@blaxel/core 0.3.26-preview.311 → 0.3.26-preview.313

package/dist/cjs-browser/client/sdk.gen.js

@@ -801,7 +801,7 @@ const listImages = (options) => {
 exports.listImages = listImages;
 /**
  * Build a container image
- * Builds a container image without creating a deployment. Returns a presigned URL for uploading source code. After upload, the image will be built and stored in the registry, but no agent, function, sandbox, or job will be created or updated.
+ * Builds or imports a container image without creating a deployment. Provide a registry image reference to download and convert an existing image, or omit image to receive a presigned URL for uploading source code. Registry imports can specify memoryMb and volumeMb for the import worker. These settings do not change the resources of workloads using the image.
  */
 const createImage = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -2448,7 +2448,7 @@ const getTemplate = (options) => {
 exports.getTemplate = getTemplate;
 /**
  * List workspace team members
- * Returns all team members in the workspace including their roles (admin or member) and invitation status.
+ * Returns all team members in the workspace including their roles (admin, member or viewer) and invitation status.
  */
 const listWorkspaceUsers = (options) => {
     return (options?.client ?? client_gen_1.client).get({

package/dist/cjs-browser/common/settings.js

@@ -30,8 +30,8 @@ function missingCredentialsMessage() {
     return "No Blaxel credentials found. Set the BL_API_KEY and BL_WORKSPACE environment variables, or run `bl login`.";
 }
 // Build info - these placeholders are replaced at build time by build:replace-imports
-const BUILD_VERSION = "0.3.26-preview.311";
-const BUILD_COMMIT = "a62496fa4537136926770cdd0d6e48ceb8506491";
+const BUILD_VERSION = "0.3.26-preview.313";
+const BUILD_COMMIT = "74b7740c0709370950088f3244fe2eeb2e970fca";
 const BUILD_SENTRY_DSN = "https://fd5e60e1c9820e1eef5ccebb84a07127@o4508714045276160.ingest.us.sentry.io/4510465864564736";
 const BLAXEL_API_VERSION = "2026-09-22";
 // Bun < 1.3.11 never sends connection-level WINDOW_UPDATE: the pooled h2

package/dist/cjs-browser/sandbox/client/sdk.gen.js

@@ -1,13 +1,14 @@
 "use strict";
 // This file is auto-generated by @hey-api/openapi-ts
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getWatchFilesystemByPath = exports.postUpgrade = exports.postProcessByIdentifierStdin = exports.deleteProcessByIdentifierStdin = exports.getProcessByIdentifierLogsStream = exports.getProcessByIdentifierLogs = exports.deleteProcessByIdentifierKill = exports.getProcessByIdentifier = exports.deleteProcessByIdentifier = exports.postProcess = exports.getProcess = exports.putNetworkTunnelConfig = exports.deleteNetworkTunnel = exports.getNetworkProcessByPidPorts = exports.postNetworkProcessByPidMonitor = exports.deleteNetworkProcessByPidMonitor = exports.getHealth = exports.putFilesystemTreeByPath = exports.getFilesystemTreeByPath = exports.deleteFilesystemTreeByPath = exports.putFilesystemByPath = exports.getFilesystemByPath = exports.deleteFilesystemByPath = exports.getFilesystemSearchByPath = exports.postFilesystemMultipartInitiateByPath = exports.getFilesystemMultipartByUploadIdParts = exports.putFilesystemMultipartByUploadIdPart = exports.postFilesystemMultipartByUploadIdComplete = exports.deleteFilesystemMultipartByUploadIdAbort = exports.getFilesystemMultipart = exports.getFilesystemFindByPath = exports.getFilesystemContentSearchByPath = exports.postEnvironmentReload = exports.deleteDrivesMountByMountPath = exports.postDrivesMount = exports.getDrivesMount = exports.getCodegenRerankingByPath = exports.putCodegenFastapplyByPath = exports.getArchiveStatus = exports.postArchiveResume = exports.postArchiveExport = void 0;
+exports.getWatchFilesystemByPath = exports.postUpgrade = exports.postProcessByIdentifierStdin = exports.deleteProcessByIdentifierStdin = exports.getProcessByIdentifierLogsStream = exports.getProcessByIdentifierLogs = exports.deleteProcessByIdentifierKill = exports.getProcessByIdentifier = exports.deleteProcessByIdentifier = exports.postProcess = exports.getProcess = exports.putNetworkTunnelConfig = exports.deleteNetworkTunnel = exports.getNetworkProcessByPidPorts = exports.postNetworkProcessByPidMonitor = exports.deleteNetworkProcessByPidMonitor = exports.getHealth = exports.putFilesystemTreeByPath = exports.getFilesystemTreeByPath = exports.deleteFilesystemTreeByPath = exports.putFilesystemByPath = exports.headFilesystemByPath = exports.getFilesystemByPath = exports.deleteFilesystemByPath = exports.getFilesystemSearchByPath = exports.postFilesystemMultipartInitiateByPath = exports.getFilesystemMultipartByUploadIdParts = exports.putFilesystemMultipartByUploadIdPart = exports.postFilesystemMultipartByUploadIdComplete = exports.deleteFilesystemMultipartByUploadIdAbort = exports.getFilesystemMultipart = exports.getFilesystemFindByPath = exports.getFilesystemContentSearchByPath = exports.postEnvironmentReload = exports.deleteDrivesMountByMountPath = exports.postDrivesMount = exports.getDrivesMount = exports.getCodegenRerankingByPath = exports.putCodegenFastapplyByPath = exports.getArchiveStatus = exports.postArchiveResume = exports.postArchiveExport = void 0;
 const client_fetch_1 = require("@hey-api/client-fetch");
 const client_gen_1 = require("./client.gen");
 /**
  * Export the filesystem changes to a presigned URL
  * Archives everything the sandbox changed on top of its base image and streams it, uncompressed, to a presigned S3 PUT URL. The memory of the sandbox is not archived.
  * The sandbox is quiesced first: the process list is saved (unless saveProcesses is false), every process is stopped, and the API then refuses the calls that would write to the filesystem. The freeze is not lifted afterwards, since an exported sandbox is meant to be restored elsewhere; call POST /archive/resume to lift it.
+ * A sandbox still frozen by an earlier export is exported as it is, with the process list that export saved.
  * Use dryRun to get the archive's content and exact size without stopping anything and without uploading.
  * Set async to start the export and answer immediately, which is what archiving a large filesystem needs: the export then reports itself through GET /archive/status.
  */
@@ -205,7 +206,7 @@ const postEnvironmentReload = (options) => {
 exports.postEnvironmentReload = postEnvironmentReload;
 /**
  * Search for text content in files
- * Searches for text content inside files using ripgrep. Returns matching lines with context.
+ * Searches for text content inside files. Returns each matching line, with the lines around it when contextLines is set.
  */
 const getFilesystemContentSearchByPath = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -294,7 +295,7 @@ const postFilesystemMultipartByUploadIdComplete = (options) => {
 exports.postFilesystemMultipartByUploadIdComplete = postFilesystemMultipartByUploadIdComplete;
 /**
  * Upload part
- * Upload a single part of a multipart upload
+ * Upload a single part of a multipart upload. Re-uploading a part number replaces that part. Wait for the previous request for that part to finish before retrying.
  */
 const putFilesystemMultipartByUploadIdPart = (options) => {
     return (options.client ?? client_gen_1.client).put({
@@ -354,7 +355,8 @@ const postFilesystemMultipartInitiateByPath = (options) => {
 exports.postFilesystemMultipartInitiateByPath = postFilesystemMultipartInitiateByPath;
 /**
  * Fuzzy search for files and directories
- * Performs fuzzy search on filesystem paths using fuzzy matching algorithm. Optimized alternative to find and grep commands.
+ * Ranks the files and directories under a path by how well their relative path fuzzy-matches `query` (fzf algorithm: the query's characters must appear in order, not necessarily next to each other), best match first.
+ * Fuzzy search is for "jump to file" lookups from a partial name. The `patterns` parameter is currently ignored by this endpoint; use find for exact glob filtering.
  */
 const getFilesystemSearchByPath = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -403,9 +405,30 @@ const getFilesystemByPath = (options) => {
     });
 };
 exports.getFilesystemByPath = getFilesystemByPath;
+/**
+ * Stat a file or directory
+ * Returns the metadata of a file or directory as headers, with no body. This checks stat availability, not permission to read file contents or list a directory. When the path does not exist or its metadata cannot be accessed, the response is an empty 200 without the X-File-Type header.
+ */
+const headFilesystemByPath = (options) => {
+    return (options.client ?? client_gen_1.client).head({
+        security: [
+            {
+                scheme: 'bearer',
+                type: 'http'
+            }
+        ],
+        url: '/filesystem/{path}',
+        ...options
+    });
+};
+exports.headFilesystemByPath = headFilesystemByPath;
 /**
  * Create or update a file or directory
- * Create or update a file or directory
+ * Create or update a file or directory.
+ *
+ * Idempotent: an existing file is overwritten (truncated, not appended to) and an existing directory is kept, so retrying the same request is safe.
+ *
+ * Send either a JSON body (FileRequest) or `multipart/form-data` for binary files. Multipart fields, in any order: `file` (required, the file content), `permissions` (optional octal mode such as `0755`, applied when the file is created, default `0644`; an existing file keeps its mode), `path` (optional, ignored: the target is always the URL path).
  */
 const putFilesystemByPath = (options) => {
     return (options.client ?? client_gen_1.client).put({
@@ -460,7 +483,7 @@ const getFilesystemTreeByPath = (options) => {
 exports.getFilesystemTreeByPath = getFilesystemTreeByPath;
 /**
  * Create or update directory tree
- * Create or update multiple files within a directory tree structure
+ * Create or update multiple files within a directory tree structure. Idempotent: existing files are overwritten, so retrying the same request is safe.
  */
 const putFilesystemTreeByPath = (options) => {
     return (options.client ?? client_gen_1.client).put({
@@ -609,7 +632,10 @@ const getProcess = (options) => {
 exports.getProcess = getProcess;
 /**
  * Execute a command
- * Execute a command and return process information. If Accept header is text/event-stream, streams logs in SSE format and returns the process response as a final event.
+ * Execute a command and return process information.
+ *
+ * Streaming: with `Accept: application/x-ndjson` (or `Accept: text/event-stream`, kept for compatibility) the response is NDJSON (`Content-Type: application/x-ndjson`), not SSE: one JSON object per line, `{"type": "...", "data": "..."}`.
+ * `type` is `stdout` or `stderr` (`data` is a raw output chunk, sent as soon as the process writes it, newlines included; if the process finished before any chunk was streamed, its output is sent instead as one event per line, without the newline), `keepalive` (every 5 seconds, no data), `error` (`data` is the message, ends the stream) or `result` (last event, `data` is the ProcessResponse as a JSON string).
  */
 const postProcess = (options) => {
     return (options.client ?? client_gen_1.client).post({
@@ -630,7 +656,7 @@ const postProcess = (options) => {
 exports.postProcess = postProcess;
 /**
  * Stop a process
- * Gracefully stop a running process
+ * Request graceful termination. Poll GET /process/{identifier} until terminal status confirms the managed process has exited.
  */
 const deleteProcessByIdentifier = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -664,7 +690,7 @@ const getProcessByIdentifier = (options) => {
 exports.getProcessByIdentifier = getProcessByIdentifier;
 /**
  * Kill a process
- * Forcefully kill a running process
+ * Request forceful termination. Poll GET /process/{identifier} until terminal status confirms the managed process has exited.
  */
 const deleteProcessByIdentifierKill = (options) => {
     return (options.client ?? client_gen_1.client).delete({
@@ -698,7 +724,11 @@ const getProcessByIdentifierLogs = (options) => {
 exports.getProcessByIdentifierLogs = getProcessByIdentifierLogs;
 /**
  * Stream process logs in real time
- * Streams the stdout and stderr output of a process in real time, one line per log, prefixed with 'stdout:' or 'stderr:'. Closes when the process exits or the client disconnects.
+ * Streams the stdout and stderr output of a process in real time: the output so far, then live output as the process writes it. Closes when the process exits or the client disconnects.
+ * By default, output is plain text with `stdout:` or `stderr:` prefixes at the start of each source stream's lines. Partial lines (e.g. prompts) are sent without waiting for a newline; their continuations have no new prefix. The other stream is not held back while a line is incomplete, and chronological order across stdout and stderr is not guaranteed.
+ * This format does not provide unambiguous framing: output from the other stream, or a `[keepalive]` marker sent every 30 seconds, can appear inside an unfinished line. A later continuation can therefore lack a prefix identifying its source. Do not rely on this text stream to reconstruct stdout and stderr separately; request NDJSON for source-preserving streaming, or use GET /process/{identifier}/logs for separate output snapshots.
+ * With `Accept: application/x-ndjson`, each line is a JSON object with `type` (`stdout`, `stderr`, `keepalive`, `restart`, `truncated`, or `error`) and optional `data`. Output records retain source identity and original bytes, including partial lines and newlines, for both retained history and live output. For `encoding: "base64"`, decode `data` before concatenating bytes per source; this occurs for binary data or a UTF-8 character split across chunks. Chunk boundaries are arbitrary and ordering is collection order, not a strict chronology across streams.
+ * `keepalive` has no output data. A quiet active stream sends an initial keepalive after attachment so clients can receive the response before sending stdin; subsequent keepalives are sent every 30 seconds. `restart` carries a supervisor restart notice, not process output. `truncated` reports a retention or slow-reader gap and must not be appended to stdout/stderr. `error` reports a streaming failure. The connection ends after the final process exit, including automatic restarts; there is no `result` record. Older processes without structured history return HTTP 409 for NDJSON; their text stream remains available.
  */
 const getProcessByIdentifierLogsStream = (options) => {
     return (options.client ?? client_gen_1.client).get({
@@ -778,7 +808,10 @@ const postUpgrade = (options) => {
 exports.postUpgrade = postUpgrade;
 /**
  * Stream file modification events in a directory
- * Streams the path of modified files (one per line) in the given directory. Closes when the client disconnects.
+ * Streams change events for a directory until the client disconnects.
+ *
+ * The body is JSON lines (sent with `Content-Type: text/plain`): one event object per line, e.g. `{"op":"WRITE","name":"main.go","path":"/app/src","error":null}`. `op` is the fsnotify operation (CREATE, WRITE, REMOVE, RENAME or CHMOD, several can be joined with `|`), `name` the base name of the changed entry, `path` the directory containing it, and `error` is always null. A `[keepalive]` line (not JSON) is sent every 30 seconds.
+ * Only the directory's direct entries are watched. To also watch every subdirectory, including ones created later, end the path with `**`. The stream reports subsequent changes without an initial snapshot. When a new directory is detected, synthetic CREATE events are emitted for entries already present inside it to cover changes before its watch was registered.
  */
 const getWatchFilesystemByPath = (options) => {
     return (options.client ?? client_gen_1.client).get({

package/dist/cjs-browser/sandbox/filesystem/filesystem.js

@@ -266,7 +266,7 @@ class SandboxFileSystem extends action_js_1.SandboxAction {
     }
     async search(query, path = "/", options) {
         const formattedPath = this.formatPath(path);
-        const queryParams = {};
+        const queryParams = { query };
         if (options?.maxResults !== undefined) {
             queryParams.maxResults = options.maxResults;
         }

package/dist/cjs-browser/types/client/sdk.gen.d.ts

@@ -262,7 +262,7 @@ export declare const listImages: <ThrowOnError extends boolean = false>(options?
 }, unknown, ThrowOnError>;
 /**
  * Build a container image
- * Builds a container image without creating a deployment. Returns a presigned URL for uploading source code. After upload, the image will be built and stored in the registry, but no agent, function, sandbox, or job will be created or updated.
+ * Builds or imports a container image without creating a deployment. Provide a registry image reference to download and convert an existing image, or omit image to receive a presigned URL for uploading source code. Registry imports can specify memoryMb and volumeMb for the import worker. These settings do not change the resources of workloads using the image.
  */
 export declare const createImage: <ThrowOnError extends boolean = false>(options: Options<CreateImageData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<{
     image?: string;
@@ -664,6 +664,7 @@ export declare const getWorkspaceServiceAccounts: <ThrowOnError extends boolean
     created_at?: string;
     description?: string;
     name?: string;
+    role?: string;
     updated_at?: string;
 }[], unknown, ThrowOnError>;
 /**
@@ -676,6 +677,7 @@ export declare const createWorkspaceServiceAccount: <ThrowOnError extends boolea
     created_at?: string;
     description?: string;
     name?: string;
+    role?: string;
     updated_at?: string;
 }, unknown, ThrowOnError>;
 /**
@@ -698,6 +700,7 @@ export declare const updateWorkspaceServiceAccount: <ThrowOnError extends boolea
     created_at?: string;
     description?: string;
     name?: string;
+    role?: string;
     updated_at?: string;
 }, unknown, ThrowOnError>;
 /**
@@ -752,7 +755,7 @@ export declare const listTemplates: <ThrowOnError extends boolean = false>(optio
 export declare const getTemplate: <ThrowOnError extends boolean = false>(options: Options<GetTemplateData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen.js").Template, unknown, ThrowOnError>;
 /**
  * List workspace team members
- * Returns all team members in the workspace including their roles (admin or member) and invitation status.
+ * Returns all team members in the workspace including their roles (admin, member or viewer) and invitation status.
  */
 export declare const listWorkspaceUsers: <ThrowOnError extends boolean = false>(options?: Options<ListWorkspaceUsersData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen.js").WorkspaceUser[], unknown, ThrowOnError>;
 /**

package/dist/cjs-browser/types/client/types.gen.d.ts

@@ -1041,7 +1041,7 @@ export type ExpirationPolicy = {
      */
     type?: 'ttl-idle' | 'ttl-max-age' | 'date';
     /**
-     * Duration value for TTL policies (e.g., '30m', '24h', '7d') or ISO 8601 date for date policies
+     * Duration value for TTL policies (e.g., '30m', '24h', '7d', minimum '5m') or ISO 8601 date for date policies
      */
     value?: string;
 };
@@ -1223,9 +1223,9 @@ export type GroupWorkspaceMapping = {
      */
     groupName?: string;
     /**
-     * Role to assign in this workspace (admin or member)
+     * Role to assign in this workspace (admin, member or viewer)
      */
-    role?: 'admin' | 'member';
+    role?: 'admin' | 'member' | 'viewer';
 };
 export type Image = {
     metadata: ImageMetadata;
@@ -1715,10 +1715,18 @@ export type JobExecutionSpec = {
      * Number of parallel tasks
      */
     parallelism?: number;
+    /**
+     * Number of tasks of this execution
+     */
+    taskCount?: number;
     /**
      * List of execution tasks
      */
     tasks?: Array<JobExecutionTask>;
+    /**
+     * Where this execution's task list is stored (server-managed)
+     */
+    readonly tasksRef?: string;
     /**
      * Job timeout in seconds (captured at execution creation time)
      */
@@ -1742,6 +1750,10 @@ export type JobExecutionSpecWritable = {
      * Number of parallel tasks
      */
     parallelism?: number;
+    /**
+     * Number of tasks of this execution
+     */
+    taskCount?: number;
     /**
      * List of execution tasks
      */
@@ -3666,6 +3678,14 @@ export type SandboxDefinition = {
      * Icon of the definition
      */
     icon?: string;
+    /**
+     * Nonempty dark-mode icon URL in responses. Blank inputs use the resolved light-mode icon.
+     */
+    iconDark?: string;
+    /**
+     * Nonempty light-mode icon URL in responses. Blank inputs use icon, iconDark, then the default Hub icon.
+     */
+    iconLight?: string;
     /**
      * Image of the Sandbox definition
      */
@@ -3743,6 +3763,7 @@ export type SandboxForkRequest = {
      * Environment variables the fork runs with, on top of the ones the source has. A variable the source already carries takes this value in the fork, one it does not is added, and every other variable of the source is kept.
      */
     envs?: Array<Env>;
+    lifecycle?: SandboxLifecycle;
     /**
      * Port to expose from the sandbox
      */
@@ -3889,7 +3910,7 @@ export type SandboxRuntime = {
      */
     expires?: string;
     /**
-     * Extra arguments for kernel selection. Supported keys: 'iptables', 'nfs' (mk3.0), 'tun' and 'android' (mk3.1). The android variant includes tun and iptables and cannot be combined with nfs. Android requests are rejected if routing selects mk3.0. Values: 'enabled' or 'disabled'. Determines which kernel variant the workload runs on. Immutable after creation.
+     * Extra arguments for kernel selection. Supported keys: 'iptables', 'nfs' (mk3.0), 'tun', 'android' and 'landlock' (mk3.1). The android variant includes tun and iptables and cannot be combined with nfs. The landlock variant enables the Landlock LSM, includes tun and iptables, and cannot be combined with android or nfs. Android and landlock requests are rejected if routing selects mk3.0. Values: 'enabled' or 'disabled'. Determines which kernel variant the workload runs on. Immutable after creation.
      */
     extraArgs?: {
         [key: string]: string;
@@ -3908,7 +3929,7 @@ export type SandboxRuntime = {
      */
     terminationGracePeriodSeconds?: number;
     /**
-     * Max-age from creation: the sandbox is deleted this long after it is created, regardless of activity (not an idle timeout). Units s, m, h, d, w (e.g., '30m', '24h', '7d', '2w'). For idle-based cleanup, use a lifecycle expiration policy of type ttl-idle.
+     * Max-age from creation: the sandbox is deleted this long after it is created, regardless of activity (not an idle timeout). Units s, m, h, d, w (e.g., '30m', '24h', '7d', '2w'), minimum '5m'. For idle-based cleanup, use a lifecycle expiration policy of type ttl-idle.
      */
     ttl?: string;
 };
@@ -4501,6 +4522,10 @@ export type TriggerConfiguration = {
      * The tasks configuration of the cronjob
      */
     tasks?: Array<TriggerConfigurationTask>;
+    /**
+     * Where this trigger's task list is stored (server-managed)
+     */
+    readonly tasksRef?: string;
     /**
      * The timeout in seconds for async triggers (max 900s, MK3 only)
      */
@@ -4813,6 +4838,10 @@ export type Workspace = TimeFields & OwnerFields & {
      * Workspace account id
      */
     accountId?: string;
+    /**
+     * Baseten team this workspace was provisioned for; absent on native workspaces
+     */
+    readonly basetenTeamId?: string;
     /**
      * Workspace display name
      */
@@ -4993,6 +5022,10 @@ export type WorkspaceUser = {
      * Workspace user given name
      */
     given_name?: string;
+    /**
+     * Whether the user has at least one verified MFA factor. Omitted when the caller is not entitled to see it (only workspace admins and owners see other members' MFA status) and for pending invitations, which have no account yet.
+     */
+    mfa_enabled?: boolean;
     /**
      * Workspace user role
      */
@@ -6353,14 +6386,22 @@ export type ListImagesResponses = {
 export type ListImagesResponse = ListImagesResponses[keyof ListImagesResponses];
 export type CreateImageData = {
     body: {
+        /**
+         * Docker configuration JSON containing credentials for the source registry.
+         */
+        dockerConfig?: string;
         /**
          * Runtime generation (e.g., mk3). Defaults to mk3 if not specified.
          */
         generation?: string;
         /**
-         * A pre-built Docker image reference (e.g., docker.io/myorg/myimage:latest). When provided, the build step is skipped and the image is used directly as the source for the resource runtime.
+         * A pre-built Docker image reference (e.g., docker.io/myorg/myimage:latest). References with a registry hostname start an asynchronous import that downloads and converts the image for the resource runtime.
          */
         image?: string;
+        /**
+         * Memory for the registry import worker in MiB. Only supported when image is a registry reference. When omitted, the platform default is used.
+         */
+        memoryMb?: number;
         /**
          * Name of the image to build
          */
@@ -6369,6 +6410,14 @@ export type CreateImageData = {
          * Resource type (agent, function, sandbox, job)
          */
         resourceType: string;
+        /**
+         * Tag for the imported image. Only supported when image is a registry reference. When omitted, a tag is derived from the build inputs. Tags are immutable, so a tag that already exists is rejected. latest, pending and failed are reserved.
+         */
+        tag?: string;
+        /**
+         * Temporary scratch disk for the registry import worker in MiB. Only supported when image is a registry reference. When omitted, the platform default is used. Set to 0 to use memory-backed scratch. Positive values are not supported for HIPAA workspaces.
+         */
+        volumeMb?: number;
     };
     path?: never;
     query?: never;
@@ -6379,6 +6428,10 @@ export type CreateImageErrors = {
      * invalid request
      */
     400: unknown;
+    /**
+     * the requested tag already exists
+     */
+    409: unknown;
 };
 export type CreateImageResponses = {
     /**
@@ -7804,7 +7857,7 @@ export type CreateSandboxData = {
     path?: never;
     query?: {
         /**
-         * If true, return existing sandbox instead of 409 error when sandbox exists and is not in FAILED/TERMINATED/TERMINATING state
+         * If true, return the existing sandbox instead of a 409 when one with this name is alive. A name held by a FAILED or TERMINATED sandbox is reused, and a deletion or a concurrent creation still in flight is waited for (with backoff) so the response is the sandbox, not a conflict to retry.
          */
         createIfNotExist?: boolean;
     };
@@ -8713,6 +8766,10 @@ export type GetWorkspaceServiceAccountsResponses = {
          * Service account name
          */
         name?: string;
+        /**
+         * Role of the service account in the workspace
+         */
+        role?: string;
         /**
          * Last update timestamp
          */
@@ -8730,6 +8787,10 @@ export type CreateWorkspaceServiceAccountData = {
          * Service account name
          */
         name: string;
+        /**
+         * Role of the service account in the workspace. Defaults to admin on creation; unchanged on update when omitted.
+         */
+        role?: 'viewer' | 'member' | 'admin';
     };
     path?: never;
     query?: never;
@@ -8760,6 +8821,10 @@ export type CreateWorkspaceServiceAccountResponses = {
          * Service account name
          */
         name?: string;
+        /**
+         * Role of the service account in the workspace
+         */
+        role?: string;
         /**
          * Last update timestamp
          */
@@ -8816,6 +8881,10 @@ export type UpdateWorkspaceServiceAccountData = {
          * Service account name
          */
         name?: string;
+        /**
+         * Role of the service account in the workspace. Defaults to admin on creation; unchanged on update when omitted.
+         */
+        role?: 'viewer' | 'member' | 'admin';
     };
     path: {
         /**
@@ -8847,6 +8916,10 @@ export type UpdateWorkspaceServiceAccountResponses = {
          * Service account name
          */
         name?: string;
+        /**
+         * Role of the service account in the workspace
+         */
+        role?: string;
         /**
          * Last update timestamp
          */

package/dist/cjs-browser/types/sandbox/client/sdk.gen.d.ts

@@ -1,5 +1,5 @@
 import { type Options as ClientOptions, type TDataShape, type Client } from '@hey-api/client-fetch';
-import type { PostArchiveExportData, PostArchiveExportResponse, PostArchiveResumeData, GetArchiveStatusData, PutCodegenFastapplyByPathData, GetCodegenRerankingByPathData, GetDrivesMountData, PostDrivesMountData, DeleteDrivesMountByMountPathData, PostEnvironmentReloadData, GetFilesystemContentSearchByPathData, GetFilesystemFindByPathData, GetFilesystemMultipartData, DeleteFilesystemMultipartByUploadIdAbortData, PostFilesystemMultipartByUploadIdCompleteData, PutFilesystemMultipartByUploadIdPartData, GetFilesystemMultipartByUploadIdPartsData, PostFilesystemMultipartInitiateByPathData, GetFilesystemSearchByPathData, DeleteFilesystemByPathData, GetFilesystemByPathData, PutFilesystemByPathData, DeleteFilesystemTreeByPathData, GetFilesystemTreeByPathData, PutFilesystemTreeByPathData, GetHealthData, DeleteNetworkProcessByPidMonitorData, PostNetworkProcessByPidMonitorData, GetNetworkProcessByPidPortsData, DeleteNetworkTunnelData, PutNetworkTunnelConfigData, GetProcessData, PostProcessData, DeleteProcessByIdentifierData, GetProcessByIdentifierData, DeleteProcessByIdentifierKillData, GetProcessByIdentifierLogsData, GetProcessByIdentifierLogsStreamData, DeleteProcessByIdentifierStdinData, PostProcessByIdentifierStdinData, PostUpgradeData, GetWatchFilesystemByPathData } from './types.gen';
+import type { PostArchiveExportData, PostArchiveExportResponse, PostArchiveResumeData, GetArchiveStatusData, PutCodegenFastapplyByPathData, GetCodegenRerankingByPathData, GetDrivesMountData, PostDrivesMountData, DeleteDrivesMountByMountPathData, PostEnvironmentReloadData, GetFilesystemContentSearchByPathData, GetFilesystemFindByPathData, GetFilesystemMultipartData, DeleteFilesystemMultipartByUploadIdAbortData, PostFilesystemMultipartByUploadIdCompleteData, PutFilesystemMultipartByUploadIdPartData, GetFilesystemMultipartByUploadIdPartsData, PostFilesystemMultipartInitiateByPathData, GetFilesystemSearchByPathData, DeleteFilesystemByPathData, GetFilesystemByPathData, HeadFilesystemByPathData, PutFilesystemByPathData, DeleteFilesystemTreeByPathData, GetFilesystemTreeByPathData, PutFilesystemTreeByPathData, GetHealthData, DeleteNetworkProcessByPidMonitorData, PostNetworkProcessByPidMonitorData, GetNetworkProcessByPidPortsData, DeleteNetworkTunnelData, PutNetworkTunnelConfigData, GetProcessData, PostProcessData, DeleteProcessByIdentifierData, GetProcessByIdentifierData, DeleteProcessByIdentifierKillData, GetProcessByIdentifierLogsData, GetProcessByIdentifierLogsStreamData, DeleteProcessByIdentifierStdinData, PostProcessByIdentifierStdinData, PostUpgradeData, GetWatchFilesystemByPathData } from './types.gen';
 export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean> = ClientOptions<TData, ThrowOnError> & {
     /**
      * You can provide a client instance returned by `createClient()` instead of
@@ -17,6 +17,7 @@ export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends
  * Export the filesystem changes to a presigned URL
  * Archives everything the sandbox changed on top of its base image and streams it, uncompressed, to a presigned S3 PUT URL. The memory of the sandbox is not archived.
  * The sandbox is quiesced first: the process list is saved (unless saveProcesses is false), every process is stopped, and the API then refuses the calls that would write to the filesystem. The freeze is not lifted afterwards, since an exported sandbox is meant to be restored elsewhere; call POST /archive/resume to lift it.
+ * A sandbox still frozen by an earlier export is exported as it is, with the process list that export saved.
  * Use dryRun to get the archive's content and exact size without stopping anything and without uploading.
  * Set async to start the export and answer immediately, which is what archiving a large filesystem needs: the export then reports itself through GET /archive/status.
  */
@@ -94,7 +95,7 @@ export declare const deleteDrivesMountByMountPath: <ThrowOnError extends boolean
 export declare const postEnvironmentReload: <ThrowOnError extends boolean = false>(options?: Options<PostEnvironmentReloadData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").HandlerReloadResponse, import("./types.gen").ErrorResponse, ThrowOnError>;
 /**
  * Search for text content in files
- * Searches for text content inside files using ripgrep. Returns matching lines with context.
+ * Searches for text content inside files. Returns each matching line, with the lines around it when contextLines is set.
  */
 export declare const getFilesystemContentSearchByPath: <ThrowOnError extends boolean = false>(options: Options<GetFilesystemContentSearchByPathData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").ContentSearchResponse, import("./types.gen").ErrorResponse, ThrowOnError>;
 /**
@@ -119,7 +120,7 @@ export declare const deleteFilesystemMultipartByUploadIdAbort: <ThrowOnError ext
 export declare const postFilesystemMultipartByUploadIdComplete: <ThrowOnError extends boolean = false>(options: Options<PostFilesystemMultipartByUploadIdCompleteData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").SuccessResponse, import("./types.gen").ErrorResponse, ThrowOnError>;
 /**
  * Upload part
- * Upload a single part of a multipart upload
+ * Upload a single part of a multipart upload. Re-uploading a part number replaces that part. Wait for the previous request for that part to finish before retrying.
  */
 export declare const putFilesystemMultipartByUploadIdPart: <ThrowOnError extends boolean = false>(options: Options<PutFilesystemMultipartByUploadIdPartData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").MultipartUploadPartResponse, import("./types.gen").ErrorResponse, ThrowOnError>;
 /**
@@ -134,7 +135,8 @@ export declare const getFilesystemMultipartByUploadIdParts: <ThrowOnError extend
 export declare const postFilesystemMultipartInitiateByPath: <ThrowOnError extends boolean = false>(options: Options<PostFilesystemMultipartInitiateByPathData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").MultipartInitiateResponse, import("./types.gen").ErrorResponse, ThrowOnError>;
 /**
  * Fuzzy search for files and directories
- * Performs fuzzy search on filesystem paths using fuzzy matching algorithm. Optimized alternative to find and grep commands.
+ * Ranks the files and directories under a path by how well their relative path fuzzy-matches `query` (fzf algorithm: the query's characters must appear in order, not necessarily next to each other), best match first.
+ * Fuzzy search is for "jump to file" lookups from a partial name. The `patterns` parameter is currently ignored by this endpoint; use find for exact glob filtering.
  */
 export declare const getFilesystemSearchByPath: <ThrowOnError extends boolean = false>(options: Options<GetFilesystemSearchByPathData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").FuzzySearchResponse, import("./types.gen").ErrorResponse, ThrowOnError>;
 /**
@@ -147,9 +149,18 @@ export declare const deleteFilesystemByPath: <ThrowOnError extends boolean = fal
  * Get content of a file or listing of a directory. Use Accept header to control response format for files.
  */
 export declare const getFilesystemByPath: <ThrowOnError extends boolean = false>(options: Options<GetFilesystemByPathData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").File | import("./types.gen").Directory | import("./types.gen").FileWithContent | Blob, import("./types.gen").ErrorResponse, ThrowOnError>;
+/**
+ * Stat a file or directory
+ * Returns the metadata of a file or directory as headers, with no body. This checks stat availability, not permission to read file contents or list a directory. When the path does not exist or its metadata cannot be accessed, the response is an empty 200 without the X-File-Type header.
+ */
+export declare const headFilesystemByPath: <ThrowOnError extends boolean = false>(options: Options<HeadFilesystemByPathData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<unknown, unknown, ThrowOnError>;
 /**
  * Create or update a file or directory
- * Create or update a file or directory
+ * Create or update a file or directory.
+ *
+ * Idempotent: an existing file is overwritten (truncated, not appended to) and an existing directory is kept, so retrying the same request is safe.
+ *
+ * Send either a JSON body (FileRequest) or `multipart/form-data` for binary files. Multipart fields, in any order: `file` (required, the file content), `permissions` (optional octal mode such as `0755`, applied when the file is created, default `0644`; an existing file keeps its mode), `path` (optional, ignored: the target is always the URL path).
  */
 export declare const putFilesystemByPath: <ThrowOnError extends boolean = false>(options: Options<PutFilesystemByPathData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").SuccessResponse, import("./types.gen").ErrorResponse, ThrowOnError>;
 /**
@@ -161,12 +172,12 @@ export declare const deleteFilesystemTreeByPath: <ThrowOnError extends boolean =
  * Get directory tree
  * Get a recursive directory tree structure starting from the specified path
  */
-export declare const getFilesystemTreeByPath: <ThrowOnError extends boolean = false>(options: Options<GetFilesystemTreeByPathData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").File | import("./types.gen").Directory | import("./types.gen").FileWithContent | Blob, import("./types.gen").ErrorResponse, ThrowOnError>;
+export declare const getFilesystemTreeByPath: <ThrowOnError extends boolean = false>(options: Options<GetFilesystemTreeByPathData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").Directory, import("./types.gen").ErrorResponse, ThrowOnError>;
 /**
  * Create or update directory tree
- * Create or update multiple files within a directory tree structure
+ * Create or update multiple files within a directory tree structure. Idempotent: existing files are overwritten, so retrying the same request is safe.
  */
-export declare const putFilesystemTreeByPath: <ThrowOnError extends boolean = false>(options: Options<PutFilesystemTreeByPathData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").File | import("./types.gen").Directory | import("./types.gen").FileWithContent | Blob, import("./types.gen").ErrorResponse, ThrowOnError>;
+export declare const putFilesystemTreeByPath: <ThrowOnError extends boolean = false>(options: Options<PutFilesystemTreeByPathData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").Directory, import("./types.gen").ErrorResponse, ThrowOnError>;
 /**
  * Health check
  * Returns health status and system information including upgrade count and binary details
@@ -211,12 +222,15 @@ export declare const putNetworkTunnelConfig: <ThrowOnError extends boolean = fal
 export declare const getProcess: <ThrowOnError extends boolean = false>(options?: Options<GetProcessData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").ProcessResponse[], unknown, ThrowOnError>;
 /**
  * Execute a command
- * Execute a command and return process information. If Accept header is text/event-stream, streams logs in SSE format and returns the process response as a final event.
+ * Execute a command and return process information.
+ *
+ * Streaming: with `Accept: application/x-ndjson` (or `Accept: text/event-stream`, kept for compatibility) the response is NDJSON (`Content-Type: application/x-ndjson`), not SSE: one JSON object per line, `{"type": "...", "data": "..."}`.
+ * `type` is `stdout` or `stderr` (`data` is a raw output chunk, sent as soon as the process writes it, newlines included; if the process finished before any chunk was streamed, its output is sent instead as one event per line, without the newline), `keepalive` (every 5 seconds, no data), `error` (`data` is the message, ends the stream) or `result` (last event, `data` is the ProcessResponse as a JSON string).
  */
 export declare const postProcess: <ThrowOnError extends boolean = false>(options: Options<PostProcessData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").ProcessResponse, import("./types.gen").ErrorResponse, ThrowOnError>;
 /**
  * Stop a process
- * Gracefully stop a running process
+ * Request graceful termination. Poll GET /process/{identifier} until terminal status confirms the managed process has exited.
  */
 export declare const deleteProcessByIdentifier: <ThrowOnError extends boolean = false>(options: Options<DeleteProcessByIdentifierData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").SuccessResponse, import("./types.gen").ErrorResponse, ThrowOnError>;
 /**
@@ -226,7 +240,7 @@ export declare const deleteProcessByIdentifier: <ThrowOnError extends boolean =
 export declare const getProcessByIdentifier: <ThrowOnError extends boolean = false>(options: Options<GetProcessByIdentifierData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").ProcessResponse, import("./types.gen").ErrorResponse, ThrowOnError>;
 /**
  * Kill a process
- * Forcefully kill a running process
+ * Request forceful termination. Poll GET /process/{identifier} until terminal status confirms the managed process has exited.
  */
 export declare const deleteProcessByIdentifierKill: <ThrowOnError extends boolean = false>(options: Options<DeleteProcessByIdentifierKillData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").SuccessResponse, import("./types.gen").ErrorResponse, ThrowOnError>;
 /**
@@ -236,7 +250,11 @@ export declare const deleteProcessByIdentifierKill: <ThrowOnError extends boolea
 export declare const getProcessByIdentifierLogs: <ThrowOnError extends boolean = false>(options: Options<GetProcessByIdentifierLogsData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").ProcessLogs, import("./types.gen").ErrorResponse, ThrowOnError>;
 /**
  * Stream process logs in real time
- * Streams the stdout and stderr output of a process in real time, one line per log, prefixed with 'stdout:' or 'stderr:'. Closes when the process exits or the client disconnects.
+ * Streams the stdout and stderr output of a process in real time: the output so far, then live output as the process writes it. Closes when the process exits or the client disconnects.
+ * By default, output is plain text with `stdout:` or `stderr:` prefixes at the start of each source stream's lines. Partial lines (e.g. prompts) are sent without waiting for a newline; their continuations have no new prefix. The other stream is not held back while a line is incomplete, and chronological order across stdout and stderr is not guaranteed.
+ * This format does not provide unambiguous framing: output from the other stream, or a `[keepalive]` marker sent every 30 seconds, can appear inside an unfinished line. A later continuation can therefore lack a prefix identifying its source. Do not rely on this text stream to reconstruct stdout and stderr separately; request NDJSON for source-preserving streaming, or use GET /process/{identifier}/logs for separate output snapshots.
+ * With `Accept: application/x-ndjson`, each line is a JSON object with `type` (`stdout`, `stderr`, `keepalive`, `restart`, `truncated`, or `error`) and optional `data`. Output records retain source identity and original bytes, including partial lines and newlines, for both retained history and live output. For `encoding: "base64"`, decode `data` before concatenating bytes per source; this occurs for binary data or a UTF-8 character split across chunks. Chunk boundaries are arbitrary and ordering is collection order, not a strict chronology across streams.
+ * `keepalive` has no output data. A quiet active stream sends an initial keepalive after attachment so clients can receive the response before sending stdin; subsequent keepalives are sent every 30 seconds. `restart` carries a supervisor restart notice, not process output. `truncated` reports a retention or slow-reader gap and must not be appended to stdout/stderr. `error` reports a streaming failure. The connection ends after the final process exit, including automatic restarts; there is no `result` record. Older processes without structured history return HTTP 409 for NDJSON; their text stream remains available.
  */
 export declare const getProcessByIdentifierLogsStream: <ThrowOnError extends boolean = false>(options: Options<GetProcessByIdentifierLogsStreamData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<string, import("./types.gen").ErrorResponse, ThrowOnError>;
 /**
@@ -260,6 +278,9 @@ export declare const postProcessByIdentifierStdin: <ThrowOnError extends boolean
 export declare const postUpgrade: <ThrowOnError extends boolean = false>(options?: Options<PostUpgradeData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<import("./types.gen").SuccessResponse, import("./types.gen").ErrorResponse, ThrowOnError>;
 /**
  * Stream file modification events in a directory
- * Streams the path of modified files (one per line) in the given directory. Closes when the client disconnects.
+ * Streams change events for a directory until the client disconnects.
+ *
+ * The body is JSON lines (sent with `Content-Type: text/plain`): one event object per line, e.g. `{"op":"WRITE","name":"main.go","path":"/app/src","error":null}`. `op` is the fsnotify operation (CREATE, WRITE, REMOVE, RENAME or CHMOD, several can be joined with `|`), `name` the base name of the changed entry, `path` the directory containing it, and `error` is always null. A `[keepalive]` line (not JSON) is sent every 30 seconds.
+ * Only the directory's direct entries are watched. To also watch every subdirectory, including ones created later, end the path with `**`. The stream reports subsequent changes without an initial snapshot. When a new directory is detected, synthetic CREATE events are emitted for entries already present inside it to cover changes before its watch was registered.
  */
 export declare const getWatchFilesystemByPath: <ThrowOnError extends boolean = false>(options: Options<GetWatchFilesystemByPathData, ThrowOnError>) => import("@hey-api/client-fetch").RequestResult<string, import("./types.gen").ErrorResponse, ThrowOnError>;