modal 0.10.2-dev.0 → 0.10.2-dev.2

package/dist/index.cjs

@@ -55,6 +55,7 @@ __export(index_exports, {
   InvalidError: () => InvalidError,
   ModalClient: () => ModalClient,
   NotFoundError: () => NotFoundError,
+  OutboundPolicy: () => OutboundPolicy2,
   Probe: () => Probe2,
   Proxy: () => Proxy3,
   ProxyService: () => ProxyService,
@@ -17731,7 +17732,8 @@ function createBaseEndpointCreateRequest() {
     inputModalities: [],
     environmentName: "",
     unauthenticated: false,
-    servingMode: 0
+    servingMode: 0,
+    sharedEndpointNoticeAcknowledged: false
   };
 }
 var EndpointCreateRequest = {
@@ -17770,6 +17772,9 @@ var EndpointCreateRequest = {
     if (message.servingMode !== 0) {
       writer.uint32(80).int32(message.servingMode);
     }
+    if (message.sharedEndpointNoticeAcknowledged !== false) {
+      writer.uint32(88).bool(message.sharedEndpointNoticeAcknowledged);
+    }
     return writer;
   },
   decode(input, length) {
@@ -17863,6 +17868,13 @@ var EndpointCreateRequest = {
           message.servingMode = reader.int32();
           continue;
         }
+        case 11: {
+          if (tag !== 88) {
+            break;
+          }
+          message.sharedEndpointNoticeAcknowledged = reader.bool();
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -17882,7 +17894,8 @@ var EndpointCreateRequest = {
       inputModalities: globalThis.Array.isArray(object?.inputModalities) ? object.inputModalities.map((e) => endpointInputModalityFromJSON(e)) : [],
       environmentName: isSet5(object.environmentName) ? globalThis.String(object.environmentName) : "",
       unauthenticated: isSet5(object.unauthenticated) ? globalThis.Boolean(object.unauthenticated) : false,
-      servingMode: isSet5(object.servingMode) ? endpointServingModeFromJSON(object.servingMode) : 0
+      servingMode: isSet5(object.servingMode) ? endpointServingModeFromJSON(object.servingMode) : 0,
+      sharedEndpointNoticeAcknowledged: isSet5(object.sharedEndpointNoticeAcknowledged) ? globalThis.Boolean(object.sharedEndpointNoticeAcknowledged) : false
     };
   },
   toJSON(message) {
@@ -17917,6 +17930,9 @@ var EndpointCreateRequest = {
     if (message.servingMode !== 0) {
       obj.servingMode = endpointServingModeToJSON(message.servingMode);
     }
+    if (message.sharedEndpointNoticeAcknowledged !== false) {
+      obj.sharedEndpointNoticeAcknowledged = message.sharedEndpointNoticeAcknowledged;
+    }
     return obj;
   },
   create(base) {
@@ -17934,6 +17950,7 @@ var EndpointCreateRequest = {
     message.environmentName = object.environmentName ?? "";
     message.unauthenticated = object.unauthenticated ?? false;
     message.servingMode = object.servingMode ?? 0;
+    message.sharedEndpointNoticeAcknowledged = object.sharedEndpointNoticeAcknowledged ?? false;
     return message;
   }
 };
@@ -22492,8 +22509,6 @@ function createBaseFunctionMessage() {
     cloudBucketMounts: [],
     schedulerPlacement: void 0,
     isClass: false,
-    useFunctionId: "",
-    useMethodName: "",
     classParameterInfo: void 0,
     batchMaxSize: 0,
     batchLingerMs: 0,
@@ -22664,12 +22679,6 @@ var FunctionMessage = {
     if (message.isClass !== false) {
       writer.uint32(424).bool(message.isClass);
     }
-    if (message.useFunctionId !== "") {
-      writer.uint32(434).string(message.useFunctionId);
-    }
-    if (message.useMethodName !== "") {
-      writer.uint32(442).string(message.useMethodName);
-    }
     if (message.classParameterInfo !== void 0) {
       ClassParameterInfo.encode(message.classParameterInfo, writer.uint32(450).fork()).join();
     }
@@ -23095,20 +23104,6 @@ var FunctionMessage = {
           message.isClass = reader.bool();
           continue;
         }
-        case 54: {
-          if (tag !== 434) {
-            break;
-          }
-          message.useFunctionId = reader.string();
-          continue;
-        }
-        case 55: {
-          if (tag !== 442) {
-            break;
-          }
-          message.useMethodName = reader.string();
-          continue;
-        }
         case 56: {
           if (tag !== 450) {
             break;
@@ -23441,8 +23436,6 @@ var FunctionMessage = {
       cloudBucketMounts: globalThis.Array.isArray(object?.cloudBucketMounts) ? object.cloudBucketMounts.map((e) => CloudBucketMount.fromJSON(e)) : [],
       schedulerPlacement: isSet5(object.schedulerPlacement) ? SchedulerPlacement.fromJSON(object.schedulerPlacement) : void 0,
       isClass: isSet5(object.isClass) ? globalThis.Boolean(object.isClass) : false,
-      useFunctionId: isSet5(object.useFunctionId) ? globalThis.String(object.useFunctionId) : "",
-      useMethodName: isSet5(object.useMethodName) ? globalThis.String(object.useMethodName) : "",
       classParameterInfo: isSet5(object.classParameterInfo) ? ClassParameterInfo.fromJSON(object.classParameterInfo) : void 0,
       batchMaxSize: isSet5(object.batchMaxSize) ? globalThis.Number(object.batchMaxSize) : 0,
       batchLingerMs: isSet5(object.batchLingerMs) ? globalThis.Number(object.batchLingerMs) : 0,
@@ -23619,12 +23612,6 @@ var FunctionMessage = {
     if (message.isClass !== false) {
       obj.isClass = message.isClass;
     }
-    if (message.useFunctionId !== "") {
-      obj.useFunctionId = message.useFunctionId;
-    }
-    if (message.useMethodName !== "") {
-      obj.useMethodName = message.useMethodName;
-    }
     if (message.classParameterInfo !== void 0) {
       obj.classParameterInfo = ClassParameterInfo.toJSON(message.classParameterInfo);
     }
@@ -23798,8 +23785,6 @@ var FunctionMessage = {
     message.cloudBucketMounts = object.cloudBucketMounts?.map((e) => CloudBucketMount.fromPartial(e)) || [];
     message.schedulerPlacement = object.schedulerPlacement !== void 0 && object.schedulerPlacement !== null ? SchedulerPlacement.fromPartial(object.schedulerPlacement) : void 0;
     message.isClass = object.isClass ?? false;
-    message.useFunctionId = object.useFunctionId ?? "";
-    message.useMethodName = object.useMethodName ?? "";
     message.classParameterInfo = object.classParameterInfo !== void 0 && object.classParameterInfo !== null ? ClassParameterInfo.fromPartial(object.classParameterInfo) : void 0;
     message.batchMaxSize = object.batchMaxSize ?? 0;
     message.batchLingerMs = object.batchLingerMs ?? 0;
@@ -25571,8 +25556,6 @@ function createBaseFunctionData() {
     isClass: false,
     classParameterInfo: void 0,
     isMethod: false,
-    useFunctionId: "",
-    useMethodName: "",
     rankedFunctions: [],
     schedule: void 0,
     untrusted: false,
@@ -25664,12 +25647,6 @@ var FunctionData = {
     if (message.isMethod !== false) {
       writer.uint32(120).bool(message.isMethod);
     }
-    if (message.useFunctionId !== "") {
-      writer.uint32(130).string(message.useFunctionId);
-    }
-    if (message.useMethodName !== "") {
-      writer.uint32(138).string(message.useMethodName);
-    }
     for (const v of message.rankedFunctions) {
       FunctionData_RankedFunction.encode(v, writer.uint32(146).fork()).join();
     }
@@ -25901,20 +25878,6 @@ var FunctionData = {
           message.isMethod = reader.bool();
           continue;
         }
-        case 16: {
-          if (tag !== 130) {
-            break;
-          }
-          message.useFunctionId = reader.string();
-          continue;
-        }
-        case 17: {
-          if (tag !== 138) {
-            break;
-          }
-          message.useMethodName = reader.string();
-          continue;
-        }
         case 18: {
           if (tag !== 146) {
             break;
@@ -26094,8 +26057,6 @@ var FunctionData = {
       isClass: isSet5(object.isClass) ? globalThis.Boolean(object.isClass) : false,
       classParameterInfo: isSet5(object.classParameterInfo) ? ClassParameterInfo.fromJSON(object.classParameterInfo) : void 0,
       isMethod: isSet5(object.isMethod) ? globalThis.Boolean(object.isMethod) : false,
-      useFunctionId: isSet5(object.useFunctionId) ? globalThis.String(object.useFunctionId) : "",
-      useMethodName: isSet5(object.useMethodName) ? globalThis.String(object.useMethodName) : "",
       rankedFunctions: globalThis.Array.isArray(object?.rankedFunctions) ? object.rankedFunctions.map((e) => FunctionData_RankedFunction.fromJSON(e)) : [],
       schedule: isSet5(object.schedule) ? Schedule.fromJSON(object.schedule) : void 0,
       untrusted: isSet5(object.untrusted) ? globalThis.Boolean(object.untrusted) : false,
@@ -26196,12 +26157,6 @@ var FunctionData = {
     if (message.isMethod !== false) {
       obj.isMethod = message.isMethod;
     }
-    if (message.useFunctionId !== "") {
-      obj.useFunctionId = message.useFunctionId;
-    }
-    if (message.useMethodName !== "") {
-      obj.useMethodName = message.useMethodName;
-    }
     if (message.rankedFunctions?.length) {
       obj.rankedFunctions = message.rankedFunctions.map((e) => FunctionData_RankedFunction.toJSON(e));
     }
@@ -26297,8 +26252,6 @@ var FunctionData = {
     message.isClass = object.isClass ?? false;
     message.classParameterInfo = object.classParameterInfo !== void 0 && object.classParameterInfo !== null ? ClassParameterInfo.fromPartial(object.classParameterInfo) : void 0;
     message.isMethod = object.isMethod ?? false;
-    message.useFunctionId = object.useFunctionId ?? "";
-    message.useMethodName = object.useMethodName ?? "";
     message.rankedFunctions = object.rankedFunctions?.map((e) => FunctionData_RankedFunction.fromPartial(e)) || [];
     message.schedule = object.schedule !== void 0 && object.schedule !== null ? Schedule.fromPartial(object.schedule) : void 0;
     message.untrusted = object.untrusted ?? false;
@@ -28931,7 +28884,6 @@ function createBaseFunctionHandleMetadata() {
     functionType: 0,
     webUrl: "",
     isMethod: false,
-    useFunctionId: "",
     useMethodName: "",
     definitionId: "",
     classParameterInfo: void 0,
@@ -28962,9 +28914,6 @@ var FunctionHandleMetadata = {
     if (message.isMethod !== false) {
       writer.uint32(312).bool(message.isMethod);
     }
-    if (message.useFunctionId !== "") {
-      writer.uint32(322).string(message.useFunctionId);
-    }
     if (message.useMethodName !== "") {
       writer.uint32(330).string(message.useMethodName);
     }
@@ -29048,13 +28997,6 @@ var FunctionHandleMetadata = {
           message.isMethod = reader.bool();
           continue;
         }
-        case 40: {
-          if (tag !== 322) {
-            break;
-          }
-          message.useFunctionId = reader.string();
-          continue;
-        }
         case 41: {
           if (tag !== 330) {
             break;
@@ -29184,7 +29126,6 @@ var FunctionHandleMetadata = {
       functionType: isSet5(object.functionType) ? function_FunctionTypeFromJSON(object.functionType) : 0,
       webUrl: isSet5(object.webUrl) ? globalThis.String(object.webUrl) : "",
       isMethod: isSet5(object.isMethod) ? globalThis.Boolean(object.isMethod) : false,
-      useFunctionId: isSet5(object.useFunctionId) ? globalThis.String(object.useFunctionId) : "",
       useMethodName: isSet5(object.useMethodName) ? globalThis.String(object.useMethodName) : "",
       definitionId: isSet5(object.definitionId) ? globalThis.String(object.definitionId) : "",
       classParameterInfo: isSet5(object.classParameterInfo) ? ClassParameterInfo.fromJSON(object.classParameterInfo) : void 0,
@@ -29221,9 +29162,6 @@ var FunctionHandleMetadata = {
     if (message.isMethod !== false) {
       obj.isMethod = message.isMethod;
     }
-    if (message.useFunctionId !== "") {
-      obj.useFunctionId = message.useFunctionId;
-    }
     if (message.useMethodName !== "") {
       obj.useMethodName = message.useMethodName;
     }
@@ -29283,7 +29221,6 @@ var FunctionHandleMetadata = {
     message.functionType = object.functionType ?? 0;
     message.webUrl = object.webUrl ?? "";
     message.isMethod = object.isMethod ?? false;
-    message.useFunctionId = object.useFunctionId ?? "";
     message.useMethodName = object.useMethodName ?? "";
     message.definitionId = object.definitionId ?? "";
     message.classParameterInfo = object.classParameterInfo !== void 0 && object.classParameterInfo !== null ? ClassParameterInfo.fromPartial(object.classParameterInfo) : void 0;
@@ -30171,8 +30108,6 @@ function createBaseFunctionPrecreateRequest() {
     existingFunctionId: "",
     functionType: 0,
     webhookConfig: void 0,
-    useFunctionId: "",
-    useMethodName: "",
     methodDefinitions: {},
     functionSchema: void 0,
     supportedInputFormats: [],
@@ -30196,12 +30131,6 @@ var FunctionPrecreateRequest = {
     if (message.webhookConfig !== void 0) {
       WebhookConfig.encode(message.webhookConfig, writer.uint32(42).fork()).join();
     }
-    if (message.useFunctionId !== "") {
-      writer.uint32(50).string(message.useFunctionId);
-    }
-    if (message.useMethodName !== "") {
-      writer.uint32(58).string(message.useMethodName);
-    }
     Object.entries(message.methodDefinitions).forEach(([key, value]) => {
       FunctionPrecreateRequest_MethodDefinitionsEntry.encode({ key, value }, writer.uint32(66).fork()).join();
     });
@@ -30262,20 +30191,6 @@ var FunctionPrecreateRequest = {
           message.webhookConfig = WebhookConfig.decode(reader, reader.uint32());
           continue;
         }
-        case 6: {
-          if (tag !== 50) {
-            break;
-          }
-          message.useFunctionId = reader.string();
-          continue;
-        }
-        case 7: {
-          if (tag !== 58) {
-            break;
-          }
-          message.useMethodName = reader.string();
-          continue;
-        }
         case 8: {
           if (tag !== 66) {
             break;
@@ -30336,8 +30251,6 @@ var FunctionPrecreateRequest = {
       existingFunctionId: isSet5(object.existingFunctionId) ? globalThis.String(object.existingFunctionId) : "",
       functionType: isSet5(object.functionType) ? function_FunctionTypeFromJSON(object.functionType) : 0,
       webhookConfig: isSet5(object.webhookConfig) ? WebhookConfig.fromJSON(object.webhookConfig) : void 0,
-      useFunctionId: isSet5(object.useFunctionId) ? globalThis.String(object.useFunctionId) : "",
-      useMethodName: isSet5(object.useMethodName) ? globalThis.String(object.useMethodName) : "",
       methodDefinitions: isObject2(object.methodDefinitions) ? Object.entries(object.methodDefinitions).reduce((acc, [key, value]) => {
         acc[key] = MethodDefinition.fromJSON(value);
         return acc;
@@ -30364,12 +30277,6 @@ var FunctionPrecreateRequest = {
     if (message.webhookConfig !== void 0) {
       obj.webhookConfig = WebhookConfig.toJSON(message.webhookConfig);
     }
-    if (message.useFunctionId !== "") {
-      obj.useFunctionId = message.useFunctionId;
-    }
-    if (message.useMethodName !== "") {
-      obj.useMethodName = message.useMethodName;
-    }
     if (message.methodDefinitions) {
       const entries = Object.entries(message.methodDefinitions);
       if (entries.length > 0) {
@@ -30400,8 +30307,6 @@ var FunctionPrecreateRequest = {
     message.existingFunctionId = object.existingFunctionId ?? "";
     message.functionType = object.functionType ?? 0;
     message.webhookConfig = object.webhookConfig !== void 0 && object.webhookConfig !== null ? WebhookConfig.fromPartial(object.webhookConfig) : void 0;
-    message.useFunctionId = object.useFunctionId ?? "";
-    message.useMethodName = object.useMethodName ?? "";
     message.methodDefinitions = Object.entries(object.methodDefinitions ?? {}).reduce((acc, [key, value]) => {
       if (value !== void 0) {
         acc[key] = MethodDefinition.fromPartial(value);
@@ -32145,7 +32050,8 @@ function createBaseHTTPConfig() {
     exitGracePeriod: 0,
     h2Enabled: false,
     targetConcurrency: 0,
-    unauthenticated: false
+    unauthenticated: false,
+    liftAndShiftConfig: void 0
   };
 }
 var HTTPConfig = {
@@ -32171,6 +32077,9 @@ var HTTPConfig = {
     if (message.unauthenticated !== false) {
       writer.uint32(56).bool(message.unauthenticated);
     }
+    if (message.liftAndShiftConfig !== void 0) {
+      LiftAndShiftConfig.encode(message.liftAndShiftConfig, writer.uint32(66).fork()).join();
+    }
     return writer;
   },
   decode(input, length) {
@@ -32229,6 +32138,13 @@ var HTTPConfig = {
           message.unauthenticated = reader.bool();
           continue;
         }
+        case 8: {
+          if (tag !== 66) {
+            break;
+          }
+          message.liftAndShiftConfig = LiftAndShiftConfig.decode(reader, reader.uint32());
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -32245,7 +32161,8 @@ var HTTPConfig = {
       exitGracePeriod: isSet5(object.exitGracePeriod) ? globalThis.Number(object.exitGracePeriod) : 0,
       h2Enabled: isSet5(object.h2Enabled) ? globalThis.Boolean(object.h2Enabled) : false,
       targetConcurrency: isSet5(object.targetConcurrency) ? globalThis.Number(object.targetConcurrency) : 0,
-      unauthenticated: isSet5(object.unauthenticated) ? globalThis.Boolean(object.unauthenticated) : false
+      unauthenticated: isSet5(object.unauthenticated) ? globalThis.Boolean(object.unauthenticated) : false,
+      liftAndShiftConfig: isSet5(object.liftAndShiftConfig) ? LiftAndShiftConfig.fromJSON(object.liftAndShiftConfig) : void 0
     };
   },
   toJSON(message) {
@@ -32271,6 +32188,9 @@ var HTTPConfig = {
     if (message.unauthenticated !== false) {
       obj.unauthenticated = message.unauthenticated;
     }
+    if (message.liftAndShiftConfig !== void 0) {
+      obj.liftAndShiftConfig = LiftAndShiftConfig.toJSON(message.liftAndShiftConfig);
+    }
     return obj;
   },
   create(base) {
@@ -32285,6 +32205,7 @@ var HTTPConfig = {
     message.h2Enabled = object.h2Enabled ?? false;
     message.targetConcurrency = object.targetConcurrency ?? 0;
     message.unauthenticated = object.unauthenticated ?? false;
+    message.liftAndShiftConfig = object.liftAndShiftConfig !== void 0 && object.liftAndShiftConfig !== null ? LiftAndShiftConfig.fromPartial(object.liftAndShiftConfig) : void 0;
     return message;
   }
 };
@@ -35060,6 +34981,43 @@ var InputInfo = {
     return message;
   }
 };
+function createBaseLiftAndShiftConfig() {
+  return {};
+}
+var LiftAndShiftConfig = {
+  encode(_, writer = new BinaryWriter()) {
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseLiftAndShiftConfig();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(_) {
+    return {};
+  },
+  toJSON(_) {
+    const obj = {};
+    return obj;
+  },
+  create(base) {
+    return LiftAndShiftConfig.fromPartial(base ?? {});
+  },
+  fromPartial(_) {
+    const message = createBaseLiftAndShiftConfig();
+    return message;
+  }
+};
 function createBaseListPagination() {
   return { maxObjects: 0, createdBefore: 0 };
 }
@@ -51685,7 +51643,8 @@ function createBaseTaskLogsBatch() {
     eof: false,
     ptyExecId: "",
     rootFunctionId: "",
-    ttlDays: 0
+    ttlDays: 0,
+    sandboxId: ""
   };
 }
 var TaskLogsBatch = {
@@ -51723,6 +51682,9 @@ var TaskLogsBatch = {
     if (message.ttlDays !== 0) {
       writer.uint32(136).uint32(message.ttlDays);
     }
+    if (message.sandboxId !== "") {
+      writer.uint32(146).string(message.sandboxId);
+    }
     return writer;
   },
   decode(input, length) {
@@ -51809,6 +51771,13 @@ var TaskLogsBatch = {
           message.ttlDays = reader.uint32();
           continue;
         }
+        case 18: {
+          if (tag !== 146) {
+            break;
+          }
+          message.sandboxId = reader.string();
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -51829,7 +51798,8 @@ var TaskLogsBatch = {
       eof: isSet5(object.eof) ? globalThis.Boolean(object.eof) : false,
       ptyExecId: isSet5(object.ptyExecId) ? globalThis.String(object.ptyExecId) : "",
       rootFunctionId: isSet5(object.rootFunctionId) ? globalThis.String(object.rootFunctionId) : "",
-      ttlDays: isSet5(object.ttlDays) ? globalThis.Number(object.ttlDays) : 0
+      ttlDays: isSet5(object.ttlDays) ? globalThis.Number(object.ttlDays) : 0,
+      sandboxId: isSet5(object.sandboxId) ? globalThis.String(object.sandboxId) : ""
     };
   },
   toJSON(message) {
@@ -51867,6 +51837,9 @@ var TaskLogsBatch = {
     if (message.ttlDays !== 0) {
       obj.ttlDays = Math.round(message.ttlDays);
     }
+    if (message.sandboxId !== "") {
+      obj.sandboxId = message.sandboxId;
+    }
     return obj;
   },
   create(base) {
@@ -51885,6 +51858,7 @@ var TaskLogsBatch = {
     message.ptyExecId = object.ptyExecId ?? "";
     message.rootFunctionId = object.rootFunctionId ?? "";
     message.ttlDays = object.ttlDays ?? 0;
+    message.sandboxId = object.sandboxId ?? "";
     return message;
   }
 };
@@ -68311,6 +68285,9 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
   async setNetworkAccess(request) {
     await this.callUnary(() => this.stub.taskSetNetworkAccess(request));
   }
+  async setOutboundPolicy(request) {
+    await this.callUnary(() => this.stub.taskSetOutboundPolicy(request));
+  }
   /**
    * Reload all Volumes mounted in the task to reflect their latest committed state.
    *
@@ -70369,6 +70346,19 @@ async function buildSandboxCreateRequestProto(appId, imageId, params = {}) {
       );
     }
   }
+  if (params.outboundPolicy !== void 0) {
+    params.outboundPolicy._validate();
+    if (params.blockNetwork) {
+      throw new InvalidError(
+        "outboundPolicy cannot be used when blockNetwork is enabled"
+      );
+    }
+    if (params.outboundDomainAllowlist && params.outboundDomainAllowlist.length > 0) {
+      throw new InvalidError(
+        "outboundPolicy cannot be used with outboundDomainAllowlist"
+      );
+    }
+  }
   const networkAccess = buildOutboundNetworkAccess(
     params.blockNetwork,
     params.outboundCidrAllowlist,
@@ -70449,6 +70439,7 @@ async function buildSandboxCreateRequestProto(appId, imageId, params = {}) {
       idleTimeoutSecs: params.idleTimeoutMs != void 0 ? params.idleTimeoutMs / 1e3 : void 0,
       workdir: params.workdir ?? void 0,
       networkAccess,
+      outboundPolicy: params.outboundPolicy?._toProto(),
       resources: Resources.create({
         milliCpu,
         milliCpuMax,
@@ -70509,7 +70500,7 @@ var SandboxService = class {
     );
     await hydrateSandboxSecrets(
       this.#client,
-      mergedSecrets,
+      [...mergedSecrets, ...params.outboundPolicy?._secrets() ?? []],
       params.cloudBucketMounts
     );
     const mergedParams = {
@@ -70570,7 +70561,7 @@ var SandboxService = class {
     Object.assign(envDict, params.env ?? {});
     await hydrateSandboxSecrets(
       this.#client,
-      resolvableSecrets,
+      [...resolvableSecrets, ...params.outboundPolicy?._secrets() ?? []],
       params.cloudBucketMounts
     );
     const mergedParams = {
@@ -71716,6 +71707,29 @@ var Sandbox2 = class _Sandbox {
     });
     await commandRouterClient.setNetworkAccess(request);
   }
+  /**
+   * Replace the outbound policy of a running Sandbox.
+   *
+   * The new policy replaces all existing policy configuration on the
+   * Sandbox; build a policy including any existing rules you want to keep.
+   *
+   * Only Sandboxes created with an `outboundPolicy` can be updated this
+   * way; for Sandboxes created without one this fails, since header
+   * replacement is only set up at creation time.
+   */
+  async updateOutboundPolicy(outboundPolicy) {
+    this.#ensureAttached();
+    outboundPolicy._validate();
+    const [, [taskId, commandRouterClient]] = await Promise.all([
+      hydrateSecrets(this.#client, outboundPolicy._secrets()),
+      this.#getCommandRouter()
+    ]);
+    const request = TaskSetOutboundPolicyRequest.create({
+      taskId,
+      outboundPolicy: outboundPolicy._toProto()
+    });
+    await commandRouterClient.setOutboundPolicy(request);
+  }
   /**
    * Reload all Volumes mounted in the Sandbox.
    *
@@ -72273,7 +72287,7 @@ var AuthTokenManager = class {
 };
 
 // src/version.ts
-var SDK_VERSION = "0.10.2-dev.0";
+var SDK_VERSION = "0.10.2-dev.2";
 function getSDKVersion() {
   return SDK_VERSION;
 }
@@ -74599,6 +74613,129 @@ var ClsInstance = class {
     return method;
   }
 };
+
+// src/outbound_policy.ts
+var DOMAIN_RE = /^(\*\.)?([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$/;
+var HEADER_NAME_RE = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+var MAX_HEADER_REPLACEMENTS = 25;
+function hasInvalidHeaderValueChar(value) {
+  for (const c of value) {
+    const code = c.codePointAt(0);
+    if (code < 32 && c !== "	" || code === 127) {
+      return true;
+    }
+  }
+  return false;
+}
+function templateReferencesKey(template) {
+  const isKeyStart = (c) => /[a-zA-Z_]/.test(c);
+  let i = template.indexOf("$");
+  while (i !== -1 && i + 1 < template.length) {
+    const c = template[i + 1];
+    if (c === "$") {
+      i = template.indexOf("$", i + 2);
+      continue;
+    }
+    if (isKeyStart(c)) {
+      return true;
+    }
+    i = template.indexOf("$", i + 1);
+  }
+  return false;
+}
+var OutboundPolicy2 = class _OutboundPolicy {
+  /** @internal */
+  _replacements;
+  /** @internal */
+  constructor(_replacements = []) {
+    this._replacements = _replacements;
+  }
+  /**
+   * Return a new {@link OutboundPolicy} with an added header replacement.
+   *
+   * @param params.domain Domain the replacements are scoped to. Supports `*.` wildcard
+   *   prefixes (matching the apex domain and subdomains) and a bare `"*"`.
+   * @param params.headers Header name -> header value. Values support `$KEY` templates
+   *   referencing keys in the replacement's `secret`.
+   * @param params.secret Named {@link Secret} (e.g. from `client.secrets.fromName`) whose
+   *   keys may be referenced in the header value templates. Static replacements pass no secret.
+   */
+  withHeaderReplacement(params) {
+    const { domain, headers, secret } = params;
+    return new _OutboundPolicy([
+      ...this._replacements,
+      { domain, headers: { ...headers }, secret }
+    ]);
+  }
+  /** Check all replacements, throwing `InvalidError` on the first violation found.
+   * @internal
+   */
+  _validate() {
+    let total = 0;
+    for (const replacement of this._replacements) {
+      const { domain, headers, secret } = replacement;
+      if (domain !== "*" && !DOMAIN_RE.test(domain)) {
+        throw new InvalidError(`Invalid domain: ${JSON.stringify(domain)}`);
+      }
+      const entries = Object.entries(headers);
+      if (entries.length === 0) {
+        throw new InvalidError("`headers` must contain at least one header");
+      }
+      for (const [name, value] of entries) {
+        if (!HEADER_NAME_RE.test(name)) {
+          throw new InvalidError(
+            `Invalid header name: ${JSON.stringify(name)}`
+          );
+        }
+        if (hasInvalidHeaderValueChar(value)) {
+          throw new InvalidError(
+            `Header value for ${JSON.stringify(name)} must not contain control characters (except tab)`
+          );
+        }
+        if (secret === void 0 && templateReferencesKey(value)) {
+          throw new InvalidError(
+            `Header value for ${JSON.stringify(name)} references a secret key, but no \`secret\` was passed`
+          );
+        }
+      }
+      if (secret !== void 0 && secretEnvDictHydrator(secret) !== void 0) {
+        throw new InvalidError(
+          "Outbound policies only support named secrets (e.g. `client.secrets.fromName`); ephemeral secrets (e.g. `client.secrets.fromObject`) are not yet supported"
+        );
+      }
+      total += entries.length;
+    }
+    if (total > MAX_HEADER_REPLACEMENTS) {
+      throw new InvalidError(
+        `Outbound policy cannot have more than ${MAX_HEADER_REPLACEMENTS} header replacements`
+      );
+    }
+  }
+  /** Deduplicated list of secrets referenced by the policy's replacements.
+   * @internal
+   */
+  _secrets() {
+    return [
+      ...new Set(
+        this._replacements.map((s) => s.secret).filter((s) => s !== void 0)
+      )
+    ];
+  }
+  /** Convert to the wire format. Referenced secrets must be hydrated first.
+   * @internal
+   */
+  _toProto() {
+    return OutboundPolicy.create({
+      headerReplacements: this._replacements.map(
+        (replacement) => OutboundPolicy_HeaderReplacement.create({
+          domain: replacement.domain,
+          secretId: replacement.secret?.secretId ?? "",
+          headers: replacement.headers
+        })
+      )
+    });
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AlreadyExistsError,
@@ -74626,6 +74763,7 @@ var ClsInstance = class {
   InvalidError,
   ModalClient,
   NotFoundError,
+  OutboundPolicy,
   Probe,
   Proxy,
   ProxyService,