modal 0.10.2-dev.1 → 0.10.2-dev.2

package/dist/index.js

@@ -17639,7 +17639,8 @@ function createBaseEndpointCreateRequest() {
     inputModalities: [],
     environmentName: "",
     unauthenticated: false,
-    servingMode: 0
+    servingMode: 0,
+    sharedEndpointNoticeAcknowledged: false
   };
 }
 var EndpointCreateRequest = {
@@ -17678,6 +17679,9 @@ var EndpointCreateRequest = {
     if (message.servingMode !== 0) {
       writer.uint32(80).int32(message.servingMode);
     }
+    if (message.sharedEndpointNoticeAcknowledged !== false) {
+      writer.uint32(88).bool(message.sharedEndpointNoticeAcknowledged);
+    }
     return writer;
   },
   decode(input, length) {
@@ -17771,6 +17775,13 @@ var EndpointCreateRequest = {
           message.servingMode = reader.int32();
           continue;
         }
+        case 11: {
+          if (tag !== 88) {
+            break;
+          }
+          message.sharedEndpointNoticeAcknowledged = reader.bool();
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -17790,7 +17801,8 @@ var EndpointCreateRequest = {
       inputModalities: globalThis.Array.isArray(object?.inputModalities) ? object.inputModalities.map((e) => endpointInputModalityFromJSON(e)) : [],
       environmentName: isSet5(object.environmentName) ? globalThis.String(object.environmentName) : "",
       unauthenticated: isSet5(object.unauthenticated) ? globalThis.Boolean(object.unauthenticated) : false,
-      servingMode: isSet5(object.servingMode) ? endpointServingModeFromJSON(object.servingMode) : 0
+      servingMode: isSet5(object.servingMode) ? endpointServingModeFromJSON(object.servingMode) : 0,
+      sharedEndpointNoticeAcknowledged: isSet5(object.sharedEndpointNoticeAcknowledged) ? globalThis.Boolean(object.sharedEndpointNoticeAcknowledged) : false
     };
   },
   toJSON(message) {
@@ -17825,6 +17837,9 @@ var EndpointCreateRequest = {
     if (message.servingMode !== 0) {
       obj.servingMode = endpointServingModeToJSON(message.servingMode);
     }
+    if (message.sharedEndpointNoticeAcknowledged !== false) {
+      obj.sharedEndpointNoticeAcknowledged = message.sharedEndpointNoticeAcknowledged;
+    }
     return obj;
   },
   create(base) {
@@ -17842,6 +17857,7 @@ var EndpointCreateRequest = {
     message.environmentName = object.environmentName ?? "";
     message.unauthenticated = object.unauthenticated ?? false;
     message.servingMode = object.servingMode ?? 0;
+    message.sharedEndpointNoticeAcknowledged = object.sharedEndpointNoticeAcknowledged ?? false;
     return message;
   }
 };
@@ -22400,8 +22416,6 @@ function createBaseFunctionMessage() {
     cloudBucketMounts: [],
     schedulerPlacement: void 0,
     isClass: false,
-    useFunctionId: "",
-    useMethodName: "",
     classParameterInfo: void 0,
     batchMaxSize: 0,
     batchLingerMs: 0,
@@ -22572,12 +22586,6 @@ var FunctionMessage = {
     if (message.isClass !== false) {
       writer.uint32(424).bool(message.isClass);
     }
-    if (message.useFunctionId !== "") {
-      writer.uint32(434).string(message.useFunctionId);
-    }
-    if (message.useMethodName !== "") {
-      writer.uint32(442).string(message.useMethodName);
-    }
     if (message.classParameterInfo !== void 0) {
       ClassParameterInfo.encode(message.classParameterInfo, writer.uint32(450).fork()).join();
     }
@@ -23003,20 +23011,6 @@ var FunctionMessage = {
           message.isClass = reader.bool();
           continue;
         }
-        case 54: {
-          if (tag !== 434) {
-            break;
-          }
-          message.useFunctionId = reader.string();
-          continue;
-        }
-        case 55: {
-          if (tag !== 442) {
-            break;
-          }
-          message.useMethodName = reader.string();
-          continue;
-        }
         case 56: {
           if (tag !== 450) {
             break;
@@ -23349,8 +23343,6 @@ var FunctionMessage = {
       cloudBucketMounts: globalThis.Array.isArray(object?.cloudBucketMounts) ? object.cloudBucketMounts.map((e) => CloudBucketMount.fromJSON(e)) : [],
       schedulerPlacement: isSet5(object.schedulerPlacement) ? SchedulerPlacement.fromJSON(object.schedulerPlacement) : void 0,
       isClass: isSet5(object.isClass) ? globalThis.Boolean(object.isClass) : false,
-      useFunctionId: isSet5(object.useFunctionId) ? globalThis.String(object.useFunctionId) : "",
-      useMethodName: isSet5(object.useMethodName) ? globalThis.String(object.useMethodName) : "",
       classParameterInfo: isSet5(object.classParameterInfo) ? ClassParameterInfo.fromJSON(object.classParameterInfo) : void 0,
       batchMaxSize: isSet5(object.batchMaxSize) ? globalThis.Number(object.batchMaxSize) : 0,
       batchLingerMs: isSet5(object.batchLingerMs) ? globalThis.Number(object.batchLingerMs) : 0,
@@ -23527,12 +23519,6 @@ var FunctionMessage = {
     if (message.isClass !== false) {
       obj.isClass = message.isClass;
     }
-    if (message.useFunctionId !== "") {
-      obj.useFunctionId = message.useFunctionId;
-    }
-    if (message.useMethodName !== "") {
-      obj.useMethodName = message.useMethodName;
-    }
     if (message.classParameterInfo !== void 0) {
       obj.classParameterInfo = ClassParameterInfo.toJSON(message.classParameterInfo);
     }
@@ -23706,8 +23692,6 @@ var FunctionMessage = {
     message.cloudBucketMounts = object.cloudBucketMounts?.map((e) => CloudBucketMount.fromPartial(e)) || [];
     message.schedulerPlacement = object.schedulerPlacement !== void 0 && object.schedulerPlacement !== null ? SchedulerPlacement.fromPartial(object.schedulerPlacement) : void 0;
     message.isClass = object.isClass ?? false;
-    message.useFunctionId = object.useFunctionId ?? "";
-    message.useMethodName = object.useMethodName ?? "";
     message.classParameterInfo = object.classParameterInfo !== void 0 && object.classParameterInfo !== null ? ClassParameterInfo.fromPartial(object.classParameterInfo) : void 0;
     message.batchMaxSize = object.batchMaxSize ?? 0;
     message.batchLingerMs = object.batchLingerMs ?? 0;
@@ -25479,8 +25463,6 @@ function createBaseFunctionData() {
     isClass: false,
     classParameterInfo: void 0,
     isMethod: false,
-    useFunctionId: "",
-    useMethodName: "",
     rankedFunctions: [],
     schedule: void 0,
     untrusted: false,
@@ -25572,12 +25554,6 @@ var FunctionData = {
     if (message.isMethod !== false) {
       writer.uint32(120).bool(message.isMethod);
     }
-    if (message.useFunctionId !== "") {
-      writer.uint32(130).string(message.useFunctionId);
-    }
-    if (message.useMethodName !== "") {
-      writer.uint32(138).string(message.useMethodName);
-    }
     for (const v of message.rankedFunctions) {
       FunctionData_RankedFunction.encode(v, writer.uint32(146).fork()).join();
     }
@@ -25809,20 +25785,6 @@ var FunctionData = {
           message.isMethod = reader.bool();
           continue;
         }
-        case 16: {
-          if (tag !== 130) {
-            break;
-          }
-          message.useFunctionId = reader.string();
-          continue;
-        }
-        case 17: {
-          if (tag !== 138) {
-            break;
-          }
-          message.useMethodName = reader.string();
-          continue;
-        }
         case 18: {
           if (tag !== 146) {
             break;
@@ -26002,8 +25964,6 @@ var FunctionData = {
       isClass: isSet5(object.isClass) ? globalThis.Boolean(object.isClass) : false,
       classParameterInfo: isSet5(object.classParameterInfo) ? ClassParameterInfo.fromJSON(object.classParameterInfo) : void 0,
       isMethod: isSet5(object.isMethod) ? globalThis.Boolean(object.isMethod) : false,
-      useFunctionId: isSet5(object.useFunctionId) ? globalThis.String(object.useFunctionId) : "",
-      useMethodName: isSet5(object.useMethodName) ? globalThis.String(object.useMethodName) : "",
       rankedFunctions: globalThis.Array.isArray(object?.rankedFunctions) ? object.rankedFunctions.map((e) => FunctionData_RankedFunction.fromJSON(e)) : [],
       schedule: isSet5(object.schedule) ? Schedule.fromJSON(object.schedule) : void 0,
       untrusted: isSet5(object.untrusted) ? globalThis.Boolean(object.untrusted) : false,
@@ -26104,12 +26064,6 @@ var FunctionData = {
     if (message.isMethod !== false) {
       obj.isMethod = message.isMethod;
     }
-    if (message.useFunctionId !== "") {
-      obj.useFunctionId = message.useFunctionId;
-    }
-    if (message.useMethodName !== "") {
-      obj.useMethodName = message.useMethodName;
-    }
     if (message.rankedFunctions?.length) {
       obj.rankedFunctions = message.rankedFunctions.map((e) => FunctionData_RankedFunction.toJSON(e));
     }
@@ -26205,8 +26159,6 @@ var FunctionData = {
     message.isClass = object.isClass ?? false;
     message.classParameterInfo = object.classParameterInfo !== void 0 && object.classParameterInfo !== null ? ClassParameterInfo.fromPartial(object.classParameterInfo) : void 0;
     message.isMethod = object.isMethod ?? false;
-    message.useFunctionId = object.useFunctionId ?? "";
-    message.useMethodName = object.useMethodName ?? "";
     message.rankedFunctions = object.rankedFunctions?.map((e) => FunctionData_RankedFunction.fromPartial(e)) || [];
     message.schedule = object.schedule !== void 0 && object.schedule !== null ? Schedule.fromPartial(object.schedule) : void 0;
     message.untrusted = object.untrusted ?? false;
@@ -28839,7 +28791,6 @@ function createBaseFunctionHandleMetadata() {
     functionType: 0,
     webUrl: "",
     isMethod: false,
-    useFunctionId: "",
     useMethodName: "",
     definitionId: "",
     classParameterInfo: void 0,
@@ -28870,9 +28821,6 @@ var FunctionHandleMetadata = {
     if (message.isMethod !== false) {
       writer.uint32(312).bool(message.isMethod);
     }
-    if (message.useFunctionId !== "") {
-      writer.uint32(322).string(message.useFunctionId);
-    }
     if (message.useMethodName !== "") {
       writer.uint32(330).string(message.useMethodName);
     }
@@ -28956,13 +28904,6 @@ var FunctionHandleMetadata = {
           message.isMethod = reader.bool();
           continue;
         }
-        case 40: {
-          if (tag !== 322) {
-            break;
-          }
-          message.useFunctionId = reader.string();
-          continue;
-        }
         case 41: {
           if (tag !== 330) {
             break;
@@ -29092,7 +29033,6 @@ var FunctionHandleMetadata = {
       functionType: isSet5(object.functionType) ? function_FunctionTypeFromJSON(object.functionType) : 0,
       webUrl: isSet5(object.webUrl) ? globalThis.String(object.webUrl) : "",
       isMethod: isSet5(object.isMethod) ? globalThis.Boolean(object.isMethod) : false,
-      useFunctionId: isSet5(object.useFunctionId) ? globalThis.String(object.useFunctionId) : "",
       useMethodName: isSet5(object.useMethodName) ? globalThis.String(object.useMethodName) : "",
       definitionId: isSet5(object.definitionId) ? globalThis.String(object.definitionId) : "",
       classParameterInfo: isSet5(object.classParameterInfo) ? ClassParameterInfo.fromJSON(object.classParameterInfo) : void 0,
@@ -29129,9 +29069,6 @@ var FunctionHandleMetadata = {
     if (message.isMethod !== false) {
       obj.isMethod = message.isMethod;
     }
-    if (message.useFunctionId !== "") {
-      obj.useFunctionId = message.useFunctionId;
-    }
     if (message.useMethodName !== "") {
       obj.useMethodName = message.useMethodName;
     }
@@ -29191,7 +29128,6 @@ var FunctionHandleMetadata = {
     message.functionType = object.functionType ?? 0;
     message.webUrl = object.webUrl ?? "";
     message.isMethod = object.isMethod ?? false;
-    message.useFunctionId = object.useFunctionId ?? "";
     message.useMethodName = object.useMethodName ?? "";
     message.definitionId = object.definitionId ?? "";
     message.classParameterInfo = object.classParameterInfo !== void 0 && object.classParameterInfo !== null ? ClassParameterInfo.fromPartial(object.classParameterInfo) : void 0;
@@ -30079,8 +30015,6 @@ function createBaseFunctionPrecreateRequest() {
     existingFunctionId: "",
     functionType: 0,
     webhookConfig: void 0,
-    useFunctionId: "",
-    useMethodName: "",
     methodDefinitions: {},
     functionSchema: void 0,
     supportedInputFormats: [],
@@ -30104,12 +30038,6 @@ var FunctionPrecreateRequest = {
     if (message.webhookConfig !== void 0) {
       WebhookConfig.encode(message.webhookConfig, writer.uint32(42).fork()).join();
     }
-    if (message.useFunctionId !== "") {
-      writer.uint32(50).string(message.useFunctionId);
-    }
-    if (message.useMethodName !== "") {
-      writer.uint32(58).string(message.useMethodName);
-    }
     Object.entries(message.methodDefinitions).forEach(([key, value]) => {
       FunctionPrecreateRequest_MethodDefinitionsEntry.encode({ key, value }, writer.uint32(66).fork()).join();
     });
@@ -30170,20 +30098,6 @@ var FunctionPrecreateRequest = {
           message.webhookConfig = WebhookConfig.decode(reader, reader.uint32());
           continue;
         }
-        case 6: {
-          if (tag !== 50) {
-            break;
-          }
-          message.useFunctionId = reader.string();
-          continue;
-        }
-        case 7: {
-          if (tag !== 58) {
-            break;
-          }
-          message.useMethodName = reader.string();
-          continue;
-        }
         case 8: {
           if (tag !== 66) {
             break;
@@ -30244,8 +30158,6 @@ var FunctionPrecreateRequest = {
       existingFunctionId: isSet5(object.existingFunctionId) ? globalThis.String(object.existingFunctionId) : "",
       functionType: isSet5(object.functionType) ? function_FunctionTypeFromJSON(object.functionType) : 0,
       webhookConfig: isSet5(object.webhookConfig) ? WebhookConfig.fromJSON(object.webhookConfig) : void 0,
-      useFunctionId: isSet5(object.useFunctionId) ? globalThis.String(object.useFunctionId) : "",
-      useMethodName: isSet5(object.useMethodName) ? globalThis.String(object.useMethodName) : "",
       methodDefinitions: isObject2(object.methodDefinitions) ? Object.entries(object.methodDefinitions).reduce((acc, [key, value]) => {
         acc[key] = MethodDefinition.fromJSON(value);
         return acc;
@@ -30272,12 +30184,6 @@ var FunctionPrecreateRequest = {
     if (message.webhookConfig !== void 0) {
       obj.webhookConfig = WebhookConfig.toJSON(message.webhookConfig);
     }
-    if (message.useFunctionId !== "") {
-      obj.useFunctionId = message.useFunctionId;
-    }
-    if (message.useMethodName !== "") {
-      obj.useMethodName = message.useMethodName;
-    }
     if (message.methodDefinitions) {
       const entries = Object.entries(message.methodDefinitions);
       if (entries.length > 0) {
@@ -30308,8 +30214,6 @@ var FunctionPrecreateRequest = {
     message.existingFunctionId = object.existingFunctionId ?? "";
     message.functionType = object.functionType ?? 0;
     message.webhookConfig = object.webhookConfig !== void 0 && object.webhookConfig !== null ? WebhookConfig.fromPartial(object.webhookConfig) : void 0;
-    message.useFunctionId = object.useFunctionId ?? "";
-    message.useMethodName = object.useMethodName ?? "";
     message.methodDefinitions = Object.entries(object.methodDefinitions ?? {}).reduce((acc, [key, value]) => {
       if (value !== void 0) {
         acc[key] = MethodDefinition.fromPartial(value);
@@ -32053,7 +31957,8 @@ function createBaseHTTPConfig() {
     exitGracePeriod: 0,
     h2Enabled: false,
     targetConcurrency: 0,
-    unauthenticated: false
+    unauthenticated: false,
+    liftAndShiftConfig: void 0
   };
 }
 var HTTPConfig = {
@@ -32079,6 +31984,9 @@ var HTTPConfig = {
     if (message.unauthenticated !== false) {
       writer.uint32(56).bool(message.unauthenticated);
     }
+    if (message.liftAndShiftConfig !== void 0) {
+      LiftAndShiftConfig.encode(message.liftAndShiftConfig, writer.uint32(66).fork()).join();
+    }
     return writer;
   },
   decode(input, length) {
@@ -32137,6 +32045,13 @@ var HTTPConfig = {
           message.unauthenticated = reader.bool();
           continue;
         }
+        case 8: {
+          if (tag !== 66) {
+            break;
+          }
+          message.liftAndShiftConfig = LiftAndShiftConfig.decode(reader, reader.uint32());
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -32153,7 +32068,8 @@ var HTTPConfig = {
       exitGracePeriod: isSet5(object.exitGracePeriod) ? globalThis.Number(object.exitGracePeriod) : 0,
       h2Enabled: isSet5(object.h2Enabled) ? globalThis.Boolean(object.h2Enabled) : false,
       targetConcurrency: isSet5(object.targetConcurrency) ? globalThis.Number(object.targetConcurrency) : 0,
-      unauthenticated: isSet5(object.unauthenticated) ? globalThis.Boolean(object.unauthenticated) : false
+      unauthenticated: isSet5(object.unauthenticated) ? globalThis.Boolean(object.unauthenticated) : false,
+      liftAndShiftConfig: isSet5(object.liftAndShiftConfig) ? LiftAndShiftConfig.fromJSON(object.liftAndShiftConfig) : void 0
     };
   },
   toJSON(message) {
@@ -32179,6 +32095,9 @@ var HTTPConfig = {
     if (message.unauthenticated !== false) {
       obj.unauthenticated = message.unauthenticated;
     }
+    if (message.liftAndShiftConfig !== void 0) {
+      obj.liftAndShiftConfig = LiftAndShiftConfig.toJSON(message.liftAndShiftConfig);
+    }
     return obj;
   },
   create(base) {
@@ -32193,6 +32112,7 @@ var HTTPConfig = {
     message.h2Enabled = object.h2Enabled ?? false;
     message.targetConcurrency = object.targetConcurrency ?? 0;
     message.unauthenticated = object.unauthenticated ?? false;
+    message.liftAndShiftConfig = object.liftAndShiftConfig !== void 0 && object.liftAndShiftConfig !== null ? LiftAndShiftConfig.fromPartial(object.liftAndShiftConfig) : void 0;
     return message;
   }
 };
@@ -34968,6 +34888,43 @@ var InputInfo = {
     return message;
   }
 };
+function createBaseLiftAndShiftConfig() {
+  return {};
+}
+var LiftAndShiftConfig = {
+  encode(_, writer = new BinaryWriter()) {
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseLiftAndShiftConfig();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(_) {
+    return {};
+  },
+  toJSON(_) {
+    const obj = {};
+    return obj;
+  },
+  create(base) {
+    return LiftAndShiftConfig.fromPartial(base ?? {});
+  },
+  fromPartial(_) {
+    const message = createBaseLiftAndShiftConfig();
+    return message;
+  }
+};
 function createBaseListPagination() {
   return { maxObjects: 0, createdBefore: 0 };
 }
@@ -51593,7 +51550,8 @@ function createBaseTaskLogsBatch() {
     eof: false,
     ptyExecId: "",
     rootFunctionId: "",
-    ttlDays: 0
+    ttlDays: 0,
+    sandboxId: ""
   };
 }
 var TaskLogsBatch = {
@@ -51631,6 +51589,9 @@ var TaskLogsBatch = {
     if (message.ttlDays !== 0) {
       writer.uint32(136).uint32(message.ttlDays);
     }
+    if (message.sandboxId !== "") {
+      writer.uint32(146).string(message.sandboxId);
+    }
     return writer;
   },
   decode(input, length) {
@@ -51717,6 +51678,13 @@ var TaskLogsBatch = {
           message.ttlDays = reader.uint32();
           continue;
         }
+        case 18: {
+          if (tag !== 146) {
+            break;
+          }
+          message.sandboxId = reader.string();
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -51737,7 +51705,8 @@ var TaskLogsBatch = {
       eof: isSet5(object.eof) ? globalThis.Boolean(object.eof) : false,
       ptyExecId: isSet5(object.ptyExecId) ? globalThis.String(object.ptyExecId) : "",
       rootFunctionId: isSet5(object.rootFunctionId) ? globalThis.String(object.rootFunctionId) : "",
-      ttlDays: isSet5(object.ttlDays) ? globalThis.Number(object.ttlDays) : 0
+      ttlDays: isSet5(object.ttlDays) ? globalThis.Number(object.ttlDays) : 0,
+      sandboxId: isSet5(object.sandboxId) ? globalThis.String(object.sandboxId) : ""
     };
   },
   toJSON(message) {
@@ -51775,6 +51744,9 @@ var TaskLogsBatch = {
     if (message.ttlDays !== 0) {
       obj.ttlDays = Math.round(message.ttlDays);
     }
+    if (message.sandboxId !== "") {
+      obj.sandboxId = message.sandboxId;
+    }
     return obj;
   },
   create(base) {
@@ -51793,6 +51765,7 @@ var TaskLogsBatch = {
     message.ptyExecId = object.ptyExecId ?? "";
     message.rootFunctionId = object.rootFunctionId ?? "";
     message.ttlDays = object.ttlDays ?? 0;
+    message.sandboxId = object.sandboxId ?? "";
     return message;
   }
 };
@@ -68232,6 +68205,9 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
   async setNetworkAccess(request) {
     await this.callUnary(() => this.stub.taskSetNetworkAccess(request));
   }
+  async setOutboundPolicy(request) {
+    await this.callUnary(() => this.stub.taskSetOutboundPolicy(request));
+  }
   /**
    * Reload all Volumes mounted in the task to reflect their latest committed state.
    *
@@ -70290,6 +70266,19 @@ async function buildSandboxCreateRequestProto(appId, imageId, params = {}) {
       );
     }
   }
+  if (params.outboundPolicy !== void 0) {
+    params.outboundPolicy._validate();
+    if (params.blockNetwork) {
+      throw new InvalidError(
+        "outboundPolicy cannot be used when blockNetwork is enabled"
+      );
+    }
+    if (params.outboundDomainAllowlist && params.outboundDomainAllowlist.length > 0) {
+      throw new InvalidError(
+        "outboundPolicy cannot be used with outboundDomainAllowlist"
+      );
+    }
+  }
   const networkAccess = buildOutboundNetworkAccess(
     params.blockNetwork,
     params.outboundCidrAllowlist,
@@ -70370,6 +70359,7 @@ async function buildSandboxCreateRequestProto(appId, imageId, params = {}) {
       idleTimeoutSecs: params.idleTimeoutMs != void 0 ? params.idleTimeoutMs / 1e3 : void 0,
       workdir: params.workdir ?? void 0,
       networkAccess,
+      outboundPolicy: params.outboundPolicy?._toProto(),
       resources: Resources.create({
         milliCpu,
         milliCpuMax,
@@ -70430,7 +70420,7 @@ var SandboxService = class {
     );
     await hydrateSandboxSecrets(
       this.#client,
-      mergedSecrets,
+      [...mergedSecrets, ...params.outboundPolicy?._secrets() ?? []],
       params.cloudBucketMounts
     );
     const mergedParams = {
@@ -70491,7 +70481,7 @@ var SandboxService = class {
     Object.assign(envDict, params.env ?? {});
     await hydrateSandboxSecrets(
       this.#client,
-      resolvableSecrets,
+      [...resolvableSecrets, ...params.outboundPolicy?._secrets() ?? []],
       params.cloudBucketMounts
     );
     const mergedParams = {
@@ -71637,6 +71627,29 @@ var Sandbox2 = class _Sandbox {
     });
     await commandRouterClient.setNetworkAccess(request);
   }
+  /**
+   * Replace the outbound policy of a running Sandbox.
+   *
+   * The new policy replaces all existing policy configuration on the
+   * Sandbox; build a policy including any existing rules you want to keep.
+   *
+   * Only Sandboxes created with an `outboundPolicy` can be updated this
+   * way; for Sandboxes created without one this fails, since header
+   * replacement is only set up at creation time.
+   */
+  async updateOutboundPolicy(outboundPolicy) {
+    this.#ensureAttached();
+    outboundPolicy._validate();
+    const [, [taskId, commandRouterClient]] = await Promise.all([
+      hydrateSecrets(this.#client, outboundPolicy._secrets()),
+      this.#getCommandRouter()
+    ]);
+    const request = TaskSetOutboundPolicyRequest.create({
+      taskId,
+      outboundPolicy: outboundPolicy._toProto()
+    });
+    await commandRouterClient.setOutboundPolicy(request);
+  }
   /**
    * Reload all Volumes mounted in the Sandbox.
    *
@@ -72194,7 +72207,7 @@ var AuthTokenManager = class {
 };
 
 // src/version.ts
-var SDK_VERSION = "0.10.2-dev.1";
+var SDK_VERSION = "0.10.2-dev.2";
 function getSDKVersion() {
   return SDK_VERSION;
 }
@@ -74525,6 +74538,129 @@ var ClsInstance = class {
     return method;
   }
 };
+
+// src/outbound_policy.ts
+var DOMAIN_RE = /^(\*\.)?([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$/;
+var HEADER_NAME_RE = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+var MAX_HEADER_REPLACEMENTS = 25;
+function hasInvalidHeaderValueChar(value) {
+  for (const c of value) {
+    const code = c.codePointAt(0);
+    if (code < 32 && c !== "	" || code === 127) {
+      return true;
+    }
+  }
+  return false;
+}
+function templateReferencesKey(template) {
+  const isKeyStart = (c) => /[a-zA-Z_]/.test(c);
+  let i = template.indexOf("$");
+  while (i !== -1 && i + 1 < template.length) {
+    const c = template[i + 1];
+    if (c === "$") {
+      i = template.indexOf("$", i + 2);
+      continue;
+    }
+    if (isKeyStart(c)) {
+      return true;
+    }
+    i = template.indexOf("$", i + 1);
+  }
+  return false;
+}
+var OutboundPolicy2 = class _OutboundPolicy {
+  /** @internal */
+  _replacements;
+  /** @internal */
+  constructor(_replacements = []) {
+    this._replacements = _replacements;
+  }
+  /**
+   * Return a new {@link OutboundPolicy} with an added header replacement.
+   *
+   * @param params.domain Domain the replacements are scoped to. Supports `*.` wildcard
+   *   prefixes (matching the apex domain and subdomains) and a bare `"*"`.
+   * @param params.headers Header name -> header value. Values support `$KEY` templates
+   *   referencing keys in the replacement's `secret`.
+   * @param params.secret Named {@link Secret} (e.g. from `client.secrets.fromName`) whose
+   *   keys may be referenced in the header value templates. Static replacements pass no secret.
+   */
+  withHeaderReplacement(params) {
+    const { domain, headers, secret } = params;
+    return new _OutboundPolicy([
+      ...this._replacements,
+      { domain, headers: { ...headers }, secret }
+    ]);
+  }
+  /** Check all replacements, throwing `InvalidError` on the first violation found.
+   * @internal
+   */
+  _validate() {
+    let total = 0;
+    for (const replacement of this._replacements) {
+      const { domain, headers, secret } = replacement;
+      if (domain !== "*" && !DOMAIN_RE.test(domain)) {
+        throw new InvalidError(`Invalid domain: ${JSON.stringify(domain)}`);
+      }
+      const entries = Object.entries(headers);
+      if (entries.length === 0) {
+        throw new InvalidError("`headers` must contain at least one header");
+      }
+      for (const [name, value] of entries) {
+        if (!HEADER_NAME_RE.test(name)) {
+          throw new InvalidError(
+            `Invalid header name: ${JSON.stringify(name)}`
+          );
+        }
+        if (hasInvalidHeaderValueChar(value)) {
+          throw new InvalidError(
+            `Header value for ${JSON.stringify(name)} must not contain control characters (except tab)`
+          );
+        }
+        if (secret === void 0 && templateReferencesKey(value)) {
+          throw new InvalidError(
+            `Header value for ${JSON.stringify(name)} references a secret key, but no \`secret\` was passed`
+          );
+        }
+      }
+      if (secret !== void 0 && secretEnvDictHydrator(secret) !== void 0) {
+        throw new InvalidError(
+          "Outbound policies only support named secrets (e.g. `client.secrets.fromName`); ephemeral secrets (e.g. `client.secrets.fromObject`) are not yet supported"
+        );
+      }
+      total += entries.length;
+    }
+    if (total > MAX_HEADER_REPLACEMENTS) {
+      throw new InvalidError(
+        `Outbound policy cannot have more than ${MAX_HEADER_REPLACEMENTS} header replacements`
+      );
+    }
+  }
+  /** Deduplicated list of secrets referenced by the policy's replacements.
+   * @internal
+   */
+  _secrets() {
+    return [
+      ...new Set(
+        this._replacements.map((s) => s.secret).filter((s) => s !== void 0)
+      )
+    ];
+  }
+  /** Convert to the wire format. Referenced secrets must be hydrated first.
+   * @internal
+   */
+  _toProto() {
+    return OutboundPolicy.create({
+      headerReplacements: this._replacements.map(
+        (replacement) => OutboundPolicy_HeaderReplacement.create({
+          domain: replacement.domain,
+          secretId: replacement.secret?.secretId ?? "",
+          headers: replacement.headers
+        })
+      )
+    });
+  }
+};
 export {
   AlreadyExistsError,
   App,
@@ -74551,6 +74687,7 @@ export {
   InvalidError,
   ModalClient,
   NotFoundError,
+  OutboundPolicy2 as OutboundPolicy,
   Probe2 as Probe,
   Proxy2 as Proxy,
   ProxyService,