modal 0.10.2-dev.1 → 0.10.2-dev.10

package/dist/index.d.cts

@@ -233,6 +233,20 @@ declare enum FileDescriptor {
     FILE_DESCRIPTOR_INFO = 3,
     UNRECOGNIZED = -1
 }
+declare enum FunctionCallInputStatus {
+    FUNCTION_CALL_INPUT_STATUS_UNSPECIFIED = 0,
+    FUNCTION_CALL_INPUT_STATUS_PENDING = 1,
+    FUNCTION_CALL_INPUT_STATUS_RUNNING = 2,
+    FUNCTION_CALL_INPUT_STATUS_SUCCESS = 3,
+    FUNCTION_CALL_INPUT_STATUS_FAILURE = 4,
+    FUNCTION_CALL_INPUT_STATUS_TIMEOUT = 5,
+    FUNCTION_CALL_INPUT_STATUS_TERMINATED = 6,
+    FUNCTION_CALL_INPUT_STATUS_INIT_FAILURE = 7,
+    FUNCTION_CALL_INPUT_STATUS_INTERNAL_FAILURE = 8,
+    FUNCTION_CALL_INPUT_STATUS_IDLE_TIMEOUT = 9,
+    FUNCTION_CALL_INPUT_STATUS_MEMORY_MANAGER_EVICTION = 10,
+    UNRECOGNIZED = -1
+}
 declare enum FunctionCallInvocationType {
     FUNCTION_CALL_INVOCATION_TYPE_UNSPECIFIED = 0,
     FUNCTION_CALL_INVOCATION_TYPE_SYNC_LEGACY = 1,
@@ -530,6 +544,11 @@ declare enum SandboxGetExitSnapshotResponse_ErrorCode {
     ERROR_CODE_UNSPECIFIED = 0,
     ERROR_CODE_TIMEOUT = 1,
     ERROR_CODE_INTERNAL = 2,
+    /**
+     * ERROR_CODE_FILESYSTEM_INCONSISTENT - The sandbox exited without leaving a consistent filesystem (e.g. killed
+     * before it could flush) and recovery failed, so no exit snapshot exists.
+     */
+    ERROR_CODE_FILESYSTEM_INCONSISTENT = 3,
     UNRECOGNIZED = -1
 }
 declare enum SandboxRestoreRequest_SandboxNameOverrideType {
@@ -683,6 +702,8 @@ interface AppGetInfoResponse_FunctionInfoSummary {
     /** True for Web Functions and classes with web methods; false for Servers. */
     webFunction: boolean;
     requiresProxyAuth?: boolean | undefined;
+    /** True for Sessioned Servers. */
+    isSessioned: boolean;
 }
 declare const AppGetInfoResponse_FunctionInfoSummary: MessageFns$1<AppGetInfoResponse_FunctionInfoSummary>;
 interface AppGetLayoutRequest {
@@ -1599,6 +1620,7 @@ interface EndpointCreateRequest {
     environmentName: string;
     unauthenticated: boolean;
     servingMode: EndpointServingMode;
+    sharedEndpointNoticeAcknowledged: boolean;
 }
 declare const EndpointCreateRequest: MessageFns$1<EndpointCreateRequest>;
 interface EndpointCreateResponse {
@@ -1712,7 +1734,7 @@ interface EnvironmentBillingSummaryResponse {
      * at the workspace level
      */
     meteredCost: string;
-    /** keyed by deployed, ephemeral, volume, notebook */
+    /** keyed by app type (deployed, ephemeral, notebook, endpoint, ...), volume, tokens, network egress */
     meteredCostBreakdown: {
         [key: string]: string;
     };
@@ -2000,10 +2022,6 @@ interface FunctionMessage {
     schedulerPlacement?: SchedulerPlacement | undefined;
     /** if "Function" is actually a class grouping multiple methods */
     isClass: boolean;
-    /** for class methods use this function id instead for invocations - the *referenced* function should have is_class=True */
-    useFunctionId: string;
-    /** for class methods - this method name needs to be included in the FunctionInput */
-    useMethodName: string;
     classParameterInfo: ClassParameterInfo | undefined;
     /** Maximum number of inputs to fetch at once */
     batchMaxSize: number;
@@ -2030,13 +2048,6 @@ interface FunctionMessage {
     untrusted: boolean;
     /** To be replaced by autoscaler_settings.buffer_containers */
     ExperimentalBufferContainers: number;
-    /**
-     * _experimental_proxy_ip -> ProxyInfo
-     * TODO: deprecate.
-     *
-     * @deprecated
-     */
-    ExperimentalProxyIp?: string | undefined;
     /** For internal debugging use only. */
     runtimePerfRecord: boolean;
     schedule: Schedule | undefined;
@@ -2132,6 +2143,23 @@ interface FunctionCallCancelRequest {
     functionId?: string | undefined;
 }
 declare const FunctionCallCancelRequest: MessageFns$1<FunctionCallCancelRequest>;
+interface FunctionCallFetchRequest {
+    functionId: string;
+    tail?: FunctionCallFetchRequest_Tail | undefined;
+    /** Include the root Function and its eligible variants. */
+    allVariants: boolean;
+}
+declare const FunctionCallFetchRequest: MessageFns$1<FunctionCallFetchRequest>;
+interface FunctionCallFetchRequest_Tail {
+    /** Number of most recent inputs to return. Must be between 1 and 1000. */
+    count: number;
+}
+declare const FunctionCallFetchRequest_Tail: MessageFns$1<FunctionCallFetchRequest_Tail>;
+interface FunctionCallFetchResponse {
+    /** The requested number of most recent inputs from the last seven days, ordered from newest to oldest. */
+    functionCallInputs: FunctionCallInputInfo[];
+}
+declare const FunctionCallFetchResponse: MessageFns$1<FunctionCallFetchResponse>;
 interface FunctionCallFromIdRequest {
     functionCallId: string;
 }
@@ -2178,6 +2206,17 @@ interface FunctionCallInfo {
     totalInputs: number;
 }
 declare const FunctionCallInfo: MessageFns$1<FunctionCallInfo>;
+interface FunctionCallInputInfo {
+    enqueuedAt: Date | undefined;
+    startedAt?: Date | undefined;
+    containerId?: string | undefined;
+    startupTimeSeconds?: number | undefined;
+    executionTimeSeconds?: number | undefined;
+    status: FunctionCallInputStatus;
+    functionCallId: string;
+    serviceMethodName?: string | undefined;
+}
+declare const FunctionCallInputInfo: MessageFns$1<FunctionCallInputInfo>;
 interface FunctionCallListRequest {
     functionId: string;
 }
@@ -2255,13 +2294,6 @@ interface FunctionData {
     webUrlInfo: WebUrlInfo | undefined;
     webhookConfig: WebhookConfig | undefined;
     customDomainInfo: CustomDomainInfo[];
-    /**
-     * _experimental_proxy_ip -> ProxyInfo
-     * TODO: deprecate.
-     *
-     * @deprecated
-     */
-    ExperimentalProxyIp?: string | undefined;
     /** Mapping of method names to method definitions, only non-empty for class service functions */
     methodDefinitions: {
         [key: string]: MethodDefinition;
@@ -2271,10 +2303,6 @@ interface FunctionData {
     isClass: boolean;
     classParameterInfo: ClassParameterInfo | undefined;
     isMethod: boolean;
-    /** used for methods */
-    useFunctionId: string;
-    /** used for methods */
-    useMethodName: string;
     rankedFunctions: FunctionData_RankedFunction[];
     schedule: Schedule | undefined;
     /** If set, the function will be run in an untrusted environment. */
@@ -2523,8 +2551,6 @@ interface FunctionHandleMetadata {
     webUrl: string;
     isMethod: boolean;
     /** used for methods */
-    useFunctionId: string;
-    /** used for methods */
     useMethodName: string;
     definitionId: string;
     classParameterInfo: ClassParameterInfo | undefined;
@@ -2557,6 +2583,20 @@ interface FunctionInput {
     methodName?: string | undefined;
 }
 declare const FunctionInput: MessageFns$1<FunctionInput>;
+interface FunctionListVariantsRequest {
+    functionId: string;
+    cursor: FunctionVariantCursor | undefined;
+    limit: number;
+}
+declare const FunctionListVariantsRequest: MessageFns$1<FunctionListVariantsRequest>;
+interface FunctionListVariantsResponse {
+    infos: FunctionVariantInfo[];
+    /** Pass back as cursor to fetch the next page. Unset once the listing is complete. */
+    nextCursor: FunctionVariantCursor | undefined;
+    /** Set by the server when it ordered the variants by how many tasks each is running, busiest first. */
+    orderedByTaskCount: boolean;
+}
+declare const FunctionListVariantsResponse: MessageFns$1<FunctionListVariantsResponse>;
 interface FunctionMapRequest {
     functionId: string;
     parentInputId: string;
@@ -2609,10 +2649,6 @@ interface FunctionPrecreateRequest {
     existingFunctionId: string;
     functionType: Function_FunctionType;
     webhookConfig: WebhookConfig | undefined;
-    /** for class methods - use this function id instead for invocations - the *referenced* function should have is_class=True */
-    useFunctionId: string;
-    /** for class methods - this method name needs to be included in the FunctionInput */
-    useMethodName: string;
     /** Mapping of method names to method definitions, only non-empty for class service functions */
     methodDefinitions: {
         [key: string]: MethodDefinition;
@@ -2720,6 +2756,17 @@ interface FunctionUpdateSchedulingParamsResponse {
     currentSettings: AutoscalerSettings | undefined;
 }
 declare const FunctionUpdateSchedulingParamsResponse: MessageFns$1<FunctionUpdateSchedulingParamsResponse>;
+interface FunctionVariantCursor {
+    createdBefore: number;
+    functionId: string;
+}
+declare const FunctionVariantCursor: MessageFns$1<FunctionVariantCursor>;
+interface FunctionVariantInfo {
+    functionId: string;
+    serializedParams: Uint8Array;
+    functionOptions: FunctionOptions$1 | undefined;
+}
+declare const FunctionVariantInfo: MessageFns$1<FunctionVariantInfo>;
 interface GPUConfig {
     /** Deprecated, at some point */
     type: GPUType;
@@ -2763,6 +2810,7 @@ interface HTTPConfig {
     h2Enabled: boolean;
     targetConcurrency: number;
     unauthenticated: boolean;
+    liftAndShiftConfig?: LiftAndShiftConfig | undefined;
 }
 declare const HTTPConfig: MessageFns$1<HTTPConfig>;
 interface Image$1 {
@@ -3016,6 +3064,9 @@ interface InputInfo {
     taskFirstInput: boolean;
 }
 declare const InputInfo: MessageFns$1<InputInfo>;
+interface LiftAndShiftConfig {
+}
+declare const LiftAndShiftConfig: MessageFns$1<LiftAndShiftConfig>;
 interface ListPagination {
     maxObjects: number;
     createdBefore: number;
@@ -3591,7 +3642,10 @@ interface Sandbox$1 {
      * Set by the backend at snapshot creation time.
      */
     runscRuntimeVersion?: string | undefined;
-    /** If set, overrides the runtime used by the function, either "runc" or "gvisor". */
+    /**
+     * Runtime the sandbox runs in: "vm" for a virtual machine, or a container
+     * runtime such as "gvisor". Leave it unset to let Modal pick.
+     */
     runtime?: string | undefined;
     /** If set, the sandbox will be created with verbose logging enabled. */
     verbose: boolean;
@@ -4034,6 +4088,14 @@ interface SecretDeleteRequest {
     secretId: string;
 }
 declare const SecretDeleteRequest: MessageFns$1<SecretDeleteRequest>;
+interface SecretGetInfoRequest {
+    secretId: string;
+}
+declare const SecretGetInfoRequest: MessageFns$1<SecretGetInfoRequest>;
+interface SecretGetInfoResponse {
+    metadata: SecretMetadata | undefined;
+}
+declare const SecretGetInfoResponse: MessageFns$1<SecretGetInfoResponse>;
 interface SecretGetOrCreateRequest {
     deploymentName: string;
     environmentName: string;
@@ -4076,6 +4138,8 @@ declare const SecretListResponse: MessageFns$1<SecretListResponse>;
 interface SecretMetadata {
     name: string;
     creationInfo: CreationInfo | undefined;
+    keys: string[];
+    environmentName: string;
 }
 declare const SecretMetadata: MessageFns$1<SecretMetadata>;
 interface SecretUpdateRequest {
@@ -4154,6 +4218,29 @@ interface ServerGetTimeRangeStatsResponse_ServerStatusCodeCount {
     count: number;
 }
 declare const ServerGetTimeRangeStatsResponse_ServerStatusCodeCount: MessageFns$1<ServerGetTimeRangeStatsResponse_ServerStatusCodeCount>;
+interface ServerRequestFetchRequest {
+    functionId: string;
+    tail?: ServerRequestFetchRequest_Tail | undefined;
+}
+declare const ServerRequestFetchRequest: MessageFns$1<ServerRequestFetchRequest>;
+interface ServerRequestFetchRequest_Tail {
+    /** Number of most recent requests to return. Must be between 1 and 1000. */
+    count: number;
+}
+declare const ServerRequestFetchRequest_Tail: MessageFns$1<ServerRequestFetchRequest_Tail>;
+interface ServerRequestFetchResponse {
+    /** The requested number of most recent requests from the last seven days, ordered from newest to oldest. */
+    requests: ServerRequestInfo[];
+}
+declare const ServerRequestFetchResponse: MessageFns$1<ServerRequestFetchResponse>;
+interface ServerRequestInfo {
+    route: string;
+    timestamp: Date | undefined;
+    containerId: string;
+    durationSeconds: number;
+    status: number;
+}
+declare const ServerRequestInfo: MessageFns$1<ServerRequestInfo>;
 interface ServiceUser {
     name: string;
     tokenId: string;
@@ -4376,6 +4463,7 @@ interface TaskLogsBatch {
     ptyExecId: string;
     rootFunctionId: string;
     ttlDays: number;
+    sandboxId: string;
 }
 declare const TaskLogsBatch: MessageFns$1<TaskLogsBatch>;
 interface TaskProgress {
@@ -4435,6 +4523,7 @@ interface TokenFlowCreateRequest {
     utmSource: string;
     localhostPort: number;
     nextUrl: string;
+    expiresInSeconds: number;
 }
 declare const TokenFlowCreateRequest: MessageFns$1<TokenFlowCreateRequest>;
 interface TokenFlowCreateResponse {
@@ -4870,6 +4959,11 @@ interface WebhookTokenListResponse {
     tokens: WebhookToken[];
 }
 declare const WebhookTokenListResponse: MessageFns$1<WebhookTokenListResponse>;
+interface WebhookTokenUpdateRequest {
+    tokenId: string;
+    name?: string | undefined;
+}
+declare const WebhookTokenUpdateRequest: MessageFns$1<WebhookTokenUpdateRequest>;
 interface WorkspaceBillingRatesRequest {
 }
 declare const WorkspaceBillingRatesRequest: MessageFns$1<WorkspaceBillingRatesRequest>;
@@ -4926,7 +5020,7 @@ interface WorkspaceBillingSummaryResponse {
     meteredCostBreakdown: {
         [key: string]: string;
     };
-    /** keyed by plan, credits, reservations, storage */
+    /** keyed by plan, credits, reservations, storage, network egress allowance */
     adjustments: {
         [key: string]: string;
     };
@@ -5725,6 +5819,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly functionCallFetch: {
+            readonly name: "FunctionCallFetch";
+            readonly requestType: MessageFns$1<FunctionCallFetchRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<FunctionCallFetchResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly functionCallFromId: {
             readonly name: "FunctionCallFromId";
             readonly requestType: MessageFns$1<FunctionCallFromIdRequest>;
@@ -5880,6 +5982,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly functionListVariants: {
+            readonly name: "FunctionListVariants";
+            readonly requestType: MessageFns$1<FunctionListVariantsRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<FunctionListVariantsResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly functionMap: {
             readonly name: "FunctionMap";
             readonly requestType: MessageFns$1<FunctionMapRequest>;
@@ -6514,6 +6624,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly secretGetInfo: {
+            readonly name: "SecretGetInfo";
+            readonly requestType: MessageFns$1<SecretGetInfoRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<SecretGetInfoResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly secretGetOrCreate: {
             readonly name: "SecretGetOrCreate";
             readonly requestType: MessageFns$1<SecretGetOrCreateRequest>;
@@ -6547,6 +6665,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly serverRequestFetch: {
+            readonly name: "ServerRequestFetch";
+            readonly requestType: MessageFns$1<ServerRequestFetchRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<ServerRequestFetchResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         /** Service users */
         readonly serviceUserList: {
             readonly name: "ServiceUserList";
@@ -6940,6 +7066,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly webhookTokenUpdate: {
+            readonly name: "WebhookTokenUpdate";
+            readonly requestType: MessageFns$1<WebhookTokenUpdateRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<WebhookToken>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         /** Workspaces */
         readonly workspaceBillingRates: {
             readonly name: "WorkspaceBillingRates";
@@ -7206,6 +7340,8 @@ interface FunctionCallLogFetchParams {
     /** Filter by text contained in the log message. */
     searchText?: string;
 }
+type SandboxLogFetchParams = FunctionLogFetchParams;
+type SandboxLogTailParams = FunctionLogTailParams;
 interface FunctionLogs {
     fetch(params: FunctionLogFetchParams): AsyncIterable<LogEntry>;
     tail(params?: FunctionLogTailParams): AsyncIterable<LogEntry>;
@@ -7216,6 +7352,10 @@ interface FunctionCallLogs extends Omit<FunctionLogs, "fetch"> {
     tail(params?: FunctionCallLogTailParams): AsyncIterable<LogEntry>;
     stream(params?: FunctionCallLogStreamParams): AsyncIterable<LogEntry>;
 }
+interface SandboxLogs {
+    fetch(params: SandboxLogFetchParams): AsyncIterable<LogEntry>;
+    tail(params?: SandboxLogTailParams): AsyncIterable<LogEntry>;
+}
 interface LogQueryParams {
     client: ModalClient;
     objectId: string;
@@ -7368,6 +7508,59 @@ declare class FunctionCallLogsManager extends LogsManager implements FunctionCal
      */
     stream(params?: FunctionCallLogStreamParams): AsyncIterable<LogEntry>;
 }
+/** Namespace for Sandbox entrypoint log APIs. */
+declare class SandboxLogsManager implements SandboxLogs {
+    private readonly client;
+    private readonly sandboxId;
+    private readonly getAppId;
+    private readonly getTaskId;
+    /** @ignore */
+    constructor(client: ModalClient, sandboxId: string, getAppId: () => Promise<string>, getTaskId: () => Promise<string>);
+    /**
+     * Fetch Sandbox entrypoint logs corresponding to a UTC time range and
+     * optional filters.
+     *
+     * Entries are returned in chronological order.
+     *
+     * @returns An async iterable of {@link LogEntry} objects.
+     *
+     * @example
+     * ```typescript
+     * import { ModalClient } from "modal";
+     *
+     * const modal = new ModalClient();
+     * const sandbox = await modal.sandboxes.fromId("sb-...");
+     *
+     * for await (const entry of sandbox.logs.fetch({
+     *   since: new Date(Date.now() - 60 * 60 * 1_000),
+     *   source: "stdout",
+     * })) {
+     *   process.stdout.write(entry.message);
+     * }
+     * ```
+     */
+    fetch(params: SandboxLogFetchParams): AsyncIterable<LogEntry>;
+    /**
+     * Fetch the most recent Sandbox entrypoint logs.
+     *
+     * Entries are returned in chronological order.
+     *
+     * @returns An async iterable of {@link LogEntry} objects.
+     *
+     * @example
+     * ```typescript
+     * import { ModalClient } from "modal";
+     *
+     * const modal = new ModalClient();
+     * const sandbox = await modal.sandboxes.fromId("sb-...");
+     *
+     * for await (const entry of sandbox.logs.tail({ entries: 20 })) {
+     *   process.stdout.write(entry.message);
+     * }
+     * ```
+     */
+    tail(params?: SandboxLogTailParams): AsyncIterable<LogEntry>;
+}
 
 /**
  * Service for managing {@link FunctionCall}s.
@@ -8032,6 +8225,12 @@ interface TaskContainerCreateRequest {
     networkAccess?: NetworkAccess | undefined;
     /** Optional PTY info for sidecar. */
     ptyInfo?: PTYInfo | undefined;
+    /**
+     * Memory, in MiB, the sidecar consumes from the sandbox's sidecar memory
+     * reserve (experimental option vm_sidecar_memory_reserve_mib); unset
+     * consumes whatever is left of it. Ignored without a reserve.
+     */
+    memoryReserveConsumeMib?: number | undefined;
 }
 declare const TaskContainerCreateRequest: MessageFns<TaskContainerCreateRequest>;
 interface TaskContainerCreateResponse {
@@ -8191,6 +8390,12 @@ interface TaskSetNetworkAccessRequest {
     networkAccess: NetworkAccess | undefined;
 }
 declare const TaskSetNetworkAccessRequest: MessageFns<TaskSetNetworkAccessRequest>;
+interface TaskSetOutboundPolicyRequest {
+    taskId: string;
+    /** Replaces the task's outbound policy. */
+    outboundPolicy: OutboundPolicy | undefined;
+}
+declare const TaskSetOutboundPolicyRequest: MessageFns<TaskSetOutboundPolicyRequest>;
 interface TaskSnapshotDirectoryRequest {
     taskId: string;
     path: Uint8Array;
@@ -8309,7 +8514,7 @@ interface Profile {
     sandboxChannelIdleTimeoutMs: number;
     /**
      * Set by the MODAL_SANDBOX_V2 environment variable or the sandbox_v2
-     * profile key in .modal.toml.
+     * profile key in .modal.toml. Defaults to true when neither is set.
      */
     sandboxV2: boolean;
 }
@@ -8444,6 +8649,7 @@ declare class TaskCommandRouterClientImpl {
     snapshotMemory(request: TaskSnapshotMemoryRequest, options?: TimeoutOptions): Promise<TaskSnapshotMemoryResponse>;
     unmountDirectory(request: TaskUnmountDirectoryRequest): Promise<void>;
     setNetworkAccess(request: TaskSetNetworkAccessRequest): Promise<void>;
+    setOutboundPolicy(request: TaskSetOutboundPolicyRequest): Promise<void>;
     /**
      * Reload all Volumes mounted in the task to reflect their latest committed state.
      *
@@ -8467,6 +8673,84 @@ declare class TaskCommandRouterClientImpl {
     private streamSandboxStdio;
 }
 
+/**
+ * Immutable configuration for replacing headers in outbound HTTPS traffic.
+ */
+
+/** @internal */
+type HeaderReplacement = {
+    domain: string;
+    headers: Record<string, string>;
+    secret?: Secret;
+};
+/**
+ * Immutable configuration for replacing headers in outbound HTTPS requests
+ * from a Sandbox.
+ *
+ * EXPERIMENTAL: the API is subject to change.
+ *
+ * Header values support templating with keys in a replacement's secret: a
+ * `$`-prefixed key name in the secret is replaced with the secret value.
+ * Literal `$` characters are written `$$`.
+ *
+ * Secret values never enter the Sandbox: they are resolved and injected into
+ * matching requests outside the container.
+ *
+ * ```ts
+ * const secret = await modal.secrets.fromName("api-token");
+ *
+ * const outboundPolicy = new modal.ExperimentalOutboundPolicy()
+ *   // Inject a secret-backed Authorization header.
+ *   .withHeaderReplacement({
+ *     domain: "example.com",
+ *     secret,
+ *     headers: { Authorization: "Bearer $API_TOKEN" },
+ *   })
+ *   // Inject a static header into requests to another domain.
+ *   .withHeaderReplacement({
+ *     domain: "modal.com",
+ *     headers: { "X-Trace-Token": "trace_abcd" },
+ *   });
+ *
+ * const sb = await modal.sandboxes.create(app, image, {
+ *   experimentalOutboundPolicy: outboundPolicy,
+ * });
+ * ```
+ */
+declare class ExperimentalOutboundPolicy {
+    /** @internal */
+    readonly _replacements: readonly HeaderReplacement[];
+    /** @internal */
+    constructor(_replacements?: readonly HeaderReplacement[]);
+    /**
+     * Return a new {@link ExperimentalOutboundPolicy} with an added header replacement.
+     *
+     * @param params.domain Domain the replacements are scoped to. Supports `*.` wildcard
+     *   prefixes (matching the apex domain and subdomains) and a bare `"*"`.
+     * @param params.headers Header name -> header value. Values support `$KEY` templates
+     *   referencing keys in the replacement's `secret`.
+     * @param params.secret Named {@link Secret} (e.g. from `client.secrets.fromName`) whose
+     *   keys may be referenced in the header value templates. Static replacements pass no secret.
+     */
+    withHeaderReplacement(params: {
+        domain: string;
+        headers: Record<string, string>;
+        secret?: Secret;
+    }): ExperimentalOutboundPolicy;
+    /** Check all replacements, throwing `InvalidError` on the first violation found.
+     * @internal
+     */
+    _validate(): void;
+    /** Deduplicated list of secrets referenced by the policy's replacements.
+     * @internal
+     */
+    _secrets(): Secret[];
+    /** Convert to the wire format. Referenced secrets must be hydrated first.
+     * @internal
+     */
+    _toProto(): OutboundPolicy;
+}
+
 /** Type of a filesystem entry. */
 type FileType = "file" | "directory" | "symlink";
 /** Metadata for a file or directory entry in a Sandbox. */
@@ -8699,6 +8983,8 @@ type SidecarCreateParams = {
     secrets?: Secret[];
     /** Working directory of the sidecar container. */
     workdir?: string;
+    /** Mount points for Modal {@link Volume}s. */
+    volumes?: Record<string, Volume>;
     /**
      * List of CIDRs the sidecar is allowed to access. Independent of the main
      * container; if not set, all CIDRs are allowed. An empty list blocks all
@@ -8712,6 +8998,13 @@ type SidecarCreateParams = {
     outboundDomainAllowlist?: string[];
     /** Enable a PTY for the sidecar. */
     pty?: boolean;
+    /**
+     * Memory, in MiB, the sidecar consumes from the Sandbox's sidecar memory
+     * reserve (the `vm_sidecar_memory_reserve_mib` experimental option); unset
+     * consumes whatever is left of it. Ignored by Sandboxes without a reserve.
+     * Experimental.
+     */
+    experimentalMemoryReserveConsumeMiB?: number;
 };
 /** Options for {@link SidecarService#get SidecarService.get()}. */
 type SidecarGetParams = {
@@ -8937,6 +9230,8 @@ type StdioBehavior = "pipe" | "ignore";
  * means the data will be read as raw bytes (Uint8Array).
  */
 type StreamMode = "text" | "binary";
+/** Runtime a Sandbox runs in: a virtual machine, or gVisor. */
+type SandboxRuntime = "gvisor" | "vm";
 /** Optional parameters for {@link Probe.withTcp} and {@link Probe.withExec}. */
 type ProbeParams = {
     intervalMs: number;
@@ -8960,6 +9255,8 @@ type SandboxCreateParams = {
     memoryMiB?: number;
     /** Hard limit of memory in MiB. */
     memoryLimitMiB?: number;
+    /** Runtime under which the Sandbox executes, or undefined to let Modal pick. */
+    runtime?: SandboxRuntime;
     /** GPU reservation for the Sandbox (e.g. "A100", "T4:2", "A100-80GB:4"). */
     gpu?: string;
     /** Maximum lifetime of the Sandbox in milliseconds. Defaults to 5 minutes. */
@@ -8996,6 +9293,11 @@ type SandboxCreateParams = {
     outboundCidrAllowlist?: string[];
     /** List of domain names the Sandbox is allowed to access. Supports wildcard prefixes (`*.example.com`). Cannot be used with blockNetwork. */
     outboundDomainAllowlist?: string[];
+    /** Configuration for replacing headers in outbound HTTPS requests from the Sandbox.
+     * Secrets referenced by the policy are resolved outside the Sandbox and are never
+     * visible to the workload. See {@link ExperimentalOutboundPolicy}.
+     * EXPERIMENTAL: the API is subject to change. */
+    experimentalOutboundPolicy?: ExperimentalOutboundPolicy;
     /** List of CIDRs allowed to connect inbound to the Sandbox (tunnels and connection tokens). If not set, all IPs are allowed. Cannot be used with blockNetwork. */
     inboundCidrAllowlist?: string[];
     /** Enable private IPv6 networking (i6pn) so Sandboxes in the same workspace can address each
@@ -9304,6 +9606,18 @@ declare class Sandbox {
     get stdin(): ModalWriteStream<string>;
     get stdout(): ModalReadStream<string>;
     get stderr(): ModalReadStream<string>;
+    /**
+     * Access persisted entrypoint logs emitted by this Sandbox.
+     *
+     * Use {@link SandboxLogsManager#fetch fetch()} to read logs from a UTC time
+     * range and {@link SandboxLogsManager#tail tail()} to read the most recent
+     * logs.
+     *
+     * This is separate from {@link Sandbox#stdout stdout} and
+     * {@link Sandbox#stderr stderr}, which expose the Sandbox's live output
+     * streams.
+     */
+    get logs(): SandboxLogsManager;
     get filesystem(): SandboxFilesystem;
     /**
      * Operations for managing sidecar containers that run alongside the
@@ -9343,6 +9657,15 @@ declare class Sandbox {
     exec(command: string[], params: SandboxExecParams & {
         mode: "binary";
     }): Promise<ContainerProcess<Uint8Array>>;
+    /**
+     * Blocks until the Sandbox has a task. If the wait fails, the Sandbox is
+     * terminated so a queued one cannot start later with no caller. A timeout
+     * surfaces as a ResourceExhaustedError.
+     *
+     * @internal
+     * @hidden
+     */
+    _waitForScheduling(timeoutMs: number): Promise<void>;
     /**
      * Create a token for making HTTP connections to the Sandbox.
      */
@@ -9462,6 +9785,19 @@ declare class Sandbox {
      * @param params - Both `outboundCidrAllowlist` and `outboundDomainAllowlist` must be provided.
      */
     updateNetworkPolicy(params: SandboxUpdateNetworkPolicyParams): Promise<void>;
+    /**
+     * Replace the outbound policy of a running Sandbox.
+     *
+     * EXPERIMENTAL: the API is subject to change.
+     *
+     * The new policy replaces all existing policy configuration on the
+     * Sandbox; build a policy including any existing rules you want to keep.
+     *
+     * Only Sandboxes created with an `experimentalOutboundPolicy` can be updated this
+     * way; for Sandboxes created without one this fails, since header
+     * replacement is only set up at creation time.
+     */
+    experimentalUpdateOutboundPolicy(outboundPolicy: ExperimentalOutboundPolicy): Promise<void>;
     /**
      * Reload all Volumes mounted in the Sandbox.
      *
@@ -9714,6 +10050,10 @@ declare class QueueEmptyError extends Error {
 declare class QueueFullError extends Error {
     constructor(message: string);
 }
+/** A server-side resource has been exhausted, such as capacity, a quota, or a rate limit. */
+declare class ResourceExhaustedError extends Error {
+    constructor(message: string);
+}
 /** Errors from invalid Sandbox FileSystem operations. */
 declare class SandboxFilesystemError extends Error {
     constructor(message: string);
@@ -9761,4 +10101,4 @@ declare class ClientClosedError extends Error {
 
 declare function checkForRenamedParams(params: any, renames: Record<string, string>): void;
 
-export { AlreadyExistsError, App, type AppFromNameParams, AppService, ClientClosedError, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ConflictError, ContainerProcess, ExecutionError, type FileInfo, type FileType, type FileWatchEvent, type FileWatchEventType, type FunctionAutoscalerSettings, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, type FunctionCallLogFetchParams, type FunctionCallLogStreamParams, type FunctionCallLogTailParams, FunctionCallLogsManager, FunctionCallService, type FunctionFromNameParams, type FunctionLogFetchParams, type FunctionLogStreamParams, type FunctionLogTailParams, FunctionLogsManager, FunctionService, type FunctionStats, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, type FunctionWithBatchingParams, type FunctionWithConcurrencyParams, type FunctionWithOptionsParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, type ImageFromNameParams, type ImagePublishParams, ImageService, InternalFailure, InvalidError, type LogEntry, type FunctionLogFetchParams as LogFetchParams, type LogLevel, type LogSource, type Logger, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, type SandboxExperimentalFromNameParams, type SandboxExperimentalFromSnapshotParams, type SandboxExperimentalGetExitSnapshotParams, type SandboxExperimentalListParams, SandboxFilesystem, SandboxFilesystemDirectoryNotEmptyError, SandboxFilesystemError, SandboxFilesystemFileTooLargeError, SandboxFilesystemIsADirectoryError, SandboxFilesystemNotADirectoryError, SandboxFilesystemNotFoundError, SandboxFilesystemPathAlreadyExistsError, SandboxFilesystemPermissionError, type SandboxFromNameParams, type SandboxListParams, type SandboxMountImageParams, type SandboxReloadVolumesParams, SandboxService, SandboxSnapshot, type SandboxSnapshotDirectoryParams, type SandboxSnapshotFilesystemParams, SandboxSnapshotService, type SandboxTerminateParams, SandboxTimeoutError, type SandboxUpdateNetworkPolicyParams, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, SidecarContainer, type SidecarCreateParams, type SidecarExecParams, type SidecarGetParams, type SidecarListParams, type SidecarMountImageParams, SidecarService, type SidecarSnapshotDirectoryParams, type SidecarSnapshotFilesystemParams, type SidecarTerminateParams, type SidecarUnmountImageParams, SnapshotCreationError, type StdioBehavior, type StreamMode, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, type VolumeMountOptionsParams, VolumeService, checkForRenamedParams };
+export { AlreadyExistsError, App, type AppFromNameParams, AppService, ClientClosedError, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ConflictError, ContainerProcess, ExecutionError, ExperimentalOutboundPolicy, type FileInfo, type FileType, type FileWatchEvent, type FileWatchEventType, type FunctionAutoscalerSettings, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, type FunctionCallLogFetchParams, type FunctionCallLogStreamParams, type FunctionCallLogTailParams, FunctionCallLogsManager, FunctionCallService, type FunctionFromNameParams, type FunctionLogFetchParams, type FunctionLogStreamParams, type FunctionLogTailParams, FunctionLogsManager, FunctionService, type FunctionStats, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, type FunctionWithBatchingParams, type FunctionWithConcurrencyParams, type FunctionWithOptionsParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, type ImageFromNameParams, type ImagePublishParams, ImageService, InternalFailure, InvalidError, type LogEntry, type FunctionLogFetchParams as LogFetchParams, type LogLevel, type LogSource, type Logger, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, ResourceExhaustedError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, type SandboxExperimentalFromNameParams, type SandboxExperimentalFromSnapshotParams, type SandboxExperimentalGetExitSnapshotParams, type SandboxExperimentalListParams, SandboxFilesystem, SandboxFilesystemDirectoryNotEmptyError, SandboxFilesystemError, SandboxFilesystemFileTooLargeError, SandboxFilesystemIsADirectoryError, SandboxFilesystemNotADirectoryError, SandboxFilesystemNotFoundError, SandboxFilesystemPathAlreadyExistsError, SandboxFilesystemPermissionError, type SandboxFromNameParams, type SandboxListParams, type SandboxLogFetchParams, type SandboxLogTailParams, SandboxLogsManager, type SandboxMountImageParams, type SandboxReloadVolumesParams, type SandboxRuntime, SandboxService, SandboxSnapshot, type SandboxSnapshotDirectoryParams, type SandboxSnapshotFilesystemParams, SandboxSnapshotService, type SandboxTerminateParams, SandboxTimeoutError, type SandboxUpdateNetworkPolicyParams, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, SidecarContainer, type SidecarCreateParams, type SidecarExecParams, type SidecarGetParams, type SidecarListParams, type SidecarMountImageParams, SidecarService, type SidecarSnapshotDirectoryParams, type SidecarSnapshotFilesystemParams, type SidecarTerminateParams, type SidecarUnmountImageParams, SnapshotCreationError, type StdioBehavior, type StreamMode, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, type VolumeMountOptionsParams, VolumeService, checkForRenamedParams };