modal 0.10.2-dev.6 → 0.10.2-dev.8

package/dist/index.d.cts

@@ -702,6 +702,8 @@ interface AppGetInfoResponse_FunctionInfoSummary {
     /** True for Web Functions and classes with web methods; false for Servers. */
     webFunction: boolean;
     requiresProxyAuth?: boolean | undefined;
+    /** True for Sessioned Servers. */
+    isSessioned: boolean;
 }
 declare const AppGetInfoResponse_FunctionInfoSummary: MessageFns$1<AppGetInfoResponse_FunctionInfoSummary>;
 interface AppGetLayoutRequest {
@@ -3305,11 +3307,11 @@ interface ObjectDependency {
 }
 declare const ObjectDependency: MessageFns$1<ObjectDependency>;
 /** Policy for outbound traffic from a sandbox. */
-interface OutboundPolicy$1 {
+interface OutboundPolicy {
     /** Replace headers in outbound HTTPS requests, potentially with secret values. */
     headerReplacements: OutboundPolicy_HeaderReplacement[];
 }
-declare const OutboundPolicy$1: MessageFns$1<OutboundPolicy$1>;
+declare const OutboundPolicy: MessageFns$1<OutboundPolicy>;
 interface OutboundPolicy_HeaderReplacement {
     /**
      * Domain that the header replacements are scoped to. Supports wildcards in
@@ -3654,7 +3656,10 @@ interface Sandbox$1 {
      * Set by the backend at snapshot creation time.
      */
     runscRuntimeVersion?: string | undefined;
-    /** If set, overrides the runtime used by the function, either "runc" or "gvisor". */
+    /**
+     * Runtime the sandbox runs in: "vm" for a virtual machine, or a container
+     * runtime such as "gvisor". Leave it unset to let Modal pick.
+     */
     runtime?: string | undefined;
     /** If set, the sandbox will be created with verbose logging enabled. */
     verbose: boolean;
@@ -3704,7 +3709,7 @@ interface Sandbox$1 {
      */
     inboundCidrAllowlist: string[];
     environmentVariables: StringMap | undefined;
-    outboundPolicy?: OutboundPolicy$1 | undefined;
+    outboundPolicy?: OutboundPolicy | undefined;
     /**
      * If set, the sandbox's main container is served an X.509-SVID over a
      * SPIFFE Workload API socket, addressed by SPIFFE_ENDPOINT_SOCKET. The
@@ -4097,6 +4102,14 @@ interface SecretDeleteRequest {
     secretId: string;
 }
 declare const SecretDeleteRequest: MessageFns$1<SecretDeleteRequest>;
+interface SecretGetInfoRequest {
+    secretId: string;
+}
+declare const SecretGetInfoRequest: MessageFns$1<SecretGetInfoRequest>;
+interface SecretGetInfoResponse {
+    metadata: SecretMetadata | undefined;
+}
+declare const SecretGetInfoResponse: MessageFns$1<SecretGetInfoResponse>;
 interface SecretGetOrCreateRequest {
     deploymentName: string;
     environmentName: string;
@@ -4140,6 +4153,7 @@ interface SecretMetadata {
     name: string;
     creationInfo: CreationInfo | undefined;
     keys: string[];
+    environmentName: string;
 }
 declare const SecretMetadata: MessageFns$1<SecretMetadata>;
 interface SecretUpdateRequest {
@@ -4959,6 +4973,11 @@ interface WebhookTokenListResponse {
     tokens: WebhookToken[];
 }
 declare const WebhookTokenListResponse: MessageFns$1<WebhookTokenListResponse>;
+interface WebhookTokenUpdateRequest {
+    tokenId: string;
+    name?: string | undefined;
+}
+declare const WebhookTokenUpdateRequest: MessageFns$1<WebhookTokenUpdateRequest>;
 interface WorkspaceBillingRatesRequest {
 }
 declare const WorkspaceBillingRatesRequest: MessageFns$1<WorkspaceBillingRatesRequest>;
@@ -6619,6 +6638,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly secretGetInfo: {
+            readonly name: "SecretGetInfo";
+            readonly requestType: MessageFns$1<SecretGetInfoRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<SecretGetInfoResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly secretGetOrCreate: {
             readonly name: "SecretGetOrCreate";
             readonly requestType: MessageFns$1<SecretGetOrCreateRequest>;
@@ -7053,6 +7080,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly webhookTokenUpdate: {
+            readonly name: "WebhookTokenUpdate";
+            readonly requestType: MessageFns$1<WebhookTokenUpdateRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<WebhookToken>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         /** Workspaces */
         readonly workspaceBillingRates: {
             readonly name: "WorkspaceBillingRates";
@@ -7319,6 +7354,8 @@ interface FunctionCallLogFetchParams {
     /** Filter by text contained in the log message. */
     searchText?: string;
 }
+type SandboxLogFetchParams = FunctionLogFetchParams;
+type SandboxLogTailParams = FunctionLogTailParams;
 interface FunctionLogs {
     fetch(params: FunctionLogFetchParams): AsyncIterable<LogEntry>;
     tail(params?: FunctionLogTailParams): AsyncIterable<LogEntry>;
@@ -7329,6 +7366,10 @@ interface FunctionCallLogs extends Omit<FunctionLogs, "fetch"> {
     tail(params?: FunctionCallLogTailParams): AsyncIterable<LogEntry>;
     stream(params?: FunctionCallLogStreamParams): AsyncIterable<LogEntry>;
 }
+interface SandboxLogs {
+    fetch(params: SandboxLogFetchParams): AsyncIterable<LogEntry>;
+    tail(params?: SandboxLogTailParams): AsyncIterable<LogEntry>;
+}
 interface LogQueryParams {
     client: ModalClient;
     objectId: string;
@@ -7481,6 +7522,59 @@ declare class FunctionCallLogsManager extends LogsManager implements FunctionCal
      */
     stream(params?: FunctionCallLogStreamParams): AsyncIterable<LogEntry>;
 }
+/** Namespace for Sandbox entrypoint log APIs. */
+declare class SandboxLogsManager implements SandboxLogs {
+    private readonly client;
+    private readonly sandboxId;
+    private readonly getAppId;
+    private readonly getTaskId;
+    /** @ignore */
+    constructor(client: ModalClient, sandboxId: string, getAppId: () => Promise<string>, getTaskId: () => Promise<string>);
+    /**
+     * Fetch Sandbox entrypoint logs corresponding to a UTC time range and
+     * optional filters.
+     *
+     * Entries are returned in chronological order.
+     *
+     * @returns An async iterable of {@link LogEntry} objects.
+     *
+     * @example
+     * ```typescript
+     * import { ModalClient } from "modal";
+     *
+     * const modal = new ModalClient();
+     * const sandbox = await modal.sandboxes.fromId("sb-...");
+     *
+     * for await (const entry of sandbox.logs.fetch({
+     *   since: new Date(Date.now() - 60 * 60 * 1_000),
+     *   source: "stdout",
+     * })) {
+     *   process.stdout.write(entry.message);
+     * }
+     * ```
+     */
+    fetch(params: SandboxLogFetchParams): AsyncIterable<LogEntry>;
+    /**
+     * Fetch the most recent Sandbox entrypoint logs.
+     *
+     * Entries are returned in chronological order.
+     *
+     * @returns An async iterable of {@link LogEntry} objects.
+     *
+     * @example
+     * ```typescript
+     * import { ModalClient } from "modal";
+     *
+     * const modal = new ModalClient();
+     * const sandbox = await modal.sandboxes.fromId("sb-...");
+     *
+     * for await (const entry of sandbox.logs.tail({ entries: 20 })) {
+     *   process.stdout.write(entry.message);
+     * }
+     * ```
+     */
+    tail(params?: SandboxLogTailParams): AsyncIterable<LogEntry>;
+}
 
 /**
  * Service for managing {@link FunctionCall}s.
@@ -8307,7 +8401,7 @@ declare const TaskSetNetworkAccessRequest: MessageFns<TaskSetNetworkAccessReques
 interface TaskSetOutboundPolicyRequest {
     taskId: string;
     /** Replaces the task's outbound policy. */
-    outboundPolicy: OutboundPolicy$1 | undefined;
+    outboundPolicy: OutboundPolicy | undefined;
 }
 declare const TaskSetOutboundPolicyRequest: MessageFns<TaskSetOutboundPolicyRequest>;
 interface TaskSnapshotDirectoryRequest {
@@ -8601,6 +8695,8 @@ type HeaderReplacement = {
  * Immutable configuration for replacing headers in outbound HTTPS requests
  * from a Sandbox.
  *
+ * EXPERIMENTAL: the API is subject to change.
+ *
  * Header values support templating with keys in a replacement's secret: a
  * `$`-prefixed key name in the secret is replaced with the secret value.
  * Literal `$` characters are written `$$`.
@@ -8611,7 +8707,7 @@ type HeaderReplacement = {
  * ```ts
  * const secret = await modal.secrets.fromName("api-token");
  *
- * const outboundPolicy = new modal.OutboundPolicy()
+ * const outboundPolicy = new modal.ExperimentalOutboundPolicy()
  *   // Inject a secret-backed Authorization header.
  *   .withHeaderReplacement({
  *     domain: "example.com",
@@ -8624,16 +8720,18 @@ type HeaderReplacement = {
  *     headers: { "X-Trace-Token": "trace_abcd" },
  *   });
  *
- * const sb = await modal.sandboxes.create(app, image, { outboundPolicy });
+ * const sb = await modal.sandboxes.create(app, image, {
+ *   experimentalOutboundPolicy: outboundPolicy,
+ * });
  * ```
  */
-declare class OutboundPolicy {
+declare class ExperimentalOutboundPolicy {
     /** @internal */
     readonly _replacements: readonly HeaderReplacement[];
     /** @internal */
     constructor(_replacements?: readonly HeaderReplacement[]);
     /**
-     * Return a new {@link OutboundPolicy} with an added header replacement.
+     * Return a new {@link ExperimentalOutboundPolicy} with an added header replacement.
      *
      * @param params.domain Domain the replacements are scoped to. Supports `*.` wildcard
      *   prefixes (matching the apex domain and subdomains) and a bare `"*"`.
@@ -8646,7 +8744,7 @@ declare class OutboundPolicy {
         domain: string;
         headers: Record<string, string>;
         secret?: Secret;
-    }): OutboundPolicy;
+    }): ExperimentalOutboundPolicy;
     /** Check all replacements, throwing `InvalidError` on the first violation found.
      * @internal
      */
@@ -8658,7 +8756,7 @@ declare class OutboundPolicy {
     /** Convert to the wire format. Referenced secrets must be hydrated first.
      * @internal
      */
-    _toProto(): OutboundPolicy$1;
+    _toProto(): OutboundPolicy;
 }
 
 /** Type of a filesystem entry. */
@@ -9133,6 +9231,8 @@ type StdioBehavior = "pipe" | "ignore";
  * means the data will be read as raw bytes (Uint8Array).
  */
 type StreamMode = "text" | "binary";
+/** Runtime a Sandbox runs in: a virtual machine, or gVisor. */
+type SandboxRuntime = "gvisor" | "vm";
 /** Optional parameters for {@link Probe.withTcp} and {@link Probe.withExec}. */
 type ProbeParams = {
     intervalMs: number;
@@ -9156,6 +9256,8 @@ type SandboxCreateParams = {
     memoryMiB?: number;
     /** Hard limit of memory in MiB. */
     memoryLimitMiB?: number;
+    /** Runtime under which the Sandbox executes, or undefined to let Modal pick. */
+    runtime?: SandboxRuntime;
     /** GPU reservation for the Sandbox (e.g. "A100", "T4:2", "A100-80GB:4"). */
     gpu?: string;
     /** Maximum lifetime of the Sandbox in milliseconds. Defaults to 5 minutes. */
@@ -9194,8 +9296,9 @@ type SandboxCreateParams = {
     outboundDomainAllowlist?: string[];
     /** Configuration for replacing headers in outbound HTTPS requests from the Sandbox.
      * Secrets referenced by the policy are resolved outside the Sandbox and are never
-     * visible to the workload. See {@link OutboundPolicy}. */
-    outboundPolicy?: OutboundPolicy;
+     * visible to the workload. See {@link ExperimentalOutboundPolicy}.
+     * EXPERIMENTAL: the API is subject to change. */
+    experimentalOutboundPolicy?: ExperimentalOutboundPolicy;
     /** List of CIDRs allowed to connect inbound to the Sandbox (tunnels and connection tokens). If not set, all IPs are allowed. Cannot be used with blockNetwork. */
     inboundCidrAllowlist?: string[];
     /** Enable private IPv6 networking (i6pn) so Sandboxes in the same workspace can address each
@@ -9504,6 +9607,18 @@ declare class Sandbox {
     get stdin(): ModalWriteStream<string>;
     get stdout(): ModalReadStream<string>;
     get stderr(): ModalReadStream<string>;
+    /**
+     * Access persisted entrypoint logs emitted by this Sandbox.
+     *
+     * Use {@link SandboxLogsManager#fetch fetch()} to read logs from a UTC time
+     * range and {@link SandboxLogsManager#tail tail()} to read the most recent
+     * logs.
+     *
+     * This is separate from {@link Sandbox#stdout stdout} and
+     * {@link Sandbox#stderr stderr}, which expose the Sandbox's live output
+     * streams.
+     */
+    get logs(): SandboxLogsManager;
     get filesystem(): SandboxFilesystem;
     /**
      * Operations for managing sidecar containers that run alongside the
@@ -9665,14 +9780,16 @@ declare class Sandbox {
     /**
      * Replace the outbound policy of a running Sandbox.
      *
+     * EXPERIMENTAL: the API is subject to change.
+     *
      * The new policy replaces all existing policy configuration on the
      * Sandbox; build a policy including any existing rules you want to keep.
      *
-     * Only Sandboxes created with an `outboundPolicy` can be updated this
+     * Only Sandboxes created with an `experimentalOutboundPolicy` can be updated this
      * way; for Sandboxes created without one this fails, since header
      * replacement is only set up at creation time.
      */
-    updateOutboundPolicy(outboundPolicy: OutboundPolicy): Promise<void>;
+    experimentalUpdateOutboundPolicy(outboundPolicy: ExperimentalOutboundPolicy): Promise<void>;
     /**
      * Reload all Volumes mounted in the Sandbox.
      *
@@ -9972,4 +10089,4 @@ declare class ClientClosedError extends Error {
 
 declare function checkForRenamedParams(params: any, renames: Record<string, string>): void;
 
-export { AlreadyExistsError, App, type AppFromNameParams, AppService, ClientClosedError, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ConflictError, ContainerProcess, ExecutionError, type FileInfo, type FileType, type FileWatchEvent, type FileWatchEventType, type FunctionAutoscalerSettings, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, type FunctionCallLogFetchParams, type FunctionCallLogStreamParams, type FunctionCallLogTailParams, FunctionCallLogsManager, FunctionCallService, type FunctionFromNameParams, type FunctionLogFetchParams, type FunctionLogStreamParams, type FunctionLogTailParams, FunctionLogsManager, FunctionService, type FunctionStats, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, type FunctionWithBatchingParams, type FunctionWithConcurrencyParams, type FunctionWithOptionsParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, type ImageFromNameParams, type ImagePublishParams, ImageService, InternalFailure, InvalidError, type LogEntry, type FunctionLogFetchParams as LogFetchParams, type LogLevel, type LogSource, type Logger, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, OutboundPolicy, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, type SandboxExperimentalFromNameParams, type SandboxExperimentalFromSnapshotParams, type SandboxExperimentalGetExitSnapshotParams, type SandboxExperimentalListParams, SandboxFilesystem, SandboxFilesystemDirectoryNotEmptyError, SandboxFilesystemError, SandboxFilesystemFileTooLargeError, SandboxFilesystemIsADirectoryError, SandboxFilesystemNotADirectoryError, SandboxFilesystemNotFoundError, SandboxFilesystemPathAlreadyExistsError, SandboxFilesystemPermissionError, type SandboxFromNameParams, type SandboxListParams, type SandboxMountImageParams, type SandboxReloadVolumesParams, SandboxService, SandboxSnapshot, type SandboxSnapshotDirectoryParams, type SandboxSnapshotFilesystemParams, SandboxSnapshotService, type SandboxTerminateParams, SandboxTimeoutError, type SandboxUpdateNetworkPolicyParams, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, SidecarContainer, type SidecarCreateParams, type SidecarExecParams, type SidecarGetParams, type SidecarListParams, type SidecarMountImageParams, SidecarService, type SidecarSnapshotDirectoryParams, type SidecarSnapshotFilesystemParams, type SidecarTerminateParams, type SidecarUnmountImageParams, SnapshotCreationError, type StdioBehavior, type StreamMode, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, type VolumeMountOptionsParams, VolumeService, checkForRenamedParams };
+export { AlreadyExistsError, App, type AppFromNameParams, AppService, ClientClosedError, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ConflictError, ContainerProcess, ExecutionError, ExperimentalOutboundPolicy, type FileInfo, type FileType, type FileWatchEvent, type FileWatchEventType, type FunctionAutoscalerSettings, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, type FunctionCallLogFetchParams, type FunctionCallLogStreamParams, type FunctionCallLogTailParams, FunctionCallLogsManager, FunctionCallService, type FunctionFromNameParams, type FunctionLogFetchParams, type FunctionLogStreamParams, type FunctionLogTailParams, FunctionLogsManager, FunctionService, type FunctionStats, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, type FunctionWithBatchingParams, type FunctionWithConcurrencyParams, type FunctionWithOptionsParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, type ImageFromNameParams, type ImagePublishParams, ImageService, InternalFailure, InvalidError, type LogEntry, type FunctionLogFetchParams as LogFetchParams, type LogLevel, type LogSource, type Logger, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, type SandboxExperimentalFromNameParams, type SandboxExperimentalFromSnapshotParams, type SandboxExperimentalGetExitSnapshotParams, type SandboxExperimentalListParams, SandboxFilesystem, SandboxFilesystemDirectoryNotEmptyError, SandboxFilesystemError, SandboxFilesystemFileTooLargeError, SandboxFilesystemIsADirectoryError, SandboxFilesystemNotADirectoryError, SandboxFilesystemNotFoundError, SandboxFilesystemPathAlreadyExistsError, SandboxFilesystemPermissionError, type SandboxFromNameParams, type SandboxListParams, type SandboxLogFetchParams, type SandboxLogTailParams, SandboxLogsManager, type SandboxMountImageParams, type SandboxReloadVolumesParams, type SandboxRuntime, SandboxService, SandboxSnapshot, type SandboxSnapshotDirectoryParams, type SandboxSnapshotFilesystemParams, SandboxSnapshotService, type SandboxTerminateParams, SandboxTimeoutError, type SandboxUpdateNetworkPolicyParams, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, SidecarContainer, type SidecarCreateParams, type SidecarExecParams, type SidecarGetParams, type SidecarListParams, type SidecarMountImageParams, SidecarService, type SidecarSnapshotDirectoryParams, type SidecarSnapshotFilesystemParams, type SidecarTerminateParams, type SidecarUnmountImageParams, SnapshotCreationError, type StdioBehavior, type StreamMode, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, type VolumeMountOptionsParams, VolumeService, checkForRenamedParams };

package/dist/index.d.ts

@@ -702,6 +702,8 @@ interface AppGetInfoResponse_FunctionInfoSummary {
     /** True for Web Functions and classes with web methods; false for Servers. */
     webFunction: boolean;
     requiresProxyAuth?: boolean | undefined;
+    /** True for Sessioned Servers. */
+    isSessioned: boolean;
 }
 declare const AppGetInfoResponse_FunctionInfoSummary: MessageFns$1<AppGetInfoResponse_FunctionInfoSummary>;
 interface AppGetLayoutRequest {
@@ -3305,11 +3307,11 @@ interface ObjectDependency {
 }
 declare const ObjectDependency: MessageFns$1<ObjectDependency>;
 /** Policy for outbound traffic from a sandbox. */
-interface OutboundPolicy$1 {
+interface OutboundPolicy {
     /** Replace headers in outbound HTTPS requests, potentially with secret values. */
     headerReplacements: OutboundPolicy_HeaderReplacement[];
 }
-declare const OutboundPolicy$1: MessageFns$1<OutboundPolicy$1>;
+declare const OutboundPolicy: MessageFns$1<OutboundPolicy>;
 interface OutboundPolicy_HeaderReplacement {
     /**
      * Domain that the header replacements are scoped to. Supports wildcards in
@@ -3654,7 +3656,10 @@ interface Sandbox$1 {
      * Set by the backend at snapshot creation time.
      */
     runscRuntimeVersion?: string | undefined;
-    /** If set, overrides the runtime used by the function, either "runc" or "gvisor". */
+    /**
+     * Runtime the sandbox runs in: "vm" for a virtual machine, or a container
+     * runtime such as "gvisor". Leave it unset to let Modal pick.
+     */
     runtime?: string | undefined;
     /** If set, the sandbox will be created with verbose logging enabled. */
     verbose: boolean;
@@ -3704,7 +3709,7 @@ interface Sandbox$1 {
      */
     inboundCidrAllowlist: string[];
     environmentVariables: StringMap | undefined;
-    outboundPolicy?: OutboundPolicy$1 | undefined;
+    outboundPolicy?: OutboundPolicy | undefined;
     /**
      * If set, the sandbox's main container is served an X.509-SVID over a
      * SPIFFE Workload API socket, addressed by SPIFFE_ENDPOINT_SOCKET. The
@@ -4097,6 +4102,14 @@ interface SecretDeleteRequest {
     secretId: string;
 }
 declare const SecretDeleteRequest: MessageFns$1<SecretDeleteRequest>;
+interface SecretGetInfoRequest {
+    secretId: string;
+}
+declare const SecretGetInfoRequest: MessageFns$1<SecretGetInfoRequest>;
+interface SecretGetInfoResponse {
+    metadata: SecretMetadata | undefined;
+}
+declare const SecretGetInfoResponse: MessageFns$1<SecretGetInfoResponse>;
 interface SecretGetOrCreateRequest {
     deploymentName: string;
     environmentName: string;
@@ -4140,6 +4153,7 @@ interface SecretMetadata {
     name: string;
     creationInfo: CreationInfo | undefined;
     keys: string[];
+    environmentName: string;
 }
 declare const SecretMetadata: MessageFns$1<SecretMetadata>;
 interface SecretUpdateRequest {
@@ -4959,6 +4973,11 @@ interface WebhookTokenListResponse {
     tokens: WebhookToken[];
 }
 declare const WebhookTokenListResponse: MessageFns$1<WebhookTokenListResponse>;
+interface WebhookTokenUpdateRequest {
+    tokenId: string;
+    name?: string | undefined;
+}
+declare const WebhookTokenUpdateRequest: MessageFns$1<WebhookTokenUpdateRequest>;
 interface WorkspaceBillingRatesRequest {
 }
 declare const WorkspaceBillingRatesRequest: MessageFns$1<WorkspaceBillingRatesRequest>;
@@ -6619,6 +6638,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly secretGetInfo: {
+            readonly name: "SecretGetInfo";
+            readonly requestType: MessageFns$1<SecretGetInfoRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<SecretGetInfoResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly secretGetOrCreate: {
             readonly name: "SecretGetOrCreate";
             readonly requestType: MessageFns$1<SecretGetOrCreateRequest>;
@@ -7053,6 +7080,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly webhookTokenUpdate: {
+            readonly name: "WebhookTokenUpdate";
+            readonly requestType: MessageFns$1<WebhookTokenUpdateRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<WebhookToken>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         /** Workspaces */
         readonly workspaceBillingRates: {
             readonly name: "WorkspaceBillingRates";
@@ -7319,6 +7354,8 @@ interface FunctionCallLogFetchParams {
     /** Filter by text contained in the log message. */
     searchText?: string;
 }
+type SandboxLogFetchParams = FunctionLogFetchParams;
+type SandboxLogTailParams = FunctionLogTailParams;
 interface FunctionLogs {
     fetch(params: FunctionLogFetchParams): AsyncIterable<LogEntry>;
     tail(params?: FunctionLogTailParams): AsyncIterable<LogEntry>;
@@ -7329,6 +7366,10 @@ interface FunctionCallLogs extends Omit<FunctionLogs, "fetch"> {
     tail(params?: FunctionCallLogTailParams): AsyncIterable<LogEntry>;
     stream(params?: FunctionCallLogStreamParams): AsyncIterable<LogEntry>;
 }
+interface SandboxLogs {
+    fetch(params: SandboxLogFetchParams): AsyncIterable<LogEntry>;
+    tail(params?: SandboxLogTailParams): AsyncIterable<LogEntry>;
+}
 interface LogQueryParams {
     client: ModalClient;
     objectId: string;
@@ -7481,6 +7522,59 @@ declare class FunctionCallLogsManager extends LogsManager implements FunctionCal
      */
     stream(params?: FunctionCallLogStreamParams): AsyncIterable<LogEntry>;
 }
+/** Namespace for Sandbox entrypoint log APIs. */
+declare class SandboxLogsManager implements SandboxLogs {
+    private readonly client;
+    private readonly sandboxId;
+    private readonly getAppId;
+    private readonly getTaskId;
+    /** @ignore */
+    constructor(client: ModalClient, sandboxId: string, getAppId: () => Promise<string>, getTaskId: () => Promise<string>);
+    /**
+     * Fetch Sandbox entrypoint logs corresponding to a UTC time range and
+     * optional filters.
+     *
+     * Entries are returned in chronological order.
+     *
+     * @returns An async iterable of {@link LogEntry} objects.
+     *
+     * @example
+     * ```typescript
+     * import { ModalClient } from "modal";
+     *
+     * const modal = new ModalClient();
+     * const sandbox = await modal.sandboxes.fromId("sb-...");
+     *
+     * for await (const entry of sandbox.logs.fetch({
+     *   since: new Date(Date.now() - 60 * 60 * 1_000),
+     *   source: "stdout",
+     * })) {
+     *   process.stdout.write(entry.message);
+     * }
+     * ```
+     */
+    fetch(params: SandboxLogFetchParams): AsyncIterable<LogEntry>;
+    /**
+     * Fetch the most recent Sandbox entrypoint logs.
+     *
+     * Entries are returned in chronological order.
+     *
+     * @returns An async iterable of {@link LogEntry} objects.
+     *
+     * @example
+     * ```typescript
+     * import { ModalClient } from "modal";
+     *
+     * const modal = new ModalClient();
+     * const sandbox = await modal.sandboxes.fromId("sb-...");
+     *
+     * for await (const entry of sandbox.logs.tail({ entries: 20 })) {
+     *   process.stdout.write(entry.message);
+     * }
+     * ```
+     */
+    tail(params?: SandboxLogTailParams): AsyncIterable<LogEntry>;
+}
 
 /**
  * Service for managing {@link FunctionCall}s.
@@ -8307,7 +8401,7 @@ declare const TaskSetNetworkAccessRequest: MessageFns<TaskSetNetworkAccessReques
 interface TaskSetOutboundPolicyRequest {
     taskId: string;
     /** Replaces the task's outbound policy. */
-    outboundPolicy: OutboundPolicy$1 | undefined;
+    outboundPolicy: OutboundPolicy | undefined;
 }
 declare const TaskSetOutboundPolicyRequest: MessageFns<TaskSetOutboundPolicyRequest>;
 interface TaskSnapshotDirectoryRequest {
@@ -8601,6 +8695,8 @@ type HeaderReplacement = {
  * Immutable configuration for replacing headers in outbound HTTPS requests
  * from a Sandbox.
  *
+ * EXPERIMENTAL: the API is subject to change.
+ *
  * Header values support templating with keys in a replacement's secret: a
  * `$`-prefixed key name in the secret is replaced with the secret value.
  * Literal `$` characters are written `$$`.
@@ -8611,7 +8707,7 @@ type HeaderReplacement = {
  * ```ts
  * const secret = await modal.secrets.fromName("api-token");
  *
- * const outboundPolicy = new modal.OutboundPolicy()
+ * const outboundPolicy = new modal.ExperimentalOutboundPolicy()
  *   // Inject a secret-backed Authorization header.
  *   .withHeaderReplacement({
  *     domain: "example.com",
@@ -8624,16 +8720,18 @@ type HeaderReplacement = {
  *     headers: { "X-Trace-Token": "trace_abcd" },
  *   });
  *
- * const sb = await modal.sandboxes.create(app, image, { outboundPolicy });
+ * const sb = await modal.sandboxes.create(app, image, {
+ *   experimentalOutboundPolicy: outboundPolicy,
+ * });
  * ```
  */
-declare class OutboundPolicy {
+declare class ExperimentalOutboundPolicy {
     /** @internal */
     readonly _replacements: readonly HeaderReplacement[];
     /** @internal */
     constructor(_replacements?: readonly HeaderReplacement[]);
     /**
-     * Return a new {@link OutboundPolicy} with an added header replacement.
+     * Return a new {@link ExperimentalOutboundPolicy} with an added header replacement.
      *
      * @param params.domain Domain the replacements are scoped to. Supports `*.` wildcard
      *   prefixes (matching the apex domain and subdomains) and a bare `"*"`.
@@ -8646,7 +8744,7 @@ declare class OutboundPolicy {
         domain: string;
         headers: Record<string, string>;
         secret?: Secret;
-    }): OutboundPolicy;
+    }): ExperimentalOutboundPolicy;
     /** Check all replacements, throwing `InvalidError` on the first violation found.
      * @internal
      */
@@ -8658,7 +8756,7 @@ declare class OutboundPolicy {
     /** Convert to the wire format. Referenced secrets must be hydrated first.
      * @internal
      */
-    _toProto(): OutboundPolicy$1;
+    _toProto(): OutboundPolicy;
 }
 
 /** Type of a filesystem entry. */
@@ -9133,6 +9231,8 @@ type StdioBehavior = "pipe" | "ignore";
  * means the data will be read as raw bytes (Uint8Array).
  */
 type StreamMode = "text" | "binary";
+/** Runtime a Sandbox runs in: a virtual machine, or gVisor. */
+type SandboxRuntime = "gvisor" | "vm";
 /** Optional parameters for {@link Probe.withTcp} and {@link Probe.withExec}. */
 type ProbeParams = {
     intervalMs: number;
@@ -9156,6 +9256,8 @@ type SandboxCreateParams = {
     memoryMiB?: number;
     /** Hard limit of memory in MiB. */
     memoryLimitMiB?: number;
+    /** Runtime under which the Sandbox executes, or undefined to let Modal pick. */
+    runtime?: SandboxRuntime;
     /** GPU reservation for the Sandbox (e.g. "A100", "T4:2", "A100-80GB:4"). */
     gpu?: string;
     /** Maximum lifetime of the Sandbox in milliseconds. Defaults to 5 minutes. */
@@ -9194,8 +9296,9 @@ type SandboxCreateParams = {
     outboundDomainAllowlist?: string[];
     /** Configuration for replacing headers in outbound HTTPS requests from the Sandbox.
      * Secrets referenced by the policy are resolved outside the Sandbox and are never
-     * visible to the workload. See {@link OutboundPolicy}. */
-    outboundPolicy?: OutboundPolicy;
+     * visible to the workload. See {@link ExperimentalOutboundPolicy}.
+     * EXPERIMENTAL: the API is subject to change. */
+    experimentalOutboundPolicy?: ExperimentalOutboundPolicy;
     /** List of CIDRs allowed to connect inbound to the Sandbox (tunnels and connection tokens). If not set, all IPs are allowed. Cannot be used with blockNetwork. */
     inboundCidrAllowlist?: string[];
     /** Enable private IPv6 networking (i6pn) so Sandboxes in the same workspace can address each
@@ -9504,6 +9607,18 @@ declare class Sandbox {
     get stdin(): ModalWriteStream<string>;
     get stdout(): ModalReadStream<string>;
     get stderr(): ModalReadStream<string>;
+    /**
+     * Access persisted entrypoint logs emitted by this Sandbox.
+     *
+     * Use {@link SandboxLogsManager#fetch fetch()} to read logs from a UTC time
+     * range and {@link SandboxLogsManager#tail tail()} to read the most recent
+     * logs.
+     *
+     * This is separate from {@link Sandbox#stdout stdout} and
+     * {@link Sandbox#stderr stderr}, which expose the Sandbox's live output
+     * streams.
+     */
+    get logs(): SandboxLogsManager;
     get filesystem(): SandboxFilesystem;
     /**
      * Operations for managing sidecar containers that run alongside the
@@ -9665,14 +9780,16 @@ declare class Sandbox {
     /**
      * Replace the outbound policy of a running Sandbox.
      *
+     * EXPERIMENTAL: the API is subject to change.
+     *
      * The new policy replaces all existing policy configuration on the
      * Sandbox; build a policy including any existing rules you want to keep.
      *
-     * Only Sandboxes created with an `outboundPolicy` can be updated this
+     * Only Sandboxes created with an `experimentalOutboundPolicy` can be updated this
      * way; for Sandboxes created without one this fails, since header
      * replacement is only set up at creation time.
      */
-    updateOutboundPolicy(outboundPolicy: OutboundPolicy): Promise<void>;
+    experimentalUpdateOutboundPolicy(outboundPolicy: ExperimentalOutboundPolicy): Promise<void>;
     /**
      * Reload all Volumes mounted in the Sandbox.
      *
@@ -9972,4 +10089,4 @@ declare class ClientClosedError extends Error {
 
 declare function checkForRenamedParams(params: any, renames: Record<string, string>): void;
 
-export { AlreadyExistsError, App, type AppFromNameParams, AppService, ClientClosedError, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ConflictError, ContainerProcess, ExecutionError, type FileInfo, type FileType, type FileWatchEvent, type FileWatchEventType, type FunctionAutoscalerSettings, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, type FunctionCallLogFetchParams, type FunctionCallLogStreamParams, type FunctionCallLogTailParams, FunctionCallLogsManager, FunctionCallService, type FunctionFromNameParams, type FunctionLogFetchParams, type FunctionLogStreamParams, type FunctionLogTailParams, FunctionLogsManager, FunctionService, type FunctionStats, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, type FunctionWithBatchingParams, type FunctionWithConcurrencyParams, type FunctionWithOptionsParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, type ImageFromNameParams, type ImagePublishParams, ImageService, InternalFailure, InvalidError, type LogEntry, type FunctionLogFetchParams as LogFetchParams, type LogLevel, type LogSource, type Logger, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, OutboundPolicy, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, type SandboxExperimentalFromNameParams, type SandboxExperimentalFromSnapshotParams, type SandboxExperimentalGetExitSnapshotParams, type SandboxExperimentalListParams, SandboxFilesystem, SandboxFilesystemDirectoryNotEmptyError, SandboxFilesystemError, SandboxFilesystemFileTooLargeError, SandboxFilesystemIsADirectoryError, SandboxFilesystemNotADirectoryError, SandboxFilesystemNotFoundError, SandboxFilesystemPathAlreadyExistsError, SandboxFilesystemPermissionError, type SandboxFromNameParams, type SandboxListParams, type SandboxMountImageParams, type SandboxReloadVolumesParams, SandboxService, SandboxSnapshot, type SandboxSnapshotDirectoryParams, type SandboxSnapshotFilesystemParams, SandboxSnapshotService, type SandboxTerminateParams, SandboxTimeoutError, type SandboxUpdateNetworkPolicyParams, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, SidecarContainer, type SidecarCreateParams, type SidecarExecParams, type SidecarGetParams, type SidecarListParams, type SidecarMountImageParams, SidecarService, type SidecarSnapshotDirectoryParams, type SidecarSnapshotFilesystemParams, type SidecarTerminateParams, type SidecarUnmountImageParams, SnapshotCreationError, type StdioBehavior, type StreamMode, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, type VolumeMountOptionsParams, VolumeService, checkForRenamedParams };
+export { AlreadyExistsError, App, type AppFromNameParams, AppService, ClientClosedError, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ConflictError, ContainerProcess, ExecutionError, ExperimentalOutboundPolicy, type FileInfo, type FileType, type FileWatchEvent, type FileWatchEventType, type FunctionAutoscalerSettings, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, type FunctionCallLogFetchParams, type FunctionCallLogStreamParams, type FunctionCallLogTailParams, FunctionCallLogsManager, FunctionCallService, type FunctionFromNameParams, type FunctionLogFetchParams, type FunctionLogStreamParams, type FunctionLogTailParams, FunctionLogsManager, FunctionService, type FunctionStats, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, type FunctionWithBatchingParams, type FunctionWithConcurrencyParams, type FunctionWithOptionsParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, type ImageFromNameParams, type ImagePublishParams, ImageService, InternalFailure, InvalidError, type LogEntry, type FunctionLogFetchParams as LogFetchParams, type LogLevel, type LogSource, type Logger, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, type SandboxExperimentalFromNameParams, type SandboxExperimentalFromSnapshotParams, type SandboxExperimentalGetExitSnapshotParams, type SandboxExperimentalListParams, SandboxFilesystem, SandboxFilesystemDirectoryNotEmptyError, SandboxFilesystemError, SandboxFilesystemFileTooLargeError, SandboxFilesystemIsADirectoryError, SandboxFilesystemNotADirectoryError, SandboxFilesystemNotFoundError, SandboxFilesystemPathAlreadyExistsError, SandboxFilesystemPermissionError, type SandboxFromNameParams, type SandboxListParams, type SandboxLogFetchParams, type SandboxLogTailParams, SandboxLogsManager, type SandboxMountImageParams, type SandboxReloadVolumesParams, type SandboxRuntime, SandboxService, SandboxSnapshot, type SandboxSnapshotDirectoryParams, type SandboxSnapshotFilesystemParams, SandboxSnapshotService, type SandboxTerminateParams, SandboxTimeoutError, type SandboxUpdateNetworkPolicyParams, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, SidecarContainer, type SidecarCreateParams, type SidecarExecParams, type SidecarGetParams, type SidecarListParams, type SidecarMountImageParams, SidecarService, type SidecarSnapshotDirectoryParams, type SidecarSnapshotFilesystemParams, type SidecarTerminateParams, type SidecarUnmountImageParams, SnapshotCreationError, type StdioBehavior, type StreamMode, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, type VolumeMountOptionsParams, VolumeService, checkForRenamedParams };