modal 0.10.0 → 0.10.1

package/dist/index.js

@@ -1592,6 +1592,36 @@ function appStopSourceToJSON(object) {
       return "UNRECOGNIZED";
   }
 }
+function archFromJSON(object) {
+  switch (object) {
+    case 0:
+    case "ARCH_UNSPECIFIED":
+      return 0 /* ARCH_UNSPECIFIED */;
+    case 1:
+    case "ARCH_X86_64":
+      return 1 /* ARCH_X86_64 */;
+    case 2:
+    case "ARCH_AARCH64":
+      return 2 /* ARCH_AARCH64 */;
+    case -1:
+    case "UNRECOGNIZED":
+    default:
+      return -1 /* UNRECOGNIZED */;
+  }
+}
+function archToJSON(object) {
+  switch (object) {
+    case 0 /* ARCH_UNSPECIFIED */:
+      return "ARCH_UNSPECIFIED";
+    case 1 /* ARCH_X86_64 */:
+      return "ARCH_X86_64";
+    case 2 /* ARCH_AARCH64 */:
+      return "ARCH_AARCH64";
+    case -1 /* UNRECOGNIZED */:
+    default:
+      return "UNRECOGNIZED";
+  }
+}
 function certificateStatusFromJSON(object) {
   switch (object) {
     case 0:
@@ -2062,6 +2092,41 @@ function endpointStopSourceToJSON(object) {
       return "UNRECOGNIZED";
   }
 }
+function environmentBlockUnauthenticatedResourcesFromJSON(object) {
+  switch (object) {
+    case 0:
+    case "ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_UNSPECIFIED":
+      return 0 /* ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_UNSPECIFIED */;
+    case 1:
+    case "ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_INHERIT":
+      return 1 /* ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_INHERIT */;
+    case 2:
+    case "ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_BLOCK":
+      return 2 /* ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_BLOCK */;
+    case 3:
+    case "ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_ALLOW":
+      return 3 /* ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_ALLOW */;
+    case -1:
+    case "UNRECOGNIZED":
+    default:
+      return -1 /* UNRECOGNIZED */;
+  }
+}
+function environmentBlockUnauthenticatedResourcesToJSON(object) {
+  switch (object) {
+    case 0 /* ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_UNSPECIFIED */:
+      return "ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_UNSPECIFIED";
+    case 1 /* ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_INHERIT */:
+      return "ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_INHERIT";
+    case 2 /* ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_BLOCK */:
+      return "ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_BLOCK";
+    case 3 /* ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_ALLOW */:
+      return "ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_ALLOW";
+    case -1 /* UNRECOGNIZED */:
+    default:
+      return "UNRECOGNIZED";
+  }
+}
 function environmentRoleFromJSON(object) {
   switch (object) {
     case 0:
@@ -5087,6 +5152,108 @@ var AppGetByDeploymentNameResponse = {
     return message;
   }
 };
+function createBaseAppGetInfoRequest() {
+  return { appId: "" };
+}
+var AppGetInfoRequest = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.appId !== "") {
+      writer.uint32(10).string(message.appId);
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseAppGetInfoRequest();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.appId = reader.string();
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return { appId: isSet5(object.appId) ? globalThis.String(object.appId) : "" };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.appId !== "") {
+      obj.appId = message.appId;
+    }
+    return obj;
+  },
+  create(base) {
+    return AppGetInfoRequest.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseAppGetInfoRequest();
+    message.appId = object.appId ?? "";
+    return message;
+  }
+};
+function createBaseAppGetInfoResponse() {
+  return { info: void 0 };
+}
+var AppGetInfoResponse = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.info !== void 0) {
+      AppHandleMetadata.encode(message.info, writer.uint32(10).fork()).join();
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseAppGetInfoResponse();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.info = AppHandleMetadata.decode(reader, reader.uint32());
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return { info: isSet5(object.info) ? AppHandleMetadata.fromJSON(object.info) : void 0 };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.info !== void 0) {
+      obj.info = AppHandleMetadata.toJSON(message.info);
+    }
+    return obj;
+  },
+  create(base) {
+    return AppGetInfoResponse.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseAppGetInfoResponse();
+    message.info = object.info !== void 0 && object.info !== null ? AppHandleMetadata.fromPartial(object.info) : void 0;
+    return message;
+  }
+};
 function createBaseAppGetLayoutRequest() {
   return { appId: "" };
 }
@@ -5794,13 +5961,16 @@ var AppGetOrCreateRequest = {
   }
 };
 function createBaseAppGetOrCreateResponse() {
-  return { appId: "" };
+  return { appId: "", handleMetadata: void 0 };
 }
 var AppGetOrCreateResponse = {
   encode(message, writer = new BinaryWriter()) {
     if (message.appId !== "") {
       writer.uint32(10).string(message.appId);
     }
+    if (message.handleMetadata !== void 0) {
+      AppHandleMetadata.encode(message.handleMetadata, writer.uint32(18).fork()).join();
+    }
     return writer;
   },
   decode(input, length) {
@@ -5817,6 +5987,13 @@ var AppGetOrCreateResponse = {
           message.appId = reader.string();
           continue;
         }
+        case 2: {
+          if (tag !== 18) {
+            break;
+          }
+          message.handleMetadata = AppHandleMetadata.decode(reader, reader.uint32());
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -5826,13 +6003,19 @@ var AppGetOrCreateResponse = {
     return message;
   },
   fromJSON(object) {
-    return { appId: isSet5(object.appId) ? globalThis.String(object.appId) : "" };
+    return {
+      appId: isSet5(object.appId) ? globalThis.String(object.appId) : "",
+      handleMetadata: isSet5(object.handleMetadata) ? AppHandleMetadata.fromJSON(object.handleMetadata) : void 0
+    };
   },
   toJSON(message) {
     const obj = {};
     if (message.appId !== "") {
       obj.appId = message.appId;
     }
+    if (message.handleMetadata !== void 0) {
+      obj.handleMetadata = AppHandleMetadata.toJSON(message.handleMetadata);
+    }
     return obj;
   },
   create(base) {
@@ -5841,6 +6024,7 @@ var AppGetOrCreateResponse = {
   fromPartial(object) {
     const message = createBaseAppGetOrCreateResponse();
     message.appId = object.appId ?? "";
+    message.handleMetadata = object.handleMetadata !== void 0 && object.handleMetadata !== null ? AppHandleMetadata.fromPartial(object.handleMetadata) : void 0;
     return message;
   }
 };
@@ -6033,77 +6217,35 @@ var AppGetTagsResponse_TagsEntry = {
     return message;
   }
 };
-function createBaseAppHeartbeatRequest() {
-  return { appId: "" };
+function createBaseAppHandleMetadata() {
+  return { description: "", appId: "", environmentName: "", lifecycle: void 0, functions: {}, servers: {} };
 }
-var AppHeartbeatRequest = {
+var AppHandleMetadata = {
   encode(message, writer = new BinaryWriter()) {
-    if (message.appId !== "") {
-      writer.uint32(10).string(message.appId);
-    }
-    return writer;
-  },
-  decode(input, length) {
-    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
-    let end = length === void 0 ? reader.len : reader.pos + length;
-    const message = createBaseAppHeartbeatRequest();
-    while (reader.pos < end) {
-      const tag = reader.uint32();
-      switch (tag >>> 3) {
-        case 1: {
-          if (tag !== 10) {
-            break;
-          }
-          message.appId = reader.string();
-          continue;
-        }
-      }
-      if ((tag & 7) === 4 || tag === 0) {
-        break;
-      }
-      reader.skip(tag & 7);
+    if (message.description !== "") {
+      writer.uint32(10).string(message.description);
     }
-    return message;
-  },
-  fromJSON(object) {
-    return { appId: isSet5(object.appId) ? globalThis.String(object.appId) : "" };
-  },
-  toJSON(message) {
-    const obj = {};
     if (message.appId !== "") {
-      obj.appId = message.appId;
+      writer.uint32(18).string(message.appId);
     }
-    return obj;
-  },
-  create(base) {
-    return AppHeartbeatRequest.fromPartial(base ?? {});
-  },
-  fromPartial(object) {
-    const message = createBaseAppHeartbeatRequest();
-    message.appId = object.appId ?? "";
-    return message;
-  }
-};
-function createBaseAppLayout() {
-  return { objects: [], functionIds: {}, classIds: {} };
-}
-var AppLayout = {
-  encode(message, writer = new BinaryWriter()) {
-    for (const v of message.objects) {
-      Object_.encode(v, writer.uint32(10).fork()).join();
+    if (message.environmentName !== "") {
+      writer.uint32(26).string(message.environmentName);
     }
-    Object.entries(message.functionIds).forEach(([key, value]) => {
-      AppLayout_FunctionIdsEntry.encode({ key, value }, writer.uint32(18).fork()).join();
+    if (message.lifecycle !== void 0) {
+      AppLifecycle.encode(message.lifecycle, writer.uint32(34).fork()).join();
+    }
+    Object.entries(message.functions).forEach(([key, value]) => {
+      AppHandleMetadata_FunctionsEntry.encode({ key, value }, writer.uint32(42).fork()).join();
     });
-    Object.entries(message.classIds).forEach(([key, value]) => {
-      AppLayout_ClassIdsEntry.encode({ key, value }, writer.uint32(26).fork()).join();
+    Object.entries(message.servers).forEach(([key, value]) => {
+      AppHandleMetadata_ServersEntry.encode({ key, value }, writer.uint32(50).fork()).join();
     });
     return writer;
   },
   decode(input, length) {
     const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
     let end = length === void 0 ? reader.len : reader.pos + length;
-    const message = createBaseAppLayout();
+    const message = createBaseAppHandleMetadata();
     while (reader.pos < end) {
       const tag = reader.uint32();
       switch (tag >>> 3) {
@@ -6111,26 +6253,47 @@ var AppLayout = {
           if (tag !== 10) {
             break;
           }
-          message.objects.push(Object_.decode(reader, reader.uint32()));
+          message.description = reader.string();
           continue;
         }
         case 2: {
           if (tag !== 18) {
             break;
           }
-          const entry2 = AppLayout_FunctionIdsEntry.decode(reader, reader.uint32());
-          if (entry2.value !== void 0) {
-            message.functionIds[entry2.key] = entry2.value;
-          }
+          message.appId = reader.string();
           continue;
         }
         case 3: {
           if (tag !== 26) {
             break;
           }
-          const entry3 = AppLayout_ClassIdsEntry.decode(reader, reader.uint32());
-          if (entry3.value !== void 0) {
-            message.classIds[entry3.key] = entry3.value;
+          message.environmentName = reader.string();
+          continue;
+        }
+        case 4: {
+          if (tag !== 34) {
+            break;
+          }
+          message.lifecycle = AppLifecycle.decode(reader, reader.uint32());
+          continue;
+        }
+        case 5: {
+          if (tag !== 42) {
+            break;
+          }
+          const entry5 = AppHandleMetadata_FunctionsEntry.decode(reader, reader.uint32());
+          if (entry5.value !== void 0) {
+            message.functions[entry5.key] = entry5.value;
+          }
+          continue;
+        }
+        case 6: {
+          if (tag !== 50) {
+            break;
+          }
+          const entry6 = AppHandleMetadata_ServersEntry.decode(reader, reader.uint32());
+          if (entry6.value !== void 0) {
+            message.servers[entry6.key] = entry6.value;
           }
           continue;
         }
@@ -6144,12 +6307,15 @@ var AppLayout = {
   },
   fromJSON(object) {
     return {
-      objects: globalThis.Array.isArray(object?.objects) ? object.objects.map((e) => Object_.fromJSON(e)) : [],
-      functionIds: isObject2(object.functionIds) ? Object.entries(object.functionIds).reduce((acc, [key, value]) => {
+      description: isSet5(object.description) ? globalThis.String(object.description) : "",
+      appId: isSet5(object.appId) ? globalThis.String(object.appId) : "",
+      environmentName: isSet5(object.environmentName) ? globalThis.String(object.environmentName) : "",
+      lifecycle: isSet5(object.lifecycle) ? AppLifecycle.fromJSON(object.lifecycle) : void 0,
+      functions: isObject2(object.functions) ? Object.entries(object.functions).reduce((acc, [key, value]) => {
         acc[key] = String(value);
         return acc;
       }, {}) : {},
-      classIds: isObject2(object.classIds) ? Object.entries(object.classIds).reduce((acc, [key, value]) => {
+      servers: isObject2(object.servers) ? Object.entries(object.servers).reduce((acc, [key, value]) => {
         acc[key] = String(value);
         return acc;
       }, {}) : {}
@@ -6157,36 +6323,48 @@ var AppLayout = {
   },
   toJSON(message) {
     const obj = {};
-    if (message.objects?.length) {
-      obj.objects = message.objects.map((e) => Object_.toJSON(e));
+    if (message.description !== "") {
+      obj.description = message.description;
     }
-    if (message.functionIds) {
-      const entries = Object.entries(message.functionIds);
+    if (message.appId !== "") {
+      obj.appId = message.appId;
+    }
+    if (message.environmentName !== "") {
+      obj.environmentName = message.environmentName;
+    }
+    if (message.lifecycle !== void 0) {
+      obj.lifecycle = AppLifecycle.toJSON(message.lifecycle);
+    }
+    if (message.functions) {
+      const entries = Object.entries(message.functions);
       if (entries.length > 0) {
-        obj.functionIds = {};
+        obj.functions = {};
         entries.forEach(([k, v]) => {
-          obj.functionIds[k] = v;
+          obj.functions[k] = v;
         });
       }
     }
-    if (message.classIds) {
-      const entries = Object.entries(message.classIds);
+    if (message.servers) {
+      const entries = Object.entries(message.servers);
       if (entries.length > 0) {
-        obj.classIds = {};
+        obj.servers = {};
         entries.forEach(([k, v]) => {
-          obj.classIds[k] = v;
+          obj.servers[k] = v;
         });
       }
     }
     return obj;
   },
   create(base) {
-    return AppLayout.fromPartial(base ?? {});
+    return AppHandleMetadata.fromPartial(base ?? {});
   },
   fromPartial(object) {
-    const message = createBaseAppLayout();
-    message.objects = object.objects?.map((e) => Object_.fromPartial(e)) || [];
-    message.functionIds = Object.entries(object.functionIds ?? {}).reduce(
+    const message = createBaseAppHandleMetadata();
+    message.description = object.description ?? "";
+    message.appId = object.appId ?? "";
+    message.environmentName = object.environmentName ?? "";
+    message.lifecycle = object.lifecycle !== void 0 && object.lifecycle !== null ? AppLifecycle.fromPartial(object.lifecycle) : void 0;
+    message.functions = Object.entries(object.functions ?? {}).reduce(
       (acc, [key, value]) => {
         if (value !== void 0) {
           acc[key] = globalThis.String(value);
@@ -6195,7 +6373,7 @@ var AppLayout = {
       },
       {}
     );
-    message.classIds = Object.entries(object.classIds ?? {}).reduce((acc, [key, value]) => {
+    message.servers = Object.entries(object.servers ?? {}).reduce((acc, [key, value]) => {
       if (value !== void 0) {
         acc[key] = globalThis.String(value);
       }
@@ -6204,10 +6382,10 @@ var AppLayout = {
     return message;
   }
 };
-function createBaseAppLayout_FunctionIdsEntry() {
+function createBaseAppHandleMetadata_FunctionsEntry() {
   return { key: "", value: "" };
 }
-var AppLayout_FunctionIdsEntry = {
+var AppHandleMetadata_FunctionsEntry = {
   encode(message, writer = new BinaryWriter()) {
     if (message.key !== "") {
       writer.uint32(10).string(message.key);
@@ -6220,7 +6398,314 @@ var AppLayout_FunctionIdsEntry = {
   decode(input, length) {
     const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
     let end = length === void 0 ? reader.len : reader.pos + length;
-    const message = createBaseAppLayout_FunctionIdsEntry();
+    const message = createBaseAppHandleMetadata_FunctionsEntry();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.key = reader.string();
+          continue;
+        }
+        case 2: {
+          if (tag !== 18) {
+            break;
+          }
+          message.value = reader.string();
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      key: isSet5(object.key) ? globalThis.String(object.key) : "",
+      value: isSet5(object.value) ? globalThis.String(object.value) : ""
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.key !== "") {
+      obj.key = message.key;
+    }
+    if (message.value !== "") {
+      obj.value = message.value;
+    }
+    return obj;
+  },
+  create(base) {
+    return AppHandleMetadata_FunctionsEntry.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseAppHandleMetadata_FunctionsEntry();
+    message.key = object.key ?? "";
+    message.value = object.value ?? "";
+    return message;
+  }
+};
+function createBaseAppHandleMetadata_ServersEntry() {
+  return { key: "", value: "" };
+}
+var AppHandleMetadata_ServersEntry = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.key !== "") {
+      writer.uint32(10).string(message.key);
+    }
+    if (message.value !== "") {
+      writer.uint32(18).string(message.value);
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseAppHandleMetadata_ServersEntry();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.key = reader.string();
+          continue;
+        }
+        case 2: {
+          if (tag !== 18) {
+            break;
+          }
+          message.value = reader.string();
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      key: isSet5(object.key) ? globalThis.String(object.key) : "",
+      value: isSet5(object.value) ? globalThis.String(object.value) : ""
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.key !== "") {
+      obj.key = message.key;
+    }
+    if (message.value !== "") {
+      obj.value = message.value;
+    }
+    return obj;
+  },
+  create(base) {
+    return AppHandleMetadata_ServersEntry.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseAppHandleMetadata_ServersEntry();
+    message.key = object.key ?? "";
+    message.value = object.value ?? "";
+    return message;
+  }
+};
+function createBaseAppHeartbeatRequest() {
+  return { appId: "" };
+}
+var AppHeartbeatRequest = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.appId !== "") {
+      writer.uint32(10).string(message.appId);
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseAppHeartbeatRequest();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.appId = reader.string();
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return { appId: isSet5(object.appId) ? globalThis.String(object.appId) : "" };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.appId !== "") {
+      obj.appId = message.appId;
+    }
+    return obj;
+  },
+  create(base) {
+    return AppHeartbeatRequest.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseAppHeartbeatRequest();
+    message.appId = object.appId ?? "";
+    return message;
+  }
+};
+function createBaseAppLayout() {
+  return { objects: [], functionIds: {}, classIds: {} };
+}
+var AppLayout = {
+  encode(message, writer = new BinaryWriter()) {
+    for (const v of message.objects) {
+      Object_.encode(v, writer.uint32(10).fork()).join();
+    }
+    Object.entries(message.functionIds).forEach(([key, value]) => {
+      AppLayout_FunctionIdsEntry.encode({ key, value }, writer.uint32(18).fork()).join();
+    });
+    Object.entries(message.classIds).forEach(([key, value]) => {
+      AppLayout_ClassIdsEntry.encode({ key, value }, writer.uint32(26).fork()).join();
+    });
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseAppLayout();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.objects.push(Object_.decode(reader, reader.uint32()));
+          continue;
+        }
+        case 2: {
+          if (tag !== 18) {
+            break;
+          }
+          const entry2 = AppLayout_FunctionIdsEntry.decode(reader, reader.uint32());
+          if (entry2.value !== void 0) {
+            message.functionIds[entry2.key] = entry2.value;
+          }
+          continue;
+        }
+        case 3: {
+          if (tag !== 26) {
+            break;
+          }
+          const entry3 = AppLayout_ClassIdsEntry.decode(reader, reader.uint32());
+          if (entry3.value !== void 0) {
+            message.classIds[entry3.key] = entry3.value;
+          }
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      objects: globalThis.Array.isArray(object?.objects) ? object.objects.map((e) => Object_.fromJSON(e)) : [],
+      functionIds: isObject2(object.functionIds) ? Object.entries(object.functionIds).reduce((acc, [key, value]) => {
+        acc[key] = String(value);
+        return acc;
+      }, {}) : {},
+      classIds: isObject2(object.classIds) ? Object.entries(object.classIds).reduce((acc, [key, value]) => {
+        acc[key] = String(value);
+        return acc;
+      }, {}) : {}
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.objects?.length) {
+      obj.objects = message.objects.map((e) => Object_.toJSON(e));
+    }
+    if (message.functionIds) {
+      const entries = Object.entries(message.functionIds);
+      if (entries.length > 0) {
+        obj.functionIds = {};
+        entries.forEach(([k, v]) => {
+          obj.functionIds[k] = v;
+        });
+      }
+    }
+    if (message.classIds) {
+      const entries = Object.entries(message.classIds);
+      if (entries.length > 0) {
+        obj.classIds = {};
+        entries.forEach(([k, v]) => {
+          obj.classIds[k] = v;
+        });
+      }
+    }
+    return obj;
+  },
+  create(base) {
+    return AppLayout.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseAppLayout();
+    message.objects = object.objects?.map((e) => Object_.fromPartial(e)) || [];
+    message.functionIds = Object.entries(object.functionIds ?? {}).reduce(
+      (acc, [key, value]) => {
+        if (value !== void 0) {
+          acc[key] = globalThis.String(value);
+        }
+        return acc;
+      },
+      {}
+    );
+    message.classIds = Object.entries(object.classIds ?? {}).reduce((acc, [key, value]) => {
+      if (value !== void 0) {
+        acc[key] = globalThis.String(value);
+      }
+      return acc;
+    }, {});
+    return message;
+  }
+};
+function createBaseAppLayout_FunctionIdsEntry() {
+  return { key: "", value: "" };
+}
+var AppLayout_FunctionIdsEntry = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.key !== "") {
+      writer.uint32(10).string(message.key);
+    }
+    if (message.value !== "") {
+      writer.uint32(18).string(message.value);
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseAppLayout_FunctionIdsEntry();
     while (reader.pos < end) {
       const tag = reader.uint32();
       switch (tag >>> 3) {
@@ -17371,7 +17856,8 @@ function createBaseEndpointListItem() {
     createdByAvatarUrl: "",
     provisioningStatus: 0,
     status: "",
-    servingMode: 0
+    servingMode: 0,
+    unauthenticated: false
   };
 }
 var EndpointListItem = {
@@ -17412,6 +17898,9 @@ var EndpointListItem = {
     if (message.servingMode !== 0) {
       writer.uint32(96).int32(message.servingMode);
     }
+    if (message.unauthenticated !== false) {
+      writer.uint32(104).bool(message.unauthenticated);
+    }
     return writer;
   },
   decode(input, length) {
@@ -17505,6 +17994,13 @@ var EndpointListItem = {
           message.servingMode = reader.int32();
           continue;
         }
+        case 13: {
+          if (tag !== 104) {
+            break;
+          }
+          message.unauthenticated = reader.bool();
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -17526,7 +18022,8 @@ var EndpointListItem = {
       createdByAvatarUrl: isSet5(object.createdByAvatarUrl) ? globalThis.String(object.createdByAvatarUrl) : "",
       provisioningStatus: isSet5(object.provisioningStatus) ? endpointProvisioningStatusFromJSON(object.provisioningStatus) : 0,
       status: isSet5(object.status) ? globalThis.String(object.status) : "",
-      servingMode: isSet5(object.servingMode) ? endpointServingModeFromJSON(object.servingMode) : 0
+      servingMode: isSet5(object.servingMode) ? endpointServingModeFromJSON(object.servingMode) : 0,
+      unauthenticated: isSet5(object.unauthenticated) ? globalThis.Boolean(object.unauthenticated) : false
     };
   },
   toJSON(message) {
@@ -17567,6 +18064,9 @@ var EndpointListItem = {
     if (message.servingMode !== 0) {
       obj.servingMode = endpointServingModeToJSON(message.servingMode);
     }
+    if (message.unauthenticated !== false) {
+      obj.unauthenticated = message.unauthenticated;
+    }
     return obj;
   },
   create(base) {
@@ -17586,6 +18086,7 @@ var EndpointListItem = {
     message.provisioningStatus = object.provisioningStatus ?? 0;
     message.status = object.status ?? "";
     message.servingMode = object.servingMode ?? 0;
+    message.unauthenticated = object.unauthenticated ?? false;
     return message;
   }
 };
@@ -19501,7 +20002,8 @@ function createBaseEnvironmentListItem() {
     currentCycleUsage: 0,
     spendLimitReached: false,
     environmentType: 0,
-    defaultMemberRole: void 0
+    defaultMemberRole: void 0,
+    blockUnauthenticatedResources: void 0
   };
 }
 var EnvironmentListItem = {
@@ -19554,6 +20056,9 @@ var EnvironmentListItem = {
     if (message.defaultMemberRole !== void 0) {
       writer.uint32(128).int32(message.defaultMemberRole);
     }
+    if (message.blockUnauthenticatedResources !== void 0) {
+      writer.uint32(136).bool(message.blockUnauthenticatedResources);
+    }
     return writer;
   },
   decode(input, length) {
@@ -19675,6 +20180,13 @@ var EnvironmentListItem = {
           message.defaultMemberRole = reader.int32();
           continue;
         }
+        case 17: {
+          if (tag !== 136) {
+            break;
+          }
+          message.blockUnauthenticatedResources = reader.bool();
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -19700,7 +20212,8 @@ var EnvironmentListItem = {
       currentCycleUsage: isSet5(object.currentCycleUsage) ? globalThis.Number(object.currentCycleUsage) : 0,
       spendLimitReached: isSet5(object.spendLimitReached) ? globalThis.Boolean(object.spendLimitReached) : false,
       environmentType: isSet5(object.environmentType) ? environmentTypeFromJSON(object.environmentType) : 0,
-      defaultMemberRole: isSet5(object.defaultMemberRole) ? environmentRoleFromJSON(object.defaultMemberRole) : void 0
+      defaultMemberRole: isSet5(object.defaultMemberRole) ? environmentRoleFromJSON(object.defaultMemberRole) : void 0,
+      blockUnauthenticatedResources: isSet5(object.blockUnauthenticatedResources) ? globalThis.Boolean(object.blockUnauthenticatedResources) : void 0
     };
   },
   toJSON(message) {
@@ -19753,6 +20266,9 @@ var EnvironmentListItem = {
     if (message.defaultMemberRole !== void 0) {
       obj.defaultMemberRole = environmentRoleToJSON(message.defaultMemberRole);
     }
+    if (message.blockUnauthenticatedResources !== void 0) {
+      obj.blockUnauthenticatedResources = message.blockUnauthenticatedResources;
+    }
     return obj;
   },
   create(base) {
@@ -19776,6 +20292,7 @@ var EnvironmentListItem = {
     message.spendLimitReached = object.spendLimitReached ?? false;
     message.environmentType = object.environmentType ?? 0;
     message.defaultMemberRole = object.defaultMemberRole ?? void 0;
+    message.blockUnauthenticatedResources = object.blockUnauthenticatedResources ?? void 0;
     return message;
   }
 };
@@ -20263,7 +20780,13 @@ var EnvironmentSetManagedRequest = {
   }
 };
 function createBaseEnvironmentSettings() {
-  return { imageBuilderVersion: "", webhookSuffix: "", maxConcurrentGpus: void 0, maxConcurrentTasks: void 0 };
+  return {
+    imageBuilderVersion: "",
+    webhookSuffix: "",
+    maxConcurrentGpus: void 0,
+    maxConcurrentTasks: void 0,
+    blockUnauthenticatedResources: void 0
+  };
 }
 var EnvironmentSettings = {
   encode(message, writer = new BinaryWriter()) {
@@ -20279,6 +20802,9 @@ var EnvironmentSettings = {
     if (message.maxConcurrentTasks !== void 0) {
       writer.uint32(32).int32(message.maxConcurrentTasks);
     }
+    if (message.blockUnauthenticatedResources !== void 0) {
+      writer.uint32(40).bool(message.blockUnauthenticatedResources);
+    }
     return writer;
   },
   decode(input, length) {
@@ -20316,6 +20842,13 @@ var EnvironmentSettings = {
           message.maxConcurrentTasks = reader.int32();
           continue;
         }
+        case 5: {
+          if (tag !== 40) {
+            break;
+          }
+          message.blockUnauthenticatedResources = reader.bool();
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -20329,7 +20862,8 @@ var EnvironmentSettings = {
       imageBuilderVersion: isSet5(object.imageBuilderVersion) ? globalThis.String(object.imageBuilderVersion) : "",
       webhookSuffix: isSet5(object.webhookSuffix) ? globalThis.String(object.webhookSuffix) : "",
       maxConcurrentGpus: isSet5(object.maxConcurrentGpus) ? globalThis.Number(object.maxConcurrentGpus) : void 0,
-      maxConcurrentTasks: isSet5(object.maxConcurrentTasks) ? globalThis.Number(object.maxConcurrentTasks) : void 0
+      maxConcurrentTasks: isSet5(object.maxConcurrentTasks) ? globalThis.Number(object.maxConcurrentTasks) : void 0,
+      blockUnauthenticatedResources: isSet5(object.blockUnauthenticatedResources) ? globalThis.Boolean(object.blockUnauthenticatedResources) : void 0
     };
   },
   toJSON(message) {
@@ -20346,6 +20880,9 @@ var EnvironmentSettings = {
     if (message.maxConcurrentTasks !== void 0) {
       obj.maxConcurrentTasks = Math.round(message.maxConcurrentTasks);
     }
+    if (message.blockUnauthenticatedResources !== void 0) {
+      obj.blockUnauthenticatedResources = message.blockUnauthenticatedResources;
+    }
     return obj;
   },
   create(base) {
@@ -20357,6 +20894,7 @@ var EnvironmentSettings = {
     message.webhookSuffix = object.webhookSuffix ?? "";
     message.maxConcurrentGpus = object.maxConcurrentGpus ?? void 0;
     message.maxConcurrentTasks = object.maxConcurrentTasks ?? void 0;
+    message.blockUnauthenticatedResources = object.blockUnauthenticatedResources ?? void 0;
     return message;
   }
 };
@@ -20366,7 +20904,8 @@ function createBaseEnvironmentUpdateRequest() {
     name: void 0,
     webSuffix: void 0,
     maxConcurrentTasks: void 0,
-    maxConcurrentGpus: void 0
+    maxConcurrentGpus: void 0,
+    blockUnauthenticatedResources: void 0
   };
 }
 var EnvironmentUpdateRequest = {
@@ -20386,6 +20925,9 @@ var EnvironmentUpdateRequest = {
     if (message.maxConcurrentGpus !== void 0) {
       writer.uint32(40).int32(message.maxConcurrentGpus);
     }
+    if (message.blockUnauthenticatedResources !== void 0) {
+      writer.uint32(48).int32(message.blockUnauthenticatedResources);
+    }
     return writer;
   },
   decode(input, length) {
@@ -20430,6 +20972,13 @@ var EnvironmentUpdateRequest = {
           message.maxConcurrentGpus = reader.int32();
           continue;
         }
+        case 6: {
+          if (tag !== 48) {
+            break;
+          }
+          message.blockUnauthenticatedResources = reader.int32();
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -20444,7 +20993,8 @@ var EnvironmentUpdateRequest = {
       name: isSet5(object.name) ? String(object.name) : void 0,
       webSuffix: isSet5(object.webSuffix) ? String(object.webSuffix) : void 0,
       maxConcurrentTasks: isSet5(object.maxConcurrentTasks) ? globalThis.Number(object.maxConcurrentTasks) : void 0,
-      maxConcurrentGpus: isSet5(object.maxConcurrentGpus) ? globalThis.Number(object.maxConcurrentGpus) : void 0
+      maxConcurrentGpus: isSet5(object.maxConcurrentGpus) ? globalThis.Number(object.maxConcurrentGpus) : void 0,
+      blockUnauthenticatedResources: isSet5(object.blockUnauthenticatedResources) ? environmentBlockUnauthenticatedResourcesFromJSON(object.blockUnauthenticatedResources) : void 0
     };
   },
   toJSON(message) {
@@ -20464,6 +21014,11 @@ var EnvironmentUpdateRequest = {
     if (message.maxConcurrentGpus !== void 0) {
       obj.maxConcurrentGpus = Math.round(message.maxConcurrentGpus);
     }
+    if (message.blockUnauthenticatedResources !== void 0) {
+      obj.blockUnauthenticatedResources = environmentBlockUnauthenticatedResourcesToJSON(
+        message.blockUnauthenticatedResources
+      );
+    }
     return obj;
   },
   create(base) {
@@ -20476,6 +21031,7 @@ var EnvironmentUpdateRequest = {
     message.webSuffix = object.webSuffix ?? void 0;
     message.maxConcurrentTasks = object.maxConcurrentTasks ?? void 0;
     message.maxConcurrentGpus = object.maxConcurrentGpus ?? void 0;
+    message.blockUnauthenticatedResources = object.blockUnauthenticatedResources ?? void 0;
     return message;
   }
 };
@@ -25350,6 +25906,125 @@ var FunctionFinishInputsRequest = {
     return message;
   }
 };
+function createBaseFunctionGetByIdRequest() {
+  return { functionId: "" };
+}
+var FunctionGetByIdRequest = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.functionId !== "") {
+      writer.uint32(10).string(message.functionId);
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseFunctionGetByIdRequest();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.functionId = reader.string();
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return { functionId: isSet5(object.functionId) ? globalThis.String(object.functionId) : "" };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.functionId !== "") {
+      obj.functionId = message.functionId;
+    }
+    return obj;
+  },
+  create(base) {
+    return FunctionGetByIdRequest.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseFunctionGetByIdRequest();
+    message.functionId = object.functionId ?? "";
+    return message;
+  }
+};
+function createBaseFunctionGetByIdResponse() {
+  return { function: void 0, handleMetadata: void 0 };
+}
+var FunctionGetByIdResponse = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.function !== void 0) {
+      FunctionData.encode(message.function, writer.uint32(10).fork()).join();
+    }
+    if (message.handleMetadata !== void 0) {
+      FunctionHandleMetadata.encode(message.handleMetadata, writer.uint32(18).fork()).join();
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseFunctionGetByIdResponse();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.function = FunctionData.decode(reader, reader.uint32());
+          continue;
+        }
+        case 2: {
+          if (tag !== 18) {
+            break;
+          }
+          message.handleMetadata = FunctionHandleMetadata.decode(reader, reader.uint32());
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      function: isSet5(object.function) ? FunctionData.fromJSON(object.function) : void 0,
+      handleMetadata: isSet5(object.handleMetadata) ? FunctionHandleMetadata.fromJSON(object.handleMetadata) : void 0
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.function !== void 0) {
+      obj.function = FunctionData.toJSON(message.function);
+    }
+    if (message.handleMetadata !== void 0) {
+      obj.handleMetadata = FunctionHandleMetadata.toJSON(message.handleMetadata);
+    }
+    return obj;
+  },
+  create(base) {
+    return FunctionGetByIdResponse.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseFunctionGetByIdResponse();
+    message.function = object.function !== void 0 && object.function !== null ? FunctionData.fromPartial(object.function) : void 0;
+    message.handleMetadata = object.handleMetadata !== void 0 && object.handleMetadata !== null ? FunctionHandleMetadata.fromPartial(object.handleMetadata) : void 0;
+    return message;
+  }
+};
 function createBaseFunctionGetCallGraphRequest() {
   return { functionCallId: "" };
 }
@@ -25402,7 +26077,7 @@ var FunctionGetCallGraphRequest = {
   }
 };
 function createBaseFunctionGetCallGraphResponse() {
-  return { inputs: [], functionCalls: [] };
+  return { inputs: [], functionCalls: [], truncated: false };
 }
 var FunctionGetCallGraphResponse = {
   encode(message, writer = new BinaryWriter()) {
@@ -25412,6 +26087,9 @@ var FunctionGetCallGraphResponse = {
     for (const v of message.functionCalls) {
       FunctionCallCallGraphInfo.encode(v, writer.uint32(18).fork()).join();
     }
+    if (message.truncated !== false) {
+      writer.uint32(24).bool(message.truncated);
+    }
     return writer;
   },
   decode(input, length) {
@@ -25435,6 +26113,13 @@ var FunctionGetCallGraphResponse = {
           message.functionCalls.push(FunctionCallCallGraphInfo.decode(reader, reader.uint32()));
           continue;
         }
+        case 3: {
+          if (tag !== 24) {
+            break;
+          }
+          message.truncated = reader.bool();
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -25446,7 +26131,8 @@ var FunctionGetCallGraphResponse = {
   fromJSON(object) {
     return {
       inputs: globalThis.Array.isArray(object?.inputs) ? object.inputs.map((e) => InputCallGraphInfo.fromJSON(e)) : [],
-      functionCalls: globalThis.Array.isArray(object?.functionCalls) ? object.functionCalls.map((e) => FunctionCallCallGraphInfo.fromJSON(e)) : []
+      functionCalls: globalThis.Array.isArray(object?.functionCalls) ? object.functionCalls.map((e) => FunctionCallCallGraphInfo.fromJSON(e)) : [],
+      truncated: isSet5(object.truncated) ? globalThis.Boolean(object.truncated) : false
     };
   },
   toJSON(message) {
@@ -25457,6 +26143,9 @@ var FunctionGetCallGraphResponse = {
     if (message.functionCalls?.length) {
       obj.functionCalls = message.functionCalls.map((e) => FunctionCallCallGraphInfo.toJSON(e));
     }
+    if (message.truncated !== false) {
+      obj.truncated = message.truncated;
+    }
     return obj;
   },
   create(base) {
@@ -25466,6 +26155,7 @@ var FunctionGetCallGraphResponse = {
     const message = createBaseFunctionGetCallGraphResponse();
     message.inputs = object.inputs?.map((e) => InputCallGraphInfo.fromPartial(e)) || [];
     message.functionCalls = object.functionCalls?.map((e) => FunctionCallCallGraphInfo.fromPartial(e)) || [];
+    message.truncated = object.truncated ?? false;
     return message;
   }
 };
@@ -25654,6 +26344,108 @@ var FunctionGetDynamicConcurrencyResponse = {
     return message;
   }
 };
+function createBaseFunctionGetFlashAuthTokenRequest() {
+  return { functionId: "" };
+}
+var FunctionGetFlashAuthTokenRequest = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.functionId !== "") {
+      writer.uint32(10).string(message.functionId);
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseFunctionGetFlashAuthTokenRequest();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.functionId = reader.string();
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return { functionId: isSet5(object.functionId) ? globalThis.String(object.functionId) : "" };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.functionId !== "") {
+      obj.functionId = message.functionId;
+    }
+    return obj;
+  },
+  create(base) {
+    return FunctionGetFlashAuthTokenRequest.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseFunctionGetFlashAuthTokenRequest();
+    message.functionId = object.functionId ?? "";
+    return message;
+  }
+};
+function createBaseFunctionGetFlashAuthTokenResponse() {
+  return { token: "" };
+}
+var FunctionGetFlashAuthTokenResponse = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.token !== "") {
+      writer.uint32(10).string(message.token);
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseFunctionGetFlashAuthTokenResponse();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.token = reader.string();
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return { token: isSet5(object.token) ? globalThis.String(object.token) : "" };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.token !== "") {
+      obj.token = message.token;
+    }
+    return obj;
+  },
+  create(base) {
+    return FunctionGetFlashAuthTokenResponse.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseFunctionGetFlashAuthTokenResponse();
+    message.token = object.token ?? "";
+    return message;
+  }
+};
 function createBaseFunctionGetInputsItem() {
   return {
     inputId: "",
@@ -26792,7 +27584,7 @@ var FunctionGetSerializedResponse = {
   }
 };
 function createBaseFunctionGetTimeRangeStatsRequest() {
-  return { functionId: "", since: void 0, until: void 0, rollup: false };
+  return { functionId: "", since: void 0, until: void 0, rollup: false, containerId: void 0 };
 }
 var FunctionGetTimeRangeStatsRequest = {
   encode(message, writer = new BinaryWriter()) {
@@ -26808,6 +27600,9 @@ var FunctionGetTimeRangeStatsRequest = {
     if (message.rollup !== false) {
       writer.uint32(32).bool(message.rollup);
     }
+    if (message.containerId !== void 0) {
+      writer.uint32(42).string(message.containerId);
+    }
     return writer;
   },
   decode(input, length) {
@@ -26845,6 +27640,13 @@ var FunctionGetTimeRangeStatsRequest = {
           message.rollup = reader.bool();
           continue;
         }
+        case 5: {
+          if (tag !== 42) {
+            break;
+          }
+          message.containerId = reader.string();
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -26858,7 +27660,8 @@ var FunctionGetTimeRangeStatsRequest = {
       functionId: isSet5(object.functionId) ? globalThis.String(object.functionId) : "",
       since: isSet5(object.since) ? fromJsonTimestamp(object.since) : void 0,
       until: isSet5(object.until) ? fromJsonTimestamp(object.until) : void 0,
-      rollup: isSet5(object.rollup) ? globalThis.Boolean(object.rollup) : false
+      rollup: isSet5(object.rollup) ? globalThis.Boolean(object.rollup) : false,
+      containerId: isSet5(object.containerId) ? globalThis.String(object.containerId) : void 0
     };
   },
   toJSON(message) {
@@ -26875,6 +27678,9 @@ var FunctionGetTimeRangeStatsRequest = {
     if (message.rollup !== false) {
       obj.rollup = message.rollup;
     }
+    if (message.containerId !== void 0) {
+      obj.containerId = message.containerId;
+    }
     return obj;
   },
   create(base) {
@@ -26886,6 +27692,7 @@ var FunctionGetTimeRangeStatsRequest = {
     message.since = object.since ?? void 0;
     message.until = object.until ?? void 0;
     message.rollup = object.rollup ?? false;
+    message.containerId = object.containerId ?? void 0;
     return message;
   }
 };
@@ -26893,16 +27700,15 @@ function createBaseFunctionGetTimeRangeStatsResponse() {
   return {
     since: void 0,
     until: void 0,
-    executionTimeSeconds: void 0,
-    queueTimeSeconds: void 0,
-    endToEndLatencySeconds: void 0,
-    containerStartupTimeSeconds: void 0,
     inputSuccessCount: 0,
     inputFailureCount: 0,
     inputTimeoutCount: 0,
-    cpuUtilization: void 0,
-    memoryUtilization: void 0,
-    gpuUtilization: void 0,
+    inputRunningAtEndCount: 0,
+    inputPercentileStats: {},
+    containerStartedCount: 0,
+    containerErrorCount: 0,
+    containerCreatingAtEndCount: 0,
+    containerPercentileStats: {},
     variantCount: 0
   };
 }
@@ -26914,38 +27720,41 @@ var FunctionGetTimeRangeStatsResponse = {
     if (message.until !== void 0) {
       Timestamp.encode(toTimestamp(message.until), writer.uint32(18).fork()).join();
     }
-    if (message.executionTimeSeconds !== void 0) {
-      FunctionStatsPercentiles.encode(message.executionTimeSeconds, writer.uint32(26).fork()).join();
-    }
-    if (message.queueTimeSeconds !== void 0) {
-      FunctionStatsPercentiles.encode(message.queueTimeSeconds, writer.uint32(34).fork()).join();
-    }
-    if (message.endToEndLatencySeconds !== void 0) {
-      FunctionStatsPercentiles.encode(message.endToEndLatencySeconds, writer.uint32(42).fork()).join();
-    }
-    if (message.containerStartupTimeSeconds !== void 0) {
-      FunctionStatsPercentiles.encode(message.containerStartupTimeSeconds, writer.uint32(50).fork()).join();
-    }
     if (message.inputSuccessCount !== 0) {
-      writer.uint32(56).uint64(message.inputSuccessCount);
+      writer.uint32(24).uint64(message.inputSuccessCount);
     }
     if (message.inputFailureCount !== 0) {
-      writer.uint32(64).uint64(message.inputFailureCount);
+      writer.uint32(32).uint64(message.inputFailureCount);
     }
     if (message.inputTimeoutCount !== 0) {
-      writer.uint32(72).uint64(message.inputTimeoutCount);
+      writer.uint32(40).uint64(message.inputTimeoutCount);
     }
-    if (message.cpuUtilization !== void 0) {
-      FunctionStatsPercentiles.encode(message.cpuUtilization, writer.uint32(82).fork()).join();
+    if (message.inputRunningAtEndCount !== 0) {
+      writer.uint32(48).uint64(message.inputRunningAtEndCount);
+    }
+    Object.entries(message.inputPercentileStats).forEach(([key, value]) => {
+      FunctionGetTimeRangeStatsResponse_InputPercentileStatsEntry.encode(
+        { key, value },
+        writer.uint32(58).fork()
+      ).join();
+    });
+    if (message.containerStartedCount !== 0) {
+      writer.uint32(64).uint64(message.containerStartedCount);
     }
-    if (message.memoryUtilization !== void 0) {
-      FunctionStatsPercentiles.encode(message.memoryUtilization, writer.uint32(90).fork()).join();
+    if (message.containerErrorCount !== 0) {
+      writer.uint32(72).uint64(message.containerErrorCount);
     }
-    if (message.gpuUtilization !== void 0) {
-      FunctionStatsPercentiles.encode(message.gpuUtilization, writer.uint32(98).fork()).join();
+    if (message.containerCreatingAtEndCount !== 0) {
+      writer.uint32(80).uint64(message.containerCreatingAtEndCount);
     }
+    Object.entries(message.containerPercentileStats).forEach(([key, value]) => {
+      FunctionGetTimeRangeStatsResponse_ContainerPercentileStatsEntry.encode(
+        { key, value },
+        writer.uint32(90).fork()
+      ).join();
+    });
     if (message.variantCount !== 0) {
-      writer.uint32(104).uint32(message.variantCount);
+      writer.uint32(96).uint32(message.variantCount);
     }
     return writer;
   },
@@ -26971,77 +27780,79 @@ var FunctionGetTimeRangeStatsResponse = {
           continue;
         }
         case 3: {
-          if (tag !== 26) {
+          if (tag !== 24) {
             break;
           }
-          message.executionTimeSeconds = FunctionStatsPercentiles.decode(reader, reader.uint32());
+          message.inputSuccessCount = longToNumber2(reader.uint64());
           continue;
         }
         case 4: {
-          if (tag !== 34) {
+          if (tag !== 32) {
             break;
           }
-          message.queueTimeSeconds = FunctionStatsPercentiles.decode(reader, reader.uint32());
+          message.inputFailureCount = longToNumber2(reader.uint64());
           continue;
         }
         case 5: {
-          if (tag !== 42) {
+          if (tag !== 40) {
             break;
           }
-          message.endToEndLatencySeconds = FunctionStatsPercentiles.decode(reader, reader.uint32());
+          message.inputTimeoutCount = longToNumber2(reader.uint64());
           continue;
         }
         case 6: {
-          if (tag !== 50) {
+          if (tag !== 48) {
             break;
           }
-          message.containerStartupTimeSeconds = FunctionStatsPercentiles.decode(reader, reader.uint32());
+          message.inputRunningAtEndCount = longToNumber2(reader.uint64());
           continue;
         }
         case 7: {
-          if (tag !== 56) {
+          if (tag !== 58) {
             break;
           }
-          message.inputSuccessCount = longToNumber2(reader.uint64());
+          const entry7 = FunctionGetTimeRangeStatsResponse_InputPercentileStatsEntry.decode(reader, reader.uint32());
+          if (entry7.value !== void 0) {
+            message.inputPercentileStats[entry7.key] = entry7.value;
+          }
           continue;
         }
         case 8: {
           if (tag !== 64) {
             break;
           }
-          message.inputFailureCount = longToNumber2(reader.uint64());
+          message.containerStartedCount = longToNumber2(reader.uint64());
           continue;
         }
         case 9: {
           if (tag !== 72) {
             break;
           }
-          message.inputTimeoutCount = longToNumber2(reader.uint64());
+          message.containerErrorCount = longToNumber2(reader.uint64());
           continue;
         }
         case 10: {
-          if (tag !== 82) {
+          if (tag !== 80) {
             break;
           }
-          message.cpuUtilization = FunctionStatsPercentiles.decode(reader, reader.uint32());
+          message.containerCreatingAtEndCount = longToNumber2(reader.uint64());
           continue;
         }
         case 11: {
           if (tag !== 90) {
             break;
           }
-          message.memoryUtilization = FunctionStatsPercentiles.decode(reader, reader.uint32());
-          continue;
-        }
-        case 12: {
-          if (tag !== 98) {
-            break;
+          const entry11 = FunctionGetTimeRangeStatsResponse_ContainerPercentileStatsEntry.decode(
+            reader,
+            reader.uint32()
+          );
+          if (entry11.value !== void 0) {
+            message.containerPercentileStats[entry11.key] = entry11.value;
           }
-          message.gpuUtilization = FunctionStatsPercentiles.decode(reader, reader.uint32());
           continue;
         }
-        case 13: {
-          if (tag !== 104) {
+        case 12: {
+          if (tag !== 96) {
             break;
           }
           message.variantCount = reader.uint32();
@@ -27059,16 +27870,27 @@ var FunctionGetTimeRangeStatsResponse = {
     return {
       since: isSet5(object.since) ? fromJsonTimestamp(object.since) : void 0,
       until: isSet5(object.until) ? fromJsonTimestamp(object.until) : void 0,
-      executionTimeSeconds: isSet5(object.executionTimeSeconds) ? FunctionStatsPercentiles.fromJSON(object.executionTimeSeconds) : void 0,
-      queueTimeSeconds: isSet5(object.queueTimeSeconds) ? FunctionStatsPercentiles.fromJSON(object.queueTimeSeconds) : void 0,
-      endToEndLatencySeconds: isSet5(object.endToEndLatencySeconds) ? FunctionStatsPercentiles.fromJSON(object.endToEndLatencySeconds) : void 0,
-      containerStartupTimeSeconds: isSet5(object.containerStartupTimeSeconds) ? FunctionStatsPercentiles.fromJSON(object.containerStartupTimeSeconds) : void 0,
       inputSuccessCount: isSet5(object.inputSuccessCount) ? globalThis.Number(object.inputSuccessCount) : 0,
       inputFailureCount: isSet5(object.inputFailureCount) ? globalThis.Number(object.inputFailureCount) : 0,
       inputTimeoutCount: isSet5(object.inputTimeoutCount) ? globalThis.Number(object.inputTimeoutCount) : 0,
-      cpuUtilization: isSet5(object.cpuUtilization) ? FunctionStatsPercentiles.fromJSON(object.cpuUtilization) : void 0,
-      memoryUtilization: isSet5(object.memoryUtilization) ? FunctionStatsPercentiles.fromJSON(object.memoryUtilization) : void 0,
-      gpuUtilization: isSet5(object.gpuUtilization) ? FunctionStatsPercentiles.fromJSON(object.gpuUtilization) : void 0,
+      inputRunningAtEndCount: isSet5(object.inputRunningAtEndCount) ? globalThis.Number(object.inputRunningAtEndCount) : 0,
+      inputPercentileStats: isObject2(object.inputPercentileStats) ? Object.entries(object.inputPercentileStats).reduce(
+        (acc, [key, value]) => {
+          acc[key] = StatsPercentileDistribution.fromJSON(value);
+          return acc;
+        },
+        {}
+      ) : {},
+      containerStartedCount: isSet5(object.containerStartedCount) ? globalThis.Number(object.containerStartedCount) : 0,
+      containerErrorCount: isSet5(object.containerErrorCount) ? globalThis.Number(object.containerErrorCount) : 0,
+      containerCreatingAtEndCount: isSet5(object.containerCreatingAtEndCount) ? globalThis.Number(object.containerCreatingAtEndCount) : 0,
+      containerPercentileStats: isObject2(object.containerPercentileStats) ? Object.entries(object.containerPercentileStats).reduce(
+        (acc, [key, value]) => {
+          acc[key] = StatsPercentileDistribution.fromJSON(value);
+          return acc;
+        },
+        {}
+      ) : {},
       variantCount: isSet5(object.variantCount) ? globalThis.Number(object.variantCount) : 0
     };
   },
@@ -27080,18 +27902,6 @@ var FunctionGetTimeRangeStatsResponse = {
     if (message.until !== void 0) {
       obj.until = message.until.toISOString();
     }
-    if (message.executionTimeSeconds !== void 0) {
-      obj.executionTimeSeconds = FunctionStatsPercentiles.toJSON(message.executionTimeSeconds);
-    }
-    if (message.queueTimeSeconds !== void 0) {
-      obj.queueTimeSeconds = FunctionStatsPercentiles.toJSON(message.queueTimeSeconds);
-    }
-    if (message.endToEndLatencySeconds !== void 0) {
-      obj.endToEndLatencySeconds = FunctionStatsPercentiles.toJSON(message.endToEndLatencySeconds);
-    }
-    if (message.containerStartupTimeSeconds !== void 0) {
-      obj.containerStartupTimeSeconds = FunctionStatsPercentiles.toJSON(message.containerStartupTimeSeconds);
-    }
     if (message.inputSuccessCount !== 0) {
       obj.inputSuccessCount = Math.round(message.inputSuccessCount);
     }
@@ -27101,14 +27911,35 @@ var FunctionGetTimeRangeStatsResponse = {
     if (message.inputTimeoutCount !== 0) {
       obj.inputTimeoutCount = Math.round(message.inputTimeoutCount);
     }
-    if (message.cpuUtilization !== void 0) {
-      obj.cpuUtilization = FunctionStatsPercentiles.toJSON(message.cpuUtilization);
+    if (message.inputRunningAtEndCount !== 0) {
+      obj.inputRunningAtEndCount = Math.round(message.inputRunningAtEndCount);
+    }
+    if (message.inputPercentileStats) {
+      const entries = Object.entries(message.inputPercentileStats);
+      if (entries.length > 0) {
+        obj.inputPercentileStats = {};
+        entries.forEach(([k, v]) => {
+          obj.inputPercentileStats[k] = StatsPercentileDistribution.toJSON(v);
+        });
+      }
+    }
+    if (message.containerStartedCount !== 0) {
+      obj.containerStartedCount = Math.round(message.containerStartedCount);
     }
-    if (message.memoryUtilization !== void 0) {
-      obj.memoryUtilization = FunctionStatsPercentiles.toJSON(message.memoryUtilization);
+    if (message.containerErrorCount !== 0) {
+      obj.containerErrorCount = Math.round(message.containerErrorCount);
     }
-    if (message.gpuUtilization !== void 0) {
-      obj.gpuUtilization = FunctionStatsPercentiles.toJSON(message.gpuUtilization);
+    if (message.containerCreatingAtEndCount !== 0) {
+      obj.containerCreatingAtEndCount = Math.round(message.containerCreatingAtEndCount);
+    }
+    if (message.containerPercentileStats) {
+      const entries = Object.entries(message.containerPercentileStats);
+      if (entries.length > 0) {
+        obj.containerPercentileStats = {};
+        entries.forEach(([k, v]) => {
+          obj.containerPercentileStats[k] = StatsPercentileDistribution.toJSON(v);
+        });
+      }
     }
     if (message.variantCount !== 0) {
       obj.variantCount = Math.round(message.variantCount);
@@ -27122,20 +27953,165 @@ var FunctionGetTimeRangeStatsResponse = {
     const message = createBaseFunctionGetTimeRangeStatsResponse();
     message.since = object.since ?? void 0;
     message.until = object.until ?? void 0;
-    message.executionTimeSeconds = object.executionTimeSeconds !== void 0 && object.executionTimeSeconds !== null ? FunctionStatsPercentiles.fromPartial(object.executionTimeSeconds) : void 0;
-    message.queueTimeSeconds = object.queueTimeSeconds !== void 0 && object.queueTimeSeconds !== null ? FunctionStatsPercentiles.fromPartial(object.queueTimeSeconds) : void 0;
-    message.endToEndLatencySeconds = object.endToEndLatencySeconds !== void 0 && object.endToEndLatencySeconds !== null ? FunctionStatsPercentiles.fromPartial(object.endToEndLatencySeconds) : void 0;
-    message.containerStartupTimeSeconds = object.containerStartupTimeSeconds !== void 0 && object.containerStartupTimeSeconds !== null ? FunctionStatsPercentiles.fromPartial(object.containerStartupTimeSeconds) : void 0;
     message.inputSuccessCount = object.inputSuccessCount ?? 0;
     message.inputFailureCount = object.inputFailureCount ?? 0;
     message.inputTimeoutCount = object.inputTimeoutCount ?? 0;
-    message.cpuUtilization = object.cpuUtilization !== void 0 && object.cpuUtilization !== null ? FunctionStatsPercentiles.fromPartial(object.cpuUtilization) : void 0;
-    message.memoryUtilization = object.memoryUtilization !== void 0 && object.memoryUtilization !== null ? FunctionStatsPercentiles.fromPartial(object.memoryUtilization) : void 0;
-    message.gpuUtilization = object.gpuUtilization !== void 0 && object.gpuUtilization !== null ? FunctionStatsPercentiles.fromPartial(object.gpuUtilization) : void 0;
+    message.inputRunningAtEndCount = object.inputRunningAtEndCount ?? 0;
+    message.inputPercentileStats = Object.entries(object.inputPercentileStats ?? {}).reduce((acc, [key, value]) => {
+      if (value !== void 0) {
+        acc[key] = StatsPercentileDistribution.fromPartial(value);
+      }
+      return acc;
+    }, {});
+    message.containerStartedCount = object.containerStartedCount ?? 0;
+    message.containerErrorCount = object.containerErrorCount ?? 0;
+    message.containerCreatingAtEndCount = object.containerCreatingAtEndCount ?? 0;
+    message.containerPercentileStats = Object.entries(object.containerPercentileStats ?? {}).reduce((acc, [key, value]) => {
+      if (value !== void 0) {
+        acc[key] = StatsPercentileDistribution.fromPartial(value);
+      }
+      return acc;
+    }, {});
     message.variantCount = object.variantCount ?? 0;
     return message;
   }
 };
+function createBaseFunctionGetTimeRangeStatsResponse_InputPercentileStatsEntry() {
+  return { key: "", value: void 0 };
+}
+var FunctionGetTimeRangeStatsResponse_InputPercentileStatsEntry = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.key !== "") {
+      writer.uint32(10).string(message.key);
+    }
+    if (message.value !== void 0) {
+      StatsPercentileDistribution.encode(message.value, writer.uint32(18).fork()).join();
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseFunctionGetTimeRangeStatsResponse_InputPercentileStatsEntry();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.key = reader.string();
+          continue;
+        }
+        case 2: {
+          if (tag !== 18) {
+            break;
+          }
+          message.value = StatsPercentileDistribution.decode(reader, reader.uint32());
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      key: isSet5(object.key) ? globalThis.String(object.key) : "",
+      value: isSet5(object.value) ? StatsPercentileDistribution.fromJSON(object.value) : void 0
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.key !== "") {
+      obj.key = message.key;
+    }
+    if (message.value !== void 0) {
+      obj.value = StatsPercentileDistribution.toJSON(message.value);
+    }
+    return obj;
+  },
+  create(base) {
+    return FunctionGetTimeRangeStatsResponse_InputPercentileStatsEntry.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseFunctionGetTimeRangeStatsResponse_InputPercentileStatsEntry();
+    message.key = object.key ?? "";
+    message.value = object.value !== void 0 && object.value !== null ? StatsPercentileDistribution.fromPartial(object.value) : void 0;
+    return message;
+  }
+};
+function createBaseFunctionGetTimeRangeStatsResponse_ContainerPercentileStatsEntry() {
+  return { key: "", value: void 0 };
+}
+var FunctionGetTimeRangeStatsResponse_ContainerPercentileStatsEntry = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.key !== "") {
+      writer.uint32(10).string(message.key);
+    }
+    if (message.value !== void 0) {
+      StatsPercentileDistribution.encode(message.value, writer.uint32(18).fork()).join();
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseFunctionGetTimeRangeStatsResponse_ContainerPercentileStatsEntry();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.key = reader.string();
+          continue;
+        }
+        case 2: {
+          if (tag !== 18) {
+            break;
+          }
+          message.value = StatsPercentileDistribution.decode(reader, reader.uint32());
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      key: isSet5(object.key) ? globalThis.String(object.key) : "",
+      value: isSet5(object.value) ? StatsPercentileDistribution.fromJSON(object.value) : void 0
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.key !== "") {
+      obj.key = message.key;
+    }
+    if (message.value !== void 0) {
+      obj.value = StatsPercentileDistribution.toJSON(message.value);
+    }
+    return obj;
+  },
+  create(base) {
+    return FunctionGetTimeRangeStatsResponse_ContainerPercentileStatsEntry.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseFunctionGetTimeRangeStatsResponse_ContainerPercentileStatsEntry();
+    message.key = object.key ?? "";
+    message.value = object.value !== void 0 && object.value !== null ? StatsPercentileDistribution.fromPartial(object.value) : void 0;
+    return message;
+  }
+};
 function createBaseFunctionHandleMetadata() {
   return {
     functionName: "",
@@ -29796,74 +30772,6 @@ var FunctionStats = {
     return message;
   }
 };
-function createBaseFunctionStatsPercentiles() {
-  return { p50: 0, p90: 0 };
-}
-var FunctionStatsPercentiles = {
-  encode(message, writer = new BinaryWriter()) {
-    if (message.p50 !== 0) {
-      writer.uint32(9).double(message.p50);
-    }
-    if (message.p90 !== 0) {
-      writer.uint32(17).double(message.p90);
-    }
-    return writer;
-  },
-  decode(input, length) {
-    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
-    let end = length === void 0 ? reader.len : reader.pos + length;
-    const message = createBaseFunctionStatsPercentiles();
-    while (reader.pos < end) {
-      const tag = reader.uint32();
-      switch (tag >>> 3) {
-        case 1: {
-          if (tag !== 9) {
-            break;
-          }
-          message.p50 = reader.double();
-          continue;
-        }
-        case 2: {
-          if (tag !== 17) {
-            break;
-          }
-          message.p90 = reader.double();
-          continue;
-        }
-      }
-      if ((tag & 7) === 4 || tag === 0) {
-        break;
-      }
-      reader.skip(tag & 7);
-    }
-    return message;
-  },
-  fromJSON(object) {
-    return {
-      p50: isSet5(object.p50) ? globalThis.Number(object.p50) : 0,
-      p90: isSet5(object.p90) ? globalThis.Number(object.p90) : 0
-    };
-  },
-  toJSON(message) {
-    const obj = {};
-    if (message.p50 !== 0) {
-      obj.p50 = message.p50;
-    }
-    if (message.p90 !== 0) {
-      obj.p90 = message.p90;
-    }
-    return obj;
-  },
-  create(base) {
-    return FunctionStatsPercentiles.fromPartial(base ?? {});
-  },
-  fromPartial(object) {
-    const message = createBaseFunctionStatsPercentiles();
-    message.p50 = object.p50 ?? 0;
-    message.p90 = object.p90 ?? 0;
-    return message;
-  }
-};
 function createBaseFunctionUpdateSchedulingParamsRequest() {
   return { functionId: "", warmPoolSizeOverride: 0, settings: void 0 };
 }
@@ -30552,7 +31460,8 @@ function createBaseImage() {
     runtimeDebug: false,
     buildFunction: void 0,
     buildArgs: {},
-    volumeMounts: []
+    volumeMounts: [],
+    arch: 0
   };
 }
 var Image = {
@@ -30602,6 +31511,9 @@ var Image = {
     for (const v of message.volumeMounts) {
       VolumeMount.encode(v, writer.uint32(186).fork()).join();
     }
+    if (message.arch !== 0) {
+      writer.uint32(192).int32(message.arch);
+    }
     return writer;
   },
   decode(input, length) {
@@ -30719,6 +31631,13 @@ var Image = {
           message.volumeMounts.push(VolumeMount.decode(reader, reader.uint32()));
           continue;
         }
+        case 24: {
+          if (tag !== 192) {
+            break;
+          }
+          message.arch = reader.int32();
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -30746,7 +31665,8 @@ var Image = {
         acc[key] = String(value);
         return acc;
       }, {}) : {},
-      volumeMounts: globalThis.Array.isArray(object?.volumeMounts) ? object.volumeMounts.map((e) => VolumeMount.fromJSON(e)) : []
+      volumeMounts: globalThis.Array.isArray(object?.volumeMounts) ? object.volumeMounts.map((e) => VolumeMount.fromJSON(e)) : [],
+      arch: isSet5(object.arch) ? archFromJSON(object.arch) : 0
     };
   },
   toJSON(message) {
@@ -30802,6 +31722,9 @@ var Image = {
     if (message.volumeMounts?.length) {
       obj.volumeMounts = message.volumeMounts.map((e) => VolumeMount.toJSON(e));
     }
+    if (message.arch !== 0) {
+      obj.arch = archToJSON(message.arch);
+    }
     return obj;
   },
   create(base) {
@@ -30832,6 +31755,7 @@ var Image = {
       {}
     );
     message.volumeMounts = object.volumeMounts?.map((e) => VolumeMount.fromPartial(e)) || [];
+    message.arch = object.arch ?? 0;
     return message;
   }
 };
@@ -35879,6 +36803,157 @@ var ObjectDependency = {
     return message;
   }
 };
+function createBaseOutboundPolicy() {
+  return { headerReplacements: [] };
+}
+var OutboundPolicy = {
+  encode(message, writer = new BinaryWriter()) {
+    for (const v of message.headerReplacements) {
+      OutboundPolicy_HeaderReplacement.encode(v, writer.uint32(10).fork()).join();
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseOutboundPolicy();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.headerReplacements.push(OutboundPolicy_HeaderReplacement.decode(reader, reader.uint32()));
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      headerReplacements: globalThis.Array.isArray(object?.headerReplacements) ? object.headerReplacements.map((e) => OutboundPolicy_HeaderReplacement.fromJSON(e)) : []
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.headerReplacements?.length) {
+      obj.headerReplacements = message.headerReplacements.map((e) => OutboundPolicy_HeaderReplacement.toJSON(e));
+    }
+    return obj;
+  },
+  create(base) {
+    return OutboundPolicy.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseOutboundPolicy();
+    message.headerReplacements = object.headerReplacements?.map((e) => OutboundPolicy_HeaderReplacement.fromPartial(e)) || [];
+    return message;
+  }
+};
+function createBaseOutboundPolicy_HeaderReplacement() {
+  return { domain: "", headerName: "", headerValue: "", secretId: "" };
+}
+var OutboundPolicy_HeaderReplacement = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.domain !== "") {
+      writer.uint32(10).string(message.domain);
+    }
+    if (message.headerName !== "") {
+      writer.uint32(18).string(message.headerName);
+    }
+    if (message.headerValue !== "") {
+      writer.uint32(26).string(message.headerValue);
+    }
+    if (message.secretId !== "") {
+      writer.uint32(34).string(message.secretId);
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseOutboundPolicy_HeaderReplacement();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.domain = reader.string();
+          continue;
+        }
+        case 2: {
+          if (tag !== 18) {
+            break;
+          }
+          message.headerName = reader.string();
+          continue;
+        }
+        case 3: {
+          if (tag !== 26) {
+            break;
+          }
+          message.headerValue = reader.string();
+          continue;
+        }
+        case 4: {
+          if (tag !== 34) {
+            break;
+          }
+          message.secretId = reader.string();
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      domain: isSet5(object.domain) ? globalThis.String(object.domain) : "",
+      headerName: isSet5(object.headerName) ? globalThis.String(object.headerName) : "",
+      headerValue: isSet5(object.headerValue) ? globalThis.String(object.headerValue) : "",
+      secretId: isSet5(object.secretId) ? globalThis.String(object.secretId) : ""
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.domain !== "") {
+      obj.domain = message.domain;
+    }
+    if (message.headerName !== "") {
+      obj.headerName = message.headerName;
+    }
+    if (message.headerValue !== "") {
+      obj.headerValue = message.headerValue;
+    }
+    if (message.secretId !== "") {
+      obj.secretId = message.secretId;
+    }
+    return obj;
+  },
+  create(base) {
+    return OutboundPolicy_HeaderReplacement.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseOutboundPolicy_HeaderReplacement();
+    message.domain = object.domain ?? "";
+    message.headerName = object.headerName ?? "";
+    message.headerValue = object.headerValue ?? "";
+    message.secretId = object.secretId ?? "";
+    return message;
+  }
+};
 function createBasePTYInfo() {
   return {
     enabled: false,
@@ -39569,7 +40644,8 @@ function createBaseSandbox() {
     includeOidcIdentityToken: false,
     readinessProbe: void 0,
     inboundCidrAllowlist: [],
-    environmentVariables: void 0
+    environmentVariables: void 0,
+    outboundPolicy: void 0
   };
 }
 var Sandbox = {
@@ -39691,6 +40767,9 @@ var Sandbox = {
     if (message.environmentVariables !== void 0) {
       StringMap.encode(message.environmentVariables, writer.uint32(322).fork()).join();
     }
+    if (message.outboundPolicy !== void 0) {
+      OutboundPolicy.encode(message.outboundPolicy, writer.uint32(338).fork()).join();
+    }
     return writer;
   },
   decode(input, length) {
@@ -39979,6 +41058,13 @@ var Sandbox = {
           message.environmentVariables = StringMap.decode(reader, reader.uint32());
           continue;
         }
+        case 42: {
+          if (tag !== 338) {
+            break;
+          }
+          message.outboundPolicy = OutboundPolicy.decode(reader, reader.uint32());
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -40033,7 +41119,8 @@ var Sandbox = {
       includeOidcIdentityToken: isSet5(object.includeOidcIdentityToken) ? globalThis.Boolean(object.includeOidcIdentityToken) : false,
       readinessProbe: isSet5(object.readinessProbe) ? Probe.fromJSON(object.readinessProbe) : void 0,
       inboundCidrAllowlist: globalThis.Array.isArray(object?.inboundCidrAllowlist) ? object.inboundCidrAllowlist.map((e) => globalThis.String(e)) : [],
-      environmentVariables: isSet5(object.environmentVariables) ? StringMap.fromJSON(object.environmentVariables) : void 0
+      environmentVariables: isSet5(object.environmentVariables) ? StringMap.fromJSON(object.environmentVariables) : void 0,
+      outboundPolicy: isSet5(object.outboundPolicy) ? OutboundPolicy.fromJSON(object.outboundPolicy) : void 0
     };
   },
   toJSON(message) {
@@ -40167,6 +41254,9 @@ var Sandbox = {
     if (message.environmentVariables !== void 0) {
       obj.environmentVariables = StringMap.toJSON(message.environmentVariables);
     }
+    if (message.outboundPolicy !== void 0) {
+      obj.outboundPolicy = OutboundPolicy.toJSON(message.outboundPolicy);
+    }
     return obj;
   },
   create(base) {
@@ -40226,6 +41316,7 @@ var Sandbox = {
     message.readinessProbe = object.readinessProbe !== void 0 && object.readinessProbe !== null ? Probe.fromPartial(object.readinessProbe) : void 0;
     message.inboundCidrAllowlist = object.inboundCidrAllowlist?.map((e) => e) || [];
     message.environmentVariables = object.environmentVariables !== void 0 && object.environmentVariables !== null ? StringMap.fromPartial(object.environmentVariables) : void 0;
+    message.outboundPolicy = object.outboundPolicy !== void 0 && object.outboundPolicy !== null ? OutboundPolicy.fromPartial(object.outboundPolicy) : void 0;
     return message;
   }
 };
@@ -40365,6 +41456,287 @@ var Sandbox_ExperimentalOptionsV2Entry = {
     return message;
   }
 };
+function createBaseSandboxContainerCreateV2Request() {
+  return {
+    sandboxId: "",
+    containerName: "",
+    definition: void 0,
+    ephemeralSecrets: void 0,
+    cloudBucketMountCredentials: {}
+  };
+}
+var SandboxContainerCreateV2Request = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.sandboxId !== "") {
+      writer.uint32(10).string(message.sandboxId);
+    }
+    if (message.containerName !== "") {
+      writer.uint32(18).string(message.containerName);
+    }
+    if (message.definition !== void 0) {
+      Sandbox.encode(message.definition, writer.uint32(26).fork()).join();
+    }
+    if (message.ephemeralSecrets !== void 0) {
+      StringMap.encode(message.ephemeralSecrets, writer.uint32(34).fork()).join();
+    }
+    Object.entries(message.cloudBucketMountCredentials).forEach(([key, value]) => {
+      SandboxContainerCreateV2Request_CloudBucketMountCredentialsEntry.encode(
+        { key, value },
+        writer.uint32(42).fork()
+      ).join();
+    });
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseSandboxContainerCreateV2Request();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.sandboxId = reader.string();
+          continue;
+        }
+        case 2: {
+          if (tag !== 18) {
+            break;
+          }
+          message.containerName = reader.string();
+          continue;
+        }
+        case 3: {
+          if (tag !== 26) {
+            break;
+          }
+          message.definition = Sandbox.decode(reader, reader.uint32());
+          continue;
+        }
+        case 4: {
+          if (tag !== 34) {
+            break;
+          }
+          message.ephemeralSecrets = StringMap.decode(reader, reader.uint32());
+          continue;
+        }
+        case 5: {
+          if (tag !== 42) {
+            break;
+          }
+          const entry5 = SandboxContainerCreateV2Request_CloudBucketMountCredentialsEntry.decode(
+            reader,
+            reader.uint32()
+          );
+          if (entry5.value !== void 0) {
+            message.cloudBucketMountCredentials[entry5.key] = entry5.value;
+          }
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      sandboxId: isSet5(object.sandboxId) ? globalThis.String(object.sandboxId) : "",
+      containerName: isSet5(object.containerName) ? globalThis.String(object.containerName) : "",
+      definition: isSet5(object.definition) ? Sandbox.fromJSON(object.definition) : void 0,
+      ephemeralSecrets: isSet5(object.ephemeralSecrets) ? StringMap.fromJSON(object.ephemeralSecrets) : void 0,
+      cloudBucketMountCredentials: isObject2(object.cloudBucketMountCredentials) ? Object.entries(object.cloudBucketMountCredentials).reduce(
+        (acc, [key, value]) => {
+          acc[key] = StringMap.fromJSON(value);
+          return acc;
+        },
+        {}
+      ) : {}
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.sandboxId !== "") {
+      obj.sandboxId = message.sandboxId;
+    }
+    if (message.containerName !== "") {
+      obj.containerName = message.containerName;
+    }
+    if (message.definition !== void 0) {
+      obj.definition = Sandbox.toJSON(message.definition);
+    }
+    if (message.ephemeralSecrets !== void 0) {
+      obj.ephemeralSecrets = StringMap.toJSON(message.ephemeralSecrets);
+    }
+    if (message.cloudBucketMountCredentials) {
+      const entries = Object.entries(message.cloudBucketMountCredentials);
+      if (entries.length > 0) {
+        obj.cloudBucketMountCredentials = {};
+        entries.forEach(([k, v]) => {
+          obj.cloudBucketMountCredentials[k] = StringMap.toJSON(v);
+        });
+      }
+    }
+    return obj;
+  },
+  create(base) {
+    return SandboxContainerCreateV2Request.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseSandboxContainerCreateV2Request();
+    message.sandboxId = object.sandboxId ?? "";
+    message.containerName = object.containerName ?? "";
+    message.definition = object.definition !== void 0 && object.definition !== null ? Sandbox.fromPartial(object.definition) : void 0;
+    message.ephemeralSecrets = object.ephemeralSecrets !== void 0 && object.ephemeralSecrets !== null ? StringMap.fromPartial(object.ephemeralSecrets) : void 0;
+    message.cloudBucketMountCredentials = Object.entries(object.cloudBucketMountCredentials ?? {}).reduce((acc, [key, value]) => {
+      if (value !== void 0) {
+        acc[key] = StringMap.fromPartial(value);
+      }
+      return acc;
+    }, {});
+    return message;
+  }
+};
+function createBaseSandboxContainerCreateV2Request_CloudBucketMountCredentialsEntry() {
+  return { key: "", value: void 0 };
+}
+var SandboxContainerCreateV2Request_CloudBucketMountCredentialsEntry = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.key !== "") {
+      writer.uint32(10).string(message.key);
+    }
+    if (message.value !== void 0) {
+      StringMap.encode(message.value, writer.uint32(18).fork()).join();
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseSandboxContainerCreateV2Request_CloudBucketMountCredentialsEntry();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.key = reader.string();
+          continue;
+        }
+        case 2: {
+          if (tag !== 18) {
+            break;
+          }
+          message.value = StringMap.decode(reader, reader.uint32());
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      key: isSet5(object.key) ? globalThis.String(object.key) : "",
+      value: isSet5(object.value) ? StringMap.fromJSON(object.value) : void 0
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.key !== "") {
+      obj.key = message.key;
+    }
+    if (message.value !== void 0) {
+      obj.value = StringMap.toJSON(message.value);
+    }
+    return obj;
+  },
+  create(base) {
+    return SandboxContainerCreateV2Request_CloudBucketMountCredentialsEntry.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseSandboxContainerCreateV2Request_CloudBucketMountCredentialsEntry();
+    message.key = object.key ?? "";
+    message.value = object.value !== void 0 && object.value !== null ? StringMap.fromPartial(object.value) : void 0;
+    return message;
+  }
+};
+function createBaseSandboxContainerCreateV2Response() {
+  return { containerId: "", containerName: "" };
+}
+var SandboxContainerCreateV2Response = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.containerId !== "") {
+      writer.uint32(10).string(message.containerId);
+    }
+    if (message.containerName !== "") {
+      writer.uint32(18).string(message.containerName);
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseSandboxContainerCreateV2Response();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.containerId = reader.string();
+          continue;
+        }
+        case 2: {
+          if (tag !== 18) {
+            break;
+          }
+          message.containerName = reader.string();
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      containerId: isSet5(object.containerId) ? globalThis.String(object.containerId) : "",
+      containerName: isSet5(object.containerName) ? globalThis.String(object.containerName) : ""
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.containerId !== "") {
+      obj.containerId = message.containerId;
+    }
+    if (message.containerName !== "") {
+      obj.containerName = message.containerName;
+    }
+    return obj;
+  },
+  create(base) {
+    return SandboxContainerCreateV2Response.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseSandboxContainerCreateV2Response();
+    message.containerId = object.containerId ?? "";
+    message.containerName = object.containerName ?? "";
+    return message;
+  }
+};
 function createBaseSandboxCreateConnectTokenRequest() {
   return { sandboxId: "", userMetadata: "", port: void 0 };
 }
@@ -47167,6 +48539,142 @@ var SharedVolumeRemoveFileRequest = {
     return message;
   }
 };
+function createBaseStatsPercentile() {
+  return { percentileBasisPoints: 0, value: 0 };
+}
+var StatsPercentile = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.percentileBasisPoints !== 0) {
+      writer.uint32(8).uint32(message.percentileBasisPoints);
+    }
+    if (message.value !== 0) {
+      writer.uint32(17).double(message.value);
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseStatsPercentile();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 8) {
+            break;
+          }
+          message.percentileBasisPoints = reader.uint32();
+          continue;
+        }
+        case 2: {
+          if (tag !== 17) {
+            break;
+          }
+          message.value = reader.double();
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      percentileBasisPoints: isSet5(object.percentileBasisPoints) ? globalThis.Number(object.percentileBasisPoints) : 0,
+      value: isSet5(object.value) ? globalThis.Number(object.value) : 0
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.percentileBasisPoints !== 0) {
+      obj.percentileBasisPoints = Math.round(message.percentileBasisPoints);
+    }
+    if (message.value !== 0) {
+      obj.value = message.value;
+    }
+    return obj;
+  },
+  create(base) {
+    return StatsPercentile.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseStatsPercentile();
+    message.percentileBasisPoints = object.percentileBasisPoints ?? 0;
+    message.value = object.value ?? 0;
+    return message;
+  }
+};
+function createBaseStatsPercentileDistribution() {
+  return { unit: "", percentiles: [] };
+}
+var StatsPercentileDistribution = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.unit !== "") {
+      writer.uint32(10).string(message.unit);
+    }
+    for (const v of message.percentiles) {
+      StatsPercentile.encode(v, writer.uint32(18).fork()).join();
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseStatsPercentileDistribution();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.unit = reader.string();
+          continue;
+        }
+        case 2: {
+          if (tag !== 18) {
+            break;
+          }
+          message.percentiles.push(StatsPercentile.decode(reader, reader.uint32()));
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      unit: isSet5(object.unit) ? globalThis.String(object.unit) : "",
+      percentiles: globalThis.Array.isArray(object?.percentiles) ? object.percentiles.map((e) => StatsPercentile.fromJSON(e)) : []
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.unit !== "") {
+      obj.unit = message.unit;
+    }
+    if (message.percentiles?.length) {
+      obj.percentiles = message.percentiles.map((e) => StatsPercentile.toJSON(e));
+    }
+    return obj;
+  },
+  create(base) {
+    return StatsPercentileDistribution.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseStatsPercentileDistribution();
+    message.unit = object.unit ?? "";
+    message.percentiles = object.percentiles?.map((e) => StatsPercentile.fromPartial(e)) || [];
+    return message;
+  }
+};
 function createBaseStringMap() {
   return { contents: {} };
 }
@@ -51068,7 +52576,7 @@ var VolumeGetByIdResponse = {
   }
 };
 function createBaseVolumeGetFile2Request() {
-  return { volumeId: "", path: "", start: 0, len: 0 };
+  return { volumeId: "", path: "", start: 0, len: 0, clientPadsBlocks: false };
 }
 var VolumeGetFile2Request = {
   encode(message, writer = new BinaryWriter()) {
@@ -51084,6 +52592,9 @@ var VolumeGetFile2Request = {
     if (message.len !== 0) {
       writer.uint32(32).uint64(message.len);
     }
+    if (message.clientPadsBlocks !== false) {
+      writer.uint32(40).bool(message.clientPadsBlocks);
+    }
     return writer;
   },
   decode(input, length) {
@@ -51121,6 +52632,13 @@ var VolumeGetFile2Request = {
           message.len = longToNumber2(reader.uint64());
           continue;
         }
+        case 5: {
+          if (tag !== 40) {
+            break;
+          }
+          message.clientPadsBlocks = reader.bool();
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -51134,7 +52652,8 @@ var VolumeGetFile2Request = {
       volumeId: isSet5(object.volumeId) ? globalThis.String(object.volumeId) : "",
       path: isSet5(object.path) ? globalThis.String(object.path) : "",
       start: isSet5(object.start) ? globalThis.Number(object.start) : 0,
-      len: isSet5(object.len) ? globalThis.Number(object.len) : 0
+      len: isSet5(object.len) ? globalThis.Number(object.len) : 0,
+      clientPadsBlocks: isSet5(object.clientPadsBlocks) ? globalThis.Boolean(object.clientPadsBlocks) : false
     };
   },
   toJSON(message) {
@@ -51151,6 +52670,9 @@ var VolumeGetFile2Request = {
     if (message.len !== 0) {
       obj.len = Math.round(message.len);
     }
+    if (message.clientPadsBlocks !== false) {
+      obj.clientPadsBlocks = message.clientPadsBlocks;
+    }
     return obj;
   },
   create(base) {
@@ -51162,6 +52684,7 @@ var VolumeGetFile2Request = {
     message.path = object.path ?? "";
     message.start = object.start ?? 0;
     message.len = object.len ?? 0;
+    message.clientPadsBlocks = object.clientPadsBlocks ?? false;
     return message;
   }
 };
@@ -56003,6 +57526,14 @@ var ModalClientDefinition = {
       responseStream: false,
       options: {}
     },
+    appGetInfo: {
+      name: "AppGetInfo",
+      requestType: AppGetInfoRequest,
+      requestStream: false,
+      responseType: AppGetInfoResponse,
+      responseStream: false,
+      options: {}
+    },
     appGetLayout: {
       name: "AppGetLayout",
       requestType: AppGetLayoutRequest,
@@ -56738,6 +58269,14 @@ var ModalClientDefinition = {
       responseStream: false,
       options: {}
     },
+    functionGetById: {
+      name: "FunctionGetById",
+      requestType: FunctionGetByIdRequest,
+      requestStream: false,
+      responseType: FunctionGetByIdResponse,
+      responseStream: false,
+      options: {}
+    },
     functionGetCallGraph: {
       name: "FunctionGetCallGraph",
       requestType: FunctionGetCallGraphRequest,
@@ -56762,6 +58301,14 @@ var ModalClientDefinition = {
       responseStream: false,
       options: {}
     },
+    functionGetFlashAuthToken: {
+      name: "FunctionGetFlashAuthToken",
+      requestType: FunctionGetFlashAuthTokenRequest,
+      requestStream: false,
+      responseType: FunctionGetFlashAuthTokenResponse,
+      responseStream: false,
+      options: {}
+    },
     /** For containers to request next call */
     functionGetInputs: {
       name: "FunctionGetInputs",
@@ -57124,6 +58671,14 @@ var ModalClientDefinition = {
       options: {}
     },
     /** Sandboxes */
+    sandboxContainerCreateV2: {
+      name: "SandboxContainerCreateV2",
+      requestType: SandboxContainerCreateV2Request,
+      requestStream: false,
+      responseType: SandboxContainerCreateV2Response,
+      responseStream: false,
+      options: {}
+    },
     sandboxCreate: {
       name: "SandboxCreate",
       requestType: SandboxCreateRequest,
@@ -58481,7 +60036,7 @@ function checkForRenamedParams(params, renames) {
 }
 
 // src/client.ts
-import { v4 as uuidv42 } from "uuid";
+import { v4 as uuidv44 } from "uuid";
 import {
   ClientError as ClientError13,
   createChannel as createChannel2,
@@ -59938,6 +61493,33 @@ var Queue = class _Queue {
 import { ClientError as ClientError11, Status as Status11 } from "nice-grpc";
 import { setTimeout as setTimeout3 } from "timers/promises";
 
+// src/idle_countdown.ts
+var IdleCountdown = class {
+  #timer;
+  /** Ends the countdown in progress. */
+  stop() {
+    if (this.#timer !== void 0) {
+      globalThis.clearTimeout(this.#timer);
+      this.#timer = void 0;
+    }
+  }
+  /**
+   * Starts the countdown again, calling `release` when it elapses. A timeout of
+   * zero or less leaves it stopped.
+   */
+  arm(timeoutMs, release) {
+    this.stop();
+    if (timeoutMs <= 0) {
+      return;
+    }
+    this.#timer = globalThis.setTimeout(() => {
+      this.#timer = void 0;
+      release();
+    }, timeoutMs);
+    this.#timer.unref?.();
+  }
+};
+
 // proto/modal_proto/task_command_router.ts
 function sandboxStdioFileDescriptorFromJSON(object) {
   switch (object) {
@@ -63022,6 +64604,111 @@ var TaskSetNetworkAccessResponse = {
     return message;
   }
 };
+function createBaseTaskSetOutboundPolicyRequest() {
+  return { taskId: "", outboundPolicy: void 0 };
+}
+var TaskSetOutboundPolicyRequest = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.taskId !== "") {
+      writer.uint32(10).string(message.taskId);
+    }
+    if (message.outboundPolicy !== void 0) {
+      OutboundPolicy.encode(message.outboundPolicy, writer.uint32(18).fork()).join();
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseTaskSetOutboundPolicyRequest();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.taskId = reader.string();
+          continue;
+        }
+        case 2: {
+          if (tag !== 18) {
+            break;
+          }
+          message.outboundPolicy = OutboundPolicy.decode(reader, reader.uint32());
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      taskId: isSet6(object.taskId) ? globalThis.String(object.taskId) : "",
+      outboundPolicy: isSet6(object.outboundPolicy) ? OutboundPolicy.fromJSON(object.outboundPolicy) : void 0
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.taskId !== "") {
+      obj.taskId = message.taskId;
+    }
+    if (message.outboundPolicy !== void 0) {
+      obj.outboundPolicy = OutboundPolicy.toJSON(message.outboundPolicy);
+    }
+    return obj;
+  },
+  create(base) {
+    return TaskSetOutboundPolicyRequest.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseTaskSetOutboundPolicyRequest();
+    message.taskId = object.taskId ?? "";
+    message.outboundPolicy = object.outboundPolicy !== void 0 && object.outboundPolicy !== null ? OutboundPolicy.fromPartial(object.outboundPolicy) : void 0;
+    return message;
+  }
+};
+function createBaseTaskSetOutboundPolicyResponse() {
+  return {};
+}
+var TaskSetOutboundPolicyResponse = {
+  encode(_, writer = new BinaryWriter()) {
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseTaskSetOutboundPolicyResponse();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(_) {
+    return {};
+  },
+  toJSON(_) {
+    const obj = {};
+    return obj;
+  },
+  create(base) {
+    return TaskSetOutboundPolicyResponse.fromPartial(base ?? {});
+  },
+  fromPartial(_) {
+    const message = createBaseTaskSetOutboundPolicyResponse();
+    return message;
+  }
+};
 function createBaseTaskSnapshotDirectoryRequest() {
   return {
     taskId: "",
@@ -63751,6 +65438,15 @@ var TaskCommandRouterDefinition = {
       responseStream: false,
       options: {}
     },
+    /** Replace the task's outbound policy. */
+    taskSetOutboundPolicy: {
+      name: "TaskSetOutboundPolicy",
+      requestType: TaskSetOutboundPolicyRequest,
+      requestStream: false,
+      responseType: TaskSetOutboundPolicyResponse,
+      responseStream: false,
+      options: {}
+    },
     /** Snapshot a directory with a mounted image, including any local changes, into a new image. */
     taskSnapshotDirectory: {
       name: "TaskSnapshotDirectory",
@@ -63851,6 +65547,8 @@ import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import path from "node:path";
 import { parse as parseToml } from "smol-toml";
+var DEFAULT_SANDBOX_CHANNEL_IDLE_TIMEOUT_MS = 3e4;
+var MAX_TIMEOUT_MS = 2147483647;
 function isLocalhost(profile) {
   const url = new URL(profile.serverUrl);
   const hostname = url.hostname;
@@ -63878,6 +65576,12 @@ function readConfigFile() {
   }
 }
 var config = readConfigFile();
+function resolveOAuthClientAuth(secretEnv, jwtKeyEnv, secretFile, jwtKeyFile) {
+  if (secretEnv || jwtKeyEnv) {
+    return { oauthClientSecret: secretEnv, oauthJwtKey: jwtKeyEnv };
+  }
+  return { oauthClientSecret: secretFile, oauthJwtKey: jwtKeyFile };
+}
 function getProfile(profileName) {
   if (!profileName) {
     for (const [name, profileData2] of Object.entries(config)) {
@@ -63892,8 +65596,16 @@ function getProfile(profileName) {
     serverUrl: process.env["MODAL_SERVER_URL"] || profileData.server_url || "https://api.modal.com:443",
     tokenId: process.env["MODAL_TOKEN_ID"] || profileData.token_id,
     tokenSecret: process.env["MODAL_TOKEN_SECRET"] || profileData.token_secret,
+    oauthRefreshToken: process.env["MODAL_OAUTH_REFRESH_TOKEN"] || profileData.oauth_refresh_token,
+    oauthClientId: process.env["MODAL_OAUTH_CLIENT_ID"] || profileData.oauth_client_id,
+    ...resolveOAuthClientAuth(
+      process.env["MODAL_OAUTH_CLIENT_SECRET"],
+      process.env["MODAL_OAUTH_JWT_KEY"],
+      profileData.oauth_client_secret,
+      profileData.oauth_jwt_key
+    ),
     environment: process.env["MODAL_ENVIRONMENT"] || profileData.environment,
-    imageBuilderVersion: process.env["MODAL_IMAGE_BUILDER_VERSION"] || profileData.imageBuilderVersion,
+    imageBuilderVersion: process.env["MODAL_IMAGE_BUILDER_VERSION"] || profileData.image_builder_version,
     logLevel: process.env["MODAL_LOGLEVEL"] || profileData.loglevel,
     maxThrottleWaitSecs: (() => {
       const val = process.env["MODAL_MAX_THROTTLE_WAIT"];
@@ -63906,10 +65618,28 @@ function getProfile(profileName) {
         return void 0;
       }
       return parsed;
-    })()
+    })(),
+    sandboxChannelIdleTimeoutMs: (() => {
+      const val = process.env["MODAL_SANDBOX_CHANNEL_IDLE_TIMEOUT"];
+      if (!val) return DEFAULT_SANDBOX_CHANNEL_IDLE_TIMEOUT_MS;
+      const parsed = Number(val);
+      if (!Number.isFinite(parsed) || parsed < 0 || parsed * 1e3 > MAX_TIMEOUT_MS) {
+        warn(
+          `MODAL_SANDBOX_CHANNEL_IDLE_TIMEOUT="${val}" is not a valid non-negative number of seconds; ignoring.`
+        );
+        return DEFAULT_SANDBOX_CHANNEL_IDLE_TIMEOUT_MS;
+      }
+      const ms = Math.round(parsed * 1e3);
+      return parsed > 0 && ms === 0 ? 1 : ms;
+    })(),
+    sandboxV2: process.env["MODAL_SANDBOX_V2"] ? parseBooleanFlag(process.env["MODAL_SANDBOX_V2"]) : parseBooleanFlag(profileData.sandbox_v2)
   };
   return profile;
 }
+function parseBooleanFlag(value) {
+  if (!value) return false;
+  return !["0", "false"].includes(String(value).toLowerCase());
+}
 
 // src/task_command_router_client.ts
 function parseJwtExpiration(jwtToken, logger2) {
@@ -63980,7 +65710,37 @@ async function callWithRetriesOnTransientErrors(func, baseDelayMs = 10, delayFac
 }
 var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
   stub;
+  /**
+   * The connection, absent while it is released. It is dialled again by the
+   * next operation, so nothing may hold `stub` across one.
+   */
   channel;
+  dial;
+  factory;
+  /**
+   * How many operations are using the connection. A count rather than a flag
+   * because operations overlap: only the last one out starts the idle clock.
+   */
+  inFlight = 0;
+  idle = new IdleCountdown();
+  /**
+   * Bumped every time a connection is dialled. A stream opened on an earlier
+   * one is stale: the connection under it has since been given up.
+   */
+  generation = 0;
+  /**
+   * Streams open right now, tracked so they can be ended on release.
+   *
+   * grpc-js does not cancel a call in flight when its channel is closed, and a
+   * subchannel with a live call on it is never collected - so closing alone
+   * leaves the socket up. Aborting the calls first is what actually frees it.
+   */
+  liveStreams = /* @__PURE__ */ new Set();
+  /**
+   * How long the client may go unused before its connection is given up. Zero
+   * keeps it up until the client is closed. Overridable in tests.
+   */
+  idleTimeoutMs = DEFAULT_SANDBOX_CHANNEL_IDLE_TIMEOUT_MS;
   serverClient;
   taskId;
   sandboxId;
@@ -63991,6 +65751,7 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
   jwtRefreshLock = Promise.resolve();
   logger;
   closed = false;
+  draining = false;
   /**
    * `access` is the router access returned by SandboxCreateV2, which lets a
    * freshly created sandbox connect without a round-trip. Pass undefined to look
@@ -64042,23 +65803,17 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
       "grpc.keepalive_timeout_ms": 1e4,
       "grpc.keepalive_permit_without_calls": 1
     };
-    let channel;
-    if (isLocalhost(profile)) {
+    const insecure = isLocalhost(profile);
+    if (insecure) {
       logger2.warn(
         "Using insecure TLS (skip certificate verification) for task command router"
       );
-      channel = createChannel(
-        serverUrl,
-        ChannelCredentials.createInsecure(),
-        channelConfig
-      );
-    } else {
-      channel = createChannel(
-        serverUrl,
-        ChannelCredentials.createSsl(),
-        channelConfig
-      );
     }
+    const dial = () => createChannel(
+      serverUrl,
+      insecure ? ChannelCredentials.createInsecure() : ChannelCredentials.createSsl(),
+      channelConfig
+    );
     const client = new _TaskCommandRouterClientImpl(
       serverClient,
       taskId,
@@ -64066,8 +65821,9 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
       isV2,
       resp.url,
       resp.jwt,
-      channel,
-      logger2
+      dial,
+      logger2,
+      profile.sandboxChannelIdleTimeoutMs
     );
     logger2.debug(
       "Successfully initialized command router client",
@@ -64076,7 +65832,14 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
     );
     return client;
   }
-  constructor(serverClient, taskId, sandboxId, isV2, serverUrl, jwt, channel, logger2) {
+  /**
+   * Builds a client around an already-resolved connection. Public so a test can
+   * construct one without the control-plane round trip `tryInit` makes; the
+   * class is not exported from the package, so this is not API surface.
+   */
+  constructor(serverClient, taskId, sandboxId, isV2, serverUrl, jwt, dial, logger2, idleTimeoutMs) {
+    this.dial = dial;
+    this.idleTimeoutMs = idleTimeoutMs;
     this.serverClient = serverClient;
     this.taskId = taskId;
     this.sandboxId = sandboxId;
@@ -64085,25 +65848,110 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
     this.jwt = jwt;
     this.jwtExp = parseJwtExpiration(jwt, logger2);
     this.logger = logger2;
-    this.channel = channel;
+    this.channel = dial();
     const self = this;
     const factory = createClientFactory().use(timeoutMiddleware).use(async function* authMiddleware(call, options) {
       options.metadata ??= new Metadata();
       options.metadata.set("authorization", `Bearer ${self.jwt}`);
       return yield* call.next(call.request, options);
     });
-    this.stub = factory.create(TaskCommandRouterDefinition, channel);
+    this.factory = factory;
+    this.stub = factory.create(TaskCommandRouterDefinition, this.channel);
+    this.armIdleTimer();
+  }
+  /**
+   * Says the client is about to be used: holds off the idle timer, and dials
+   * again if the connection was already given up. Returns the generation being
+   * used; pair every call with endOp.
+   */
+  beginOp() {
+    if (this.closed || this.draining) {
+      throw new ClientClosedError();
+    }
+    this.idle.stop();
+    if (this.channel === void 0) {
+      this.channel = this.dial();
+      this.stub = this.factory.create(
+        TaskCommandRouterDefinition,
+        this.channel
+      );
+      this.generation++;
+      this.logger.debug(
+        "Reconnected to the command router after an idle release",
+        "task_id",
+        this.taskId
+      );
+    }
+    this.inFlight = (this.inFlight ?? 0) + 1;
+    return this.generation;
+  }
+  /** Says the caller is done. The last one out starts the clock. */
+  endOp() {
+    this.inFlight--;
+    if (this.inFlight > 0) {
+      return;
+    }
+    if (this.draining) {
+      this.close();
+    } else {
+      this.armIdleTimer();
+    }
+  }
+  /**
+   * Starts the countdown to giving the connection back. Call it with nothing
+   * in flight.
+   */
+  armIdleTimer() {
+    if (this.closed) {
+      return;
+    }
+    this.idle.arm(this.idleTimeoutMs, () => {
+      if (this.inFlight > 0 || this.channel === void 0) {
+        return;
+      }
+      this.logger.debug(
+        "Releasing the command router connection to an idle Sandbox",
+        "task_id",
+        this.taskId
+      );
+      for (const stream of this.liveStreams) {
+        stream.abort();
+      }
+      this.liveStreams.clear();
+      this.channel.close();
+      this.channel = void 0;
+    });
+  }
+  /** Refuse new operations and release resources after current operations finish. */
+  closeWhenIdle() {
+    this.draining = true;
+    this.idle.stop();
+    if (this.inFlight === 0) this.close();
   }
   close() {
     if (this.closed) {
       return;
     }
     this.closed = true;
-    this.channel.close();
+    this.idle.stop();
+    for (const stream of this.liveStreams) {
+      stream.abort();
+    }
+    this.liveStreams.clear();
+    this.channel?.close();
+    this.channel = void 0;
+  }
+  async callWithRetries(...args) {
+    this.beginOp();
+    try {
+      return await callWithRetriesOnTransientErrors(...args);
+    } finally {
+      this.endOp();
+    }
   }
   /** Run a unary RPC against the command router with the default retry policy. */
   async callUnary(fn) {
-    return await callWithRetriesOnTransientErrors(
+    return await this.callWithRetries(
       () => this.callWithAuthRetry(fn),
       10,
       // baseDelayMs
@@ -64134,7 +65982,7 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
   async containerWait(request) {
     return await this.callUnary(() => this.stub.taskContainerWait(request));
   }
-  async *execStdioRead(taskId, execId, fileDescriptor, deadline = null) {
+  async *execStdioRead(taskId, execId, fileDescriptor, deadline = null, signal) {
     let srFd;
     if (fileDescriptor === 1 /* FILE_DESCRIPTOR_STDOUT */) {
       srFd = 0 /* TASK_EXEC_STDIO_FILE_DESCRIPTOR_STDOUT */;
@@ -64145,7 +65993,7 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
     } else {
       throw new Error(`Invalid file descriptor: ${fileDescriptor}`);
     }
-    yield* this.streamStdio(taskId, execId, srFd, deadline);
+    yield* this.streamExecStdio(taskId, execId, srFd, deadline, signal);
   }
   async execStdinWrite(taskId, execId, offset, data, eof) {
     const request = TaskExecStdinWriteRequest.create({
@@ -64177,76 +66025,100 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
    * stream from that point. Returns the total bytes streamed.
    */
   async execStdinWriteStream(taskId, execId, source, chunkSize = STREAMING_STDIN_CHUNK_SIZE, maxResumeAttempts = 9) {
-    let offset = 0;
-    let attempt = 0;
-    while (true) {
-      let bytesRead = offset;
-      let sourceExhausted = false;
-      let sourceError;
-      const requests = async function* () {
-        yield TaskExecStdinWriteStreamRequest.create({
-          start: { taskId, execId, offset }
-        });
-        const chunks = async function* () {
-          try {
-            yield* source.readFrom(offset);
-          } catch (err) {
-            sourceError = err;
+    this.beginOp();
+    try {
+      let offset = 0;
+      let attempt = 0;
+      while (true) {
+        let bytesRead = offset;
+        let sourceExhausted = false;
+        let sourceError;
+        const requests = async function* () {
+          yield TaskExecStdinWriteStreamRequest.create({
+            start: { taskId, execId, offset }
+          });
+          const chunks = async function* () {
+            try {
+              yield* source.readFrom(offset);
+            } catch (err) {
+              sourceError = err;
+              throw err;
+            }
+          }();
+          for await (const chunk of chunks) {
+            for (let i = 0; i < chunk.length; i += chunkSize) {
+              const data = chunk.subarray(i, i + chunkSize);
+              if (data.length === 0) continue;
+              bytesRead += data.length;
+              yield TaskExecStdinWriteStreamRequest.create({ data });
+            }
+          }
+          sourceExhausted = true;
+          yield TaskExecStdinWriteStreamRequest.create({ end: {} });
+        };
+        const abort = new AbortController();
+        this.liveStreams.add(abort);
+        try {
+          await this.stub.taskExecStdinWriteStream(requests(), {
+            signal: abort.signal
+          });
+          return bytesRead;
+        } catch (err) {
+          if (sourceError !== void 0) {
+            throw sourceError;
+          }
+          if (err instanceof ClientError6 && err.code === Status6.CANCELLED && this.closed) {
+            throw new ClientClosedError();
+          }
+          if (!isResumableStreamingStdinError(err)) {
             throw err;
           }
-        }();
-        for await (const chunk of chunks) {
-          for (let i = 0; i < chunk.length; i += chunkSize) {
-            const data = chunk.subarray(i, i + chunkSize);
-            if (data.length === 0) continue;
-            bytesRead += data.length;
-            yield TaskExecStdinWriteStreamRequest.create({ data });
+          attempt++;
+          if (attempt > maxResumeAttempts) {
+            throw err;
           }
-        }
-        sourceExhausted = true;
-        yield TaskExecStdinWriteStreamRequest.create({ end: {} });
-      };
-      try {
-        await this.stub.taskExecStdinWriteStream(requests());
-        return bytesRead;
-      } catch (err) {
-        if (sourceError !== void 0) {
-          throw sourceError;
-        }
-        if (err instanceof ClientError6 && err.code === Status6.CANCELLED && this.closed) {
-          throw new ClientClosedError();
-        }
-        if (!isResumableStreamingStdinError(err)) {
-          throw err;
-        }
-        attempt++;
-        if (attempt > maxResumeAttempts) {
-          throw err;
-        }
-        if (err instanceof ClientError6 && err.code === Status6.UNAUTHENTICATED) {
-          await this.refreshJwt();
-        }
-        const status = await this.execStdinStatus(taskId, execId);
-        if (status.closed) {
-          if (sourceExhausted && status.numBytesWritten === bytesRead) {
-            this.logger.debug(
-              "execStdinWriteStream completed but response was lost",
-              "error",
-              err
-            );
-            return bytesRead;
+          if (err instanceof ClientError6 && err.code === Status6.UNAUTHENTICATED) {
+            await this.refreshJwt();
+          }
+          const status = await callWithRetriesOnTransientErrors(
+            () => this.callWithAuthRetry(
+              () => this.stub.taskExecStdinStatus(
+                TaskExecStdinStatusRequest.create({ taskId, execId })
+              )
+            ),
+            10,
+            2,
+            10,
+            null,
+            () => this.closed
+          );
+          if (status.closed) {
+            if (sourceExhausted && status.numBytesWritten === bytesRead) {
+              this.logger.debug(
+                "execStdinWriteStream completed but response was lost",
+                "error",
+                err
+              );
+              return bytesRead;
+            }
+            throw err;
+          }
+          offset = status.numBytesWritten;
+          this.logger.debug(
+            "execStdinWriteStream resuming after error",
+            "offset",
+            offset,
+            "error",
+            err
+          );
+        } finally {
+          if (this.liveStreams.delete(abort)) {
+            abort.abort();
           }
-          throw err;
         }
-        offset = status.numBytesWritten;
-        this.logger.debug(
-          "execStdinWriteStream resuming after error",
-          "offset",
-          offset,
-          "error",
-          err
-        );
       }
+    } finally {
+      this.endOp();
     }
   }
   async execPoll(taskId, execId, deadline = null) {
@@ -64255,7 +66127,7 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
       throw new Error(`Deadline exceeded while polling for exec ${execId}`);
     }
     try {
-      return await callWithRetriesOnTransientErrors(
+      return await this.callWithRetries(
         () => this.callWithAuthRetry(() => this.stub.taskExecPoll(request)),
         10,
         // baseDelayMs
@@ -64280,7 +66152,7 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
       throw new Error(`Deadline exceeded while waiting for exec ${execId}`);
     }
     try {
-      return await callWithRetriesOnTransientErrors(
+      return await this.callWithRetries(
         () => this.callWithAuthRetry(
           () => this.stub.taskExecWait(request, {
             timeoutMs: 6e4
@@ -64309,7 +66181,7 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
   async snapshotDirectory(request, options) {
     const overallDeadlineMs = options?.timeoutMs !== void 0 ? Date.now() + options.timeoutMs : null;
     try {
-      return await callWithRetriesOnTransientErrors(
+      return await this.callWithRetries(
         () => this.callWithAuthRetry(() => {
           const remainingMs = overallDeadlineMs !== null ? Math.max(1, overallDeadlineMs - Date.now()) : options?.timeoutMs;
           return this.stub.taskSnapshotDirectory(request, {
@@ -64334,7 +66206,7 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
   async snapshotFilesystem(request, options) {
     const overallDeadlineMs = options?.timeoutMs !== void 0 ? Date.now() + options.timeoutMs : null;
     try {
-      return await callWithRetriesOnTransientErrors(
+      return await this.callWithRetries(
         () => this.callWithAuthRetry(() => {
           const remainingMs = overallDeadlineMs !== null ? Math.max(1, overallDeadlineMs - Date.now()) : options?.timeoutMs;
           return this.stub.taskSnapshotFilesystem(request, {
@@ -64359,7 +66231,7 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
   async snapshotMemory(request, options) {
     const overallDeadlineMs = options?.timeoutMs !== void 0 ? Date.now() + options.timeoutMs : null;
     try {
-      return await callWithRetriesOnTransientErrors(
+      return await this.callWithRetries(
         () => this.callWithAuthRetry(() => {
           const remainingMs = overallDeadlineMs !== null ? Math.max(1, overallDeadlineMs - Date.now()) : options?.timeoutMs;
           return this.stub.taskSnapshotMemory(request, {
@@ -64396,7 +66268,7 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
   async reloadVolumes(request, options) {
     const overallDeadlineMs = options?.timeoutMs !== void 0 ? Date.now() + options.timeoutMs : null;
     try {
-      await callWithRetriesOnTransientErrors(
+      await this.callWithRetries(
         () => this.callWithAuthRetry(() => {
           const remainingMs = overallDeadlineMs !== null ? Math.max(1, overallDeadlineMs - Date.now()) : options?.timeoutMs;
           return this.stub.taskReloadVolumes(request, {
@@ -64418,10 +66290,32 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
       throw err;
     }
   }
+  async *sandboxStdioReadV2(taskId, fileDescriptor, signal) {
+    let srFd;
+    if (fileDescriptor === 1 /* FILE_DESCRIPTOR_STDOUT */) {
+      srFd = 0 /* SANDBOX_STDIO_FILE_DESCRIPTOR_STDOUT */;
+    } else if (fileDescriptor === 2 /* FILE_DESCRIPTOR_STDERR */) {
+      srFd = 1 /* SANDBOX_STDIO_FILE_DESCRIPTOR_STDERR */;
+    } else if (fileDescriptor === 3 /* FILE_DESCRIPTOR_INFO */ || fileDescriptor === 0 /* FILE_DESCRIPTOR_UNSPECIFIED */) {
+      throw new Error(`Unsupported file descriptor: ${fileDescriptor}`);
+    } else {
+      throw new Error(`Invalid file descriptor: ${fileDescriptor}`);
+    }
+    yield* this.streamSandboxStdio(taskId, srFd, signal);
+  }
+  async sandboxStdinWriteV2(taskId, offset, data, eof) {
+    const request = SandboxStdinWriteV2Request.create({
+      taskId,
+      offset,
+      data,
+      eof
+    });
+    return await this.callUnary(() => this.stub.sandboxStdinWriteV2(request));
+  }
   async sandboxWaitUntilReady(taskId, timeoutMs) {
     const deadlineMs = Date.now() + timeoutMs;
     try {
-      return await callWithRetriesOnTransientErrors(
+      return await this.callWithRetries(
         () => this.callWithAuthRetry(() => {
           const remainingMs = Math.max(1, deadlineMs - Date.now());
           const request = SandboxWaitUntilReadyTcrRequest.create({
@@ -64480,6 +66374,7 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
       throw error;
     }
   }
+  /** The caller holds an operation lease across authentication and all retries. */
   async callWithAuthRetry(func) {
     try {
       return await func();
@@ -64491,68 +66386,133 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
       throw err;
     }
   }
-  async *streamStdio(taskId, execId, fileDescriptor, deadline) {
-    let offset = 0;
-    let delayMs = 10;
+  /**
+   * Yields the next chunk of stdio, opening or reopening the stream as it needs
+   * to, and determining whether or not to retry a failed open or read. It waits
+   * out the backoff itself.
+   */
+  async *streamStdioWithRetries(spec) {
+    const baseDelayMs = 10;
     const delayFactor = 2;
-    let numRetriesRemaining = 10;
+    const maxRetries = 10;
+    let offset = 0;
+    let delayMs = baseDelayMs;
+    let numRetriesRemaining = maxRetries;
     let didAuthRetry = false;
-    while (true) {
-      try {
-        const timeoutMs = deadline !== null ? Math.max(0, deadline - Date.now()) : void 0;
-        const request = TaskExecStdioReadRequest.create({
-          taskId,
-          execId,
-          offset,
-          fileDescriptor
-        });
-        const stream = this.stub.taskExecStdioRead(request, {
-          timeoutMs
-        });
+    let generation = this.beginOp();
+    let leased = true;
+    try {
+      attempts: while (true) {
+        spec.signal?.throwIfAborted();
+        const abort = new AbortController();
+        const abortWithCaller = () => abort.abort();
+        spec.signal?.addEventListener("abort", abortWithCaller, { once: true });
         try {
-          for await (const item of stream) {
-            if (didAuthRetry) {
-              didAuthRetry = false;
+          const streamGeneration = generation;
+          this.liveStreams.add(abort);
+          const stream = spec.open(offset, abort.signal);
+          try {
+            const items = stream[Symbol.asyncIterator]();
+            let firstOfAttempt = true;
+            while (true) {
+              if (generation !== streamGeneration) {
+                continue attempts;
+              }
+              const next = await items.next();
+              if (next.done) {
+                return;
+              }
+              const item = next.value;
+              if (didAuthRetry) {
+                didAuthRetry = false;
+              }
+              delayMs = baseDelayMs;
+              numRetriesRemaining = maxRetries;
+              offset = spec.nextOffset(item, offset, firstOfAttempt);
+              firstOfAttempt = false;
+              this.endOp();
+              leased = false;
+              yield item;
+              generation = this.beginOp();
+              leased = true;
             }
-            delayMs = 10;
-            offset += item.data.length;
-            yield item;
+          } catch (err) {
+            if (err instanceof ClientError6 && err.code === Status6.UNAUTHENTICATED && !didAuthRetry) {
+              await this.refreshJwt();
+              didAuthRetry = true;
+              continue;
+            }
+            throw err;
           }
-          return;
         } catch (err) {
-          if (err instanceof ClientError6 && err.code === Status6.UNAUTHENTICATED && !didAuthRetry) {
-            await this.refreshJwt();
-            didAuthRetry = true;
-            continue;
+          if (spec.signal?.aborted) {
+            throw err;
           }
-          throw err;
-        }
-      } catch (err) {
-        if (err instanceof ClientError6 && err.code === Status6.CANCELLED && this.closed) {
-          throw new ClientClosedError();
-        }
-        if (err instanceof ClientError6 && RETRYABLE_GRPC_STATUS_CODES.has(err.code) && numRetriesRemaining > 0) {
-          if (deadline && deadline - Date.now() <= delayMs) {
-            throw new Error(
-              `Deadline exceeded while streaming stdio for exec ${execId}`
+          if (err instanceof ClientError6 && err.code === Status6.CANCELLED && this.closed) {
+            throw new ClientClosedError();
+          }
+          if (err instanceof ClientError6 && RETRYABLE_GRPC_STATUS_CODES.has(err.code) && numRetriesRemaining > 0) {
+            if (spec.deadline && spec.deadline - Date.now() <= delayMs) {
+              throw new Error(
+                `Deadline exceeded while streaming stdio for ${spec.label}`
+              );
+            }
+            this.logger.debug(
+              "Retrying stdio read with delay",
+              "delay_ms",
+              delayMs,
+              "error",
+              err
             );
+            await setTimeout2(delayMs, void 0, { signal: spec.signal });
+            delayMs *= delayFactor;
+            numRetriesRemaining--;
+          } else {
+            throw err;
+          }
+        } finally {
+          spec.signal?.removeEventListener("abort", abortWithCaller);
+          if (this.liveStreams.delete(abort)) {
+            abort.abort();
           }
-          this.logger.debug(
-            "Retrying stdio read with delay",
-            "delay_ms",
-            delayMs,
-            "error",
-            err
-          );
-          await setTimeout2(delayMs);
-          delayMs *= delayFactor;
-          numRetriesRemaining--;
-        } else {
-          throw err;
         }
       }
+    } finally {
+      if (leased) this.endOp();
     }
   }
+  streamExecStdio(taskId, execId, fileDescriptor, deadline, signal) {
+    return this.streamStdioWithRetries({
+      open: (offset, signal2) => this.stub.taskExecStdioRead(
+        TaskExecStdioReadRequest.create({
+          taskId,
+          execId,
+          offset,
+          fileDescriptor
+        }),
+        {
+          timeoutMs: deadline !== null ? Math.max(0, deadline - Date.now()) : void 0,
+          signal: signal2
+        }
+      ),
+      nextOffset: (item, offset) => offset + item.data.length,
+      deadline,
+      label: `exec ${execId}`,
+      signal
+    });
+  }
+  streamSandboxStdio(taskId, fileDescriptor, signal) {
+    return this.streamStdioWithRetries({
+      open: (offset, signal2) => this.stub.sandboxStdioReadV2(
+        SandboxStdioReadV2Request.create({ taskId, offset, fileDescriptor }),
+        { signal: signal2 }
+      ),
+      nextOffset: (item, offset, firstOfAttempt) => (firstOfAttempt ? item.startingOffset : offset) + item.data.length,
+      deadline: null,
+      label: `Sandbox task ${taskId}`,
+      signal
+    });
+  }
 };
 async function getCommandRouterAccess(serverClient, taskId, sandboxId, isV2) {
   if (isV2) {
@@ -64568,7 +66528,7 @@ async function getCommandRouterAccess(serverClient, taskId, sandboxId, isV2) {
 }
 
 // src/sandbox.ts
-import { v4 as uuidv4 } from "uuid";
+import { v4 as uuidv42 } from "uuid";
 
 // src/sandbox_fs.ts
 import { randomBytes } from "node:crypto";
@@ -65482,6 +67442,7 @@ var SandboxFilesystem = class {
 
 // src/sandbox_sidecar.ts
 import { ClientError as ClientError9, Status as Status9 } from "nice-grpc";
+import { v4 as uuidv4 } from "uuid";
 var MAIN_CONTAINER_NAME = "main";
 var CONTAINER_WAIT_POLL_TIMEOUT_SECONDS = 10;
 function validateSidecarName(name) {
@@ -65696,6 +67657,10 @@ var SidecarContainer = class {
       return this.wait();
     }
   }
+  /** Snapshot this Sidecar container's filesystem into an Image. */
+  async snapshotFilesystem(params) {
+    return this.#access.snapshotFilesystem(this.containerId, params);
+  }
   /**
    * Reload all Volumes mounted in this sidecar container.
    *
@@ -65705,6 +67670,80 @@ var SidecarContainer = class {
   async reloadVolumes(params) {
     await this.#access.reloadVolumes(this.containerId, params);
   }
+  /**
+   * Mount an {@link Image} at a path in this Sidecar container's filesystem.
+   *
+   * @param path - The path where the directory should be mounted
+   * @param image - Optional {@link Image} to mount. If undefined, mounts an empty directory.
+   * @param params - Optional parameters; see {@link SidecarMountImageParams}.
+   */
+  async mountImage(path2, image, params) {
+    const imageId = resolveMountImageId(image);
+    const [taskId, client] = await this.#access.commandRouter();
+    await client.mountDirectory(
+      buildTaskMountDirectoryRequestProto(
+        taskId,
+        path2,
+        imageId,
+        params,
+        this.containerId
+      )
+    );
+  }
+  /**
+   * Unmounts an {@link Image} previously mounted at a path in this Sidecar container's filesystem.
+   *
+   * @param path - The mount path to unmount
+   */
+  async unmountImage(path2, _params) {
+    const [taskId, client] = await this.#access.commandRouter();
+    await client.unmountDirectory(
+      TaskUnmountDirectoryRequest.create({
+        taskId,
+        path: new TextEncoder().encode(path2),
+        containerId: this.containerId
+      })
+    );
+  }
+  /**
+   * Snapshots and creates a new {@link Image} from a directory in the running Sidecar container.
+   *
+   * The resulting Image is retained for `ttlMs` (default: 30 days),
+   * as a hard cutoff measured from creation — usage does not extend
+   * the lifetime. Pass `ttlMs: null` to retain indefinitely.
+   *
+   * The call has an overall `timeoutMs` budget (default: 55000). If it
+   * elapses before a snapshot completes, the call is cancelled and an
+   * error is thrown.
+   *
+   * The Image can be used anywhere an Image is accepted, including as a mount
+   * or as the base filesystem for another container.
+   *
+   * @param path - The path of the directory to snapshot
+   * @param params - Optional parameters; see {@link SidecarSnapshotDirectoryParams}.
+   * @returns Promise that resolves to an {@link Image}
+   */
+  async snapshotDirectory(path2, params) {
+    const timeoutMs = params?.timeoutMs || 55e3;
+    const [taskId, client] = await this.#access.commandRouter();
+    const response = await client.snapshotDirectory(
+      buildTaskSnapshotDirectoryRequestProto(
+        taskId,
+        path2,
+        uuidv4(),
+        resolveTtlSeconds(params?.ttlMs),
+        params,
+        this.containerId
+      ),
+      { timeoutMs }
+    );
+    if (!response.imageId) {
+      throw new InternalFailure(
+        "Sidecar snapshot directory response missing `imageId`"
+      );
+    }
+    return new Image2(this.#access.client, response.imageId, "");
+  }
 };
 
 // src/streams.ts
@@ -65725,7 +67764,7 @@ var readMixin = {
         if (value) {
           if (typeof value === "string") chunks.push(value);
           else {
-            chunks.push(decoder2.decode(value.buffer, { stream: true }));
+            chunks.push(decoder2.decode(value, { stream: true }));
           }
         }
         if (done) {
@@ -65810,12 +67849,26 @@ function streamConsumingIter(iterable, onCancel) {
         }
       }
     },
-    new ByteLengthQueuingStrategy({
-      highWaterMark: 64 * 1024
-      // 64 KiB
-    })
+    // The high water mark is set to zero intentionally to not run any
+    // background buffering of data, since that would eagerly start streams etc.
+    // If users want a buffered stream they can add buffing on top of the returned
+    // streams instead.
+    new CountQueuingStrategy({ highWaterMark: 0 })
   );
 }
+async function* decodeTextIter(source) {
+  const decoder2 = new TextDecoder();
+  for await (const chunk of source) {
+    const text = decoder2.decode(chunk, { stream: true });
+    if (text) {
+      yield text;
+    }
+  }
+  const rest = decoder2.decode();
+  if (rest) {
+    yield rest;
+  }
+}
 
 // src/sandbox_snapshot.ts
 var SandboxSnapshot = class {
@@ -66368,6 +68421,9 @@ var SandboxService = class {
    * Create a new {@link Sandbox} in the {@link App} with the specified {@link Image} and options.
    */
   async create(app, image, params = {}) {
+    if (this.#client.profile.sandboxV2 && !params.gpu) {
+      return await this.experimentalCreate(app, image, params);
+    }
     await image.build(app);
     const mergedSecrets = await mergeEnvIntoSecrets(
       this.#client,
@@ -66495,6 +68551,13 @@ var SandboxService = class {
    * @returns Promise that resolves to a Sandbox
    */
   async fromName(appName, name, params) {
+    if (this.#client.profile.sandboxV2) {
+      try {
+        return await this.experimentalFromName(appName, name, params);
+      } catch (err) {
+        if (!(err instanceof NotFoundError)) throw err;
+      }
+    }
     try {
       const resp = await this.#client.cpClient.sandboxGetFromName({
         sandboxName: name,
@@ -66593,6 +68656,10 @@ var SandboxService = class {
    * If tags are specified, only Sandboxes that have at least those tags are returned.
    */
   async *list(params = {}) {
+    if (this.#client.profile.sandboxV2) {
+      yield* this.experimentalList(params);
+      return;
+    }
     const env = this.#client.environmentName(params.environment);
     const tagsList = params.tags ? Object.entries(params.tags).map(([tagName, tagValue]) => ({
       tagName,
@@ -66649,20 +68716,27 @@ var SandboxService = class {
     })) : [];
     let beforeTimestamp = void 0;
     while (true) {
-      const resp = await this.#client.cpClient.sandboxListV2({
-        appId: params.appId,
-        beforeTimestamp,
-        environmentName,
-        includeFinished: false,
-        tags: tagsList
-      });
-      if (!resp.sandboxes || resp.sandboxes.length === 0) {
-        return;
-      }
-      for (const info of resp.sandboxes) {
-        yield new Sandbox2(this.#client, info.id);
+      try {
+        const resp = await this.#client.cpClient.sandboxListV2({
+          appId: params.appId,
+          beforeTimestamp,
+          environmentName,
+          includeFinished: false,
+          tags: tagsList
+        });
+        if (!resp.sandboxes || resp.sandboxes.length === 0) {
+          return;
+        }
+        for (const info of resp.sandboxes) {
+          yield new Sandbox2(this.#client, info.id);
+        }
+        beforeTimestamp = resp.sandboxes[resp.sandboxes.length - 1].createdAt;
+      } catch (err) {
+        if (err instanceof ClientError11 && err.code === Status11.INVALID_ARGUMENT) {
+          throw new InvalidError(err.details || err.message);
+        }
+        throw err;
       }
-      beforeTimestamp = resp.sandboxes[resp.sandboxes.length - 1].createdAt;
     }
   }
 };
@@ -66794,17 +68868,26 @@ function buildTaskExecStartRequestProto(taskId, execId, command, params, contain
     containerId: containerId ?? ""
   });
 }
-function buildTaskMountDirectoryRequestProto(taskId, path2, imageId, params) {
+function buildTaskMountDirectoryRequestProto(taskId, path2, imageId, params, containerId = "") {
   return TaskMountDirectoryRequest.create({
     taskId,
     path: new TextEncoder().encode(path2),
     imageId,
     customerSuppliedEncryptionKey: validateExperimentalEncryptionKey(
       params?.experimentalEncryptionKey
-    )
+    ),
+    containerId
   });
 }
-function buildTaskSnapshotDirectoryRequestProto(taskId, path2, snapshotId, ttlSeconds, params) {
+function resolveMountImageId(image) {
+  if (image && !image.imageId) {
+    throw new Error(
+      "Image must be built before mounting. Call `image.build(app)` first."
+    );
+  }
+  return image?.imageId ?? "";
+}
+function buildTaskSnapshotDirectoryRequestProto(taskId, path2, snapshotId, ttlSeconds, params, containerId = "") {
   return TaskSnapshotDirectoryRequest.create({
     taskId,
     path: new TextEncoder().encode(path2),
@@ -66812,7 +68895,8 @@ function buildTaskSnapshotDirectoryRequestProto(taskId, path2, snapshotId, ttlSe
     ttlSeconds,
     customerSuppliedEncryptionKey: validateExperimentalEncryptionKey(
       params?.experimentalEncryptionKey
-    )
+    ),
+    containerId
   });
 }
 var Sandbox2 = class _Sandbox {
@@ -66821,8 +68905,6 @@ var Sandbox2 = class _Sandbox {
   #stdin;
   #stdout;
   #stderr;
-  #stdoutAbort;
-  #stderrAbort;
   #taskId;
   #tunnels;
   #isV2;
@@ -66847,51 +68929,57 @@ var Sandbox2 = class _Sandbox {
     this.#initCommandRouterAccess = params.initCommandRouterAccess;
   }
   get stdin() {
-    this.#ensureV1("stdin");
     if (!this.#stdin) {
       this.#stdin = toModalWriteStream(
-        inputStreamSb(this.#client.cpClient, this.sandboxId)
+        this.#isV2 ? inputStreamSbV2(() => this.#getCommandRouter()) : inputStreamSb(this.#client.cpClient, this.sandboxId)
       );
     }
     return this.#stdin;
   }
   get stdout() {
-    this.#ensureV1("stdout");
     if (!this.#stdout) {
-      this.#stdoutAbort = new AbortController();
-      const bytesStream = streamConsumingIter(
-        outputStreamSb(
-          this.#client.cpClient,
-          this.sandboxId,
-          1 /* FILE_DESCRIPTOR_STDOUT */,
-          this.#stdoutAbort.signal
-        ),
-        () => this.#stdoutAbort?.abort()
-      );
-      this.#stdout = toModalReadStream(
-        bytesStream.pipeThrough(new TextDecoderStream())
-      );
+      this.#stdout = this.#outputStream(1 /* FILE_DESCRIPTOR_STDOUT */);
     }
     return this.#stdout;
   }
   get stderr() {
-    this.#ensureV1("stderr");
     if (!this.#stderr) {
-      this.#stderrAbort = new AbortController();
-      const bytesStream = streamConsumingIter(
+      this.#stderr = this.#outputStream(2 /* FILE_DESCRIPTOR_STDERR */);
+    }
+    return this.#stderr;
+  }
+  #outputStream(fileDescriptor) {
+    if (this.#isV2) {
+      this.#ensureAttached();
+      const v2Abort = new AbortController();
+      return toModalReadStream(
+        streamConsumingIter(
+          decodeTextIter(
+            outputStreamSbV2(
+              () => this.#getCommandRouter(v2Abort.signal),
+              this.sandboxId,
+              fileDescriptor,
+              this.#client.logger,
+              v2Abort.signal
+            )
+          ),
+          () => v2Abort.abort()
+        )
+      );
+    }
+    const abort = new AbortController();
+    return toModalReadStream(
+      streamConsumingIter(
         outputStreamSb(
           this.#client.cpClient,
           this.sandboxId,
-          2 /* FILE_DESCRIPTOR_STDERR */,
-          this.#stderrAbort.signal
+          fileDescriptor,
+          this.#client.profile.sandboxChannelIdleTimeoutMs,
+          abort.signal
         ),
-        () => this.#stderrAbort?.abort()
-      );
-      this.#stderr = toModalReadStream(
-        bytesStream.pipeThrough(new TextDecoderStream())
-      );
-    }
-    return this.#stderr;
+        () => abort.abort()
+      )
+    );
   }
   get filesystem() {
     this.#ensureAttached();
@@ -66915,7 +69003,8 @@ var Sandbox2 = class _Sandbox {
         client: this.#client,
         exec: (command, params, containerId) => this.#execInternal(command, params, containerId),
         commandRouter: () => this.#getCommandRouter(),
-        reloadVolumes: (containerId, params) => this.#reloadVolumes(containerId, params)
+        reloadVolumes: (containerId, params) => this.#reloadVolumes(containerId, params),
+        snapshotFilesystem: (containerId, params) => this.#snapshotFilesystem(containerId, params)
       });
     }
     return this.#sidecars;
@@ -67035,7 +69124,7 @@ var Sandbox2 = class _Sandbox {
       secrets: resolvableSecrets
     };
     const [taskId, commandRouterClient] = await this.#getCommandRouter();
-    const execId = uuidv4();
+    const execId = uuidv42();
     const request = buildTaskExecStartRequestProto(
       taskId,
       execId,
@@ -67064,9 +69153,9 @@ var Sandbox2 = class _Sandbox {
       deadline
     );
   }
-  async #getCommandRouter() {
+  async #getCommandRouter(signal) {
     this.#ensureAttached();
-    const taskId = await this.#getTaskId();
+    const taskId = await this.#getTaskId(signal);
     const client = await this.#getOrCreateCommandRouterClient(taskId);
     return [taskId, client];
   }
@@ -67075,13 +69164,6 @@ var Sandbox2 = class _Sandbox {
       throw new ClientClosedError();
     }
   }
-  #ensureV1(methodName) {
-    if (this.#isV2) {
-      throw new InvalidError(
-        `Sandbox.${methodName} is not supported for V2 sandboxes`
-      );
-    }
-  }
   #ensureV2(methodName) {
     if (!this.#isV2) {
       throw new InvalidError(
@@ -67096,12 +69178,12 @@ var Sandbox2 = class _Sandbox {
     }
     return this.#client.cpClient.sandboxWait(req);
   }
-  #sandboxGetTaskId() {
+  #sandboxGetTaskId(signal) {
     const req = { sandboxId: this.sandboxId };
     if (this.#isV2) {
-      return this.#client.cpClient.sandboxGetTaskIdV2(req);
+      return this.#client.cpClient.sandboxGetTaskIdV2(req, { signal });
     }
-    return this.#client.cpClient.sandboxGetTaskId(req);
+    return this.#client.cpClient.sandboxGetTaskId(req, { signal });
   }
   #sandboxGetTunnels(timeoutMs) {
     const req = { sandboxId: this.sandboxId, timeout: timeoutMs / 1e3 };
@@ -67127,12 +69209,16 @@ var Sandbox2 = class _Sandbox {
   }
   static #maxGetTaskIdAttempts = 600;
   // 5 minutes at 500ms intervals
-  async #getTaskId() {
+  async #getTaskId(signal) {
     if (this.#taskId !== void 0) {
       return this.#taskId;
     }
     for (let i = 0; i < _Sandbox.#maxGetTaskIdAttempts; i++) {
-      const resp = await this.#sandboxGetTaskId();
+      const resp = await this.#sandboxGetTaskId(signal);
+      if (resp.taskId) {
+        this.#taskId = resp.taskId;
+        return this.#taskId;
+      }
       if (resp.taskResult) {
         if (resp.taskResult.status === 1 /* GENERIC_STATUS_SUCCESS */ || !resp.taskResult.exception) {
           throw new Error(`Sandbox ${this.sandboxId} has already completed`);
@@ -67141,11 +69227,7 @@ var Sandbox2 = class _Sandbox {
           `Sandbox ${this.sandboxId} has already completed with result: exception:"${resp.taskResult.exception}"`
         );
       }
-      if (resp.taskId) {
-        this.#taskId = resp.taskId;
-        return this.#taskId;
-      }
-      await setTimeout3(500);
+      await setTimeout3(500, void 0, { signal });
     }
     throw new Error(
       `Timed out waiting for task ID for Sandbox ${this.sandboxId}`
@@ -67218,18 +69300,19 @@ var Sandbox2 = class _Sandbox {
     if (params?.wait) {
       exitCode = await this.wait();
     }
-    this.#taskId = void 0;
-    this.detach();
     return exitCode;
   }
   /**
    * Disconnect from the Sandbox, cleaning up local resources.
    * The Sandbox continues running on Modal's infrastructure.
    * After calling detach(), most operations on this Sandbox object will throw.
+   *
+   * This does not block on or interrupt ongoing reads or calls. Connection
+   * resources are closed promptly once those operations finish.
    */
   detach() {
-    this.#commandRouterClient?.close();
     this.#attached = false;
+    this.#commandRouterClient?.closeWhenIdle();
     this.#commandRouterClient = void 0;
     this.#commandRouterClientPromise = void 0;
   }
@@ -67308,13 +69391,17 @@ var Sandbox2 = class _Sandbox {
    */
   async snapshotFilesystem(params) {
     this.#ensureAttached();
+    return this.#snapshotFilesystem("", params);
+  }
+  async #snapshotFilesystem(containerId, params) {
     const wireTtlSeconds = resolveTtlSeconds(params?.ttlMs);
     const timeoutMs = params?.timeoutMs || 55e3;
     const [taskId, commandRouterClient] = await this.#getCommandRouter();
     const request = TaskSnapshotFilesystemRequest.create({
       taskId,
-      snapshotId: uuidv4(),
-      ttlSeconds: wireTtlSeconds
+      snapshotId: uuidv42(),
+      ttlSeconds: wireTtlSeconds,
+      containerId
     });
     const response = await commandRouterClient.snapshotFilesystem(request, {
       timeoutMs
@@ -67327,13 +69414,39 @@ var Sandbox2 = class _Sandbox {
   /**
    * Get the exit filesystem snapshot image.
    *
+   * An exit snapshot captures the Sandbox filesystem when the Sandbox exits,
+   * whether its entrypoint finishes gracefully, abruptly, or it is stopped with
+   * {@link Sandbox#terminate}. The resulting {@link Image} can be passed to
+   * {@link SandboxService#create client.sandboxes.create()} to start a new
+   * Sandbox from the saved filesystem.
+   *
+   * Exit snapshots are opt-in: the Sandbox must have been created with
+   * `experimentalOptions: { enable_exit_snapshot: true }`. Calling this on a
+   * Sandbox created without that option throws an {@link InvalidError}.
+   *
+   * @example
+   * ```ts
+   * const sb = await modal.sandboxes.create(app, image, {
+   *   experimentalOptions: { enable_exit_snapshot: true },
+   * });
+   * // ... use the Sandbox ...
+   * await sb.terminate();
+   * const image = await sb.experimentalGetExitSnapshot();
+   * const sb2 = await modal.sandboxes.create(app, image);
+   * ```
+   *
    * EXPERIMENTAL: the API is subject to change.
    *
    * @param params - Optional parameters; see SandboxExperimentalGetExitSnapshotParams.
    * @returns The exit snapshot Image.
+   * @throws {InvalidError} If `timeoutMs` is negative, or if exit snapshots
+   *   were not enabled when the Sandbox was created.
    * @throws {TimeoutError} If `timeoutMs` elapses before the snapshot
    *   reaches a terminal state. This includes `timeoutMs = 0` when the
    *   snapshot is still pending.
+   * @throws {SnapshotCreationError} Snapshot operation is done and failed.
+   *   Polling again will not produce an Image; filesystem state is gone.
+   * @throws {NotFoundError} If the Sandbox does not exist.
    */
   async experimentalGetExitSnapshot(params) {
     const timeoutMs = params?.timeoutMs;
@@ -67445,8 +69558,8 @@ var Sandbox2 = class _Sandbox {
     if (this.#isV2) {
       const [taskId, commandRouterClient] = await this.#getCommandRouter();
       const resp = await commandRouterClient.snapshotMemory(
-        TaskSnapshotMemoryRequest.create({ taskId, idempotencyKey: uuidv4() }),
-        { timeoutMs: 55e3 }
+        TaskSnapshotMemoryRequest.create({ taskId, idempotencyKey: uuidv42() }),
+        { timeoutMs: 165e3 }
       );
       snapshotId = resp.snapshotId;
     } else {
@@ -67475,12 +69588,7 @@ var Sandbox2 = class _Sandbox {
   async mountImage(path2, image, params) {
     this.#ensureAttached();
     const [taskId, commandRouterClient] = await this.#getCommandRouter();
-    if (image && !image.imageId) {
-      throw new Error(
-        "Image must be built before mounting. Call `image.build(app)` first."
-      );
-    }
-    const imageId = image?.imageId ?? "";
+    const imageId = resolveMountImageId(image);
     const request = buildTaskMountDirectoryRequestProto(
       taskId,
       path2,
@@ -67576,7 +69684,7 @@ var Sandbox2 = class _Sandbox {
     const request = buildTaskSnapshotDirectoryRequestProto(
       taskId,
       path2,
-      uuidv4(),
+      uuidv42(),
       wireTtlSeconds,
       params
     );
@@ -67619,35 +69727,28 @@ var ContainerProcess2 = class {
     this.stdin = toModalWriteStream(
       inputStreamCp(commandRouterClient, taskId, execId)
     );
-    const stdoutStream = stdout === "ignore" ? ReadableStream.from([]) : streamConsumingIter(
-      outputStreamCp(
+    const output = (behavior, fileDescriptor) => {
+      if (behavior === "ignore") {
+        return ReadableStream.from([]);
+      }
+      const abort = new AbortController();
+      const bytes = outputStreamCp(
         commandRouterClient,
         taskId,
         execId,
-        1 /* FILE_DESCRIPTOR_STDOUT */,
-        this.#deadline
-      )
+        fileDescriptor,
+        this.#deadline,
+        abort.signal
+      );
+      const stream = mode === "text" ? streamConsumingIter(decodeTextIter(bytes), () => abort.abort()) : streamConsumingIter(bytes, () => abort.abort());
+      return stream;
+    };
+    this.stdout = toModalReadStream(
+      output(stdout, 1 /* FILE_DESCRIPTOR_STDOUT */)
     );
-    const stderrStream = stderr === "ignore" ? ReadableStream.from([]) : streamConsumingIter(
-      outputStreamCp(
-        commandRouterClient,
-        taskId,
-        execId,
-        2 /* FILE_DESCRIPTOR_STDERR */,
-        this.#deadline
-      )
+    this.stderr = toModalReadStream(
+      output(stderr, 2 /* FILE_DESCRIPTOR_STDERR */)
     );
-    if (mode === "text") {
-      this.stdout = toModalReadStream(
-        stdoutStream.pipeThrough(new TextDecoderStream())
-      );
-      this.stderr = toModalReadStream(
-        stderrStream.pipeThrough(new TextDecoderStream())
-      );
-    } else {
-      this.stdout = toModalReadStream(stdoutStream);
-      this.stderr = toModalReadStream(stderrStream);
-    }
   }
   /**
    * @ignore
@@ -67710,12 +69811,20 @@ var ContainerProcess2 = class {
     }
   }
 };
-async function* outputStreamSb(cpClient, sandboxId, fileDescriptor, signal) {
+async function* outputStreamSb(cpClient, sandboxId, fileDescriptor, idleTimeoutMs, signal) {
   let lastIndex = "0-0";
   let completed = false;
   let retriesRemaining = SB_LOGS_MAX_RETRIES;
   let delayMs = SB_LOGS_INITIAL_DELAY_MS;
   while (!completed) {
+    if (signal?.aborted) return;
+    const idle = new IdleCountdown();
+    const idleAbort = new AbortController();
+    const releaseIfIdle = () => {
+      idle.stop();
+      idleAbort.abort();
+    };
+    const callSignal = signal === void 0 ? idleAbort.signal : AbortSignal.any([signal, idleAbort.signal]);
     try {
       const outputIterator = cpClient.sandboxGetLogs(
         {
@@ -67724,13 +69833,22 @@ async function* outputStreamSb(cpClient, sandboxId, fileDescriptor, signal) {
           timeout: 55,
           lastEntryId: lastIndex
         },
-        { signal }
+        { signal: callSignal }
       );
       for await (const batch of outputIterator) {
         delayMs = SB_LOGS_INITIAL_DELAY_MS;
         retriesRemaining = SB_LOGS_MAX_RETRIES;
         lastIndex = batch.entryId;
-        yield* batch.items.map((item) => new TextEncoder().encode(item.data));
+        for (const item of batch.items) {
+          if (!idleAbort.signal.aborted) {
+            idle.arm(idleTimeoutMs, releaseIfIdle);
+          }
+          try {
+            yield item.data;
+          } finally {
+            idle.stop();
+          }
+        }
         if (batch.eof) {
           completed = true;
           break;
@@ -67738,11 +69856,20 @@ async function* outputStreamSb(cpClient, sandboxId, fileDescriptor, signal) {
         if (signal?.aborted) {
           return;
         }
+        if (idleAbort.signal.aborted) {
+          break;
+        }
+      }
+      if (idleAbort.signal.aborted) {
+        continue;
       }
     } catch (err) {
       if (signal?.aborted) {
         return;
       }
+      if (idleAbort.signal.aborted) {
+        continue;
+      }
       if (isRetryableGrpc(err) && retriesRemaining > 0) {
         try {
           await setTimeout3(delayMs, void 0, { signal });
@@ -67755,7 +69882,37 @@ async function* outputStreamSb(cpClient, sandboxId, fileDescriptor, signal) {
       } else {
         throw err;
       }
+    } finally {
+      idle.stop();
+    }
+  }
+}
+async function* outputStreamSbV2(getCommandRouter, sandboxId, fileDescriptor, logger2, signal) {
+  const [taskId, commandRouterClient] = await getCommandRouter();
+  let firstChunk = true;
+  for await (const item of commandRouterClient.sandboxStdioReadV2(
+    taskId,
+    fileDescriptor,
+    signal
+  )) {
+    if (item.data.length === 0) {
+      throw new Error(
+        `Received empty message streaming stdio from Sandbox ${sandboxId}`
+      );
+    }
+    if (firstChunk) {
+      firstChunk = false;
+      if (item.startingOffset > 0) {
+        logger2.warn(
+          "V2 Sandbox stdio: dropped bytes. Only the most recent portion of output is retained",
+          "sandbox_id",
+          sandboxId,
+          "dropped_bytes",
+          item.startingOffset
+        );
+      }
     }
+    yield item.data;
   }
 }
 function inputStreamSb(cpClient, sandboxId) {
@@ -67778,12 +69935,40 @@ function inputStreamSb(cpClient, sandboxId) {
     }
   });
 }
-async function* outputStreamCp(commandRouterClient, taskId, execId, fileDescriptor, deadline) {
+function inputStreamSbV2(getCommandRouter) {
+  let offset = 0;
+  return new WritableStream({
+    async write(chunk) {
+      const [taskId, commandRouterClient] = await getCommandRouter();
+      const data = encodeIfString(chunk);
+      await commandRouterClient.sandboxStdinWriteV2(
+        taskId,
+        offset,
+        data,
+        false
+        // eof
+      );
+      offset += data.length;
+    },
+    async close() {
+      const [taskId, commandRouterClient] = await getCommandRouter();
+      await commandRouterClient.sandboxStdinWriteV2(
+        taskId,
+        offset,
+        new Uint8Array(0),
+        true
+        // eof
+      );
+    }
+  });
+}
+async function* outputStreamCp(commandRouterClient, taskId, execId, fileDescriptor, deadline, signal) {
   for await (const batch of commandRouterClient.execStdioRead(
     taskId,
     execId,
     fileDescriptor,
-    deadline
+    deadline,
+    signal
   )) {
     yield batch.data;
   }
@@ -68010,7 +70195,7 @@ var AuthTokenManager = class {
 };
 
 // src/version.ts
-var SDK_VERSION = "0.10.0";
+var SDK_VERSION = "0.10.1";
 function getSDKVersion() {
   return SDK_VERSION;
 }
@@ -68074,6 +70259,62 @@ var EnvironmentManager = class {
   }
 };
 
+// src/oauth.ts
+import {
+  createHash as createHash2,
+  createPrivateKey,
+  createPublicKey,
+  createSign
+} from "node:crypto";
+import { v4 as uuidv43 } from "uuid";
+var OAUTH_CLIENT_ASSERTION_AUDIENCE = "modal-server";
+var OAUTH_CLIENT_ASSERTION_LIFETIME_SECONDS = 5 * 60;
+var MIN_RSA_KEY_SIZE = 2048;
+var INVALID_KEY_MESSAGE = "oauth_jwt_key must be an unencrypted RSA private key encoded as PEM.";
+function parseOAuthJwtKey(privateKeyPem) {
+  let key;
+  try {
+    key = createPrivateKey(privateKeyPem.replaceAll("\\n", "\n"));
+  } catch {
+    throw new InvalidError(INVALID_KEY_MESSAGE);
+  }
+  if (key.asymmetricKeyType !== "rsa") {
+    throw new InvalidError(INVALID_KEY_MESSAGE);
+  }
+  if ((key.asymmetricKeyDetails?.modulusLength ?? 0) < MIN_RSA_KEY_SIZE) {
+    throw new InvalidError("oauth_jwt_key must be at least 2048 bits.");
+  }
+  return key;
+}
+function rsaJwkThumbprint(key) {
+  const publicKey = key.type === "public" ? key : createPublicKey(key);
+  const jwk = publicKey.export({ format: "jwk" });
+  const canonical = JSON.stringify({ e: jwk.e, kty: "RSA", n: jwk.n });
+  return createHash2("sha256").update(canonical).digest("base64url");
+}
+function base64UrlJson(value) {
+  return Buffer.from(JSON.stringify(value), "utf-8").toString("base64url");
+}
+function mintOAuthClientAssertion(clientId, key) {
+  const issuedAt = Math.floor(Date.now() / 1e3);
+  const header = base64UrlJson({
+    alg: "RS256",
+    typ: "JWT",
+    kid: rsaJwkThumbprint(key)
+  });
+  const payload = base64UrlJson({
+    iss: clientId,
+    sub: clientId,
+    aud: OAUTH_CLIENT_ASSERTION_AUDIENCE,
+    iat: issuedAt,
+    exp: issuedAt + OAUTH_CLIENT_ASSERTION_LIFETIME_SECONDS,
+    jti: uuidv43()
+  });
+  const signingInput = `${header}.${payload}`;
+  const signature = createSign("RSA-SHA256").update(signingInput).sign(key).toString("base64url");
+  return `${signingInput}.${signature}`;
+}
+
 // src/client.ts
 var ModalClient = class {
   apps;
@@ -68096,18 +70337,40 @@ var ModalClient = class {
   authTokenManager = null;
   customMiddleware;
   environmentManager;
+  oauthJwtKey;
   constructor(params) {
     checkForRenamedParams(params, { timeout: "timeoutMs" });
     const baseProfile = getProfile(process.env["MODAL_PROFILE"]);
+    const hasTokenParams = params?.tokenId !== void 0 || params?.tokenSecret !== void 0;
+    const hasOAuthParams = params?.oauthRefreshToken !== void 0 || params?.oauthClientId !== void 0 || params?.oauthClientSecret !== void 0 || params?.oauthJwtKey !== void 0;
     this.profile = {
       ...baseProfile,
-      ...params?.tokenId && { tokenId: params.tokenId },
-      ...params?.tokenSecret && { tokenSecret: params.tokenSecret },
       ...params?.environment && { environment: params.environment },
       ...params?.maxThrottleWaitSecs !== void 0 && {
         maxThrottleWaitSecs: params.maxThrottleWaitSecs
       }
     };
+    if (hasTokenParams) {
+      if (params?.tokenId !== void 0) {
+        this.profile.tokenId = params.tokenId;
+      }
+      if (params?.tokenSecret !== void 0) {
+        this.profile.tokenSecret = params.tokenSecret;
+      }
+      this.profile.oauthRefreshToken = void 0;
+      this.profile.oauthClientId = void 0;
+      this.profile.oauthClientSecret = void 0;
+      this.profile.oauthJwtKey = void 0;
+    } else if (hasOAuthParams) {
+      this.profile.tokenId = void 0;
+      this.profile.tokenSecret = void 0;
+      this.profile.oauthRefreshToken = params?.oauthRefreshToken;
+      this.profile.oauthClientId = params?.oauthClientId;
+      this.profile.oauthClientSecret = params?.oauthClientSecret;
+      this.profile.oauthJwtKey = params?.oauthJwtKey;
+    }
+    this.validateProfileCredentials(hasOAuthParams);
+    this.oauthJwtKey = this.profile.oauthJwtKey ? parseOAuthJwtKey(this.profile.oauthJwtKey) : void 0;
     const logLevelValue = params?.logLevel || this.profile.logLevel || "";
     this.logger = createLogger(params?.logger, logLevelValue);
     this.logger.debug(
@@ -68141,6 +70404,24 @@ var ModalClient = class {
   environmentName(environment) {
     return environment || this.profile.environment || "";
   }
+  validateProfileCredentials(hasExplicitOAuthCredentials) {
+    const hasTokenCredentials = Boolean(
+      this.profile.tokenId || this.profile.tokenSecret
+    );
+    const hasOAuthCredentials = hasExplicitOAuthCredentials || Boolean(
+      this.profile.oauthRefreshToken || this.profile.oauthClientId || this.profile.oauthClientSecret || this.profile.oauthJwtKey
+    );
+    if (hasTokenCredentials && hasOAuthCredentials) {
+      throw new InvalidError(
+        "Modal token credentials and OAuth credentials cannot both be configured."
+      );
+    }
+    if (hasOAuthCredentials && (!this.profile.oauthRefreshToken || !this.profile.oauthClientId || Boolean(this.profile.oauthClientSecret) === Boolean(this.profile.oauthJwtKey))) {
+      throw new InvalidError(
+        "OAuth refresh token, client ID, and exactly one of client secret or JWT key must all be configured."
+      );
+    }
+  }
   /**
    * Returns the image builder version by querying the server where the local profile takes
    * precedence.
@@ -68207,13 +70488,13 @@ var ModalClient = class {
         ...restOptions
       } = options;
       if (call.requestStream || call.responseStream || !retries) {
-        return yield* call.next(call.request, restOptions);
+        return yield* call.next(call.request, { ...restOptions, signal });
       }
       const retryableCodes = /* @__PURE__ */ new Set([
         ...retryableGrpcStatusCodes,
         ...additionalStatusCodes
       ]);
-      const idempotencyKey = uuidv42();
+      const idempotencyKey = uuidv44();
       const throttleEnabled = maxThrottleWaitSecs !== 0;
       const startTime = Date.now();
       let attempt = 0;
@@ -68358,13 +70639,16 @@ var ModalClient = class {
       }
       return this.authTokenManager;
     };
+    const oauthJwtKey = this.oauthJwtKey;
     return async function* authMiddleware(call, options) {
-      if (!profile.tokenId || !profile.tokenSecret) {
+      const hasOAuthCredentials = Boolean(
+        profile.oauthRefreshToken && profile.oauthClientId && (profile.oauthClientSecret || oauthJwtKey)
+      );
+      if (!hasOAuthCredentials && (!profile.tokenId || !profile.tokenSecret)) {
         throw new Error(
-          `Profile is missing token_id or token_secret. Please set them in .modal.toml, or as environment variables, or via ModalClient constructor.`
+          `Profile is missing credentials. Please set them in .modal.toml, as environment variables, or via the ModalClient constructor.`
         );
       }
-      const { tokenId, tokenSecret } = profile;
       options.metadata ??= new Metadata2();
       options.metadata.set(
         "x-modal-client-type",
@@ -68375,8 +70659,27 @@ var ModalClient = class {
         "x-modal-libmodal-version",
         `modal-js/${getSDKVersion()}`
       );
-      options.metadata.set("x-modal-token-id", tokenId);
-      options.metadata.set("x-modal-token-secret", tokenSecret);
+      if (hasOAuthCredentials) {
+        options.metadata.set(
+          "x-modal-refresh-token",
+          profile.oauthRefreshToken
+        );
+        options.metadata.set("x-modal-oauth-client-id", profile.oauthClientId);
+        if (oauthJwtKey) {
+          options.metadata.set(
+            "x-modal-oauth-client-assertion",
+            mintOAuthClientAssertion(profile.oauthClientId, oauthJwtKey)
+          );
+        } else {
+          options.metadata.set(
+            "x-modal-oauth-client-secret",
+            profile.oauthClientSecret
+          );
+        }
+      } else {
+        options.metadata.set("x-modal-token-id", profile.tokenId);
+        options.metadata.set("x-modal-token-secret", profile.tokenSecret);
+      }
       if (call.method.path !== "/modal.client.ModalClient/AuthTokenGet") {
         const tokenManager = getOrCreateAuthTokenManager();
         const token = await tokenManager.getToken();
@@ -68384,6 +70687,7 @@ var ModalClient = class {
           options.metadata.set("x-modal-auth-token", token);
         }
       }
+      options.signal?.throwIfAborted();
       return yield* call.next(call.request, options);
     };
   }