventsService.methods;
+    options = TshdEventsService.options;
+    constructor(private readonly _transport: RpcTransport) {
+    }
+    /**
+     * Relogin makes the Electron app display a login modal for the specific root cluster. The request
+     * returns a response after the relogin procedure has been successfully finished.
+     *
+     * @generated from protobuf rpc: Relogin(teleport.lib.teleterm.v1.ReloginRequest) returns (teleport.lib.teleterm.v1.ReloginResponse);
+     */
+    relogin(input: ReloginRequest, options?: RpcOptions): UnaryCall<ReloginRequest, ReloginResponse> {
+        const method = this.methods[0], opt = this._transport.mergeOptions(options);
+        return stackIntercept<ReloginRequest, ReloginResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * SendNotification causes the Electron app to display a notification in the UI. The request
+     * accepts a specific message rather than a generic string so that the Electron is in control as
+     * to what message is displayed and how exactly it looks.
+     *
+     * @generated from protobuf rpc: SendNotification(teleport.lib.teleterm.v1.SendNotificationRequest) returns (teleport.lib.teleterm.v1.SendNotificationResponse);
+     */
+    sendNotification(input: SendNotificationRequest, options?: RpcOptions): UnaryCall<SendNotificationRequest, SendNotificationResponse> {
+        const method = this.methods[1], opt = this._transport.mergeOptions(options);
+        return stackIntercept<SendNotificationRequest, SendNotificationResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * SendPendingHeadlessAuthentication notifies the Electron app of a pending headless authentication,
+     * which it can use to initiate headless authentication resolution in the UI.
+     *
+     * @generated from protobuf rpc: SendPendingHeadlessAuthentication(teleport.lib.teleterm.v1.SendPendingHeadlessAuthenticationRequest) returns (teleport.lib.teleterm.v1.SendPendingHeadlessAuthenticationResponse);
+     */
+    sendPendingHeadlessAuthentication(input: SendPendingHeadlessAuthenticationRequest, options?: RpcOptions): UnaryCall<SendPendingHeadlessAuthenticationRequest, SendPendingHeadlessAuthenticationResponse> {
+        const method = this.methods[2], opt = this._transport.mergeOptions(options);
+        return stackIntercept<SendPendingHeadlessAuthenticationRequest, SendPendingHeadlessAuthenticationResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * PromptMFA notifies the Electron app that the daemon is waiting for the user to answer an MFA prompt.
+     *
+     * @generated from protobuf rpc: PromptMFA(teleport.lib.teleterm.v1.PromptMFARequest) returns (teleport.lib.teleterm.v1.PromptMFAResponse);
+     */
+    promptMFA(input: PromptMFARequest, options?: RpcOptions): UnaryCall<PromptMFARequest, PromptMFAResponse> {
+        const method = this.methods[3], opt = this._transport.mergeOptions(options);
+        return stackIntercept<PromptMFARequest, PromptMFAResponse>("unary", this._transport, method, opt, input);
+    }
+}
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.grpc-client.ts b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.grpc-client.ts
deleted file mode 100644
index de689f24f74aa..0000000000000
--- a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.grpc-client.ts
+++ /dev/null
@@ -1,136 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/lib/teleterm/v1/tshd_events_service.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-//
-// Teleport
-// Copyright (C) 2023  Gravitational, Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-//
-import { TshdEventsService } from "./tshd_events_service_pb";
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { PromptMFAResponse } from "./tshd_events_service_pb";
-import type { PromptMFARequest } from "./tshd_events_service_pb";
-import type { SendPendingHeadlessAuthenticationResponse } from "./tshd_events_service_pb";
-import type { SendPendingHeadlessAuthenticationRequest } from "./tshd_events_service_pb";
-import type { SendNotificationResponse } from "./tshd_events_service_pb";
-import type { SendNotificationRequest } from "./tshd_events_service_pb";
-import type { ReloginResponse } from "./tshd_events_service_pb";
-import type { ReloginRequest } from "./tshd_events_service_pb";
-import * as grpc from "@grpc/grpc-js";
-/**
- * TshdEventsService is served by the Electron app. The tsh daemon calls this service to notify the
- * app about actions that happen outside of the app itself.
- *
- * @generated from protobuf service teleport.lib.teleterm.v1.TshdEventsService
- */
-export interface ITshdEventsServiceClient {
-    /**
-     * Relogin makes the Electron app display a login modal for the specific root cluster. The request
-     * returns a response after the relogin procedure has been successfully finished.
-     *
-     * @generated from protobuf rpc: Relogin(teleport.lib.teleterm.v1.ReloginRequest) returns (teleport.lib.teleterm.v1.ReloginResponse);
-     */
-    relogin(input: ReloginRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ReloginResponse) => void): grpc.ClientUnaryCall;
-    relogin(input: ReloginRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: ReloginResponse) => void): grpc.ClientUnaryCall;
-    relogin(input: ReloginRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: ReloginResponse) => void): grpc.ClientUnaryCall;
-    relogin(input: ReloginRequest, callback: (err: grpc.ServiceError | null, value?: ReloginResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * SendNotification causes the Electron app to display a notification in the UI. The request
-     * accepts a specific message rather than a generic string so that the Electron is in control as
-     * to what message is displayed and how exactly it looks.
-     *
-     * @generated from protobuf rpc: SendNotification(teleport.lib.teleterm.v1.SendNotificationRequest) returns (teleport.lib.teleterm.v1.SendNotificationResponse);
-     */
-    sendNotification(input: SendNotificationRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: SendNotificationResponse) => void): grpc.ClientUnaryCall;
-    sendNotification(input: SendNotificationRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: SendNotificationResponse) => void): grpc.ClientUnaryCall;
-    sendNotification(input: SendNotificationRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: SendNotificationResponse) => void): grpc.ClientUnaryCall;
-    sendNotification(input: SendNotificationRequest, callback: (err: grpc.ServiceError | null, value?: SendNotificationResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * SendPendingHeadlessAuthentication notifies the Electron app of a pending headless authentication,
-     * which it can use to initiate headless authentication resolution in the UI.
-     *
-     * @generated from protobuf rpc: SendPendingHeadlessAuthentication(teleport.lib.teleterm.v1.SendPendingHeadlessAuthenticationRequest) returns (teleport.lib.teleterm.v1.SendPendingHeadlessAuthenticationResponse);
-     */
-    sendPendingHeadlessAuthentication(input: SendPendingHeadlessAuthenticationRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: SendPendingHeadlessAuthenticationResponse) => void): grpc.ClientUnaryCall;
-    sendPendingHeadlessAuthentication(input: SendPendingHeadlessAuthenticationRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: SendPendingHeadlessAuthenticationResponse) => void): grpc.ClientUnaryCall;
-    sendPendingHeadlessAuthentication(input: SendPendingHeadlessAuthenticationRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: SendPendingHeadlessAuthenticationResponse) => void): grpc.ClientUnaryCall;
-    sendPendingHeadlessAuthentication(input: SendPendingHeadlessAuthenticationRequest, callback: (err: grpc.ServiceError | null, value?: SendPendingHeadlessAuthenticationResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * PromptMFA notifies the Electron app that the daemon is waiting for the user to answer an MFA prompt.
-     *
-     * @generated from protobuf rpc: PromptMFA(teleport.lib.teleterm.v1.PromptMFARequest) returns (teleport.lib.teleterm.v1.PromptMFAResponse);
-     */
-    promptMFA(input: PromptMFARequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: PromptMFAResponse) => void): grpc.ClientUnaryCall;
-    promptMFA(input: PromptMFARequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: PromptMFAResponse) => void): grpc.ClientUnaryCall;
-    promptMFA(input: PromptMFARequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: PromptMFAResponse) => void): grpc.ClientUnaryCall;
-    promptMFA(input: PromptMFARequest, callback: (err: grpc.ServiceError | null, value?: PromptMFAResponse) => void): grpc.ClientUnaryCall;
-}
-/**
- * TshdEventsService is served by the Electron app. The tsh daemon calls this service to notify the
- * app about actions that happen outside of the app itself.
- *
- * @generated from protobuf service teleport.lib.teleterm.v1.TshdEventsService
- */
-export class TshdEventsServiceClient extends grpc.Client implements ITshdEventsServiceClient {
-    private readonly _binaryOptions: Partial<BinaryReadOptions & BinaryWriteOptions>;
-    constructor(address: string, credentials: grpc.ChannelCredentials, options: grpc.ClientOptions = {}, binaryOptions: Partial<BinaryReadOptions & BinaryWriteOptions> = {}) {
-        super(address, credentials, options);
-        this._binaryOptions = binaryOptions;
-    }
-    /**
-     * Relogin makes the Electron app display a login modal for the specific root cluster. The request
-     * returns a response after the relogin procedure has been successfully finished.
-     *
-     * @generated from protobuf rpc: Relogin(teleport.lib.teleterm.v1.ReloginRequest) returns (teleport.lib.teleterm.v1.ReloginResponse);
-     */
-    relogin(input: ReloginRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ReloginResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: ReloginResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: ReloginResponse) => void)): grpc.ClientUnaryCall {
-        const method = TshdEventsService.methods[0];
-        return this.makeUnaryRequest<ReloginRequest, ReloginResponse>(`/${TshdEventsService.typeName}/${method.name}`, (value: ReloginRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): ReloginResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * SendNotification causes the Electron app to display a notification in the UI. The request
-     * accepts a specific message rather than a generic string so that the Electron is in control as
-     * to what message is displayed and how exactly it looks.
-     *
-     * @generated from protobuf rpc: SendNotification(teleport.lib.teleterm.v1.SendNotificationRequest) returns (teleport.lib.teleterm.v1.SendNotificationResponse);
-     */
-    sendNotification(input: SendNotificationRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: SendNotificationResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: SendNotificationResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: SendNotificationResponse) => void)): grpc.ClientUnaryCall {
-        const method = TshdEventsService.methods[1];
-        return this.makeUnaryRequest<SendNotificationRequest, SendNotificationResponse>(`/${TshdEventsService.typeName}/${method.name}`, (value: SendNotificationRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): SendNotificationResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * SendPendingHeadlessAuthentication notifies the Electron app of a pending headless authentication,
-     * which it can use to initiate headless authentication resolution in the UI.
-     *
-     * @generated from protobuf rpc: SendPendingHeadlessAuthentication(teleport.lib.teleterm.v1.SendPendingHeadlessAuthenticationRequest) returns (teleport.lib.teleterm.v1.SendPendingHeadlessAuthenticationResponse);
-     */
-    sendPendingHeadlessAuthentication(input: SendPendingHeadlessAuthenticationRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: SendPendingHeadlessAuthenticationResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: SendPendingHeadlessAuthenticationResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: SendPendingHeadlessAuthenticationResponse) => void)): grpc.ClientUnaryCall {
-        const method = TshdEventsService.methods[2];
-        return this.makeUnaryRequest<SendPendingHeadlessAuthenticationRequest, SendPendingHeadlessAuthenticationResponse>(`/${TshdEventsService.typeName}/${method.name}`, (value: SendPendingHeadlessAuthenticationRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): SendPendingHeadlessAuthenticationResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * PromptMFA notifies the Electron app that the daemon is waiting for the user to answer an MFA prompt.
-     *
-     * @generated from protobuf rpc: PromptMFA(teleport.lib.teleterm.v1.PromptMFARequest) returns (teleport.lib.teleterm.v1.PromptMFAResponse);
-     */
-    promptMFA(input: PromptMFARequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: PromptMFAResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: PromptMFAResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: PromptMFAResponse) => void)): grpc.ClientUnaryCall {
-        const method = TshdEventsService.methods[3];
-        return this.makeUnaryRequest<PromptMFARequest, PromptMFAResponse>(`/${TshdEventsService.typeName}/${method.name}`, (value: PromptMFARequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): PromptMFAResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-}
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.grpc-server.ts b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.grpc-server.ts
index da85cbf7d8238..f3186f01c1af0 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.grpc-server.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.grpc-server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/tshd_events_service.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.ts
index 27789a28a800c..95d2b41b9582e 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/tshd_events_service.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/usage_events_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/usage_events_pb.ts
index eddabe21d976c..c98e03cdd5d9b 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/usage_events_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/usage_events_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/lib/teleterm/v1/usage_events.proto" (package "teleport.lib.teleterm.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/trait/v1/trait_pb.ts b/gen/proto/ts/teleport/trait/v1/trait_pb.ts
index 1803f4562656d..dbb9a8e8da529 100644
--- a/gen/proto/ts/teleport/trait/v1/trait_pb.ts
+++ b/gen/proto/ts/teleport/trait/v1/trait_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/trait/v1/trait.proto" (package "teleport.trait.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/assist_pb.ts b/gen/proto/ts/teleport/userpreferences/v1/assist_pb.ts
index e53572349d08d..8d504792c80a8 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/assist_pb.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/assist_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/assist.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/cluster_preferences_pb.ts b/gen/proto/ts/teleport/userpreferences/v1/cluster_preferences_pb.ts
index 0708325a7d598..19bd1857677e5 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/cluster_preferences_pb.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/cluster_preferences_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/cluster_preferences.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/onboard_pb.ts b/gen/proto/ts/teleport/userpreferences/v1/onboard_pb.ts
index 7b3f7783ea0d1..2ccaaba6b85a6 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/onboard_pb.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/onboard_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/onboard.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/theme_pb.ts b/gen/proto/ts/teleport/userpreferences/v1/theme_pb.ts
index 2eb9636c6a324..d09575f183eb0 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/theme_pb.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/theme_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/theme.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/unified_resource_preferences_pb.ts b/gen/proto/ts/teleport/userpreferences/v1/unified_resource_preferences_pb.ts
index 88ba87ddc1cc8..37ba01b16fda7 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/unified_resource_preferences_pb.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/unified_resource_preferences_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/unified_resource_preferences.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.client.ts b/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.client.ts
new file mode 100644
index 0000000000000..360e53b3bafb8
--- /dev/null
+++ b/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.client.ts
@@ -0,0 +1,79 @@
+/* eslint-disable */
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
+// @generated from protobuf file "teleport/userpreferences/v1/userpreferences.proto" (package "teleport.userpreferences.v1", syntax proto3)
+// tslint:disable
+// @ts-nocheck
+//
+// Copyright 2023 Gravitational, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
+import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
+import { UserPreferencesService } from "./userpreferences_pb";
+import type { Empty } from "../../../google/protobuf/empty_pb";
+import type { UpsertUserPreferencesRequest } from "./userpreferences_pb";
+import { stackIntercept } from "@protobuf-ts/runtime-rpc";
+import type { GetUserPreferencesResponse } from "./userpreferences_pb";
+import type { GetUserPreferencesRequest } from "./userpreferences_pb";
+import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
+import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
+/**
+ * UserPreferencesService is a service that stores user settings.
+ *
+ * @generated from protobuf service teleport.userpreferences.v1.UserPreferencesService
+ */
+export interface IUserPreferencesServiceClient {
+    /**
+     * GetUserPreferences returns the user preferences for a given user.
+     *
+     * @generated from protobuf rpc: GetUserPreferences(teleport.userpreferences.v1.GetUserPreferencesRequest) returns (teleport.userpreferences.v1.GetUserPreferencesResponse);
+     */
+    getUserPreferences(input: GetUserPreferencesRequest, options?: RpcOptions): UnaryCall<GetUserPreferencesRequest, GetUserPreferencesResponse>;
+    /**
+     * UpsertUserPreferences creates or updates user preferences for a given username.
+     *
+     * @generated from protobuf rpc: UpsertUserPreferences(teleport.userpreferences.v1.UpsertUserPreferencesRequest) returns (google.protobuf.Empty);
+     */
+    upsertUserPreferences(input: UpsertUserPreferencesRequest, options?: RpcOptions): UnaryCall<UpsertUserPreferencesRequest, Empty>;
+}
+/**
+ * UserPreferencesService is a service that stores user settings.
+ *
+ * @generated from protobuf service teleport.userpreferences.v1.UserPreferencesService
+ */
+export class UserPreferencesServiceClient implements IUserPreferencesServiceClient, ServiceInfo {
+    typeName = UserPreferencesService.typeName;
+    methods = UserPreferencesService.methods;
+    options = UserPreferencesService.options;
+    constructor(private readonly _transport: RpcTransport) {
+    }
+    /**
+     * GetUserPreferences returns the user preferences for a given user.
+     *
+     * @generated from protobuf rpc: GetUserPreferences(teleport.userpreferences.v1.GetUserPreferencesRequest) returns (teleport.userpreferences.v1.GetUserPreferencesResponse);
+     */
+    getUserPreferences(input: GetUserPreferencesRequest, options?: RpcOptions): UnaryCall<GetUserPreferencesRequest, GetUserPreferencesResponse> {
+        const method = this.methods[0], opt = this._transport.mergeOptions(options);
+        return stackIntercept<GetUserPreferencesRequest, GetUserPreferencesResponse>("unary", this._transport, method, opt, input);
+    }
+    /**
+     * UpsertUserPreferences creates or updates user preferences for a given username.
+     *
+     * @generated from protobuf rpc: UpsertUserPreferences(teleport.userpreferences.v1.UpsertUserPreferencesRequest) returns (google.protobuf.Empty);
+     */
+    upsertUserPreferences(input: UpsertUserPreferencesRequest, options?: RpcOptions): UnaryCall<UpsertUserPreferencesRequest, Empty> {
+        const method = this.methods[1], opt = this._transport.mergeOptions(options);
+        return stackIntercept<UpsertUserPreferencesRequest, Empty>("unary", this._transport, method, opt, input);
+    }
+}
diff --git a/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.grpc-client.ts b/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.grpc-client.ts
deleted file mode 100644
index da1f47c69e18b..0000000000000
--- a/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.grpc-client.ts
+++ /dev/null
@@ -1,83 +0,0 @@
-/* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
-// @generated from protobuf file "teleport/userpreferences/v1/userpreferences.proto" (package "teleport.userpreferences.v1", syntax proto3)
-// tslint:disable
-// @ts-nocheck
-//
-// Copyright 2023 Gravitational, Inc
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-import { UserPreferencesService } from "./userpreferences_pb";
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { Empty } from "../../../google/protobuf/empty_pb";
-import type { UpsertUserPreferencesRequest } from "./userpreferences_pb";
-import type { GetUserPreferencesResponse } from "./userpreferences_pb";
-import type { GetUserPreferencesRequest } from "./userpreferences_pb";
-import * as grpc from "@grpc/grpc-js";
-/**
- * UserPreferencesService is a service that stores user settings.
- *
- * @generated from protobuf service teleport.userpreferences.v1.UserPreferencesService
- */
-export interface IUserPreferencesServiceClient {
-    /**
-     * GetUserPreferences returns the user preferences for a given user.
-     *
-     * @generated from protobuf rpc: GetUserPreferences(teleport.userpreferences.v1.GetUserPreferencesRequest) returns (teleport.userpreferences.v1.GetUserPreferencesResponse);
-     */
-    getUserPreferences(input: GetUserPreferencesRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetUserPreferencesResponse) => void): grpc.ClientUnaryCall;
-    getUserPreferences(input: GetUserPreferencesRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: GetUserPreferencesResponse) => void): grpc.ClientUnaryCall;
-    getUserPreferences(input: GetUserPreferencesRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: GetUserPreferencesResponse) => void): grpc.ClientUnaryCall;
-    getUserPreferences(input: GetUserPreferencesRequest, callback: (err: grpc.ServiceError | null, value?: GetUserPreferencesResponse) => void): grpc.ClientUnaryCall;
-    /**
-     * UpsertUserPreferences creates or updates user preferences for a given username.
-     *
-     * @generated from protobuf rpc: UpsertUserPreferences(teleport.userpreferences.v1.UpsertUserPreferencesRequest) returns (google.protobuf.Empty);
-     */
-    upsertUserPreferences(input: UpsertUserPreferencesRequest, metadata: grpc.Metadata, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    upsertUserPreferences(input: UpsertUserPreferencesRequest, metadata: grpc.Metadata, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    upsertUserPreferences(input: UpsertUserPreferencesRequest, options: grpc.CallOptions, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-    upsertUserPreferences(input: UpsertUserPreferencesRequest, callback: (err: grpc.ServiceError | null, value?: Empty) => void): grpc.ClientUnaryCall;
-}
-/**
- * UserPreferencesService is a service that stores user settings.
- *
- * @generated from protobuf service teleport.userpreferences.v1.UserPreferencesService
- */
-export class UserPreferencesServiceClient extends grpc.Client implements IUserPreferencesServiceClient {
-    private readonly _binaryOptions: Partial<BinaryReadOptions & BinaryWriteOptions>;
-    constructor(address: string, credentials: grpc.ChannelCredentials, options: grpc.ClientOptions = {}, binaryOptions: Partial<BinaryReadOptions & BinaryWriteOptions> = {}) {
-        super(address, credentials, options);
-        this._binaryOptions = binaryOptions;
-    }
-    /**
-     * GetUserPreferences returns the user preferences for a given user.
-     *
-     * @generated from protobuf rpc: GetUserPreferences(teleport.userpreferences.v1.GetUserPreferencesRequest) returns (teleport.userpreferences.v1.GetUserPreferencesResponse);
-     */
-    getUserPreferences(input: GetUserPreferencesRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetUserPreferencesResponse) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: GetUserPreferencesResponse) => void), callback?: ((err: grpc.ServiceError | null, value?: GetUserPreferencesResponse) => void)): grpc.ClientUnaryCall {
-        const method = UserPreferencesService.methods[0];
-        return this.makeUnaryRequest<GetUserPreferencesRequest, GetUserPreferencesResponse>(`/${UserPreferencesService.typeName}/${method.name}`, (value: GetUserPreferencesRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): GetUserPreferencesResponse => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-    /**
-     * UpsertUserPreferences creates or updates user preferences for a given username.
-     *
-     * @generated from protobuf rpc: UpsertUserPreferences(teleport.userpreferences.v1.UpsertUserPreferencesRequest) returns (google.protobuf.Empty);
-     */
-    upsertUserPreferences(input: UpsertUserPreferencesRequest, metadata: grpc.Metadata | grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Empty) => void), options?: grpc.CallOptions | ((err: grpc.ServiceError | null, value?: Empty) => void), callback?: ((err: grpc.ServiceError | null, value?: Empty) => void)): grpc.ClientUnaryCall {
-        const method = UserPreferencesService.methods[1];
-        return this.makeUnaryRequest<UpsertUserPreferencesRequest, Empty>(`/${UserPreferencesService.typeName}/${method.name}`, (value: UpsertUserPreferencesRequest): Buffer => Buffer.from(method.I.toBinary(value, this._binaryOptions)), (value: Buffer): Empty => method.O.fromBinary(value, this._binaryOptions), input, (metadata as any), (options as any), (callback as any));
-    }
-}
diff --git a/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.grpc-server.ts b/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.grpc-server.ts
index b56b30f7a186a..f5a1dbdda7c49 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.grpc-server.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.grpc-server.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/userpreferences.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.ts b/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.ts
index 09d283e2d3795..2c3e9857cf0ff 100644
--- a/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.ts
+++ b/gen/proto/ts/teleport/userpreferences/v1/userpreferences_pb.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,client_grpc1,server_grpc1,ts_nocheck
+// @generated by protobuf-ts 2.9.3 with parameter long_type_number,eslint_disable,add_pb_suffix,server_grpc1,ts_nocheck
 // @generated from protobuf file "teleport/userpreferences/v1/userpreferences.proto" (package "teleport.userpreferences.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/lib/teleterm/apiserver/middleware.go b/lib/teleterm/apiserver/middleware.go
index ac9004abfa1aa..7f8bb787a4038 100644
--- a/lib/teleterm/apiserver/middleware.go
+++ b/lib/teleterm/apiserver/middleware.go
@@ -20,14 +20,10 @@ package apiserver
 
 import (
 	"context"
-	"errors"
 
-	"github.com/gravitational/trace"
 	"github.com/gravitational/trace/trail"
 	"github.com/sirupsen/logrus"
 	"google.golang.org/grpc"
-
-	"github.com/gravitational/teleport/api/client"
 )
 
 // withErrorHandling is gRPC middleware that maps internal errors to proper gRPC error codes
@@ -41,18 +37,6 @@ func withErrorHandling(log logrus.FieldLogger) grpc.UnaryServerInterceptor {
 		resp, err := handler(ctx, req)
 		if err != nil {
 			log.WithError(err).Error("Request failed.")
-			// A stop gap solution that allows us to show a relogin modal when we
-			// receive an error from the server saying that the cert is expired.
-			// Read more: https://github.com/gravitational/teleport/pull/38202#discussion_r1497181659
-			// TODO(gzdunek): fix when addressing https://github.com/gravitational/teleport/issues/32550
-			if errors.Is(err, client.ErrClientCredentialsHaveExpired) {
-				return resp, trail.ToGRPC(err)
-			}
-
-			// do not return a full error stack on access denied errors
-			if trace.IsAccessDenied(err) {
-				return resp, trail.ToGRPC(trace.AccessDenied("access denied"))
-			}
 			return resp, trail.ToGRPC(err)
 		}
 
diff --git a/lib/teleterm/services/clientcache/clientcache.go b/lib/teleterm/services/clientcache/clientcache.go
index 0ebe71efe02b4..4f1710595493e 100644
--- a/lib/teleterm/services/clientcache/clientcache.go
+++ b/lib/teleterm/services/clientcache/clientcache.go
@@ -80,9 +80,16 @@ func (c *Cache) Get(ctx context.Context, clusterURI uri.ResourceURI) (*client.Pr
 			return nil, trace.Wrap(err)
 		}
 
-		//nolint:staticcheck // SA1019. TODO(gzdunek): Update to use client.ClusterClient.
-		newProxyClient, err := clusterClient.ConnectToProxy(ctx)
-		if err != nil {
+		var newProxyClient *client.ProxyClient
+		if err := clusters.AddMetadataToRetryableError(ctx, func() error {
+			//nolint:staticcheck // SA1019. TODO(gzdunek): Update to use client.ClusterClient.
+			proxyClient, err := clusterClient.ConnectToProxy(ctx)
+			if err != nil {
+				return trace.Wrap(err)
+			}
+			newProxyClient = proxyClient
+			return nil
+		}); err != nil {
 			return nil, trace.Wrap(err)
 		}
 
diff --git a/tsconfig.json b/tsconfig.json
index 02f9a6ff91930..a53d8578485f0 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -12,6 +12,7 @@
     "jsx": "react-jsx",
     "module": "esnext",
     "moduleResolution": "bundler",
+    "strictBindCallApply": true,
     "noEmit": true,
     "noEmitHelpers": true,
     "resolveJsonModule": true,
diff --git a/web/packages/shared/hooks/useInfiniteScroll/useKeyBasedPagination.ts b/web/packages/shared/hooks/useInfiniteScroll/useKeyBasedPagination.ts
index 638498cbb9153..ef47d18e41af7 100644
--- a/web/packages/shared/hooks/useInfiniteScroll/useKeyBasedPagination.ts
+++ b/web/packages/shared/hooks/useInfiniteScroll/useKeyBasedPagination.ts
@@ -44,12 +44,12 @@ export function useKeyBasedPagination<T>({
     attempt: Attempt;
     finished: boolean;
     resources: T[];
-    startKey: string | null;
+    startKey: string;
   }>({
     attempt: { status: '', statusText: '' },
     finished: false,
     resources: [],
-    startKey: null,
+    startKey: '',
   });
 
   // Ephemeral state used solely to coordinate fetch calls, doesn't need to
@@ -64,7 +64,7 @@ export function useKeyBasedPagination<T>({
 
     setState({
       attempt: { status: '', statusText: '' },
-      startKey: null,
+      startKey: '',
       finished: false,
       resources: [],
     });
diff --git a/web/packages/shared/utils/abortError.test.ts b/web/packages/shared/utils/abortError.test.ts
index 48bf9118feda7..312d328b4a378 100644
--- a/web/packages/shared/utils/abortError.test.ts
+++ b/web/packages/shared/utils/abortError.test.ts
@@ -39,6 +39,7 @@ function newApiAbortError() {
   });
 }
 
+// mimics TshdRpcError
 function newGrpcAbortError() {
-  return new Error('1 CANCELLED: Cancelled on client');
+  return { code: 'CANCELLED' };
 }
diff --git a/web/packages/shared/utils/abortError.ts b/web/packages/shared/utils/abortError.ts
index 2fd426fb42933..2bff7ce9769bc 100644
--- a/web/packages/shared/utils/abortError.ts
+++ b/web/packages/shared/utils/abortError.ts
@@ -25,8 +25,6 @@ export const isAbortError = (err: any): boolean => {
     return true;
   }
 
-  // handles Connect abort error (specifically gRPC cancel error)
-  // the error has only the message field that contains the following string:
-  // '1 CANCELLED: Cancelled on client'
-  return err instanceof Error && err.message?.includes('CANCELLED');
+  // handles Connect abort error (specifically gRPC cancel error), see TshdRpcError
+  return err?.code === 'CANCELLED';
 };
diff --git a/web/packages/shared/utils/highbar.ts b/web/packages/shared/utils/highbar.ts
index a1746fed8cfbd..4d96399b73e0f 100644
--- a/web/packages/shared/utils/highbar.ts
+++ b/web/packages/shared/utils/highbar.ts
@@ -110,7 +110,8 @@ export function runOnce<T extends (...args) => any>(func: T) {
   let result;
   return function () {
     if (--n > 0) {
-      result = func.apply(this, arguments);
+      // This implementation does not pass strictBindCallApply check.
+      result = func.apply(this, arguments as any);
     }
     if (n <= 1) {
       func = undefined;
@@ -292,6 +293,7 @@ export function debounce<T extends (...args: any) => any>(
     }
     return result;
   }
+
   debounced.cancel = cancel;
   debounced.flush = flush;
   return debounced;
@@ -327,7 +329,8 @@ export function memoize<T extends (...args: any) => any>(
     if (cache.has(key)) {
       return cache.get(key);
     }
-    const result = func.apply(this, args);
+    // `as any` because the implementation does not pass strictBindCallApply check.
+    const result = func.apply(this, args as any);
     memoized.cache = cache.set(key, result) || cache;
     return result;
   };
diff --git a/web/packages/teleterm/package.json b/web/packages/teleterm/package.json
index d217ad1fe73db..84e8e68f079a2 100644
--- a/web/packages/teleterm/package.json
+++ b/web/packages/teleterm/package.json
@@ -39,6 +39,7 @@
     "@gravitational/build": "^1.0.0",
     "@gravitational/design": "1.0.0",
     "@gravitational/shared": "1.0.0",
+    "@protobuf-ts/grpc-transport": "^2.9.3",
     "@protobuf-ts/runtime": "^2.9.3",
     "@protobuf-ts/runtime-rpc": "^2.9.3",
     "@types/google-protobuf": "^3.10.0",
diff --git a/web/packages/teleterm/src/helpers.ts b/web/packages/teleterm/src/helpers.ts
index 3dcb26a6a25a3..75241ddc0acb8 100644
--- a/web/packages/teleterm/src/helpers.ts
+++ b/web/packages/teleterm/src/helpers.ts
@@ -24,8 +24,6 @@ import { Database } from 'gen-proto-ts/teleport/lib/teleterm/v1/database_pb';
 import { App } from 'gen-proto-ts/teleport/lib/teleterm/v1/app_pb';
 import { Kube } from 'gen-proto-ts/teleport/lib/teleterm/v1/kube_pb';
 
-import * as prehog from 'gen-proto-ts/prehog/v1alpha/connect_pb';
-
 import {
   PtyClientEvent,
   PtyEventData,
@@ -140,84 +138,3 @@ export function reloginReasonOneOfIsGatewayCertExpired(
 } {
   return reason.oneofKind === 'gatewayCertExpired';
 }
-
-export function connectEventOneOfIsClusterLogin(
-  event: prehog.SubmitConnectEventRequest['event']
-): event is {
-  oneofKind: 'clusterLogin';
-  clusterLogin: prehog.ConnectClusterLoginEvent;
-} {
-  return event.oneofKind === 'clusterLogin';
-}
-
-export function connectEventOneOfIsProtocolUse(
-  event: prehog.SubmitConnectEventRequest['event']
-): event is {
-  oneofKind: 'protocolUse';
-  protocolUse: prehog.ConnectProtocolUseEvent;
-} {
-  return event.oneofKind === 'protocolUse';
-}
-
-export function connectEventOneOfIsAccessRequestCreate(
-  event: prehog.SubmitConnectEventRequest['event']
-): event is {
-  oneofKind: 'accessRequestCreate';
-  accessRequestCreate: prehog.ConnectAccessRequestCreateEvent;
-} {
-  return event.oneofKind === 'accessRequestCreate';
-}
-
-export function connectEventOneOfIsAccessRequestReview(
-  event: prehog.SubmitConnectEventRequest['event']
-): event is {
-  oneofKind: 'accessRequestReview';
-  accessRequestReview: prehog.ConnectAccessRequestReviewEvent;
-} {
-  return event.oneofKind === 'accessRequestReview';
-}
-
-export function connectEventOneOfIsAccessRequestAssumeRole(
-  event: prehog.SubmitConnectEventRequest['event']
-): event is {
-  oneofKind: 'accessRequestAssumeRole';
-  accessRequestAssumeRole: prehog.ConnectAccessRequestAssumeRoleEvent;
-} {
-  return event.oneofKind === 'accessRequestAssumeRole';
-}
-
-export function connectEventOneOfIsFileTransferRun(
-  event: prehog.SubmitConnectEventRequest['event']
-): event is {
-  oneofKind: 'fileTransferRun';
-  fileTransferRun: prehog.ConnectFileTransferRunEvent;
-} {
-  return event.oneofKind === 'fileTransferRun';
-}
-
-export function connectEventOneOfIsUserJobRoleUpdate(
-  event: prehog.SubmitConnectEventRequest['event']
-): event is {
-  oneofKind: 'userJobRoleUpdate';
-  userJobRoleUpdate: prehog.ConnectUserJobRoleUpdateEvent;
-} {
-  return event.oneofKind === 'userJobRoleUpdate';
-}
-
-export function connectEventOneOfIsConnectMyComputerSetup(
-  event: prehog.SubmitConnectEventRequest['event']
-): event is {
-  oneofKind: 'connectMyComputerSetup';
-  connectMyComputerSetup: prehog.ConnectConnectMyComputerSetup;
-} {
-  return event.oneofKind === 'connectMyComputerSetup';
-}
-
-export function connectEventOneOfIsConnectMyComputerAgentStart(
-  event: prehog.SubmitConnectEventRequest['event']
-): event is {
-  oneofKind: 'connectMyComputerAgentStart';
-  connectMyComputerAgentStart: prehog.ConnectConnectMyComputerAgentStart;
-} {
-  return event.oneofKind === 'connectMyComputerAgentStart';
-}
diff --git a/web/packages/teleterm/src/mainProcess/rootClusterProxyHostAllowList.ts b/web/packages/teleterm/src/mainProcess/rootClusterProxyHostAllowList.ts
index 2db0c06d30f8e..42f9c30110c57 100644
--- a/web/packages/teleterm/src/mainProcess/rootClusterProxyHostAllowList.ts
+++ b/web/packages/teleterm/src/mainProcess/rootClusterProxyHostAllowList.ts
@@ -25,6 +25,7 @@ import { TshdClient } from 'teleterm/services/tshd/types';
 import { Logger } from 'teleterm/types';
 import { MainProcessIpc } from 'teleterm/mainProcess/types';
 import * as tshd from 'teleterm/services/tshd/types';
+import { cloneAbortSignal } from 'teleterm/services/tshd/cloneableClient';
 
 export type RootClusterProxyHostAllowList = Set<string>;
 
@@ -47,17 +48,19 @@ export function manageRootClusterProxyHostAllowList({
   logger: Logger;
   allowList: RootClusterProxyHostAllowList;
 }) {
-  let abortController: tshd.TshAbortController;
+  let abortController: AbortController;
 
   const refreshAllowList = async () => {
     // Allow only one call to be in progress. This ensures that on subsequent calls to
     // refreshAllowList, we always store only the most recent version of the list.
     abortController?.abort();
-    abortController = tshdClient.createAbortController();
+    abortController = new AbortController();
 
     let rootClusters: tshd.Cluster[];
     try {
-      rootClusters = await tshdClient.listRootClusters(abortController.signal);
+      rootClusters = await tshdClient.listRootClusters(
+        cloneAbortSignal(abortController.signal)
+      );
     } catch (error) {
       if (isAbortError(error)) {
         // Ignore abort errors. They will be logged by the gRPC client middleware.
diff --git a/web/packages/teleterm/src/services/tshd/cloneableClient.test.ts b/web/packages/teleterm/src/services/tshd/cloneableClient.test.ts
new file mode 100644
index 0000000000000..23992dc546593
--- /dev/null
+++ b/web/packages/teleterm/src/services/tshd/cloneableClient.test.ts
@@ -0,0 +1,283 @@
+/**
+ * @jest-environment node
+ */
+/**
+ * Teleport
+ * Copyright (C) 2024 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import { EventEmitter } from 'node:events';
+
+import {
+  UnaryCall,
+  RpcError,
+  ClientStreamingCall,
+  ServerStreamingCall,
+  DuplexStreamingCall,
+  RpcOutputStream,
+  ServiceInfo,
+  MethodInfo,
+} from '@protobuf-ts/runtime-rpc';
+
+import {
+  cloneAbortSignal,
+  TshdRpcError,
+  cloneClient,
+  isTshdRpcError,
+} from './cloneableClient';
+
+function getRpcError() {
+  return new RpcError('You do not have permission.', 'ACCESS_DENIED');
+}
+
+const tshdRpcErrorObjectMatcher: TshdRpcError = expect.objectContaining({
+  code: 'ACCESS_DENIED',
+  isResolvableWithRelogin: false,
+  message: 'You do not have permission.',
+  name: 'TshdRpcError',
+  stack: expect.stringContaining('You do not have permission.'),
+  cause: undefined,
+});
+
+class MockServiceMethod<T extends (...args: any[]) => any>
+  implements ServiceInfo
+{
+  public methods: MethodInfo[];
+  public options = {};
+  public typeName = '';
+
+  constructor(
+    methodInfo: Pick<MethodInfo, 'clientStreaming' | 'serverStreaming'>,
+    private implementation: T
+  ) {
+    this.methods = [
+      {
+        localName: 'fakeMethod',
+        serverStreaming: methodInfo.serverStreaming,
+        clientStreaming: methodInfo.clientStreaming,
+      } as MethodInfo,
+    ];
+  }
+
+  fakeMethod(...args: Parameters<T>): ReturnType<T> {
+    return this.implementation(...args);
+  }
+}
+
+test('cloneable abort signal reads up-to-date signal.aborted and signal.reason', () => {
+  const controller = new AbortController();
+  const cloned = cloneAbortSignal(controller.signal);
+  expect(cloned.aborted).toBe(false);
+  expect(cloned.reason).toBeUndefined();
+
+  controller.abort('test reason');
+  expect(cloned.aborted).toBe(true);
+  expect(cloned.reason).toBe('test reason');
+});
+
+test('response error is cloned as an object for a unary call', async () => {
+  const fakeCall: () => UnaryCall = jest.fn().mockImplementation(() => ({
+    then: () => Promise.reject(getRpcError()),
+  }));
+  const client = cloneClient(
+    new MockServiceMethod(
+      {
+        clientStreaming: false,
+        serverStreaming: false,
+      },
+      fakeCall
+    )
+  );
+
+  let error: unknown;
+  try {
+    // Normally we would simply await `client.fakeMethod()`, but jest doesn't support
+    // thenables https://github.com/jestjs/jest/issues/10501.
+    await client.fakeMethod().then();
+  } catch (e) {
+    error = e;
+  }
+
+  expect(Object.getPrototypeOf(error).constructor).toEqual(Object);
+  expect(error).toMatchObject(tshdRpcErrorObjectMatcher);
+});
+
+test('response error is cloned as an object in a client streaming call', async () => {
+  const send = jest.fn();
+  const complete = jest.fn();
+  const fakeCall: () => ClientStreamingCall = jest
+    .fn()
+    .mockImplementation(() => ({
+      requests: {
+        send,
+        complete,
+      },
+      then: () => Promise.reject(getRpcError()),
+    }));
+  const client = cloneClient(
+    new MockServiceMethod(
+      {
+        clientStreaming: true,
+        serverStreaming: false,
+      },
+      fakeCall
+    )
+  );
+  const res = client.fakeMethod();
+  await res.requests.send({ value: 'test' });
+  expect(send).toHaveBeenLastCalledWith({ value: 'test' });
+  await res.requests.complete();
+  expect(complete).toHaveBeenLastCalledWith();
+
+  let error: unknown;
+  try {
+    await res.then();
+  } catch (e) {
+    error = e;
+  }
+
+  expect(Object.getPrototypeOf(error).constructor).toEqual(Object);
+  expect(error).toMatchObject(tshdRpcErrorObjectMatcher);
+});
+
+test('response error is cloned as an object in a server streaming call', async () => {
+  const rejectedPromise = () => Promise.reject(getRpcError());
+  const errorEmitter = new EventEmitter();
+  const fakeCall: () => ServerStreamingCall = jest
+    .fn()
+    .mockImplementation(() => ({
+      responses: {
+        onNext: callback => {
+          errorEmitter.on('', error => callback(undefined, error, true));
+          return () => errorEmitter.off('', callback);
+        },
+        onError: callback => {
+          errorEmitter.on('', error => callback(error));
+          return () => errorEmitter.off('', callback);
+        },
+      } as Pick<RpcOutputStream, 'onNext' | 'onError'>,
+      then: rejectedPromise,
+    }));
+  const client = cloneClient(
+    new MockServiceMethod(
+      {
+        clientStreaming: false,
+        serverStreaming: true,
+      },
+      fakeCall
+    )
+  );
+  const res = client.fakeMethod();
+  const onNext = jest.fn();
+  const onError = jest.fn();
+  res.responses.onNext(onNext);
+  res.responses.onError(onError);
+
+  errorEmitter.emit('', getRpcError());
+  expect(onNext).toHaveBeenCalledWith(
+    undefined,
+    tshdRpcErrorObjectMatcher,
+    true
+  );
+  expect(onError).toHaveBeenCalledWith(tshdRpcErrorObjectMatcher);
+
+  let error: unknown;
+  try {
+    await res.then();
+  } catch (e) {
+    error = e;
+  }
+
+  expect(Object.getPrototypeOf(error).constructor).toEqual(Object);
+  expect(error).toMatchObject(tshdRpcErrorObjectMatcher);
+});
+
+test('response error is cloned as an object in a duplex call', async () => {
+  const rejectedPromise = () => Promise.reject(getRpcError());
+  const errorEmitter = new EventEmitter();
+  const fakeCall: () => DuplexStreamingCall = jest
+    .fn()
+    .mockImplementation(() => ({
+      responses: {
+        onNext: callback => {
+          errorEmitter.on('', error => callback(undefined, error, true));
+          return () => errorEmitter.off('', callback);
+        },
+        onError: callback => {
+          errorEmitter.on('', error => callback(error));
+          return () => errorEmitter.off('', callback);
+        },
+      } as Pick<RpcOutputStream, 'onNext' | 'onError'>,
+      then: rejectedPromise,
+    }));
+  const client = cloneClient(
+    new MockServiceMethod(
+      {
+        clientStreaming: true,
+        serverStreaming: true,
+      },
+      fakeCall
+    )
+  );
+  const res = client.fakeMethod();
+  const onNext = jest.fn();
+  const onError = jest.fn();
+  res.responses.onNext(onNext);
+  res.responses.onError(onError);
+
+  errorEmitter.emit('', getRpcError());
+  expect(onNext).toHaveBeenCalledWith(
+    undefined,
+    tshdRpcErrorObjectMatcher,
+    true
+  );
+  expect(onError).toHaveBeenCalledWith(tshdRpcErrorObjectMatcher);
+
+  let error: unknown;
+  try {
+    await res.then();
+  } catch (e) {
+    error = e;
+  }
+
+  expect(Object.getPrototypeOf(error).constructor).toEqual(Object);
+  expect(error).toMatchObject(tshdRpcErrorObjectMatcher);
+});
+
+test.each([
+  {
+    name: 'is not a tshd error',
+    errorToCheck: { name: 'Error' },
+    statusCodeToCheck: undefined,
+    expectTshdRpcError: false,
+  },
+  {
+    name: 'is a tshd error',
+    errorToCheck: { name: 'TshdRpcError' },
+    statusCodeToCheck: undefined,
+    expectTshdRpcError: true,
+  },
+  {
+    name: 'is a tshd error with a status code',
+    errorToCheck: { name: 'TshdRpcError', code: 'PERMISSION_DENIED' },
+    statusCodeToCheck: 'PERMISSION_DENIED',
+    expectTshdRpcError: true,
+  },
+])('$name', testCase => {
+  expect(
+    isTshdRpcError(testCase.errorToCheck, testCase.statusCodeToCheck)
+  ).toBe(testCase.expectTshdRpcError);
+});
diff --git a/web/packages/teleterm/src/services/tshd/cloneableClient.ts b/web/packages/teleterm/src/services/tshd/cloneableClient.ts
new file mode 100644
index 0000000000000..b4666400b2599
--- /dev/null
+++ b/web/packages/teleterm/src/services/tshd/cloneableClient.ts
@@ -0,0 +1,369 @@
+/**
+ * Teleport
+ * Copyright (C) 2024 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+import {
+  RpcInputStream,
+  UnaryCall,
+  ClientStreamingCall,
+  ServerStreamingCall,
+  DuplexStreamingCall,
+  RpcOutputStream,
+  RpcError,
+  RpcOptions,
+  ServiceInfo,
+} from '@protobuf-ts/runtime-rpc';
+
+/**
+ * Transforms a class-based client to an object that can be passed
+ * over the context bridge.
+ * Errors returned from its methods are converted to `TshdRpcError` objects.
+ *
+ * Why is such transformation needed?
+ * In Electron, preload and renderer contexts are isolated with a context bridge.
+ * The preload runs the tshd client, and the renderer runs the React app.
+ * That means that whatever the tshd client returns has to pass through that bridge.
+ *
+ * In this particular scenario, this causes all custom properties on `Error` to be lost.
+ * To remedy this, we convert them to custom `TshdRpcError`
+ * objects for each call type.
+ * Additionally, the client itself needs to be converted to an object
+ * (the client generated by `protobuf-ts` is class-based).
+ * Class methods are lost after crossing the bridge.
+ *
+ * Read more https://www.electronjs.org/docs/latest/api/context-bridge.
+ */
+export function cloneClient<Client extends ServiceInfo>(
+  classClient: Client
+): CloneableClient<Client> {
+  return classClient.methods.reduce<CloneableClient<Client>>(
+    (objectClient, method) => {
+      const methodName = method.localName;
+      // To avoid a problem with `this`
+      // being lost, we use wrap it into an arrow function.
+      const classMethod = (...args) => classClient[methodName](...args);
+      // unary
+      if (!method.clientStreaming && !method.serverStreaming) {
+        objectClient[methodName] = cloneUnaryCall(classMethod);
+      }
+      // client streaming
+      if (method.clientStreaming && !method.serverStreaming) {
+        objectClient[methodName] = cloneClientStreamingCall(classMethod);
+      }
+      // server streaming
+      if (!method.clientStreaming && method.serverStreaming) {
+        objectClient[methodName] = cloneServerStreamingCall(classMethod);
+      }
+      // duplex
+      if (method.clientStreaming && method.serverStreaming) {
+        objectClient[methodName] = cloneDuplexStreamingCall(classMethod);
+      }
+      return objectClient;
+    },
+    {} as CloneableClient<Client>
+  );
+}
+
+/**
+ * Converts a regular `AbortSignal` to the signal
+ * that can be passed over the context bridge.
+ */
+export function cloneAbortSignal(signal: AbortSignal): CloneableAbortSignal {
+  const cloned: Writeable<CloneableAbortSignal> = {
+    canBePassedThroughContextBridge: true,
+    onabort: (...args) => signal.onabort(...args),
+    throwIfAborted: () => signal.throwIfAborted(),
+    reason: signal.reason,
+    aborted: signal.aborted,
+    dispatchEvent: (...args) => signal.dispatchEvent(...args),
+    addEventListener: (type, listener, options) =>
+      signal.addEventListener(type, listener, options),
+    removeEventListener: (type, listener, options) =>
+      signal.removeEventListener(type, listener, options),
+    eventListeners: (...args) => signal.eventListeners(...args),
+    removeAllListeners: (...args) => signal.removeAllListeners(...args),
+  };
+
+  signal.addEventListener(
+    'abort',
+    () => {
+      cloned.reason = signal.reason;
+      cloned.aborted = signal.aborted;
+    },
+    {
+      // Catch the abort event before other listeners to update properties.
+      capture: true,
+      once: true,
+    }
+  );
+
+  return cloned;
+}
+
+/**
+ * An abort signal that can be passed over the context bridge.
+ * Can be produced with `cloneAbortSignal()`.
+ */
+export type CloneableAbortSignal = AbortSignal & {
+  /**
+   * It's an arbitrary property that lets us distinguish `CloneableAbortSignal`
+   * from `AbortSignal` on type level.
+   */
+  canBePassedThroughContextBridge: true;
+};
+
+type Writeable<T> = {
+  -readonly [P in keyof T]: T[P];
+};
+
+/**
+ * User-provided options for Remote Procedure Calls.
+ *
+ * The only difference from the original `RpcOptions` is the abort signal.
+ * The regular one is replaced with `CloneableAbortSignal`
+ * that can be passed over the context bridge.
+ */
+export type CloneableRpcOptions = Omit<RpcOptions, 'abort'> & {
+  abort?: CloneableAbortSignal;
+};
+
+/**
+ * Describes a client that can be passed over the context bridge.
+ * Errors returned from its methods are converted to `TshdRpcError` objects.
+ */
+export type CloneableClient<Client> = {
+  [Method in keyof Client]: Client[Method] extends (
+    ...args: infer Args
+  ) => infer ReturnType
+    ? (
+        ...args: { [K in keyof Args]: ReplaceRpcOptions<Args[K]> }
+      ) => CloneableCallTypes<ReturnType>
+    : never;
+};
+
+type CloneableCallTypes<T> =
+  T extends UnaryCall<infer Req, infer Res>
+    ? CloneableUnaryCall<Req, Res>
+    : T extends ClientStreamingCall<infer Req, infer Res>
+      ? CloneableClientStreamingCall<Req, Res>
+      : T extends ServerStreamingCall<infer Req, infer Res>
+        ? CloneableServerStreamingCall<Req, Res>
+        : T extends DuplexStreamingCall<infer Req, infer Res>
+          ? CloneableDuplexStreamingCall<Req, Res>
+          : never;
+
+type ReplaceRpcOptions<T> = T extends RpcOptions ? CloneableRpcOptions : T;
+
+type CloneableUnaryCall<I extends object, O extends object> = Pick<
+  UnaryCall<I, O>,
+  'then'
+>;
+
+type CloneableClientStreamingCall<I extends object, O extends object> = Pick<
+  ClientStreamingCall<I, O>,
+  'requests' | 'then'
+>;
+
+type CloneableServerStreamingCall<I extends object, O extends object> = Pick<
+  ServerStreamingCall<I, O>,
+  'responses' | 'then'
+>;
+
+type CloneableDuplexStreamingCall<I extends object, O extends object> = Pick<
+  DuplexStreamingCall<I, O>,
+  'requests' | 'responses' | 'then'
+>;
+
+function cloneUnaryCall<I extends object, O extends object>(
+  call: (input: I, options?: CloneableRpcOptions) => UnaryCall<I, O>
+): (input: I, options?: CloneableRpcOptions) => CloneableUnaryCall<I, O> {
+  return (input, options) => {
+    const output = call(input, options);
+    return { then: cloneThenRejection(output.then.bind(output)) };
+  };
+}
+
+function cloneClientStreamingCall<I extends object, O extends object>(
+  call: (options?: CloneableRpcOptions) => ClientStreamingCall<I, O>
+): (options?: CloneableRpcOptions) => CloneableClientStreamingCall<I, O> {
+  return options => {
+    const output = call(options);
+    return {
+      requests: cloneRequests(output.requests),
+      then: cloneThenRejection(output.then.bind(output)),
+    };
+  };
+}
+
+function cloneServerStreamingCall<I extends object, O extends object>(
+  call: (input: I, options?: CloneableRpcOptions) => ServerStreamingCall<I, O>
+): (
+  input: I,
+  options?: CloneableRpcOptions
+) => CloneableServerStreamingCall<I, O> {
+  return (input, options) => {
+    const output = call(input, options);
+    return {
+      responses: cloneResponses(output.responses),
+      then: cloneThenRejection(output.then.bind(output)),
+    };
+  };
+}
+
+function cloneDuplexStreamingCall<I extends object, O extends object>(
+  call: (options?: CloneableRpcOptions) => DuplexStreamingCall<I, O>
+): (options?: CloneableRpcOptions) => CloneableDuplexStreamingCall<I, O> {
+  return options => {
+    const output = call(options);
+    return {
+      requests: cloneRequests(output.requests),
+      responses: cloneResponses(output.responses),
+      then: cloneThenRejection(output.then.bind(output)),
+    };
+  };
+}
+
+/**
+ * An object that is thrown when an RPC fails.
+ * Preserves properties that would normally be lost after `Error` has passed
+ * through the context bridge.
+ */
+export type TshdRpcError = Pick<
+  RpcError,
+  'message' | 'stack' | 'cause' | 'code'
+> & {
+  name: 'TshdRpcError';
+  /**
+   * `true` if the error can be resolved by logging in again.
+   * It is taken from the error metadata.
+   */
+  isResolvableWithRelogin: boolean;
+};
+
+/**
+ * gRPC status codes.
+ * @see https://grpc.io/docs/guides/status-codes
+ */
+type RpcStatusCode =
+  | 'CANCELLED'
+  | 'UNKNOWN'
+  | 'INVALID_ARGUMENT'
+  | 'DEADLINE_EXCEEDED'
+  | 'NOT_FOUND'
+  | 'ALREADY_EXISTS'
+  | 'PERMISSION_DENIED'
+  | 'RESOURCE_EXHAUSTED'
+  | 'FAILED_PRECONDITION'
+  | 'ABORTED'
+  | 'OUT_OF_RANGE'
+  | 'UNIMPLEMENTED'
+  | 'INTERNAL'
+  | 'UNAVAILABLE'
+  | 'DATA_LOSS'
+  | 'UNAUTHENTICATED';
+
+/**
+ * Checks if the given value is a `TshdRpcError`.
+ * It's meant to be used to check errors received from a gRPC client
+ * that was produced with `cloneClient()`.
+ * @param error - Error to check.
+ * @param statusCode - Optionally, a gRPC status code to compare.
+ */
+export function isTshdRpcError(
+  error: unknown,
+  statusCode?: RpcStatusCode
+): error is TshdRpcError {
+  const isTshdRpcError = error['name'] === 'TshdRpcError';
+  if (!isTshdRpcError) {
+    return false;
+  }
+  if (statusCode) {
+    return (error as TshdRpcError).code === statusCode;
+  }
+  return true;
+}
+
+function cloneError(error: unknown): TshdRpcError | Error | unknown {
+  if (error instanceof RpcError) {
+    return {
+      name: 'TshdRpcError',
+      message: error.message,
+      stack: error.stack,
+      cause: error.cause,
+      code: error.code,
+      isResolvableWithRelogin: error.meta['is-resolvable-with-relogin'] === '1',
+    } satisfies TshdRpcError;
+  }
+
+  if (error instanceof Error) {
+    return {
+      name: error.name,
+      message: error.message,
+      stack: error.stack,
+      cause: error.cause,
+    } satisfies Error;
+  }
+
+  return error;
+}
+
+function cloneRequests<O extends object>(
+  original: RpcInputStream<O>
+): RpcInputStream<O> {
+  return {
+    send: (...args) => original.send(...args),
+    complete: (...args) => original.complete(...args),
+  };
+}
+
+function cloneResponses<O extends object>(
+  original: RpcOutputStream<O>
+): RpcOutputStream<O> {
+  return {
+    [Symbol.asyncIterator]: original[Symbol.asyncIterator],
+    onMessage: (...args) => original.onMessage(...args),
+    onComplete: (...args) => original.onComplete(...args),
+    onError: errorCallback =>
+      original.onError(e => errorCallback(cloneError(e) as Error)),
+    onNext: callback =>
+      original.onNext((message, error, complete) =>
+        callback(message, cloneError(error) as Error, complete)
+      ),
+  };
+}
+
+async function clonePromiseRejection<TResult>(
+  promise: Promise<TResult>
+): Promise<TResult> {
+  try {
+    return await promise;
+  } catch (e) {
+    throw cloneError(e);
+  }
+}
+
+function cloneThenRejection<TResult>(
+  then: Promise<TResult>['then']
+): Promise<TResult>['then'] {
+  return (onFulfilled, onRejected) => {
+    // If onRejected callback is provided, then it will handle the rejection.
+    if (onRejected) {
+      return then(onFulfilled, reason => onRejected(cloneError(reason)));
+    }
+    return clonePromiseRejection(then(onFulfilled));
+  };
+}
diff --git a/web/packages/teleterm/src/services/tshd/createAbortController.test.ts b/web/packages/teleterm/src/services/tshd/createAbortController.test.ts
deleted file mode 100644
index 1c54fd6f633a9..0000000000000
--- a/web/packages/teleterm/src/services/tshd/createAbortController.test.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import createAbortController from './createAbortController';
-
-test('abort controller emits the abort event only once', () => {
-  const listener = jest.fn();
-  const controller = createAbortController();
-
-  controller.signal.addEventListener(listener);
-  controller.abort();
-
-  // This makes sure that the implementation doesn't depend solely on `emitter.once('abort', cb)` to
-  // implement this. Once a signal has been aborted, its state changes and it cannot be reused.
-  //
-  // This mirrors the browser implementation.
-  const listenerAddedAfterAbort = jest.fn();
-  controller.signal.addEventListener(listenerAddedAfterAbort);
-  controller.abort();
-
-  expect(listener).toHaveBeenCalledTimes(1);
-  expect(listenerAddedAfterAbort).not.toHaveBeenCalled();
-});
-
-test('abort updates signal.aborted', () => {
-  const controller = createAbortController();
-  expect(controller.signal.aborted).toBe(false);
-
-  controller.abort();
-  expect(controller.signal.aborted).toBe(true);
-});
diff --git a/web/packages/teleterm/src/services/tshd/createAbortController.ts b/web/packages/teleterm/src/services/tshd/createAbortController.ts
deleted file mode 100644
index b0bcf19ed83f9..0000000000000
--- a/web/packages/teleterm/src/services/tshd/createAbortController.ts
+++ /dev/null
@@ -1,65 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-// This file works both in the browser and Node.js.
-// In Node environment, it imports the built-in events module.
-// In browser environment, it imports the events package.
-import { EventEmitter } from 'events';
-
-import { TshAbortController } from './types';
-
-/**
- * Creates a version of AbortController that can be passed through Electron contextBridge
- */
-export default function createAbortController(): TshAbortController {
-  const emitter = new EventEmitter();
-
-  const signal = {
-    aborted: false,
-    // TODO(ravicious): Consider aligning the interface of TshAbortSignal with the interface of
-    // browser's AbortSignal so that those two can be used interchangeably, for example in the wait
-    // function from the shared package.
-    //
-    // TshAbortSignal doesn't accept the event name as the first argument.
-    //
-    // TshAbortSignal still needs to have some kind of a unique property so that Connect functions
-    // can enforce on a type level that they can only accept TshAbortSignal. Regular abort signals
-    // won't work in Connect since abort signals are often passed through the context bridge.
-    addEventListener(cb: (...args: any[]) => void) {
-      emitter.once('abort', cb);
-    },
-
-    removeEventListener(cb: (...args: any[]) => void) {
-      emitter.removeListener('abort', cb);
-    },
-  };
-
-  return {
-    signal,
-    abort() {
-      // Once abort() has been called and the signal becomes aborted, it cannot be reused.
-      // https://dom.spec.whatwg.org/#abortsignal-signal-abort
-      if (signal.aborted) {
-        return;
-      }
-
-      signal.aborted = true;
-      emitter.emit('abort');
-    },
-  };
-}
diff --git a/web/packages/teleterm/src/services/tshd/createClient.ts b/web/packages/teleterm/src/services/tshd/createClient.ts
index c99a1b67b67d2..46a0bba232298 100644
--- a/web/packages/teleterm/src/services/tshd/createClient.ts
+++ b/web/packages/teleterm/src/services/tshd/createClient.ts
@@ -17,18 +17,9 @@
  */
 
 import grpc from '@grpc/grpc-js';
+import { GrpcTransport } from '@protobuf-ts/grpc-transport';
 import * as api from 'gen-proto-ts/teleport/lib/teleterm/v1/service_pb';
-import { TerminalServiceClient } from 'gen-proto-ts/teleport/lib/teleterm/v1/service_pb.grpc-client';
-import { UserPreferences } from 'gen-proto-ts/teleport/userpreferences/v1/userpreferences_pb';
-import {
-  ClusterUserPreferences,
-  PinnedResourcesUserPreferences,
-} from 'gen-proto-ts/teleport/userpreferences/v1/cluster_preferences_pb';
-import { UnifiedResourcePreferences } from 'gen-proto-ts/teleport/userpreferences/v1/unified_resource_preferences_pb';
-import {
-  AccessRequest,
-  ResourceID,
-} from 'gen-proto-ts/teleport/lib/teleterm/v1/access_request_pb';
+import { TerminalServiceClient } from 'gen-proto-ts/teleport/lib/teleterm/v1/service_pb.client';
 
 import Logger from 'teleterm/logger';
 import * as uri from 'teleterm/ui/uri';
@@ -40,41 +31,30 @@ import {
   resourceOneOfIsServer,
 } from 'teleterm/helpers';
 
-import { createFileTransferStream } from './createFileTransferStream';
-import { loggingInterceptor } from './interceptors';
+import { CloneableAbortSignal, cloneClient } from './cloneableClient';
 import * as types from './types';
 import {
-  ReportUsageEventRequest,
-  UnifiedResourceResponse,
   UpdateHeadlessAuthenticationStateParams,
+  UnifiedResourceResponse,
 } from './types';
-import createAbortController from './createAbortController';
-import { mapUsageEvent } from './mapUsageEvent';
+import { loggingInterceptor } from './interceptors';
 
 export function createTshdClient(
   addr: string,
   credentials: grpc.ChannelCredentials
 ): types.TshdClient {
   const logger = new Logger('tshd');
-  const tshd = new TerminalServiceClient(addr, credentials, {
+  const transport = new GrpcTransport({
+    host: addr,
+    channelCredentials: credentials,
     interceptors: [loggingInterceptor(logger)],
   });
+  const tshd = cloneClient(new TerminalServiceClient(transport));
 
   // Create a client instance that could be shared with the  renderer (UI) via Electron contextBridge
   const client = {
-    createAbortController,
-
     async logout(clusterUri: uri.RootClusterUri) {
-      const req = api.LogoutRequest.create({ clusterUri });
-      return new Promise<void>((resolve, reject) => {
-        tshd.logout(req, err => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve();
-          }
-        });
-      });
+      await tshd.logout({ clusterUri });
     },
 
     async getKubes({
@@ -86,28 +66,17 @@ export function createTshdClient(
       startKey,
       limit,
     }: types.GetResourcesParams) {
-      const req = api.GetKubesRequest.create({
+      const { response } = await tshd.getKubes({
         clusterUri,
         searchAsRoles,
         startKey,
         search,
         query,
         limit,
+        sortBy: sort ? `${sort.fieldName}:${sort.dir.toLowerCase()}` : '',
       });
 
-      if (sort) {
-        req.sortBy = `${sort.fieldName}:${sort.dir.toLowerCase()}`;
-      }
-
-      return new Promise<types.GetKubesResponse>((resolve, reject) => {
-        tshd.getKubes(req, (err, response) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve(response as types.GetKubesResponse);
-          }
-        });
-      });
+      return response as types.GetKubesResponse;
     },
 
     async getApps({
@@ -119,71 +88,40 @@ export function createTshdClient(
       startKey,
       limit,
     }: types.GetResourcesParams) {
-      const req = api.GetAppsRequest.create({
+      const { response } = await tshd.getApps({
         clusterUri,
         searchAsRoles,
         startKey,
         search,
         query,
         limit,
+        sortBy: sort ? `${sort.fieldName}:${sort.dir.toLowerCase()}` : '',
       });
 
-      if (sort) {
-        req.sortBy = `${sort.fieldName}:${sort.dir.toLowerCase()}`;
-      }
-
-      return new Promise<types.GetAppsResponse>((resolve, reject) => {
-        tshd.getApps(req, (err, response) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve(response as types.GetAppsResponse);
-          }
-        });
-      });
+      return response as types.GetAppsResponse;
     },
 
     async listGateways() {
-      const req = api.ListGatewaysRequest.create();
-      return new Promise<types.Gateway[]>((resolve, reject) => {
-        tshd.listGateways(req, (err, response) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve(response.gateways as types.Gateway[]);
-          }
-        });
-      });
+      const { response } = await tshd.listGateways({});
+
+      return response.gateways as types.Gateway[];
     },
 
     async listLeafClusters(clusterUri: uri.RootClusterUri) {
-      const req = api.ListLeafClustersRequest.create({ clusterUri });
-      return new Promise<types.Cluster[]>((resolve, reject) => {
-        tshd.listLeafClusters(req, (err, response) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve(response.clusters as types.Cluster[]);
-          }
-        });
-      });
+      const { response } = await tshd.listLeafClusters({ clusterUri });
+
+      return response.clusters as types.Cluster[];
     },
 
-    async listRootClusters(abortSignal?: types.TshAbortSignal) {
-      return withAbort(abortSignal, callRef => {
-        return new Promise<types.Cluster[]>((resolve, reject) => {
-          callRef.current = tshd.listRootClusters(
-            api.ListClustersRequest.create(),
-            (err, response) => {
-              if (err) {
-                reject(err);
-              } else {
-                resolve(response.clusters as types.Cluster[]);
-              }
-            }
-          );
-        });
-      });
+    async listRootClusters(abortSignal?: CloneableAbortSignal) {
+      const { response } = await tshd.listRootClusters(
+        {},
+        {
+          abort: abortSignal,
+        }
+      );
+
+      return response.clusters as types.Cluster[];
     },
 
     async getDatabases({
@@ -195,70 +133,38 @@ export function createTshdClient(
       startKey,
       limit,
     }: types.GetResourcesParams) {
-      const req = api.GetDatabasesRequest.create({
+      const { response } = await tshd.getDatabases({
         clusterUri,
         searchAsRoles,
         startKey,
         search,
         query,
         limit,
+        sortBy: sort ? `${sort.fieldName}:${sort.dir.toLowerCase()}` : '',
       });
 
-      if (sort) {
-        req.sortBy = `${sort.fieldName}:${sort.dir.toLowerCase()}`;
-      }
-
-      return new Promise<types.GetDatabasesResponse>((resolve, reject) => {
-        tshd.getDatabases(req, (err, response) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve(response as types.GetDatabasesResponse);
-          }
-        });
-      });
+      return response as types.GetDatabasesResponse;
     },
 
     async listDatabaseUsers(dbUri: uri.DatabaseUri) {
-      const req = api.ListDatabaseUsersRequest.create({ dbUri });
-      return new Promise<string[]>((resolve, reject) => {
-        tshd.listDatabaseUsers(req, (err, response) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve(response.users);
-          }
-        });
-      });
+      const { response } = await tshd.listDatabaseUsers({ dbUri });
+
+      return response.users;
     },
 
     async getAccessRequest(clusterUri: uri.RootClusterUri, requestId: string) {
-      const req = api.GetAccessRequestRequest.create({
+      const { response } = await tshd.getAccessRequest({
         clusterUri,
         accessRequestId: requestId,
       });
-      return new Promise<types.AccessRequest>((resolve, reject) => {
-        tshd.getAccessRequest(req, (err, response) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve(response.request);
-          }
-        });
-      });
+
+      return response.request;
     },
 
     async getAccessRequests(clusterUri: uri.RootClusterUri) {
-      const req = api.GetAccessRequestsRequest.create({ clusterUri });
-      return new Promise<types.AccessRequest[]>((resolve, reject) => {
-        tshd.getAccessRequests(req, (err, response) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve(response.requests);
-          }
-        });
-      });
+      const { response } = await tshd.getAccessRequests({ clusterUri });
+
+      return response.requests;
     },
 
     async getServers({
@@ -270,59 +176,32 @@ export function createTshdClient(
       startKey,
       limit,
     }: types.GetResourcesParams) {
-      const req = api.GetServersRequest.create({
+      const { response } = await tshd.getServers({
         clusterUri,
         searchAsRoles,
         startKey,
         search,
         query,
         limit,
+        sortBy: sort ? `${sort.fieldName}:${sort.dir.toLowerCase()}` : '',
       });
-
-      if (sort) {
-        req.sortBy = `${sort.fieldName}:${sort.dir.toLowerCase()}`;
-      }
-
-      return new Promise<types.GetServersResponse>((resolve, reject) => {
-        tshd.getServers(req, (err, response) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve(response as types.GetServersResponse);
-          }
-        });
-      });
+      return response as types.GetServersResponse;
     },
 
     async createAccessRequest(params: types.CreateAccessRequestParams) {
-      return new Promise<AccessRequest>((resolve, reject) => {
-        tshd.createAccessRequest(params, (err, response) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve(response.request);
-          }
-        });
-      });
+      const { response } = await tshd.createAccessRequest(params);
+
+      return response.request;
     },
 
     async deleteAccessRequest(
       clusterUri: uri.RootClusterUri,
       requestId: string
     ) {
-      const req = api.DeleteAccessRequestRequest.create({
+      await tshd.deleteAccessRequest({
         rootClusterUri: clusterUri,
         accessRequestId: requestId,
       });
-      return new Promise<void>((resolve, reject) => {
-        tshd.deleteAccessRequest(req, err => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve();
-          }
-        });
-      });
     },
 
     async assumeRole(
@@ -330,27 +209,18 @@ export function createTshdClient(
       requestIds: string[],
       dropIds: string[]
     ) {
-      const req = api.AssumeRoleRequest.create({
+      await tshd.assumeRole({
         rootClusterUri: clusterUri,
         accessRequestIds: requestIds,
         dropRequestIds: dropIds,
       });
-      return new Promise<void>((resolve, reject) => {
-        tshd.assumeRole(req, err => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve();
-          }
-        });
-      });
     },
 
     async reviewAccessRequest(
       clusterUri: uri.RootClusterUri,
       params: types.ReviewAccessRequestParams
     ) {
-      const req = api.ReviewAccessRequestRequest.create({
+      const { response } = await tshd.reviewAccessRequest({
         rootClusterUri: clusterUri,
         accessRequestId: params.id,
         state: params.state,
@@ -358,701 +228,400 @@ export function createTshdClient(
         roles: params.roles,
         assumeStartTime: params.assumeStartTime,
       });
-      return new Promise<types.AccessRequest>((resolve, reject) => {
-        tshd.reviewAccessRequest(req, (err, response) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve(response.request);
-          }
-        });
-      });
+
+      return response.request;
     },
 
     async getRequestableRoles(params: types.GetRequestableRolesParams) {
-      const req = api.GetRequestableRolesRequest.create({
+      const { response } = await tshd.getRequestableRoles({
         clusterUri: params.rootClusterUri,
-        resourceIds: params.resourceIds!.map(({ id, clusterName, kind }) =>
-          ResourceID.create({
-            name: id,
-            clusterName,
-            kind,
-          })
-        ),
+        resourceIds: params.resourceIds!.map(({ id, clusterName, kind }) => ({
+          name: id,
+          clusterName,
+          kind,
+          subResourceName: '',
+        })),
       });
-      return new Promise<types.GetRequestableRolesResponse>(
-        (resolve, reject) => {
-          tshd.getRequestableRoles(req, (err, response) => {
-            if (err) {
-              reject(err);
-            } else {
-              resolve(response);
-            }
-          });
-        }
-      );
+
+      return response;
     },
 
     async addRootCluster(addr: string) {
-      const req = api.AddClusterRequest.create({ name: addr });
-      return new Promise<types.Cluster>((resolve, reject) => {
-        tshd.addCluster(req, (err, response) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve(response as types.Cluster);
-          }
-        });
-      });
+      const { response } = await tshd.addCluster({ name: addr });
+      return response as types.Cluster;
     },
 
     async getCluster(uri: uri.RootClusterUri) {
-      const req = api.GetClusterRequest.create({ clusterUri: uri });
-      return new Promise<types.Cluster>((resolve, reject) => {
-        tshd.getCluster(req, (err, response) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve(response as types.Cluster);
-          }
-        });
-      });
+      const { response } = await tshd.getCluster({ clusterUri: uri });
+      return response as types.Cluster;
     },
 
     async loginLocal(
       params: types.LoginLocalParams,
-      abortSignal?: types.TshAbortSignal
+      abortSignal?: CloneableAbortSignal
     ) {
-      const localParams = api.LoginRequest_LocalParams.create({
-        token: params.token,
-        user: params.username,
-        password: params.password,
-      });
-      return withAbort(abortSignal, callRef => {
-        const req = api.LoginRequest.create({
+      await tshd.login(
+        {
           clusterUri: params.clusterUri,
           params: {
             oneofKind: 'local',
-            local: localParams,
+            local: {
+              token: params.token,
+              user: params.username,
+              password: params.password,
+            },
           },
-        });
-        return new Promise<void>((resolve, reject) => {
-          callRef.current = tshd.login(req, err => {
-            if (err) {
-              reject(err);
-            } else {
-              resolve();
-            }
-          });
-        });
-      });
+        },
+        {
+          abort: abortSignal,
+        }
+      );
     },
 
     async loginSso(
       params: types.LoginSsoParams,
-      abortSignal?: types.TshAbortSignal
+      abortSignal?: CloneableAbortSignal
     ) {
-      const ssoParams = api.LoginRequest_SsoParams.create({
-        providerName: params.providerName,
-        providerType: params.providerType,
-      });
-      return withAbort(abortSignal, callRef => {
-        const req = api.LoginRequest.create({
+      await tshd.login(
+        {
           clusterUri: params.clusterUri,
           params: {
             oneofKind: 'sso',
-            sso: ssoParams,
+            sso: {
+              providerName: params.providerName,
+              providerType: params.providerType,
+            },
           },
-        });
-        return new Promise<void>((resolve, reject) => {
-          callRef.current = tshd.login(req, err => {
-            if (err) {
-              reject(err);
-            } else {
-              resolve();
-            }
-          });
-        });
-      });
+        },
+        { abort: abortSignal }
+      );
     },
 
     async loginPasswordless(
       params: types.LoginPasswordlessParams,
-      abortSignal?: types.TshAbortSignal
+      abortSignal?: CloneableAbortSignal
     ) {
-      return withAbort(abortSignal, callRef => {
-        const streamInitReq =
-          api.LoginPasswordlessRequest_LoginPasswordlessRequestInit.create({
-            clusterUri: params.clusterUri,
-          });
-        const streamReq = api.LoginPasswordlessRequest.create({
+      return new Promise<void>((resolve, reject) => {
+        const stream = tshd.loginPasswordless({
+          abort: abortSignal,
+        });
+
+        let hasDeviceBeenTapped = false;
+
+        // Init the stream.
+        stream.requests.send({
           request: {
             oneofKind: 'init',
-            init: streamInitReq,
+            init: {
+              clusterUri: params.clusterUri,
+            },
           },
         });
-        return new Promise<void>((resolve, reject) => {
-          callRef.current = tshd.loginPasswordless();
-          const stream = callRef.current as grpc.ClientDuplexStream<
-            api.LoginPasswordlessRequest,
-            api.LoginPasswordlessResponse
-          >;
-
-          let hasDeviceBeenTapped = false;
-
-          // Init the stream.
-          stream.write(streamReq);
-
-          stream.on('data', function (response: api.LoginPasswordlessResponse) {
-            switch (response.prompt) {
-              case api.PasswordlessPrompt.PIN:
-                const pinResponse = pin => {
-                  const pinRes =
-                    api.LoginPasswordlessRequest_LoginPasswordlessPINResponse.create(
-                      { pin }
-                    );
-                  stream.write(
-                    api.LoginPasswordlessRequest.create({
-                      request: {
-                        oneofKind: 'pin',
-                        pin: pinRes,
-                      },
-                    })
-                  );
-                };
-
-                params.onPromptCallback({
-                  type: 'pin',
-                  onUserResponse: pinResponse,
+
+        stream.responses.onMessage(function (response) {
+          switch (response.prompt) {
+            case api.PasswordlessPrompt.PIN:
+              const pinResponse = (pin: string) => {
+                stream.requests.send({
+                  request: {
+                    oneofKind: 'pin',
+                    pin: { pin },
+                  },
                 });
-                return;
-
-              case api.PasswordlessPrompt.CREDENTIAL:
-                const credResponse = index => {
-                  const credRes =
-                    api.LoginPasswordlessRequest_LoginPasswordlessCredentialResponse.create(
-                      { index }
-                    );
-                  stream.write(
-                    api.LoginPasswordlessRequest.create({
-                      request: {
-                        oneofKind: 'credential',
-                        credential: credRes,
-                      },
-                    })
-                  );
-                };
-
-                params.onPromptCallback({
-                  type: 'credential',
-                  onUserResponse: credResponse,
-                  data: { credentials: response.credentials || [] },
+              };
+
+              params.onPromptCallback({
+                type: 'pin',
+                onUserResponse: pinResponse,
+              });
+              return;
+
+            case api.PasswordlessPrompt.CREDENTIAL:
+              const credResponse = (index: number) => {
+                stream.requests.send({
+                  request: {
+                    oneofKind: 'credential',
+                    credential: { index },
+                  },
                 });
-                return;
-
-              case api.PasswordlessPrompt.TAP:
-                if (hasDeviceBeenTapped) {
-                  params.onPromptCallback({ type: 'retap' });
-                } else {
-                  hasDeviceBeenTapped = true;
-                  params.onPromptCallback({ type: 'tap' });
-                }
-                return;
-
-              // Following cases should never happen but just in case?
-              case api.PasswordlessPrompt.UNSPECIFIED:
-                stream.cancel();
-                return reject(
-                  new Error('no passwordless prompt was specified')
-                );
-
-              default:
-                stream.cancel();
-                return reject(
-                  new Error(
-                    `passwordless prompt '${response.prompt}' not supported`
-                  )
-                );
-            }
-          });
+              };
+
+              params.onPromptCallback({
+                type: 'credential',
+                onUserResponse: credResponse,
+                data: { credentials: response.credentials || [] },
+              });
+              return;
+
+            case api.PasswordlessPrompt.TAP:
+              if (hasDeviceBeenTapped) {
+                params.onPromptCallback({ type: 'retap' });
+              } else {
+                hasDeviceBeenTapped = true;
+                params.onPromptCallback({ type: 'tap' });
+              }
+              return;
+
+            // Following cases should never happen but just in case?
+            case api.PasswordlessPrompt.UNSPECIFIED:
+              stream.requests.complete();
+              return reject(new Error('no passwordless prompt was specified'));
+
+            default:
+              stream.requests.complete();
+              return reject(
+                new Error(
+                  `passwordless prompt '${response.prompt}' not supported`
+                )
+              );
+          }
+        });
 
-          stream.on('end', function () {
-            resolve();
-          });
+        stream.responses.onComplete(function () {
+          resolve();
+        });
 
-          stream.on('error', function (err: Error) {
-            reject(err);
-          });
+        stream.responses.onError(function (err: Error) {
+          reject(err);
         });
       });
     },
 
     async getAuthSettings(clusterUri: uri.RootClusterUri) {
-      const req = api.GetAuthSettingsRequest.create({ clusterUri });
-      return new Promise<types.AuthSettings>((resolve, reject) => {
-        tshd.getAuthSettings(req, (err, response) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve(response);
-          }
-        });
-      });
+      const { response } = await tshd.getAuthSettings({ clusterUri });
+      return response;
     },
 
     async createGateway(params: types.CreateGatewayParams) {
-      const req = api.CreateGatewayRequest.create({
+      const { response } = await tshd.createGateway({
         targetUri: params.targetUri,
         targetUser: params.user,
         localPort: params.port,
         targetSubresourceName: params.subresource_name,
       });
-      return new Promise<types.Gateway>((resolve, reject) => {
-        tshd.createGateway(req, (err, response) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve(response as types.Gateway);
-          }
-        });
-      });
+
+      return response as types.Gateway;
     },
 
     async removeCluster(clusterUri: uri.RootClusterUri) {
-      const req = api.RemoveClusterRequest.create({ clusterUri });
-      return new Promise<void>((resolve, reject) => {
-        tshd.removeCluster(req, err => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve();
-          }
-        });
-      });
+      await tshd.removeCluster({ clusterUri });
     },
 
     async removeGateway(gatewayUri: uri.GatewayUri) {
-      const req = api.RemoveGatewayRequest.create({ gatewayUri });
-      return new Promise<void>((resolve, reject) => {
-        tshd.removeGateway(req, err => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve();
-          }
-        });
-      });
+      await tshd.removeGateway({ gatewayUri });
     },
 
     async setGatewayTargetSubresourceName(
       gatewayUri: uri.GatewayUri,
       targetSubresourceName = ''
     ) {
-      const req = api.SetGatewayTargetSubresourceNameRequest.create({
+      const { response } = await tshd.setGatewayTargetSubresourceName({
         gatewayUri,
         targetSubresourceName,
       });
-      return new Promise<types.Gateway>((resolve, reject) => {
-        tshd.setGatewayTargetSubresourceName(req, (err, response) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve(response as types.Gateway);
-          }
-        });
-      });
+
+      return response as types.Gateway;
     },
 
     async setGatewayLocalPort(gatewayUri: uri.GatewayUri, localPort: string) {
-      const req = api.SetGatewayLocalPortRequest.create({
+      const { response } = await tshd.setGatewayLocalPort({
         gatewayUri,
         localPort,
       });
-      return new Promise<types.Gateway>((resolve, reject) => {
-        tshd.setGatewayLocalPort(req, (err, response) => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve(response as types.Gateway);
-          }
-        });
-      });
+
+      return response as types.Gateway;
     },
 
     transferFile(
-      options: types.FileTransferRequest,
-      abortSignal: types.TshAbortSignal
+      req: types.FileTransferRequest,
+      abortSignal: CloneableAbortSignal
     ) {
-      const req = api.FileTransferRequest.create({
-        serverUri: options.serverUri,
-        login: options.login,
-        source: options.source,
-        destination: options.destination,
-        direction: options.direction,
+      const stream = tshd.transferFile(req, {
+        abort: abortSignal,
       });
 
-      return createFileTransferStream(tshd.transferFile(req), abortSignal);
+      return {
+        onProgress(callback: (progress: number) => void) {
+          stream.responses.onMessage(data => callback(data.percentage));
+        },
+        onComplete: stream.responses.onComplete,
+        onError: stream.responses.onError,
+      };
     },
 
-    updateTshdEventsServerAddress(address: string) {
-      const req = api.UpdateTshdEventsServerAddressRequest.create({ address });
-      return new Promise<void>((resolve, reject) => {
-        tshd.updateTshdEventsServerAddress(req, err => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve();
-          }
-        });
-      });
+    async updateTshdEventsServerAddress(address: string) {
+      await tshd.updateTshdEventsServerAddress({ address });
     },
 
-    reportUsageEvent(event: ReportUsageEventRequest) {
-      const req = mapUsageEvent(event);
-      return new Promise<void>((resolve, reject) => {
-        tshd.reportUsageEvent(req, err => {
-          if (err) {
-            reject(err);
-          } else {
-            resolve();
-          }
-        });
-      });
-    },
+    reportUsageEvent: tshd.reportUsageEvent,
 
-    createConnectMyComputerRole(rootClusterUri: uri.RootClusterUri) {
-      const req = api.CreateConnectMyComputerRoleRequest.create({
+    async createConnectMyComputerRole(rootClusterUri: uri.RootClusterUri) {
+      const { response } = await tshd.createConnectMyComputerRole({
         rootClusterUri,
       });
 
-      return new Promise<types.CreateConnectMyComputerRoleResponse>(
-        (resolve, reject) => {
-          tshd.createConnectMyComputerRole(req, (err, response) => {
-            if (err) {
-              reject(err);
-            } else {
-              resolve(response);
-            }
-          });
-        }
-      );
+      return response;
     },
 
-    createConnectMyComputerNodeToken(uri: uri.RootClusterUri) {
-      return new Promise<types.CreateConnectMyComputerNodeTokenResponse>(
-        (resolve, reject) => {
-          tshd.createConnectMyComputerNodeToken(
-            api.CreateConnectMyComputerNodeTokenRequest.create({
-              rootClusterUri: uri,
-            }),
-            (err, response) => {
-              if (err) {
-                reject(err);
-              } else {
-                resolve(response);
-              }
-            }
-          );
-        }
-      );
+    async createConnectMyComputerNodeToken(uri: uri.RootClusterUri) {
+      const { response } = await tshd.createConnectMyComputerNodeToken({
+        rootClusterUri: uri,
+      });
+
+      return response;
     },
 
-    waitForConnectMyComputerNodeJoin(
+    async waitForConnectMyComputerNodeJoin(
       uri: uri.RootClusterUri,
-      abortSignal: types.TshAbortSignal
+      abortSignal: CloneableAbortSignal
     ) {
-      const req = api.WaitForConnectMyComputerNodeJoinRequest.create({
-        rootClusterUri: uri,
-      });
-
-      return withAbort(
-        abortSignal,
-        callRef =>
-          new Promise<types.WaitForConnectMyComputerNodeJoinResponse>(
-            (resolve, reject) => {
-              callRef.current = tshd.waitForConnectMyComputerNodeJoin(
-                req,
-                (err, response) => {
-                  if (err) {
-                    reject(err);
-                  } else {
-                    resolve(
-                      response as types.WaitForConnectMyComputerNodeJoinResponse
-                    );
-                  }
-                }
-              );
-            }
-          )
+      const { response } = await tshd.waitForConnectMyComputerNodeJoin(
+        {
+          rootClusterUri: uri,
+        },
+        {
+          abort: abortSignal,
+        }
       );
+
+      return response as types.WaitForConnectMyComputerNodeJoinResponse;
     },
 
-    deleteConnectMyComputerNode(uri: uri.RootClusterUri) {
-      return new Promise<void>((resolve, reject) => {
-        tshd.deleteConnectMyComputerNode(
-          api.DeleteConnectMyComputerNodeRequest.create({
-            rootClusterUri: uri,
-          }),
-          err => {
-            if (err) {
-              reject(err);
-            } else {
-              resolve();
-            }
-          }
-        );
+    async deleteConnectMyComputerNode(uri: uri.RootClusterUri) {
+      await tshd.deleteConnectMyComputerNode({
+        rootClusterUri: uri,
       });
     },
 
-    getConnectMyComputerNodeName(uri: uri.RootClusterUri) {
-      return new Promise<string>((resolve, reject) => {
-        tshd.getConnectMyComputerNodeName(
-          api.GetConnectMyComputerNodeNameRequest.create({
-            rootClusterUri: uri,
-          }),
-          (err, response) => {
-            if (err) {
-              reject(err);
-            } else {
-              resolve(response.name as uri.ServerUri);
-            }
-          }
-        );
+    async getConnectMyComputerNodeName(uri: uri.RootClusterUri) {
+      const { response } = await tshd.getConnectMyComputerNodeName({
+        rootClusterUri: uri,
       });
+
+      return response.name as uri.ServerUri;
     },
 
-    updateHeadlessAuthenticationState(
+    async updateHeadlessAuthenticationState(
       params: UpdateHeadlessAuthenticationStateParams,
-      abortSignal?: types.TshAbortSignal
+      abortSignal?: CloneableAbortSignal
     ) {
-      return withAbort(abortSignal, callRef => {
-        const req = api.UpdateHeadlessAuthenticationStateRequest.create({
-          rootClusterUri: params.rootClusterUri,
-          headlessAuthenticationId: params.headlessAuthenticationId,
-          state: params.state,
-        });
-
-        return new Promise<void>((resolve, reject) => {
-          callRef.current = tshd.updateHeadlessAuthenticationState(req, err => {
-            if (err) {
-              reject(err);
-            } else {
-              resolve();
-            }
-          });
-        });
+      await tshd.updateHeadlessAuthenticationState(params, {
+        abort: abortSignal,
       });
     },
 
-    listUnifiedResources(
+    async listUnifiedResources(
       params: types.ListUnifiedResourcesRequest,
-      abortSignal?: types.TshAbortSignal
+      abortSignal?: CloneableAbortSignal
     ) {
-      return withAbort(abortSignal, callRef => {
-        const req = api.ListUnifiedResourcesRequest.create({
-          clusterUri: params.clusterUri,
-          limit: params.limit,
-          kinds: params.kinds,
-          startKey: params.startKey,
-          search: params.search,
-          query: params.query,
-          pinnedOnly: params.pinnedOnly,
-          searchAsRoles: params.searchAsRoles,
-        });
-        if (params.sortBy) {
-          req.sortBy = api.SortBy.create({
-            field: params.sortBy.field,
-            isDesc: params.sortBy.isDesc,
-          });
-        }
+      const { response } = await tshd.listUnifiedResources(params, {
+        abort: abortSignal,
+      });
+      return {
+        nextKey: response.nextKey,
+        resources: response.resources
+          .map(p => {
+            if (resourceOneOfIsServer(p.resource)) {
+              return {
+                kind: 'server',
+                resource: p.resource.server,
+              };
+            }
 
-        return new Promise<types.ListUnifiedResourcesResponse>(
-          (resolve, reject) => {
-            callRef.current = tshd.listUnifiedResources(req, (err, res) => {
-              if (err) {
-                reject(err);
-              } else {
-                resolve({
-                  nextKey: res.nextKey,
-                  resources: res.resources
-                    .map(p => {
-                      if (resourceOneOfIsServer(p.resource)) {
-                        return {
-                          kind: 'server',
-                          resource: p.resource.server,
-                        };
-                      }
-
-                      if (resourceOneOfIsDatabase(p.resource)) {
-                        return {
-                          kind: 'database',
-                          resource: p.resource.database,
-                        };
-                      }
-
-                      if (resourceOneOfIsApp(p.resource)) {
-                        return {
-                          kind: 'app',
-                          resource: p.resource.app,
-                        };
-                      }
-
-                      if (resourceOneOfIsKube(p.resource)) {
-                        return {
-                          kind: 'kube',
-                          resource: p.resource.kube,
-                        };
-                      }
-
-                      logger.info(
-                        `Ignoring unsupported resource ${JSON.stringify(p)}.`
-                      );
-                    })
-                    .filter(Boolean) as UnifiedResourceResponse[],
-                });
-              }
-            });
-          }
-        );
-      });
+            if (resourceOneOfIsDatabase(p.resource)) {
+              return {
+                kind: 'database',
+                resource: p.resource.database,
+              };
+            }
+
+            if (resourceOneOfIsApp(p.resource)) {
+              return {
+                kind: 'app',
+                resource: p.resource.app,
+              };
+            }
+
+            if (resourceOneOfIsKube(p.resource)) {
+              return {
+                kind: 'kube',
+                resource: p.resource.kube,
+              };
+            }
+
+            logger.info(`Ignoring unsupported resource ${JSON.stringify(p)}.`);
+          })
+          .filter(Boolean) as UnifiedResourceResponse[],
+      };
     },
-    getUserPreferences(
+    async getUserPreferences(
       params: api.GetUserPreferencesRequest,
-      abortSignal?: types.TshAbortSignal
+      abortSignal?: CloneableAbortSignal
     ): Promise<api.UserPreferences> {
-      return withAbort(abortSignal, callRef => {
-        const req = api.GetUserPreferencesRequest.create({
-          clusterUri: params.clusterUri,
-        });
-
-        return new Promise((resolve, reject) => {
-          callRef.current = tshd.getUserPreferences(req, (err, response) => {
-            if (err) {
-              reject(err);
-            } else {
-              resolve(response.userPreferences);
-            }
-          });
-        });
+      const { response } = await tshd.getUserPreferences(params, {
+        abort: abortSignal,
       });
+
+      return response.userPreferences;
     },
-    updateUserPreferences(
+    async updateUserPreferences(
       params: api.UpdateUserPreferencesRequest,
-      abortSignal?: types.TshAbortSignal
+      abortSignal?: CloneableAbortSignal
     ): Promise<api.UserPreferences> {
-      const userPreferences = UserPreferences.create();
+      const userPreferences: api.UserPreferences = {};
       if (params.userPreferences.clusterPreferences) {
-        userPreferences.clusterPreferences = ClusterUserPreferences.create({
-          pinnedResources: PinnedResourcesUserPreferences.create({
+        userPreferences.clusterPreferences = {
+          pinnedResources: {
             resourceIds:
               params.userPreferences.clusterPreferences.pinnedResources
                 ?.resourceIds,
-          }),
-        });
+          },
+        };
       }
 
       if (params.userPreferences.unifiedResourcePreferences) {
-        userPreferences.unifiedResourcePreferences =
-          UnifiedResourcePreferences.create({
-            defaultTab:
-              params.userPreferences.unifiedResourcePreferences.defaultTab,
-            viewMode:
-              params.userPreferences.unifiedResourcePreferences.viewMode,
-            labelsViewMode:
-              params.userPreferences.unifiedResourcePreferences.labelsViewMode,
-          });
+        userPreferences.unifiedResourcePreferences = {
+          defaultTab:
+            params.userPreferences.unifiedResourcePreferences.defaultTab,
+          viewMode: params.userPreferences.unifiedResourcePreferences.viewMode,
+          labelsViewMode:
+            params.userPreferences.unifiedResourcePreferences.labelsViewMode,
+        };
       }
 
-      return withAbort(abortSignal, callRef => {
-        const req = api.UpdateUserPreferencesRequest.create({
+      const { response } = await tshd.updateUserPreferences(
+        {
           clusterUri: params.clusterUri,
           userPreferences,
-        });
+        },
+        {
+          abort: abortSignal,
+        }
+      );
 
-        return new Promise((resolve, reject) => {
-          callRef.current = tshd.updateUserPreferences(req, (err, response) => {
-            if (err) {
-              reject(err);
-            } else {
-              resolve(response.userPreferences);
-            }
-          });
-        });
-      });
+      return response.userPreferences;
     },
-    promoteAccessRequest(
+    async promoteAccessRequest(
       params: api.PromoteAccessRequestRequest,
-      abortSignal?: types.TshAbortSignal
+      abortSignal?: CloneableAbortSignal
     ): Promise<types.AccessRequest> {
-      return withAbort(abortSignal, callRef => {
-        const req = api.PromoteAccessRequestRequest.create({
-          rootClusterUri: params.rootClusterUri,
-          accessRequestId: params.accessRequestId,
-          accessListId: params.accessListId,
-          reason: params.reason,
-        });
-
-        return new Promise((resolve, reject) => {
-          callRef.current = tshd.promoteAccessRequest(req, (err, response) => {
-            if (err) {
-              reject(err);
-            } else {
-              resolve(response.request);
-            }
-          });
-        });
+      const { response } = await tshd.promoteAccessRequest(params, {
+        abort: abortSignal,
       });
+      return response.request;
     },
-    getSuggestedAccessLists(
+
+    async getSuggestedAccessLists(
       params: api.GetSuggestedAccessListsRequest,
-      abortSignal?: types.TshAbortSignal
+      abortSignal?: CloneableAbortSignal
     ): Promise<types.AccessList[]> {
-      return withAbort(abortSignal, callRef => {
-        const req = api.GetSuggestedAccessListsRequest.create({
-          rootClusterUri: params.rootClusterUri,
-          accessRequestId: params.accessRequestId,
-        });
-
-        return new Promise((resolve, reject) => {
-          callRef.current = tshd.getSuggestedAccessLists(
-            req,
-            (err, response) => {
-              if (err) {
-                reject(err);
-              } else {
-                resolve(response.accessLists);
-              }
-            }
-          );
-        });
+      const { response } = await tshd.getSuggestedAccessLists(params, {
+        abort: abortSignal,
       });
+
+      return response.accessLists;
     },
   };
 
   return client;
 }
-
-type CallRef = {
-  current: {
-    cancel(): void;
-  } | null;
-};
-
-async function withAbort<T>(
-  sig: types.TshAbortSignal | undefined,
-  cb: (ref: CallRef) => Promise<T>
-) {
-  const ref: CallRef = {
-    current: null,
-  };
-
-  const abort = () => {
-    ref?.current?.cancel();
-  };
-
-  sig?.addEventListener(abort);
-
-  return cb(ref).finally(() => {
-    sig?.removeEventListener(abort);
-  });
-}
diff --git a/web/packages/teleterm/src/services/tshd/createFileTransferStream.ts b/web/packages/teleterm/src/services/tshd/createFileTransferStream.ts
deleted file mode 100644
index d9066526ccfad..0000000000000
--- a/web/packages/teleterm/src/services/tshd/createFileTransferStream.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import { ClientReadableStream } from '@grpc/grpc-js';
-import { FileTransferListeners } from 'shared/components/FileTransfer';
-import { FileTransferProgress } from 'gen-proto-ts/teleport/lib/teleterm/v1/service_pb';
-import * as api from 'gen-proto-ts/teleport/lib/teleterm/v1/service_pb';
-
-import { TshAbortSignal } from './types';
-
-export function createFileTransferStream(
-  stream: ClientReadableStream<FileTransferProgress>,
-  abortSignal: TshAbortSignal
-): FileTransferListeners {
-  abortSignal.addEventListener(() => stream.cancel());
-
-  return {
-    onProgress(callback: (progress: number) => void) {
-      stream.on('data', (data: api.FileTransferProgress) =>
-        callback(data.percentage)
-      );
-    },
-    onComplete(callback: () => void) {
-      stream.on('end', () => {
-        callback();
-        // When stream ends, all listeners can be removed.
-        stream.removeAllListeners();
-      });
-    },
-    onError(callback: (error: Error) => void) {
-      stream.on('error', err => {
-        callback(err);
-        // Due to a bug in grpc-js, the `error` event is also emitted after the `end` event.
-        // This behavior is not correct, only one of them should be emitted.
-        // To fix this, we remove all listeners after the stream ended with an error.
-        stream.removeAllListeners();
-      });
-    },
-  };
-}
diff --git a/web/packages/teleterm/src/services/tshd/errors.ts b/web/packages/teleterm/src/services/tshd/errors.ts
index 605025d5defcc..16660ad9cf2e2 100644
--- a/web/packages/teleterm/src/services/tshd/errors.ts
+++ b/web/packages/teleterm/src/services/tshd/errors.ts
@@ -16,14 +16,9 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-export function isAccessDeniedError(error: Error): boolean {
-  return (error.message as string)?.includes('access denied');
-}
-
-export function isNotFoundError(error: Error): boolean {
-  return (error.message as string)?.includes('NOT_FOUND');
-}
+import { isTshdRpcError } from './cloneableClient';
 
-export function isUnimplementedError(error: Error): boolean {
-  return (error.message as string)?.includes('UNIMPLEMENTED');
+/** @deprecated Use `isTshdRpcError(error, 'UNIMPLEMENTED')`. */
+export function isUnimplementedError(error: unknown): boolean {
+  return isTshdRpcError(error, 'UNIMPLEMENTED');
 }
diff --git a/web/packages/teleterm/src/services/tshd/fixtures/mocks.ts b/web/packages/teleterm/src/services/tshd/fixtures/mocks.ts
index 5ec14cfb8bbec..8da9c38ac2cf7 100644
--- a/web/packages/teleterm/src/services/tshd/fixtures/mocks.ts
+++ b/web/packages/teleterm/src/services/tshd/fixtures/mocks.ts
@@ -55,7 +55,6 @@ export class MockTshClient implements types.TshdClient {
   createAccessRequest: (
     params: types.CreateAccessRequestParams
   ) => Promise<types.AccessRequest>;
-  createAbortController: () => types.TshAbortController;
   addRootCluster: (addr: string) => Promise<types.Cluster>;
 
   listGateways: () => Promise<types.Gateway[]>;
@@ -75,15 +74,15 @@ export class MockTshClient implements types.TshdClient {
   removeCluster = () => Promise.resolve();
   loginLocal: (
     params: types.LoginLocalParams,
-    abortSignal?: types.TshAbortSignal
+    abortSignal?: types.CloneableAbortSignal
   ) => Promise<undefined>;
   loginSso: (
     params: types.LoginSsoParams,
-    abortSignal?: types.TshAbortSignal
+    abortSignal?: types.CloneableAbortSignal
   ) => Promise<undefined>;
   loginPasswordless: (
     params: types.LoginPasswordlessParams,
-    abortSignal?: types.TshAbortSignal
+    abortSignal?: types.CloneableAbortSignal
   ) => Promise<undefined>;
   logout = () => Promise.resolve();
   transferFile: () => undefined;
diff --git a/web/packages/teleterm/src/services/tshd/interceptors.test.ts b/web/packages/teleterm/src/services/tshd/interceptors.test.ts
index f7f119afa7348..0b368e7bb7af7 100644
--- a/web/packages/teleterm/src/services/tshd/interceptors.test.ts
+++ b/web/packages/teleterm/src/services/tshd/interceptors.test.ts
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { InterceptingCall, InterceptorOptions } from '@grpc/grpc-js';
+import { UnaryCall, MethodInfo } from '@protobuf-ts/runtime-rpc';
 
 import Logger from 'teleterm/logger';
 
@@ -31,23 +31,23 @@ it('do not log sensitive info like password', () => {
       warn: () => {},
     }),
   });
-  const interceptor = loggingInterceptor(new Logger())(
-    { method_definition: { path: 'LogIn' } } as InterceptorOptions,
-    () =>
-      ({
-        sendMessageWithContext: () => {},
-      }) as unknown as InterceptingCall
-  );
+  const interceptor = loggingInterceptor(new Logger());
 
-  interceptor.sendMessage({
-    passw: {},
-    userData: {
-      login: 'admin',
-      password: 'admin',
+  interceptor.interceptUnary(
+    () => ({ then: () => Promise.resolve({ response: '' }) }) as UnaryCall,
+    { name: 'LogIn' } as MethodInfo,
+    {
+      passw: {},
+      userData: {
+        login: 'admin',
+        password: 'admin',
+      },
     },
-  });
-
-  expect(infoLogger).toHaveBeenCalledWith(
-    'send: LogIn({"passw":"~FILTERED~","userData":{"login":"admin","password":"~FILTERED~"}})'
+    {}
   );
+
+  expect(infoLogger).toHaveBeenCalledWith('LogIn request:', {
+    passw: '~FILTERED~',
+    userData: { login: 'admin', password: '~FILTERED~' },
+  });
 });
diff --git a/web/packages/teleterm/src/services/tshd/interceptors.ts b/web/packages/teleterm/src/services/tshd/interceptors.ts
index fbabf1636dc49..bed80c9760744 100644
--- a/web/packages/teleterm/src/services/tshd/interceptors.ts
+++ b/web/packages/teleterm/src/services/tshd/interceptors.ts
@@ -16,57 +16,93 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import * as grpc from '@grpc/grpc-js';
+import { RpcInterceptor } from '@protobuf-ts/runtime-rpc';
+
 import { isObject } from 'shared/utils/highbar';
 
 import Logger from 'teleterm/logger';
 
-const SENSITIVE_PROPERTIES = ['passw', 'authClusterId'];
-
-export type UnaryInterceptor = (
-  options: grpc.InterceptorOptions,
-  nextCall: (options: grpc.InterceptorOptions) => grpc.InterceptingCall
-) => grpc.InterceptingCall;
-
-export const loggingInterceptor = (logger: Logger): UnaryInterceptor => {
-  return (options, nextCall) => {
-    const method = options.method_definition.path;
-    const params: grpc.Requester = {
-      start(metadata, listener, next) {
-        next(metadata, {
-          onReceiveMetadata(metadata, next) {
-            next(metadata);
-          },
-
-          onReceiveMessage(message, next) {
-            const json = message ? filterSensitiveProperties(message) : null;
-            logger.info(`receive: ${method} -> (${JSON.stringify(json)})`);
-            next(message);
-          },
-
-          onReceiveStatus(status, next) {
-            if (status.code !== grpc.status.OK) {
-              logger.error(`receive: ${method} -> (${status.details})`);
-            }
-
-            next(status);
-          },
-        });
-      },
-
-      sendMessage(message, next) {
-        logger.info(
-          `send: ${method}(${JSON.stringify(
-            filterSensitiveProperties(message)
-          )})`
-        );
-        next(message);
-      },
-    };
-
-    return new grpc.InterceptingCall(nextCall(options), params);
+const SENSITIVE_PROPERTIES = ['passw', 'authClusterId', 'pin'];
+
+export function loggingInterceptor(logger: Logger): RpcInterceptor {
+  return {
+    interceptUnary: (next, method, input, options) => {
+      const output = next(method, input, options);
+      const { logRequest, logResponse, logError } = makeMethodLogger(
+        logger,
+        method.name
+      );
+
+      logRequest(input);
+      output
+        .then(({ response }) => logResponse(response))
+        .catch(error => logError(error));
+
+      return output;
+    },
+    interceptClientStreaming: (next, method, options) => {
+      const output = next(method, options);
+      const { logRequest, logResponse, logError } = makeMethodLogger(
+        logger,
+        method.name
+      );
+
+      const originalSend = output.requests.send.bind(output.requests);
+      output.requests.send = message => {
+        logRequest(message);
+        return originalSend(message);
+      };
+
+      output
+        .then(({ response }) => logResponse(response))
+        .catch(error => logError(error));
+      return output;
+    },
+    interceptServerStreaming: (next, method, input, options) => {
+      const output = next(method, input, options);
+      const { logRequest, logResponse, logError } = makeMethodLogger(
+        logger,
+        method.name
+      );
+
+      logRequest(input);
+      output.responses.onNext((message, error) => {
+        if (message) {
+          logResponse(message);
+        }
+        if (error) {
+          logError(error);
+        }
+      });
+
+      return output;
+    },
+    interceptDuplex: (next, method, options) => {
+      const output = next(method, options);
+      const { logRequest, logResponse, logError } = makeMethodLogger(
+        logger,
+        method.name
+      );
+
+      const originalSend = output.requests.send.bind(output.requests);
+      output.requests.send = message => {
+        logRequest(message);
+        return originalSend(message);
+      };
+
+      output.responses.onNext((message, error) => {
+        if (message) {
+          logResponse(message);
+        }
+        if (error) {
+          logError(error);
+        }
+      });
+
+      return output;
+    },
   };
-};
+}
 
 export function filterSensitiveProperties(toFilter: object): object {
   const acc = {};
@@ -90,3 +126,18 @@ export function filterSensitiveProperties(toFilter: object): object {
 
   return acc;
 }
+
+function makeMethodLogger(logger: Logger, methodName: string) {
+  return {
+    logRequest: (input: object) => {
+      logger.info(`${methodName} request:`, filterSensitiveProperties(input));
+    },
+    logResponse: (output: object) => {
+      const toLog = output ? filterSensitiveProperties(output) : null;
+      logger.info(`${methodName} response:`, toLog);
+    },
+    logError: (error: unknown) => {
+      logger.error(`${methodName} response:`, `${error}`);
+    },
+  };
+}
diff --git a/web/packages/teleterm/src/services/tshd/mapUsageEvent.ts b/web/packages/teleterm/src/services/tshd/mapUsageEvent.ts
deleted file mode 100644
index ac04fba361c99..0000000000000
--- a/web/packages/teleterm/src/services/tshd/mapUsageEvent.ts
+++ /dev/null
@@ -1,198 +0,0 @@
-/**
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-import * as api from 'gen-proto-ts/teleport/lib/teleterm/v1/usage_events_pb';
-import * as prehogApi from 'gen-proto-ts/prehog/v1alpha/connect_pb';
-
-import {
-  connectEventOneOfIsAccessRequestAssumeRole,
-  connectEventOneOfIsAccessRequestCreate,
-  connectEventOneOfIsAccessRequestReview,
-  connectEventOneOfIsClusterLogin,
-  connectEventOneOfIsConnectMyComputerAgentStart,
-  connectEventOneOfIsConnectMyComputerSetup,
-  connectEventOneOfIsFileTransferRun,
-  connectEventOneOfIsProtocolUse,
-} from 'teleterm/helpers';
-
-import * as types from './types';
-
-/**
- * Maps a plain JS object into a gRPC request object.
- */
-export function mapUsageEvent(event: types.ReportUsageEventRequest) {
-  return api.ReportUsageEventRequest.create({
-    authClusterId: event.authClusterId,
-    prehogReq: mapPrehogBody(event.prehogReq),
-  });
-}
-
-function mapPrehogBody(
-  plainReq: types.ReportUsageEventRequest['prehogReq']
-): prehogApi.SubmitConnectEventRequest {
-  if (!plainReq) {
-    throw new Error(`Unrecognized event: ${JSON.stringify(plainReq)}`);
-  }
-
-  const req = prehogApi.SubmitConnectEventRequest.create({
-    timestamp: plainReq.timestamp,
-    distinctId: plainReq.distinctId,
-  });
-
-  // Non-anonymized events.
-  if (plainReq.event.oneofKind === 'userJobRoleUpdate') {
-    const event = plainReq.event.userJobRoleUpdate;
-    const reqEvent = prehogApi.ConnectUserJobRoleUpdateEvent.create({
-      jobRole: event.jobRole,
-    });
-
-    req.event = {
-      oneofKind: 'userJobRoleUpdate',
-      userJobRoleUpdate: reqEvent,
-    };
-
-    return req;
-  }
-
-  // Anonymized events.
-  if (connectEventOneOfIsClusterLogin(plainReq.event)) {
-    const event = plainReq.event.clusterLogin;
-    const reqEvent = prehogApi.ConnectClusterLoginEvent.create({
-      clusterName: event.clusterName,
-      userName: event.userName,
-      connectorType: event.connectorType,
-      os: event.os,
-      arch: event.arch,
-      osVersion: event.osVersion,
-      appVersion: event.appVersion,
-    });
-
-    req.event = {
-      oneofKind: 'clusterLogin',
-      clusterLogin: reqEvent,
-    };
-
-    return req;
-  }
-  if (connectEventOneOfIsProtocolUse(plainReq.event)) {
-    const event = plainReq.event.protocolUse;
-    const reqEvent = prehogApi.ConnectProtocolUseEvent.create({
-      clusterName: event.clusterName,
-      userName: event.userName,
-      protocol: event.protocol,
-      origin: event.origin,
-    });
-
-    req.event = {
-      oneofKind: 'protocolUse',
-      protocolUse: reqEvent,
-    };
-
-    return req;
-  }
-  if (connectEventOneOfIsAccessRequestCreate(plainReq.event)) {
-    const event = plainReq.event.accessRequestCreate;
-    const reqEvent = prehogApi.ConnectAccessRequestCreateEvent.create({
-      clusterName: event.clusterName,
-      userName: event.userName,
-      kind: event.kind,
-    });
-
-    req.event = {
-      oneofKind: 'accessRequestCreate',
-      accessRequestCreate: reqEvent,
-    };
-
-    return req;
-  }
-  if (connectEventOneOfIsAccessRequestReview(plainReq.event)) {
-    const event = plainReq.event.accessRequestReview;
-    const reqEvent = prehogApi.ConnectAccessRequestReviewEvent.create({
-      clusterName: event.clusterName,
-      userName: event.userName,
-    });
-
-    req.event = {
-      oneofKind: 'accessRequestReview',
-      accessRequestReview: reqEvent,
-    };
-
-    return req;
-  }
-  if (connectEventOneOfIsAccessRequestAssumeRole(plainReq.event)) {
-    const event = plainReq.event.accessRequestAssumeRole;
-    const reqEvent = prehogApi.ConnectAccessRequestAssumeRoleEvent.create({
-      clusterName: event.clusterName,
-      userName: event.userName,
-    });
-
-    req.event = {
-      oneofKind: 'accessRequestAssumeRole',
-      accessRequestAssumeRole: reqEvent,
-    };
-
-    return req;
-  }
-  if (connectEventOneOfIsFileTransferRun(plainReq.event)) {
-    const event = plainReq.event.fileTransferRun;
-    const reqEvent = prehogApi.ConnectFileTransferRunEvent.create({
-      clusterName: event.clusterName,
-      userName: event.userName,
-      isUpload: event.isUpload,
-    });
-
-    req.event = {
-      oneofKind: 'fileTransferRun',
-      fileTransferRun: reqEvent,
-    };
-
-    return req;
-  }
-  if (connectEventOneOfIsConnectMyComputerSetup(plainReq.event)) {
-    const event = plainReq.event.connectMyComputerSetup;
-    const reqEvent = prehogApi.ConnectConnectMyComputerSetup.create({
-      clusterName: event.clusterName,
-      userName: event.userName,
-      success: event.success,
-      failedStep: event.failedStep,
-    });
-
-    req.event = {
-      oneofKind: 'connectMyComputerSetup',
-      connectMyComputerSetup: reqEvent,
-    };
-
-    return req;
-  }
-  if (connectEventOneOfIsConnectMyComputerAgentStart(plainReq.event)) {
-    const event = plainReq.event.connectMyComputerAgentStart;
-    const reqEvent = prehogApi.ConnectConnectMyComputerAgentStart.create({
-      clusterName: event.clusterName,
-      userName: event.userName,
-    });
-
-    req.event = {
-      oneofKind: 'connectMyComputerAgentStart',
-      connectMyComputerAgentStart: reqEvent,
-    };
-
-    return req;
-  }
-
-  throw new Error(`Unrecognized event: ${JSON.stringify(plainReq)}`);
-}
diff --git a/web/packages/teleterm/src/services/tshd/testHelpers.ts b/web/packages/teleterm/src/services/tshd/testHelpers.ts
index 772f3463c9a47..56e52ec84ad08 100644
--- a/web/packages/teleterm/src/services/tshd/testHelpers.ts
+++ b/web/packages/teleterm/src/services/tshd/testHelpers.ts
@@ -17,6 +17,7 @@
  */
 
 import * as tsh from './types';
+import { TshdRpcError } from './cloneableClient';
 
 import type { App } from 'teleterm/ui/services/clusters';
 
@@ -285,3 +286,10 @@ export const makeAppGateway = (
   protocol: 'HTTP',
   ...props,
 });
+
+export const makeRetryableError = (): TshdRpcError => ({
+  name: 'TshdRpcError',
+  isResolvableWithRelogin: true,
+  code: 'UNKNOWN',
+  message: 'ssh: handshake failed',
+});
diff --git a/web/packages/teleterm/src/services/tshd/types.ts b/web/packages/teleterm/src/services/tshd/types.ts
index 84de3f998cfc2..8e80997963777 100644
--- a/web/packages/teleterm/src/services/tshd/types.ts
+++ b/web/packages/teleterm/src/services/tshd/types.ts
@@ -40,12 +40,21 @@ import * as apiAccessList from 'gen-proto-ts/teleport/accesslist/v1/accesslist_p
 
 import * as uri from 'teleterm/ui/uri';
 
+import {
+  CloneableAbortSignal,
+  CloneableRpcOptions,
+  CloneableClient,
+} from './cloneableClient';
+
 // We want to reexport both the type and the value of UserType. Because it's in a namespace, we have
 // to alias it first to do the reexport.
 // https://www.typescriptlang.org/docs/handbook/namespaces.html#aliases
 import UserType = apiCluster.LoggedInUser_UserType;
 
+import type { ITerminalServiceClient } from 'gen-proto-ts/teleport/lib/teleterm/v1/service_pb.client';
+
 export { UserType };
+export type { CloneableAbortSignal, CloneableRpcOptions };
 
 export interface Kube extends apiKube.Kube {
   uri: uri.KubeUri;
@@ -220,7 +229,7 @@ export type LoginPasswordlessRequest =
   Partial<apiService.LoginPasswordlessRequest>;
 
 export type TshdClient = {
-  listRootClusters: (abortSignal?: TshAbortSignal) => Promise<Cluster[]>;
+  listRootClusters: (abortSignal?: CloneableAbortSignal) => Promise<Cluster[]>;
   listLeafClusters: (clusterUri: uri.RootClusterUri) => Promise<Cluster[]>;
   getKubes: (params: GetResourcesParams) => Promise<GetKubesResponse>;
   getApps: (params: GetResourcesParams) => Promise<GetAppsResponse>;
@@ -253,7 +262,6 @@ export type TshdClient = {
     clusterUri: uri.RootClusterUri,
     requestId: string
   ) => Promise<void>;
-  createAbortController: () => TshAbortController;
   addRootCluster: (addr: string) => Promise<Cluster>;
 
   listGateways: () => Promise<Gateway[]>;
@@ -273,23 +281,22 @@ export type TshdClient = {
   removeCluster: (clusterUri: uri.RootClusterUri) => Promise<void>;
   loginLocal: (
     params: LoginLocalParams,
-    abortSignal?: TshAbortSignal
+    abortSignal?: CloneableAbortSignal
   ) => Promise<void>;
   loginSso: (
     params: LoginSsoParams,
-    abortSignal?: TshAbortSignal
+    abortSignal?: CloneableAbortSignal
   ) => Promise<void>;
   loginPasswordless: (
     params: LoginPasswordlessParams,
-    abortSignal?: TshAbortSignal
+    abortSignal?: CloneableAbortSignal
   ) => Promise<void>;
   logout: (clusterUri: uri.RootClusterUri) => Promise<void>;
   transferFile: (
     options: FileTransferRequest,
-    abortSignal?: TshAbortSignal
+    abortSignal?: CloneableAbortSignal
   ) => FileTransferListeners;
-  reportUsageEvent: (event: ReportUsageEventRequest) => Promise<void>;
-
+  reportUsageEvent: CloneableClient<ITerminalServiceClient>['reportUsageEvent'];
   createConnectMyComputerRole: (
     rootClusterUri: uri.RootClusterUri
   ) => Promise<CreateConnectMyComputerRoleResponse>;
@@ -298,7 +305,7 @@ export type TshdClient = {
   ) => Promise<CreateConnectMyComputerNodeTokenResponse>;
   waitForConnectMyComputerNodeJoin: (
     rootClusterUri: uri.RootClusterUri,
-    abortSignal: TshAbortSignal
+    abortSignal: CloneableAbortSignal
   ) => Promise<WaitForConnectMyComputerNodeJoinResponse>;
   deleteConnectMyComputerNode: (
     clusterUri: uri.RootClusterUri
@@ -307,45 +314,34 @@ export type TshdClient = {
 
   updateHeadlessAuthenticationState: (
     params: UpdateHeadlessAuthenticationStateParams,
-    abortSignal?: TshAbortSignal
+    abortSignal?: CloneableAbortSignal
   ) => Promise<void>;
 
   listUnifiedResources: (
     params: apiService.ListUnifiedResourcesRequest,
-    abortSignal?: TshAbortSignal
+    abortSignal?: CloneableAbortSignal
   ) => Promise<ListUnifiedResourcesResponse>;
 
   getUserPreferences: (
     params: apiService.GetUserPreferencesRequest,
-    abortSignal?: TshAbortSignal
+    abortSignal?: CloneableAbortSignal
   ) => Promise<UserPreferences>;
   updateUserPreferences: (
     params: apiService.UpdateUserPreferencesRequest,
-    abortSignal?: TshAbortSignal
+    abortSignal?: CloneableAbortSignal
   ) => Promise<UserPreferences>;
   getSuggestedAccessLists: (
     params: apiService.GetSuggestedAccessListsRequest,
-    abortSignal?: TshAbortSignal
+    abortSignal?: CloneableAbortSignal
   ) => Promise<AccessList[]>;
   promoteAccessRequest: (
     params: PromoteAccessRequestParams,
-    abortSignal?: TshAbortSignal
+    abortSignal?: CloneableAbortSignal
   ) => Promise<AccessRequest>;
 
   updateTshdEventsServerAddress: (address: string) => Promise<void>;
 };
 
-export type TshAbortController = {
-  signal: TshAbortSignal;
-  abort(): void;
-};
-
-export type TshAbortSignal = {
-  readonly aborted: boolean;
-  addEventListener(cb: (...args: any[]) => void): void;
-  removeEventListener(cb: (...args: any[]) => void): void;
-};
-
 interface LoginParamsBase {
   clusterUri: uri.RootClusterUri;
 }
diff --git a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/useClusterLogin.ts b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/useClusterLogin.ts
index f1811d7cd33b1..3c9c58f07d855 100644
--- a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/useClusterLogin.ts
+++ b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/useClusterLogin.ts
@@ -22,15 +22,15 @@ import { useAsync } from 'shared/hooks/useAsync';
 import { useAppContext } from 'teleterm/ui/appContextProvider';
 import { assertUnreachable } from 'teleterm/ui/utils';
 import { RootClusterUri } from 'teleterm/ui/uri';
+import { cloneAbortSignal } from 'teleterm/services/tshd/cloneableClient';
 
 import type * as types from 'teleterm/ui/services/clusters/types';
-import type * as tsh from 'teleterm/services/tshd/types';
 
 export default function useClusterLogin(props: Props) {
   const { onSuccess, clusterUri } = props;
   const { clustersService } = useAppContext();
   const cluster = clustersService.findCluster(clusterUri);
-  const refAbortCtrl = useRef<tsh.TshAbortController>(null);
+  const refAbortCtrl = useRef<AbortController>(null);
   const loggedInUserName =
     props.prefill.username || cluster.loggedInUser?.name || null;
   const [shouldPromptSsoStatus, promptSsoStatus] = useState(false);
@@ -50,20 +50,23 @@ export default function useClusterLogin(props: Props) {
 
   const [loginAttempt, login, setAttempt] = useAsync(
     (params: types.LoginParams) => {
-      refAbortCtrl.current = clustersService.client.createAbortController();
+      refAbortCtrl.current = new AbortController();
       switch (params.kind) {
         case 'local':
           return clustersService.loginLocal(
             params,
-            refAbortCtrl.current.signal
+            cloneAbortSignal(refAbortCtrl.current.signal)
           );
         case 'passwordless':
           return clustersService.loginPasswordless(
             params,
-            refAbortCtrl.current.signal
+            cloneAbortSignal(refAbortCtrl.current.signal)
           );
         case 'sso':
-          return clustersService.loginSso(params, refAbortCtrl.current.signal);
+          return clustersService.loginSso(
+            params,
+            cloneAbortSignal(refAbortCtrl.current.signal)
+          );
         default:
           assertUnreachable(params);
       }
diff --git a/web/packages/teleterm/src/ui/ConnectMyComputer/DocumentConnectMyComputer/Setup.tsx b/web/packages/teleterm/src/ui/ConnectMyComputer/DocumentConnectMyComputer/Setup.tsx
index accb5ebaac934..e6a40f7a193d5 100644
--- a/web/packages/teleterm/src/ui/ConnectMyComputer/DocumentConnectMyComputer/Setup.tsx
+++ b/web/packages/teleterm/src/ui/ConnectMyComputer/DocumentConnectMyComputer/Setup.tsx
@@ -32,7 +32,7 @@ import {
   useConnectMyComputerContext,
 } from 'teleterm/ui/ConnectMyComputer';
 import { codeOrSignal } from 'teleterm/ui/utils/process';
-import { isAccessDeniedError } from 'teleterm/services/tshd/errors';
+import { isTshdRpcError } from 'teleterm/services/tshd/cloneableClient';
 import { useResourcesContext } from 'teleterm/ui/DocumentCluster/resourcesContext';
 import { DocumentConnectMyComputer } from 'teleterm/ui/services/workspacesService';
 
@@ -238,9 +238,12 @@ function AgentSetup() {
                 await ctx.connectMyComputerService.createRole(rootClusterUri);
               certsReloaded = response.certsReloaded;
             } catch (error) {
-              if (isAccessDeniedError(error)) {
+              if (
+                isTshdRpcError(error, 'PERMISSION_DENIED') &&
+                !error.isResolvableWithRelogin
+              ) {
                 throw new Error(
-                  'Access denied. Contact your administrator for permissions to manage users and roles.'
+                  `Cannot set up the role: ${error.message}. Contact your administrator for permissions to manage users and roles.`
                 );
               }
               throw error;
diff --git a/web/packages/teleterm/src/ui/ConnectMyComputer/connectMyComputerContext.test.tsx b/web/packages/teleterm/src/ui/ConnectMyComputer/connectMyComputerContext.test.tsx
index 714df65ef1af9..29674fd2a8c62 100644
--- a/web/packages/teleterm/src/ui/ConnectMyComputer/connectMyComputerContext.test.tsx
+++ b/web/packages/teleterm/src/ui/ConnectMyComputer/connectMyComputerContext.test.tsx
@@ -115,7 +115,9 @@ test('startAgent re-throws errors that are thrown while spawning the process', a
     .mockImplementation(
       // Hang until abort.
       (rootClusterUri, abortSignal) =>
-        new Promise((resolve, reject) => abortSignal.addEventListener(reject))
+        new Promise((resolve, reject) =>
+          abortSignal.addEventListener('abort', reject)
+        )
     );
   jest
     .spyOn(appContext.mainProcessClient, 'getAgentState')
diff --git a/web/packages/teleterm/src/ui/ConnectMyComputer/connectMyComputerContext.tsx b/web/packages/teleterm/src/ui/ConnectMyComputer/connectMyComputerContext.tsx
index 83913282d8e08..723950eb47549 100644
--- a/web/packages/teleterm/src/ui/ConnectMyComputer/connectMyComputerContext.tsx
+++ b/web/packages/teleterm/src/ui/ConnectMyComputer/connectMyComputerContext.tsx
@@ -32,12 +32,15 @@ import {
   useAsync,
   makeEmptyAttempt,
 } from 'shared/hooks/useAsync';
+import { wait } from 'shared/utils/wait';
 
 import { RootClusterUri, routing } from 'teleterm/ui/uri';
 import { useAppContext } from 'teleterm/ui/appContextProvider';
-import { Server, TshAbortSignal } from 'teleterm/services/tshd/types';
-import createAbortController from 'teleterm/services/tshd/createAbortController';
-import { isNotFoundError } from 'teleterm/services/tshd/errors';
+import { Server } from 'teleterm/services/tshd/types';
+import {
+  cloneAbortSignal,
+  isTshdRpcError,
+} from 'teleterm/services/tshd/cloneableClient';
 import { useResourcesContext } from 'teleterm/ui/DocumentCluster/resourcesContext';
 import { useLogger } from 'teleterm/ui/hooks/useLogger';
 
@@ -202,12 +205,12 @@ export const ConnectMyComputerContextProvider: FC<
 
       await connectMyComputerService.runAgent(rootClusterUri);
 
-      const abortController = createAbortController();
+      const abortController = new AbortController();
       try {
         const server = await Promise.race([
           connectMyComputerService.waitForNodeToJoin(
             rootClusterUri,
-            abortController.signal
+            cloneAbortSignal(abortController.signal)
           ),
           throwOnAgentProcessErrors(
             mainProcessClient,
@@ -280,7 +283,7 @@ export const ConnectMyComputerContextProvider: FC<
           rootClusterUri
         );
     } catch (error) {
-      if (isNotFoundError(error)) {
+      if (isTshdRpcError(error, 'NOT_FOUND')) {
         return;
       }
       throw error;
@@ -495,7 +498,7 @@ export const useConnectMyComputerContext = () => {
 function throwOnAgentProcessErrors(
   mainProcessClient: MainProcessClient,
   rootClusterUri: RootClusterUri,
-  abortSignal: TshAbortSignal
+  abortSignal: AbortSignal
 ): Promise<never> {
   return new Promise((_, reject) => {
     const rejectOnError = (agentProcessState: AgentProcessState) => {
@@ -514,7 +517,7 @@ function throwOnAgentProcessErrors(
       rootClusterUri,
       rejectOnError
     );
-    abortSignal.addEventListener(() => {
+    abortSignal.addEventListener('abort', () => {
       cleanup();
       reject(
         new DOMException('throwOnAgentProcessErrors was aborted', 'AbortError')
@@ -570,28 +573,3 @@ export class AgentCompatibilityError extends Error {
     this.name = 'AgentCompatibilityError';
   }
 }
-
-/**
- * wait is like wait from the shared package, but it works with TshAbortSignal.
- * TODO(ravicious): Refactor TshAbortSignal so that its interface is the same as AbortSignal.
- * See the comment in createAbortController for more details.
- */
-function wait(ms: number, abortSignal: TshAbortSignal): Promise<void> {
-  if (abortSignal.aborted) {
-    return Promise.reject(new DOMException('Wait was aborted.', 'AbortError'));
-  }
-
-  return new Promise((resolve, reject) => {
-    const abort = () => {
-      clearTimeout(timeout);
-      reject(new DOMException('Wait was aborted.', 'AbortError'));
-    };
-    const done = () => {
-      abortSignal.removeEventListener(abort);
-      resolve();
-    };
-
-    const timeout = setTimeout(done, ms);
-    abortSignal.addEventListener(abort);
-  });
-}
diff --git a/web/packages/teleterm/src/ui/DocumentCluster/useUserPreferences.test.tsx b/web/packages/teleterm/src/ui/DocumentCluster/useUserPreferences.test.tsx
index d4aaf2fdd00f2..02023bb2d6bba 100644
--- a/web/packages/teleterm/src/ui/DocumentCluster/useUserPreferences.test.tsx
+++ b/web/packages/teleterm/src/ui/DocumentCluster/useUserPreferences.test.tsx
@@ -182,7 +182,7 @@ describe('updating preferences', () => {
     jest
       .spyOn(appContext.tshd, 'getUserPreferences')
       .mockImplementation((requestParams, abortSignal) => {
-        abortSignal.addEventListener(() =>
+        abortSignal.addEventListener('abort', () =>
           rejectGetUserPreferencesPromise(new Error('Aborted'))
         );
         return getUserPreferencesPromise;
diff --git a/web/packages/teleterm/src/ui/DocumentCluster/useUserPreferences.ts b/web/packages/teleterm/src/ui/DocumentCluster/useUserPreferences.ts
index f1113f509d8b6..09cb189f307ff 100644
--- a/web/packages/teleterm/src/ui/DocumentCluster/useUserPreferences.ts
+++ b/web/packages/teleterm/src/ui/DocumentCluster/useUserPreferences.ts
@@ -43,7 +43,7 @@ import { routing, ClusterUri } from 'teleterm/ui/uri';
 
 import { UserPreferences } from 'teleterm/services/tshd/types';
 import { retryWithRelogin } from 'teleterm/ui/utils';
-import createAbortController from 'teleterm/services/tshd/createAbortController';
+import { cloneAbortSignal } from 'teleterm/services/tshd/cloneableClient';
 
 export function useUserPreferences(clusterUri: ClusterUri): {
   userPreferencesAttempt: Attempt<void>;
@@ -51,7 +51,7 @@ export function useUserPreferences(clusterUri: ClusterUri): {
   userPreferences: UserPreferences;
 } {
   const appContext = useAppContext();
-  const initialFetchAttemptAbortController = useRef(createAbortController());
+  const initialFetchAttemptAbortController = useRef(new AbortController());
   // Consider storing the unified resource view preferences on the document.
   // https://github.com/gravitational/teleport/pull/35251#discussion_r1424116275
   const [unifiedResourcePreferences, setUnifiedResourcePreferences] = useState<
@@ -80,7 +80,7 @@ export function useUserPreferences(clusterUri: ClusterUri): {
         retryWithRelogin(appContext, clusterUri, () =>
           appContext.tshd.getUserPreferences(
             { clusterUri },
-            initialFetchAttemptAbortController.current.signal
+            cloneAbortSignal(initialFetchAttemptAbortController.current.signal)
           )
         ),
       [appContext, clusterUri]
diff --git a/web/packages/teleterm/src/ui/HeadlessAuthn/HeadlessAuthentication.tsx b/web/packages/teleterm/src/ui/HeadlessAuthn/HeadlessAuthentication.tsx
index 83cfc4b78c896..d395dd8f9f03d 100644
--- a/web/packages/teleterm/src/ui/HeadlessAuthn/HeadlessAuthentication.tsx
+++ b/web/packages/teleterm/src/ui/HeadlessAuthn/HeadlessAuthentication.tsx
@@ -25,6 +25,8 @@ import { HeadlessAuthenticationState } from 'gen-proto-ts/teleport/lib/teleterm/
 import { useAppContext } from 'teleterm/ui/appContextProvider';
 import { RootClusterUri } from 'teleterm/ui/uri';
 
+import { cloneAbortSignal } from 'teleterm/services/tshd/cloneableClient';
+
 import { HeadlessPrompt } from './HeadlessPrompt';
 
 interface HeadlessAuthenticationProps {
@@ -38,7 +40,7 @@ interface HeadlessAuthenticationProps {
 
 export function HeadlessAuthentication(props: HeadlessAuthenticationProps) {
   const { headlessAuthenticationService, clustersService } = useAppContext();
-  const refAbortCtrl = useRef(clustersService.client.createAbortController());
+  const refAbortCtrl = useRef(new AbortController());
   const cluster = clustersService.findCluster(props.rootClusterUri);
 
   const [updateHeadlessStateAttempt, updateHeadlessState] = useAsync(
@@ -49,7 +51,7 @@ export function HeadlessAuthentication(props: HeadlessAuthenticationProps) {
           headlessAuthenticationId: props.headlessAuthenticationId,
           state: state,
         },
-        refAbortCtrl.current.signal
+        cloneAbortSignal(refAbortCtrl.current.signal)
       )
   );
 
@@ -83,7 +85,7 @@ export function HeadlessAuthentication(props: HeadlessAuthenticationProps) {
       clientIp={props.clientIp}
       skipConfirm={props.skipConfirm}
       onApprove={handleHeadlessApprove}
-      abortApproval={refAbortCtrl.current.abort}
+      abortApproval={() => refAbortCtrl.current.abort()}
       onReject={handleHeadlessReject}
       headlessAuthenticationId={props.headlessAuthenticationId}
       updateHeadlessStateAttempt={updateHeadlessStateAttempt}
diff --git a/web/packages/teleterm/src/ui/Search/SearchBar.test.tsx b/web/packages/teleterm/src/ui/Search/SearchBar.test.tsx
index 7dc5938328788..86ad4dcca8f7c 100644
--- a/web/packages/teleterm/src/ui/Search/SearchBar.test.tsx
+++ b/web/packages/teleterm/src/ui/Search/SearchBar.test.tsx
@@ -26,7 +26,10 @@ import { MockAppContext } from 'teleterm/ui/fixtures/mocks';
 import { MockAppContextProvider } from 'teleterm/ui/fixtures/MockAppContextProvider';
 import { ResourceSearchError } from 'teleterm/ui/services/resources';
 import ModalsHost from 'teleterm/ui/ModalsHost';
-import { makeRootCluster } from 'teleterm/services/tshd/testHelpers';
+import {
+  makeRootCluster,
+  makeRetryableError,
+} from 'teleterm/services/tshd/testHelpers';
 
 import { ClusterUri } from 'teleterm/ui/uri';
 
@@ -280,7 +283,7 @@ it('shows a login modal when a request to a cluster from the current workspace f
   const resourceSearchError = new ResourceSearchError(
     cluster.uri,
     'server',
-    new Error('ssh: cert has expired')
+    makeRetryableError()
   );
   const resourceSearchResult = {
     results: [],
diff --git a/web/packages/teleterm/src/ui/Search/pickers/ActionPicker.test.ts b/web/packages/teleterm/src/ui/Search/pickers/ActionPicker.test.ts
index d44da0e49133f..d1cfaa229827b 100644
--- a/web/packages/teleterm/src/ui/Search/pickers/ActionPicker.test.ts
+++ b/web/packages/teleterm/src/ui/Search/pickers/ActionPicker.test.ts
@@ -18,7 +18,10 @@
 
 import { makeSuccessAttempt } from 'shared/hooks/useAsync';
 
-import { makeRootCluster } from 'teleterm/services/tshd/testHelpers';
+import {
+  makeRootCluster,
+  makeRetryableError,
+} from 'teleterm/services/tshd/testHelpers';
 import { ResourceSearchError } from 'teleterm/ui/services/resources';
 
 import { getActionPickerStatus } from './ActionPicker';
@@ -29,7 +32,7 @@ describe('getActionPickerStatus', () => {
       const retryableError = new ResourceSearchError(
         '/clusters/foo',
         'server',
-        new Error('ssh: cert has expired')
+        makeRetryableError()
       );
 
       const nonRetryableError = new ResourceSearchError(
@@ -66,7 +69,7 @@ describe('getActionPickerStatus', () => {
       const retryableError = new ResourceSearchError(
         '/clusters/foo',
         'server',
-        new Error('ssh: cert has expired')
+        makeRetryableError()
       );
 
       const status = getActionPickerStatus({
@@ -95,18 +98,14 @@ describe('getActionPickerStatus', () => {
         new ResourceSearchError(
           '/clusters/foo',
           'server',
-          new Error('ssh: cert has expired')
+          makeRetryableError()
         ),
         new ResourceSearchError(
           '/clusters/foo',
           'database',
-          new Error('ssh: cert has expired')
-        ),
-        new ResourceSearchError(
-          '/clusters/foo',
-          'kube',
-          new Error('ssh: cert has expired')
+          makeRetryableError()
         ),
+        new ResourceSearchError('/clusters/foo', 'kube', makeRetryableError()),
       ];
       const status = getActionPickerStatus({
         inputValue: 'foo',
@@ -194,7 +193,7 @@ describe('getActionPickerStatus', () => {
         new ResourceSearchError(
           '/clusters/foo',
           'server',
-          new Error('ssh: cert has expired')
+          makeRetryableError()
         ),
         nonRetryableError,
       ];
diff --git a/web/packages/teleterm/src/ui/services/clusters/clustersService.ts b/web/packages/teleterm/src/ui/services/clusters/clustersService.ts
index 0ad49bef48897..497b6db36c03a 100644
--- a/web/packages/teleterm/src/ui/services/clusters/clustersService.ts
+++ b/web/packages/teleterm/src/ui/services/clusters/clustersService.ts
@@ -100,7 +100,7 @@ export class ClustersService extends ImmutableStore<types.ClustersServiceState>
 
   async loginLocal(
     params: types.LoginLocalParams,
-    abortSignal: tsh.TshAbortSignal
+    abortSignal: tsh.CloneableAbortSignal
   ) {
     await this.client.loginLocal(params, abortSignal);
     // We explicitly use the `andCatchErrors` variant here. If loginLocal succeeds but syncing the
@@ -112,7 +112,7 @@ export class ClustersService extends ImmutableStore<types.ClustersServiceState>
 
   async loginSso(
     params: types.LoginSsoParams,
-    abortSignal: tsh.TshAbortSignal
+    abortSignal: tsh.CloneableAbortSignal
   ) {
     await this.client.loginSso(params, abortSignal);
     await this.syncRootClusterAndCatchErrors(params.clusterUri);
@@ -121,7 +121,7 @@ export class ClustersService extends ImmutableStore<types.ClustersServiceState>
 
   async loginPasswordless(
     params: types.LoginPasswordlessParams,
-    abortSignal: tsh.TshAbortSignal
+    abortSignal: tsh.CloneableAbortSignal
   ) {
     await this.client.loginPasswordless(params, abortSignal);
     await this.syncRootClusterAndCatchErrors(params.clusterUri);
diff --git a/web/packages/teleterm/src/ui/services/connectMyComputer/connectMyComputerService.ts b/web/packages/teleterm/src/ui/services/connectMyComputer/connectMyComputerService.ts
index 8554de72cf797..84953c52a0b0c 100644
--- a/web/packages/teleterm/src/ui/services/connectMyComputer/connectMyComputerService.ts
+++ b/web/packages/teleterm/src/ui/services/connectMyComputer/connectMyComputerService.ts
@@ -21,7 +21,7 @@ import {
   Cluster,
   CreateConnectMyComputerRoleResponse,
   Server,
-  TshAbortSignal,
+  CloneableAbortSignal,
   TshdClient,
 } from 'teleterm/services/tshd/types';
 
@@ -101,7 +101,7 @@ export class ConnectMyComputerService {
 
   async waitForNodeToJoin(
     rootClusterUri: uri.RootClusterUri,
-    abortSignal: TshAbortSignal
+    abortSignal: CloneableAbortSignal
   ): Promise<Server> {
     const response = await this.tshClient.waitForConnectMyComputerNodeJoin(
       rootClusterUri,
diff --git a/web/packages/teleterm/src/ui/services/fileTransferClient/fileTransferService.ts b/web/packages/teleterm/src/ui/services/fileTransferClient/fileTransferService.ts
index b64574ffe6db6..c064bb7cf555a 100644
--- a/web/packages/teleterm/src/ui/services/fileTransferClient/fileTransferService.ts
+++ b/web/packages/teleterm/src/ui/services/fileTransferClient/fileTransferService.ts
@@ -22,6 +22,7 @@ import { FileTransferDirection } from 'gen-proto-ts/teleport/lib/teleterm/v1/ser
 
 import { FileTransferRequest, TshdClient } from 'teleterm/services/tshd/types';
 import { UsageService } from 'teleterm/ui/services/usage';
+import { cloneAbortSignal } from 'teleterm/services/tshd/cloneableClient';
 
 export class FileTransferService {
   constructor(
@@ -33,23 +34,10 @@ export class FileTransferService {
     options: FileTransferRequest,
     abortController: AbortController
   ): FileTransferListeners {
-    const abortSignal = {
-      aborted: false,
-      addEventListener: (cb: (...args: any[]) => void) => {
-        abortController.signal.addEventListener('abort', cb);
-      },
-      removeEventListener: (cb: (...args: any[]) => void) => {
-        abortController.signal.removeEventListener('abort', cb);
-      },
-    };
-    abortController.signal.addEventListener(
-      'abort',
-      () => {
-        abortSignal.aborted = true;
-      },
-      { once: true }
+    const listeners = this.tshClient.transferFile(
+      options,
+      cloneAbortSignal(abortController.signal)
     );
-    const listeners = this.tshClient.transferFile(options, abortSignal);
     if (options.direction === FileTransferDirection.DOWNLOAD) {
       this.usageService.captureFileTransferRun(options.serverUri, {
         isUpload: false,
diff --git a/web/packages/teleterm/src/ui/services/headlessAuthn/headlessAuthnService.ts b/web/packages/teleterm/src/ui/services/headlessAuthn/headlessAuthnService.ts
index 2d45d65c10d89..7d0b9b82c5f5f 100644
--- a/web/packages/teleterm/src/ui/services/headlessAuthn/headlessAuthnService.ts
+++ b/web/packages/teleterm/src/ui/services/headlessAuthn/headlessAuthnService.ts
@@ -60,7 +60,7 @@ export class HeadlessAuthenticationService {
 
   async updateHeadlessAuthenticationState(
     params: types.UpdateHeadlessAuthenticationStateParams,
-    abortSignal: types.TshAbortSignal
+    abortSignal: types.CloneableAbortSignal
   ): Promise<void> {
     return this.tshClient.updateHeadlessAuthenticationState(
       params,
diff --git a/web/packages/teleterm/src/ui/services/resources/resourcesService.ts b/web/packages/teleterm/src/ui/services/resources/resourcesService.ts
index fa78d7e3ae3dc..a56a729f58a26 100644
--- a/web/packages/teleterm/src/ui/services/resources/resourcesService.ts
+++ b/web/packages/teleterm/src/ui/services/resources/resourcesService.ts
@@ -20,6 +20,11 @@ import { pluralize } from 'shared/utils/text';
 
 import { makeApp, App } from 'teleterm/ui/services/clusters';
 
+import {
+  cloneAbortSignal,
+  TshdRpcError,
+} from 'teleterm/services/tshd/cloneableClient';
+
 import type * as types from 'teleterm/services/tshd/types';
 import type * as uri from 'teleterm/ui/uri';
 import type { ResourceTypeFilter } from 'teleterm/ui/Search/searchResult';
@@ -89,7 +94,7 @@ export class ResourcesService {
     filters: ResourceTypeFilter[];
     limit: number;
   }): Promise<PromiseSettledResult<SearchResult[]>[]> {
-    const params = { search, clusterUri, sort: null, limit };
+    const params = { search, clusterUri, sort: null, limit, startKey: '' };
 
     const getServers = () =>
       this.fetchServers(params).then(
@@ -146,23 +151,10 @@ export class ResourcesService {
     params: types.ListUnifiedResourcesRequest,
     abortSignal: AbortSignal
   ) {
-    const tshAbortSignal = {
-      aborted: false,
-      addEventListener: (cb: (...args: any[]) => void) => {
-        abortSignal.addEventListener('abort', cb);
-      },
-      removeEventListener: (cb: (...args: any[]) => void) => {
-        abortSignal.removeEventListener('abort', cb);
-      },
-    };
-    abortSignal.addEventListener(
-      'abort',
-      () => {
-        tshAbortSignal.aborted = true;
-      },
-      { once: true }
+    return this.tshClient.listUnifiedResources(
+      params,
+      cloneAbortSignal(abortSignal)
     );
-    return this.tshClient.listUnifiedResources(params, tshAbortSignal);
   }
 }
 
@@ -177,7 +169,7 @@ export class ResourceSearchError extends Error {
   constructor(
     public clusterUri: uri.ClusterUri,
     public resourceKind: SearchResult['kind'],
-    cause: Error
+    cause: Error | TshdRpcError
   ) {
     super(
       `Error while fetching resources of type ${resourceKind} from cluster ${clusterUri}`,
diff --git a/web/packages/teleterm/src/ui/utils/retryWithRelogin.test.ts b/web/packages/teleterm/src/ui/utils/retryWithRelogin.test.ts
index 4096100f6ea36..90d3df8a6d1f9 100644
--- a/web/packages/teleterm/src/ui/utils/retryWithRelogin.test.ts
+++ b/web/packages/teleterm/src/ui/utils/retryWithRelogin.test.ts
@@ -19,6 +19,7 @@
 import { waitFor } from '@testing-library/react';
 
 import { MockAppContext } from 'teleterm/ui/fixtures/mocks';
+import { makeRetryableError } from 'teleterm/services/tshd/testHelpers';
 import Logger, { NullService } from 'teleterm/logger';
 
 import { retryWithRelogin } from './retryWithRelogin';
@@ -27,8 +28,6 @@ beforeAll(() => {
   Logger.init(new NullService());
 });
 
-const makeRetryableError = () => new Error('ssh: handshake failed');
-
 it('returns the result of actionToRetry if no error is thrown', async () => {
   const expectedReturnValue = Symbol('expectedReturnValue');
   const actionToRetry = jest.fn().mockResolvedValue(expectedReturnValue);
@@ -72,7 +71,9 @@ it('opens the login modal window and calls actionToRetry again on successful rel
       }
 
       // Dialog cancel function.
-      return { closeDialog: () => {} };
+      return {
+        closeDialog: () => {},
+      };
     });
 
   jest
@@ -146,7 +147,9 @@ it('calls actionToRetry again if relogin attempt was canceled', async () => {
       }
 
       // Dialog cancel function.
-      return { closeDialog: () => {} };
+      return {
+        closeDialog: () => {},
+      };
     });
 
   jest
diff --git a/web/packages/teleterm/src/ui/utils/retryWithRelogin.ts b/web/packages/teleterm/src/ui/utils/retryWithRelogin.ts
index 8237fc8e2febc..a3224e87e0a6a 100644
--- a/web/packages/teleterm/src/ui/utils/retryWithRelogin.ts
+++ b/web/packages/teleterm/src/ui/utils/retryWithRelogin.ts
@@ -19,6 +19,7 @@
 import { ClusterOrResourceUri, RootClusterUri, routing } from 'teleterm/ui/uri';
 import { IAppContext } from 'teleterm/ui/types';
 import Logger from 'teleterm/logger';
+import { isTshdRpcError } from 'teleterm/services/tshd/cloneableClient';
 
 const logger = new Logger('retryWithRelogin');
 
@@ -59,7 +60,7 @@ export async function retryWithRelogin<T>(
   } catch (error) {
     if (isRetryable(error)) {
       retryableErrorFromActionToRetry = error;
-      logger.info(`Activating relogin on error ${error}`);
+      logger.info(`Activating relogin on error`, error);
     } else {
       throw error;
     }
@@ -93,14 +94,7 @@ export async function retryWithRelogin<T>(
 }
 
 export function isRetryable(error: unknown): boolean {
-  // TODO(ravicious): Replace this with actual check on metadata.
-  return (
-    error instanceof Error &&
-    (error.message.includes('ssh: handshake failed') ||
-      error.message.includes('ssh: cert has expired') ||
-      error.message.includes('tls: expired certificate') ||
-      error.message.includes('client credentials have expired'))
-  );
+  return isTshdRpcError(error) && error.isResolvableWithRelogin;
 }
 
 // Notice that we don't differentiate between onSuccess and onCancel. In both cases, we're going to
diff --git a/yarn.lock b/yarn.lock
index a0fd9d536f510..f82c5c4b3905c 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2423,6 +2423,14 @@
   resolved "https://registry.yarnpkg.com/@polka/url/-/url-1.0.0-next.21.tgz#5de5a2385a35309427f6011992b544514d559aa1"
   integrity sha512-a5Sab1C4/icpTZVzZc5Ghpz88yQtGOyNqYXcZgOssB2uuAr+wF/MvN6bgtW32q7HHrvBki+BsZ0OuNv6EV3K9g==
 
+"@protobuf-ts/grpc-transport@^2.9.3":
+  version "2.9.3"
+  resolved "https://registry.yarnpkg.com/@protobuf-ts/grpc-transport/-/grpc-transport-2.9.3.tgz#e7e88dae831f292b9bacafa742747b96d891db8e"
+  integrity sha512-2TarJgLrvhHVBpxgJonPeZzEtqlbQJeSTpFZjkNI5Ye+18r8SUIcvZhl4LLS1q4zjIQl/O7lZt/x27PTNglLpg==
+  dependencies:
+    "@protobuf-ts/runtime" "^2.9.3"
+    "@protobuf-ts/runtime-rpc" "^2.9.3"
+
 "@protobuf-ts/runtime-rpc@^2.9.3":
   version "2.9.3"
   resolved "https://registry.yarnpkg.com/@protobuf-ts/runtime-rpc/-/runtime-rpc-2.9.3.tgz#7316373f2ffc2b5ab4c7e0c1ca0cad0a3c92585d"