modal 0.10.2-dev.7 → 0.10.2-dev.9

package/dist/index.cjs

@@ -42,6 +42,7 @@ __export(index_exports, {
   ConflictError: () => ConflictError,
   ContainerProcess: () => ContainerProcess2,
   ExecutionError: () => ExecutionError,
+  ExperimentalOutboundPolicy: () => ExperimentalOutboundPolicy,
   FunctionCall: () => FunctionCall,
   FunctionCallLogsManager: () => FunctionCallLogsManager,
   FunctionCallService: () => FunctionCallService,
@@ -55,7 +56,6 @@ __export(index_exports, {
   InvalidError: () => InvalidError,
   ModalClient: () => ModalClient,
   NotFoundError: () => NotFoundError,
-  OutboundPolicy: () => OutboundPolicy2,
   Probe: () => Probe2,
   Proxy: () => Proxy3,
   ProxyService: () => ProxyService,
@@ -5585,7 +5585,7 @@ var AppGetInfoResponse = {
   }
 };
 function createBaseAppGetInfoResponse_FunctionInfoSummary() {
-  return { gpuConfig: [], schedule: void 0, webFunction: false, requiresProxyAuth: void 0 };
+  return { gpuConfig: [], schedule: void 0, webFunction: false, requiresProxyAuth: void 0, isSessioned: false };
 }
 var AppGetInfoResponse_FunctionInfoSummary = {
   encode(message, writer = new BinaryWriter()) {
@@ -5601,6 +5601,9 @@ var AppGetInfoResponse_FunctionInfoSummary = {
     if (message.requiresProxyAuth !== void 0) {
       writer.uint32(32).bool(message.requiresProxyAuth);
     }
+    if (message.isSessioned !== false) {
+      writer.uint32(40).bool(message.isSessioned);
+    }
     return writer;
   },
   decode(input, length) {
@@ -5638,6 +5641,13 @@ var AppGetInfoResponse_FunctionInfoSummary = {
           message.requiresProxyAuth = reader.bool();
           continue;
         }
+        case 5: {
+          if (tag !== 40) {
+            break;
+          }
+          message.isSessioned = reader.bool();
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -5651,7 +5661,8 @@ var AppGetInfoResponse_FunctionInfoSummary = {
       gpuConfig: globalThis.Array.isArray(object?.gpuConfig) ? object.gpuConfig.map((e) => GPUConfig.fromJSON(e)) : [],
       schedule: isSet5(object.schedule) ? Schedule.fromJSON(object.schedule) : void 0,
       webFunction: isSet5(object.webFunction) ? globalThis.Boolean(object.webFunction) : false,
-      requiresProxyAuth: isSet5(object.requiresProxyAuth) ? globalThis.Boolean(object.requiresProxyAuth) : void 0
+      requiresProxyAuth: isSet5(object.requiresProxyAuth) ? globalThis.Boolean(object.requiresProxyAuth) : void 0,
+      isSessioned: isSet5(object.isSessioned) ? globalThis.Boolean(object.isSessioned) : false
     };
   },
   toJSON(message) {
@@ -5668,6 +5679,9 @@ var AppGetInfoResponse_FunctionInfoSummary = {
     if (message.requiresProxyAuth !== void 0) {
       obj.requiresProxyAuth = message.requiresProxyAuth;
     }
+    if (message.isSessioned !== false) {
+      obj.isSessioned = message.isSessioned;
+    }
     return obj;
   },
   create(base) {
@@ -5679,6 +5693,7 @@ var AppGetInfoResponse_FunctionInfoSummary = {
     message.schedule = object.schedule !== void 0 && object.schedule !== null ? Schedule.fromPartial(object.schedule) : void 0;
     message.webFunction = object.webFunction ?? false;
     message.requiresProxyAuth = object.requiresProxyAuth ?? void 0;
+    message.isSessioned = object.isSessioned ?? false;
     return message;
   }
 };
@@ -58664,6 +58679,74 @@ var WebhookTokenListResponse = {
     return message;
   }
 };
+function createBaseWebhookTokenUpdateRequest() {
+  return { tokenId: "", name: void 0 };
+}
+var WebhookTokenUpdateRequest = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.tokenId !== "") {
+      writer.uint32(10).string(message.tokenId);
+    }
+    if (message.name !== void 0) {
+      writer.uint32(18).string(message.name);
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseWebhookTokenUpdateRequest();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.tokenId = reader.string();
+          continue;
+        }
+        case 2: {
+          if (tag !== 18) {
+            break;
+          }
+          message.name = reader.string();
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      tokenId: isSet5(object.tokenId) ? globalThis.String(object.tokenId) : "",
+      name: isSet5(object.name) ? globalThis.String(object.name) : void 0
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.tokenId !== "") {
+      obj.tokenId = message.tokenId;
+    }
+    if (message.name !== void 0) {
+      obj.name = message.name;
+    }
+    return obj;
+  },
+  create(base) {
+    return WebhookTokenUpdateRequest.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseWebhookTokenUpdateRequest();
+    message.tokenId = object.tokenId ?? "";
+    message.name = object.name ?? void 0;
+    return message;
+  }
+};
 function createBaseWorkspaceBillingRatesRequest() {
   return {};
 }
@@ -62636,6 +62719,14 @@ var ModalClientDefinition = {
       responseStream: false,
       options: {}
     },
+    webhookTokenUpdate: {
+      name: "WebhookTokenUpdate",
+      requestType: WebhookTokenUpdateRequest,
+      requestStream: false,
+      responseType: WebhookToken,
+      responseStream: false,
+      options: {}
+    },
     /** Workspaces */
     workspaceBillingRates: {
       name: "WorkspaceBillingRates",
@@ -68778,6 +68869,41 @@ function isSet6(value) {
 var import_promises = require("timers/promises");
 var import_nice_grpc7 = require("nice-grpc");
 
+// src/server_warnings.ts
+var SERVER_WARNING_HEADER = "x-modal-warning";
+var SERVER_WARNING_REGISTRY_LIMIT = 2048;
+function logServerWarnings(logger2, trailer, seen) {
+  const joined = trailer.get(SERVER_WARNING_HEADER);
+  if (typeof joined !== "string") return;
+  for (const encoded of joined.split(",")) {
+    let message;
+    try {
+      message = decodeURIComponent(encoded.trim());
+    } catch {
+      message = encoded.trim();
+    }
+    if (seen.size > SERVER_WARNING_REGISTRY_LIMIT) {
+      seen.clear();
+    }
+    if (seen.has(message)) continue;
+    seen.add(message);
+    logger2.warn(message);
+  }
+}
+function serverWarningMiddleware(logger2) {
+  const seen = /* @__PURE__ */ new Set();
+  return async function* serverWarningMiddleware2(call, options) {
+    const { onTrailer, ...restOptions } = options;
+    return yield* call.next(call.request, {
+      ...restOptions,
+      onTrailer: (trailer) => {
+        logServerWarnings(logger2, trailer, seen);
+        onTrailer?.(trailer);
+      }
+    });
+  };
+}
+
 // src/config.ts
 var import_node_console = require("console");
 var import_node_fs = require("fs");
@@ -68869,7 +68995,7 @@ function getProfile(profileName) {
       const ms = Math.round(parsed * 1e3);
       return parsed > 0 && ms === 0 ? 1 : ms;
     })(),
-    sandboxV2: process.env["MODAL_SANDBOX_V2"] ? parseBooleanFlag(process.env["MODAL_SANDBOX_V2"]) : parseBooleanFlag(profileData.sandbox_v2)
+    sandboxV2: process.env["MODAL_SANDBOX_V2"] ? parseBooleanFlag(process.env["MODAL_SANDBOX_V2"]) : profileData.sandbox_v2 !== void 0 ? parseBooleanFlag(profileData.sandbox_v2) : true
   };
   return profile;
 }
@@ -69091,7 +69217,7 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
       options.metadata ??= new import_nice_grpc7.Metadata();
       options.metadata.set("authorization", `Bearer ${self.jwt}`);
       return yield* call.next(call.request, options);
-    });
+    }).use(serverWarningMiddleware(logger2));
     this.factory = factory;
     this.stub = factory.create(TaskCommandRouterDefinition, this.channel);
     this.armIdleTimer();
@@ -71402,6 +71528,19 @@ function getSandboxVersion(sandboxId) {
   }
   return "V2" /* V2 */;
 }
+function sandboxRuntimeToProto(runtime) {
+  switch (runtime) {
+    case void 0:
+      return void 0;
+    case "gvisor":
+    case "vm":
+      return runtime;
+    default:
+      throw new Error(
+        `runtime must be "gvisor" or "vm", got ${JSON.stringify(runtime)}`
+      );
+  }
+}
 var Probe2 = class _Probe {
   #tcpPort;
   #execArgv;
@@ -71535,6 +71674,7 @@ async function buildSandboxCreateRequestProto(appId, imageId, params = {}) {
   if (params.workdir && !params.workdir.startsWith("/")) {
     throw new Error(`workdir must be an absolute path, got: ${params.workdir}`);
   }
+  const runtime = sandboxRuntimeToProto(params.runtime);
   const volumeMounts = params.volumes ? Object.entries(params.volumes).map(
     ([mountPath, volume]) => volumeToMountProto(mountPath, volume)
   ) : [];
@@ -71586,16 +71726,16 @@ async function buildSandboxCreateRequestProto(appId, imageId, params = {}) {
       );
     }
   }
-  if (params.outboundPolicy !== void 0) {
-    params.outboundPolicy._validate();
+  if (params.experimentalOutboundPolicy !== void 0) {
+    params.experimentalOutboundPolicy._validate();
     if (params.blockNetwork) {
       throw new InvalidError(
-        "outboundPolicy cannot be used when blockNetwork is enabled"
+        "experimentalOutboundPolicy cannot be used when blockNetwork is enabled"
       );
     }
     if (params.outboundDomainAllowlist && params.outboundDomainAllowlist.length > 0) {
       throw new InvalidError(
-        "outboundPolicy cannot be used with outboundDomainAllowlist"
+        "experimentalOutboundPolicy cannot be used with outboundDomainAllowlist"
       );
     }
   }
@@ -71679,7 +71819,7 @@ async function buildSandboxCreateRequestProto(appId, imageId, params = {}) {
       idleTimeoutSecs: params.idleTimeoutMs != void 0 ? params.idleTimeoutMs / 1e3 : void 0,
       workdir: params.workdir ?? void 0,
       networkAccess,
-      outboundPolicy: params.outboundPolicy?._toProto(),
+      outboundPolicy: params.experimentalOutboundPolicy?._toProto(),
       resources: Resources.create({
         milliCpu,
         milliCpuMax,
@@ -71703,7 +71843,8 @@ async function buildSandboxCreateRequestProto(appId, imageId, params = {}) {
       includeOidcIdentityToken: params.includeOidcIdentityToken ?? false,
       inboundCidrAllowlist: params.inboundCidrAllowlist ?? [],
       i6pnEnabled: params.i6pn ?? false,
-      enableSnapshot: params.experimentalEnableSnapshot ?? false
+      enableSnapshot: params.experimentalEnableSnapshot ?? false,
+      runtime
     }
   });
 }
@@ -71740,7 +71881,10 @@ var SandboxService = class {
     );
     await hydrateSandboxSecrets(
       this.#client,
-      [...mergedSecrets, ...params.outboundPolicy?._secrets() ?? []],
+      [
+        ...mergedSecrets,
+        ...params.experimentalOutboundPolicy?._secrets() ?? []
+      ],
       params.cloudBucketMounts
     );
     const mergedParams = {
@@ -71801,7 +71945,10 @@ var SandboxService = class {
     Object.assign(envDict, params.env ?? {});
     await hydrateSandboxSecrets(
       this.#client,
-      [...resolvableSecrets, ...params.outboundPolicy?._secrets() ?? []],
+      [
+        ...resolvableSecrets,
+        ...params.experimentalOutboundPolicy?._secrets() ?? []
+      ],
       params.cloudBucketMounts
     );
     const mergedParams = {
@@ -73009,14 +73156,16 @@ var Sandbox2 = class _Sandbox {
   /**
    * Replace the outbound policy of a running Sandbox.
    *
+   * EXPERIMENTAL: the API is subject to change.
+   *
    * The new policy replaces all existing policy configuration on the
    * Sandbox; build a policy including any existing rules you want to keep.
    *
-   * Only Sandboxes created with an `outboundPolicy` can be updated this
+   * Only Sandboxes created with an `experimentalOutboundPolicy` can be updated this
    * way; for Sandboxes created without one this fails, since header
    * replacement is only set up at creation time.
    */
-  async updateOutboundPolicy(outboundPolicy) {
+  async experimentalUpdateOutboundPolicy(outboundPolicy) {
     this.#ensureAttached();
     outboundPolicy._validate();
     const [, [taskId, commandRouterClient]] = await Promise.all([
@@ -73586,7 +73735,7 @@ var AuthTokenManager = class {
 };
 
 // src/version.ts
-var SDK_VERSION = "0.10.2-dev.7";
+var SDK_VERSION = "0.10.2-dev.9";
 function getSDKVersion() {
   return SDK_VERSION;
 }
@@ -73853,7 +74002,7 @@ var ModalClient = class {
       "grpc.keepalive_timeout_ms": 1e4,
       "grpc.keepalive_permit_without_calls": 1
     });
-    let factory = (0, import_nice_grpc14.createClientFactory)().use(this.authMiddleware(profile)).use(this.retryMiddleware()).use(timeoutMiddleware);
+    let factory = (0, import_nice_grpc14.createClientFactory)().use(this.authMiddleware(profile)).use(this.retryMiddleware()).use(serverWarningMiddleware(this.logger)).use(timeoutMiddleware);
     for (const middleware of this.customMiddleware) {
       factory = factory.use(middleware);
     }
@@ -76037,7 +76186,7 @@ function templateReferencesKey(template) {
   }
   return false;
 }
-var OutboundPolicy2 = class _OutboundPolicy {
+var ExperimentalOutboundPolicy = class _ExperimentalOutboundPolicy {
   /** @internal */
   _replacements;
   /** @internal */
@@ -76045,7 +76194,7 @@ var OutboundPolicy2 = class _OutboundPolicy {
     this._replacements = _replacements;
   }
   /**
-   * Return a new {@link OutboundPolicy} with an added header replacement.
+   * Return a new {@link ExperimentalOutboundPolicy} with an added header replacement.
    *
    * @param params.domain Domain the replacements are scoped to. Supports `*.` wildcard
    *   prefixes (matching the apex domain and subdomains) and a bare `"*"`.
@@ -76056,7 +76205,7 @@ var OutboundPolicy2 = class _OutboundPolicy {
    */
   withHeaderReplacement(params) {
     const { domain, headers, secret } = params;
-    return new _OutboundPolicy([
+    return new _ExperimentalOutboundPolicy([
       ...this._replacements,
       { domain, headers: { ...headers }, secret }
     ]);
@@ -76144,6 +76293,7 @@ var OutboundPolicy2 = class _OutboundPolicy {
   ConflictError,
   ContainerProcess,
   ExecutionError,
+  ExperimentalOutboundPolicy,
   FunctionCall,
   FunctionCallLogsManager,
   FunctionCallService,
@@ -76157,7 +76307,6 @@ var OutboundPolicy2 = class _OutboundPolicy {
   InvalidError,
   ModalClient,
   NotFoundError,
-  OutboundPolicy,
   Probe,
   Proxy,
   ProxyService,

package/dist/index.d.cts

@@ -702,6 +702,8 @@ interface AppGetInfoResponse_FunctionInfoSummary {
     /** True for Web Functions and classes with web methods; false for Servers. */
     webFunction: boolean;
     requiresProxyAuth?: boolean | undefined;
+    /** True for Sessioned Servers. */
+    isSessioned: boolean;
 }
 declare const AppGetInfoResponse_FunctionInfoSummary: MessageFns$1<AppGetInfoResponse_FunctionInfoSummary>;
 interface AppGetLayoutRequest {
@@ -3305,11 +3307,11 @@ interface ObjectDependency {
 }
 declare const ObjectDependency: MessageFns$1<ObjectDependency>;
 /** Policy for outbound traffic from a sandbox. */
-interface OutboundPolicy$1 {
+interface OutboundPolicy {
     /** Replace headers in outbound HTTPS requests, potentially with secret values. */
     headerReplacements: OutboundPolicy_HeaderReplacement[];
 }
-declare const OutboundPolicy$1: MessageFns$1<OutboundPolicy$1>;
+declare const OutboundPolicy: MessageFns$1<OutboundPolicy>;
 interface OutboundPolicy_HeaderReplacement {
     /**
      * Domain that the header replacements are scoped to. Supports wildcards in
@@ -3654,7 +3656,10 @@ interface Sandbox$1 {
      * Set by the backend at snapshot creation time.
      */
     runscRuntimeVersion?: string | undefined;
-    /** If set, overrides the runtime used by the function, either "runc" or "gvisor". */
+    /**
+     * Runtime the sandbox runs in: "vm" for a virtual machine, or a container
+     * runtime such as "gvisor". Leave it unset to let Modal pick.
+     */
     runtime?: string | undefined;
     /** If set, the sandbox will be created with verbose logging enabled. */
     verbose: boolean;
@@ -3704,7 +3709,7 @@ interface Sandbox$1 {
      */
     inboundCidrAllowlist: string[];
     environmentVariables: StringMap | undefined;
-    outboundPolicy?: OutboundPolicy$1 | undefined;
+    outboundPolicy?: OutboundPolicy | undefined;
     /**
      * If set, the sandbox's main container is served an X.509-SVID over a
      * SPIFFE Workload API socket, addressed by SPIFFE_ENDPOINT_SOCKET. The
@@ -4968,6 +4973,11 @@ interface WebhookTokenListResponse {
     tokens: WebhookToken[];
 }
 declare const WebhookTokenListResponse: MessageFns$1<WebhookTokenListResponse>;
+interface WebhookTokenUpdateRequest {
+    tokenId: string;
+    name?: string | undefined;
+}
+declare const WebhookTokenUpdateRequest: MessageFns$1<WebhookTokenUpdateRequest>;
 interface WorkspaceBillingRatesRequest {
 }
 declare const WorkspaceBillingRatesRequest: MessageFns$1<WorkspaceBillingRatesRequest>;
@@ -5024,7 +5034,7 @@ interface WorkspaceBillingSummaryResponse {
     meteredCostBreakdown: {
         [key: string]: string;
     };
-    /** keyed by plan, credits, reservations, storage */
+    /** keyed by plan, credits, reservations, storage, network egress allowance */
     adjustments: {
         [key: string]: string;
     };
@@ -7070,6 +7080,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly webhookTokenUpdate: {
+            readonly name: "WebhookTokenUpdate";
+            readonly requestType: MessageFns$1<WebhookTokenUpdateRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<WebhookToken>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         /** Workspaces */
         readonly workspaceBillingRates: {
             readonly name: "WorkspaceBillingRates";
@@ -8383,7 +8401,7 @@ declare const TaskSetNetworkAccessRequest: MessageFns<TaskSetNetworkAccessReques
 interface TaskSetOutboundPolicyRequest {
     taskId: string;
     /** Replaces the task's outbound policy. */
-    outboundPolicy: OutboundPolicy$1 | undefined;
+    outboundPolicy: OutboundPolicy | undefined;
 }
 declare const TaskSetOutboundPolicyRequest: MessageFns<TaskSetOutboundPolicyRequest>;
 interface TaskSnapshotDirectoryRequest {
@@ -8504,7 +8522,7 @@ interface Profile {
     sandboxChannelIdleTimeoutMs: number;
     /**
      * Set by the MODAL_SANDBOX_V2 environment variable or the sandbox_v2
-     * profile key in .modal.toml.
+     * profile key in .modal.toml. Defaults to true when neither is set.
      */
     sandboxV2: boolean;
 }
@@ -8677,6 +8695,8 @@ type HeaderReplacement = {
  * Immutable configuration for replacing headers in outbound HTTPS requests
  * from a Sandbox.
  *
+ * EXPERIMENTAL: the API is subject to change.
+ *
  * Header values support templating with keys in a replacement's secret: a
  * `$`-prefixed key name in the secret is replaced with the secret value.
  * Literal `$` characters are written `$$`.
@@ -8687,7 +8707,7 @@ type HeaderReplacement = {
  * ```ts
  * const secret = await modal.secrets.fromName("api-token");
  *
- * const outboundPolicy = new modal.OutboundPolicy()
+ * const outboundPolicy = new modal.ExperimentalOutboundPolicy()
  *   // Inject a secret-backed Authorization header.
  *   .withHeaderReplacement({
  *     domain: "example.com",
@@ -8700,16 +8720,18 @@ type HeaderReplacement = {
  *     headers: { "X-Trace-Token": "trace_abcd" },
  *   });
  *
- * const sb = await modal.sandboxes.create(app, image, { outboundPolicy });
+ * const sb = await modal.sandboxes.create(app, image, {
+ *   experimentalOutboundPolicy: outboundPolicy,
+ * });
  * ```
  */
-declare class OutboundPolicy {
+declare class ExperimentalOutboundPolicy {
     /** @internal */
     readonly _replacements: readonly HeaderReplacement[];
     /** @internal */
     constructor(_replacements?: readonly HeaderReplacement[]);
     /**
-     * Return a new {@link OutboundPolicy} with an added header replacement.
+     * Return a new {@link ExperimentalOutboundPolicy} with an added header replacement.
      *
      * @param params.domain Domain the replacements are scoped to. Supports `*.` wildcard
      *   prefixes (matching the apex domain and subdomains) and a bare `"*"`.
@@ -8722,7 +8744,7 @@ declare class OutboundPolicy {
         domain: string;
         headers: Record<string, string>;
         secret?: Secret;
-    }): OutboundPolicy;
+    }): ExperimentalOutboundPolicy;
     /** Check all replacements, throwing `InvalidError` on the first violation found.
      * @internal
      */
@@ -8734,7 +8756,7 @@ declare class OutboundPolicy {
     /** Convert to the wire format. Referenced secrets must be hydrated first.
      * @internal
      */
-    _toProto(): OutboundPolicy$1;
+    _toProto(): OutboundPolicy;
 }
 
 /** Type of a filesystem entry. */
@@ -9209,6 +9231,8 @@ type StdioBehavior = "pipe" | "ignore";
  * means the data will be read as raw bytes (Uint8Array).
  */
 type StreamMode = "text" | "binary";
+/** Runtime a Sandbox runs in: a virtual machine, or gVisor. */
+type SandboxRuntime = "gvisor" | "vm";
 /** Optional parameters for {@link Probe.withTcp} and {@link Probe.withExec}. */
 type ProbeParams = {
     intervalMs: number;
@@ -9232,6 +9256,8 @@ type SandboxCreateParams = {
     memoryMiB?: number;
     /** Hard limit of memory in MiB. */
     memoryLimitMiB?: number;
+    /** Runtime under which the Sandbox executes, or undefined to let Modal pick. */
+    runtime?: SandboxRuntime;
     /** GPU reservation for the Sandbox (e.g. "A100", "T4:2", "A100-80GB:4"). */
     gpu?: string;
     /** Maximum lifetime of the Sandbox in milliseconds. Defaults to 5 minutes. */
@@ -9270,8 +9296,9 @@ type SandboxCreateParams = {
     outboundDomainAllowlist?: string[];
     /** Configuration for replacing headers in outbound HTTPS requests from the Sandbox.
      * Secrets referenced by the policy are resolved outside the Sandbox and are never
-     * visible to the workload. See {@link OutboundPolicy}. */
-    outboundPolicy?: OutboundPolicy;
+     * visible to the workload. See {@link ExperimentalOutboundPolicy}.
+     * EXPERIMENTAL: the API is subject to change. */
+    experimentalOutboundPolicy?: ExperimentalOutboundPolicy;
     /** List of CIDRs allowed to connect inbound to the Sandbox (tunnels and connection tokens). If not set, all IPs are allowed. Cannot be used with blockNetwork. */
     inboundCidrAllowlist?: string[];
     /** Enable private IPv6 networking (i6pn) so Sandboxes in the same workspace can address each
@@ -9753,14 +9780,16 @@ declare class Sandbox {
     /**
      * Replace the outbound policy of a running Sandbox.
      *
+     * EXPERIMENTAL: the API is subject to change.
+     *
      * The new policy replaces all existing policy configuration on the
      * Sandbox; build a policy including any existing rules you want to keep.
      *
-     * Only Sandboxes created with an `outboundPolicy` can be updated this
+     * Only Sandboxes created with an `experimentalOutboundPolicy` can be updated this
      * way; for Sandboxes created without one this fails, since header
      * replacement is only set up at creation time.
      */
-    updateOutboundPolicy(outboundPolicy: OutboundPolicy): Promise<void>;
+    experimentalUpdateOutboundPolicy(outboundPolicy: ExperimentalOutboundPolicy): Promise<void>;
     /**
      * Reload all Volumes mounted in the Sandbox.
      *
@@ -10060,4 +10089,4 @@ declare class ClientClosedError extends Error {
 
 declare function checkForRenamedParams(params: any, renames: Record<string, string>): void;
 
-export { AlreadyExistsError, App, type AppFromNameParams, AppService, ClientClosedError, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ConflictError, ContainerProcess, ExecutionError, type FileInfo, type FileType, type FileWatchEvent, type FileWatchEventType, type FunctionAutoscalerSettings, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, type FunctionCallLogFetchParams, type FunctionCallLogStreamParams, type FunctionCallLogTailParams, FunctionCallLogsManager, FunctionCallService, type FunctionFromNameParams, type FunctionLogFetchParams, type FunctionLogStreamParams, type FunctionLogTailParams, FunctionLogsManager, FunctionService, type FunctionStats, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, type FunctionWithBatchingParams, type FunctionWithConcurrencyParams, type FunctionWithOptionsParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, type ImageFromNameParams, type ImagePublishParams, ImageService, InternalFailure, InvalidError, type LogEntry, type FunctionLogFetchParams as LogFetchParams, type LogLevel, type LogSource, type Logger, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, OutboundPolicy, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, type SandboxExperimentalFromNameParams, type SandboxExperimentalFromSnapshotParams, type SandboxExperimentalGetExitSnapshotParams, type SandboxExperimentalListParams, SandboxFilesystem, SandboxFilesystemDirectoryNotEmptyError, SandboxFilesystemError, SandboxFilesystemFileTooLargeError, SandboxFilesystemIsADirectoryError, SandboxFilesystemNotADirectoryError, SandboxFilesystemNotFoundError, SandboxFilesystemPathAlreadyExistsError, SandboxFilesystemPermissionError, type SandboxFromNameParams, type SandboxListParams, type SandboxLogFetchParams, type SandboxLogTailParams, SandboxLogsManager, type SandboxMountImageParams, type SandboxReloadVolumesParams, SandboxService, SandboxSnapshot, type SandboxSnapshotDirectoryParams, type SandboxSnapshotFilesystemParams, SandboxSnapshotService, type SandboxTerminateParams, SandboxTimeoutError, type SandboxUpdateNetworkPolicyParams, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, SidecarContainer, type SidecarCreateParams, type SidecarExecParams, type SidecarGetParams, type SidecarListParams, type SidecarMountImageParams, SidecarService, type SidecarSnapshotDirectoryParams, type SidecarSnapshotFilesystemParams, type SidecarTerminateParams, type SidecarUnmountImageParams, SnapshotCreationError, type StdioBehavior, type StreamMode, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, type VolumeMountOptionsParams, VolumeService, checkForRenamedParams };
+export { AlreadyExistsError, App, type AppFromNameParams, AppService, ClientClosedError, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ConflictError, ContainerProcess, ExecutionError, ExperimentalOutboundPolicy, type FileInfo, type FileType, type FileWatchEvent, type FileWatchEventType, type FunctionAutoscalerSettings, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, type FunctionCallLogFetchParams, type FunctionCallLogStreamParams, type FunctionCallLogTailParams, FunctionCallLogsManager, FunctionCallService, type FunctionFromNameParams, type FunctionLogFetchParams, type FunctionLogStreamParams, type FunctionLogTailParams, FunctionLogsManager, FunctionService, type FunctionStats, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, type FunctionWithBatchingParams, type FunctionWithConcurrencyParams, type FunctionWithOptionsParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, type ImageFromNameParams, type ImagePublishParams, ImageService, InternalFailure, InvalidError, type LogEntry, type FunctionLogFetchParams as LogFetchParams, type LogLevel, type LogSource, type Logger, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, type SandboxExperimentalFromNameParams, type SandboxExperimentalFromSnapshotParams, type SandboxExperimentalGetExitSnapshotParams, type SandboxExperimentalListParams, SandboxFilesystem, SandboxFilesystemDirectoryNotEmptyError, SandboxFilesystemError, SandboxFilesystemFileTooLargeError, SandboxFilesystemIsADirectoryError, SandboxFilesystemNotADirectoryError, SandboxFilesystemNotFoundError, SandboxFilesystemPathAlreadyExistsError, SandboxFilesystemPermissionError, type SandboxFromNameParams, type SandboxListParams, type SandboxLogFetchParams, type SandboxLogTailParams, SandboxLogsManager, type SandboxMountImageParams, type SandboxReloadVolumesParams, type SandboxRuntime, SandboxService, SandboxSnapshot, type SandboxSnapshotDirectoryParams, type SandboxSnapshotFilesystemParams, SandboxSnapshotService, type SandboxTerminateParams, SandboxTimeoutError, type SandboxUpdateNetworkPolicyParams, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, SidecarContainer, type SidecarCreateParams, type SidecarExecParams, type SidecarGetParams, type SidecarListParams, type SidecarMountImageParams, SidecarService, type SidecarSnapshotDirectoryParams, type SidecarSnapshotFilesystemParams, type SidecarTerminateParams, type SidecarUnmountImageParams, SnapshotCreationError, type StdioBehavior, type StreamMode, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, type VolumeMountOptionsParams, VolumeService, checkForRenamedParams };

package/dist/index.d.ts

@@ -702,6 +702,8 @@ interface AppGetInfoResponse_FunctionInfoSummary {
     /** True for Web Functions and classes with web methods; false for Servers. */
     webFunction: boolean;
     requiresProxyAuth?: boolean | undefined;
+    /** True for Sessioned Servers. */
+    isSessioned: boolean;
 }
 declare const AppGetInfoResponse_FunctionInfoSummary: MessageFns$1<AppGetInfoResponse_FunctionInfoSummary>;
 interface AppGetLayoutRequest {
@@ -3305,11 +3307,11 @@ interface ObjectDependency {
 }
 declare const ObjectDependency: MessageFns$1<ObjectDependency>;
 /** Policy for outbound traffic from a sandbox. */
-interface OutboundPolicy$1 {
+interface OutboundPolicy {
     /** Replace headers in outbound HTTPS requests, potentially with secret values. */
     headerReplacements: OutboundPolicy_HeaderReplacement[];
 }
-declare const OutboundPolicy$1: MessageFns$1<OutboundPolicy$1>;
+declare const OutboundPolicy: MessageFns$1<OutboundPolicy>;
 interface OutboundPolicy_HeaderReplacement {
     /**
      * Domain that the header replacements are scoped to. Supports wildcards in
@@ -3654,7 +3656,10 @@ interface Sandbox$1 {
      * Set by the backend at snapshot creation time.
      */
     runscRuntimeVersion?: string | undefined;
-    /** If set, overrides the runtime used by the function, either "runc" or "gvisor". */
+    /**
+     * Runtime the sandbox runs in: "vm" for a virtual machine, or a container
+     * runtime such as "gvisor". Leave it unset to let Modal pick.
+     */
     runtime?: string | undefined;
     /** If set, the sandbox will be created with verbose logging enabled. */
     verbose: boolean;
@@ -3704,7 +3709,7 @@ interface Sandbox$1 {
      */
     inboundCidrAllowlist: string[];
     environmentVariables: StringMap | undefined;
-    outboundPolicy?: OutboundPolicy$1 | undefined;
+    outboundPolicy?: OutboundPolicy | undefined;
     /**
      * If set, the sandbox's main container is served an X.509-SVID over a
      * SPIFFE Workload API socket, addressed by SPIFFE_ENDPOINT_SOCKET. The
@@ -4968,6 +4973,11 @@ interface WebhookTokenListResponse {
     tokens: WebhookToken[];
 }
 declare const WebhookTokenListResponse: MessageFns$1<WebhookTokenListResponse>;
+interface WebhookTokenUpdateRequest {
+    tokenId: string;
+    name?: string | undefined;
+}
+declare const WebhookTokenUpdateRequest: MessageFns$1<WebhookTokenUpdateRequest>;
 interface WorkspaceBillingRatesRequest {
 }
 declare const WorkspaceBillingRatesRequest: MessageFns$1<WorkspaceBillingRatesRequest>;
@@ -5024,7 +5034,7 @@ interface WorkspaceBillingSummaryResponse {
     meteredCostBreakdown: {
         [key: string]: string;
     };
-    /** keyed by plan, credits, reservations, storage */
+    /** keyed by plan, credits, reservations, storage, network egress allowance */
     adjustments: {
         [key: string]: string;
     };
@@ -7070,6 +7080,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly webhookTokenUpdate: {
+            readonly name: "WebhookTokenUpdate";
+            readonly requestType: MessageFns$1<WebhookTokenUpdateRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<WebhookToken>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         /** Workspaces */
         readonly workspaceBillingRates: {
             readonly name: "WorkspaceBillingRates";
@@ -8383,7 +8401,7 @@ declare const TaskSetNetworkAccessRequest: MessageFns<TaskSetNetworkAccessReques
 interface TaskSetOutboundPolicyRequest {
     taskId: string;
     /** Replaces the task's outbound policy. */
-    outboundPolicy: OutboundPolicy$1 | undefined;
+    outboundPolicy: OutboundPolicy | undefined;
 }
 declare const TaskSetOutboundPolicyRequest: MessageFns<TaskSetOutboundPolicyRequest>;
 interface TaskSnapshotDirectoryRequest {
@@ -8504,7 +8522,7 @@ interface Profile {
     sandboxChannelIdleTimeoutMs: number;
     /**
      * Set by the MODAL_SANDBOX_V2 environment variable or the sandbox_v2
-     * profile key in .modal.toml.
+     * profile key in .modal.toml. Defaults to true when neither is set.
      */
     sandboxV2: boolean;
 }
@@ -8677,6 +8695,8 @@ type HeaderReplacement = {
  * Immutable configuration for replacing headers in outbound HTTPS requests
  * from a Sandbox.
  *
+ * EXPERIMENTAL: the API is subject to change.
+ *
  * Header values support templating with keys in a replacement's secret: a
  * `$`-prefixed key name in the secret is replaced with the secret value.
  * Literal `$` characters are written `$$`.
@@ -8687,7 +8707,7 @@ type HeaderReplacement = {
  * ```ts
  * const secret = await modal.secrets.fromName("api-token");
  *
- * const outboundPolicy = new modal.OutboundPolicy()
+ * const outboundPolicy = new modal.ExperimentalOutboundPolicy()
  *   // Inject a secret-backed Authorization header.
  *   .withHeaderReplacement({
  *     domain: "example.com",
@@ -8700,16 +8720,18 @@ type HeaderReplacement = {
  *     headers: { "X-Trace-Token": "trace_abcd" },
  *   });
  *
- * const sb = await modal.sandboxes.create(app, image, { outboundPolicy });
+ * const sb = await modal.sandboxes.create(app, image, {
+ *   experimentalOutboundPolicy: outboundPolicy,
+ * });
  * ```
  */
-declare class OutboundPolicy {
+declare class ExperimentalOutboundPolicy {
     /** @internal */
     readonly _replacements: readonly HeaderReplacement[];
     /** @internal */
     constructor(_replacements?: readonly HeaderReplacement[]);
     /**
-     * Return a new {@link OutboundPolicy} with an added header replacement.
+     * Return a new {@link ExperimentalOutboundPolicy} with an added header replacement.
      *
      * @param params.domain Domain the replacements are scoped to. Supports `*.` wildcard
      *   prefixes (matching the apex domain and subdomains) and a bare `"*"`.
@@ -8722,7 +8744,7 @@ declare class OutboundPolicy {
         domain: string;
         headers: Record<string, string>;
         secret?: Secret;
-    }): OutboundPolicy;
+    }): ExperimentalOutboundPolicy;
     /** Check all replacements, throwing `InvalidError` on the first violation found.
      * @internal
      */
@@ -8734,7 +8756,7 @@ declare class OutboundPolicy {
     /** Convert to the wire format. Referenced secrets must be hydrated first.
      * @internal
      */
-    _toProto(): OutboundPolicy$1;
+    _toProto(): OutboundPolicy;
 }
 
 /** Type of a filesystem entry. */
@@ -9209,6 +9231,8 @@ type StdioBehavior = "pipe" | "ignore";
  * means the data will be read as raw bytes (Uint8Array).
  */
 type StreamMode = "text" | "binary";
+/** Runtime a Sandbox runs in: a virtual machine, or gVisor. */
+type SandboxRuntime = "gvisor" | "vm";
 /** Optional parameters for {@link Probe.withTcp} and {@link Probe.withExec}. */
 type ProbeParams = {
     intervalMs: number;
@@ -9232,6 +9256,8 @@ type SandboxCreateParams = {
     memoryMiB?: number;
     /** Hard limit of memory in MiB. */
     memoryLimitMiB?: number;
+    /** Runtime under which the Sandbox executes, or undefined to let Modal pick. */
+    runtime?: SandboxRuntime;
     /** GPU reservation for the Sandbox (e.g. "A100", "T4:2", "A100-80GB:4"). */
     gpu?: string;
     /** Maximum lifetime of the Sandbox in milliseconds. Defaults to 5 minutes. */
@@ -9270,8 +9296,9 @@ type SandboxCreateParams = {
     outboundDomainAllowlist?: string[];
     /** Configuration for replacing headers in outbound HTTPS requests from the Sandbox.
      * Secrets referenced by the policy are resolved outside the Sandbox and are never
-     * visible to the workload. See {@link OutboundPolicy}. */
-    outboundPolicy?: OutboundPolicy;
+     * visible to the workload. See {@link ExperimentalOutboundPolicy}.
+     * EXPERIMENTAL: the API is subject to change. */
+    experimentalOutboundPolicy?: ExperimentalOutboundPolicy;
     /** List of CIDRs allowed to connect inbound to the Sandbox (tunnels and connection tokens). If not set, all IPs are allowed. Cannot be used with blockNetwork. */
     inboundCidrAllowlist?: string[];
     /** Enable private IPv6 networking (i6pn) so Sandboxes in the same workspace can address each
@@ -9753,14 +9780,16 @@ declare class Sandbox {
     /**
      * Replace the outbound policy of a running Sandbox.
      *
+     * EXPERIMENTAL: the API is subject to change.
+     *
      * The new policy replaces all existing policy configuration on the
      * Sandbox; build a policy including any existing rules you want to keep.
      *
-     * Only Sandboxes created with an `outboundPolicy` can be updated this
+     * Only Sandboxes created with an `experimentalOutboundPolicy` can be updated this
      * way; for Sandboxes created without one this fails, since header
      * replacement is only set up at creation time.
      */
-    updateOutboundPolicy(outboundPolicy: OutboundPolicy): Promise<void>;
+    experimentalUpdateOutboundPolicy(outboundPolicy: ExperimentalOutboundPolicy): Promise<void>;
     /**
      * Reload all Volumes mounted in the Sandbox.
      *
@@ -10060,4 +10089,4 @@ declare class ClientClosedError extends Error {
 
 declare function checkForRenamedParams(params: any, renames: Record<string, string>): void;
 
-export { AlreadyExistsError, App, type AppFromNameParams, AppService, ClientClosedError, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ConflictError, ContainerProcess, ExecutionError, type FileInfo, type FileType, type FileWatchEvent, type FileWatchEventType, type FunctionAutoscalerSettings, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, type FunctionCallLogFetchParams, type FunctionCallLogStreamParams, type FunctionCallLogTailParams, FunctionCallLogsManager, FunctionCallService, type FunctionFromNameParams, type FunctionLogFetchParams, type FunctionLogStreamParams, type FunctionLogTailParams, FunctionLogsManager, FunctionService, type FunctionStats, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, type FunctionWithBatchingParams, type FunctionWithConcurrencyParams, type FunctionWithOptionsParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, type ImageFromNameParams, type ImagePublishParams, ImageService, InternalFailure, InvalidError, type LogEntry, type FunctionLogFetchParams as LogFetchParams, type LogLevel, type LogSource, type Logger, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, OutboundPolicy, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, type SandboxExperimentalFromNameParams, type SandboxExperimentalFromSnapshotParams, type SandboxExperimentalGetExitSnapshotParams, type SandboxExperimentalListParams, SandboxFilesystem, SandboxFilesystemDirectoryNotEmptyError, SandboxFilesystemError, SandboxFilesystemFileTooLargeError, SandboxFilesystemIsADirectoryError, SandboxFilesystemNotADirectoryError, SandboxFilesystemNotFoundError, SandboxFilesystemPathAlreadyExistsError, SandboxFilesystemPermissionError, type SandboxFromNameParams, type SandboxListParams, type SandboxLogFetchParams, type SandboxLogTailParams, SandboxLogsManager, type SandboxMountImageParams, type SandboxReloadVolumesParams, SandboxService, SandboxSnapshot, type SandboxSnapshotDirectoryParams, type SandboxSnapshotFilesystemParams, SandboxSnapshotService, type SandboxTerminateParams, SandboxTimeoutError, type SandboxUpdateNetworkPolicyParams, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, SidecarContainer, type SidecarCreateParams, type SidecarExecParams, type SidecarGetParams, type SidecarListParams, type SidecarMountImageParams, SidecarService, type SidecarSnapshotDirectoryParams, type SidecarSnapshotFilesystemParams, type SidecarTerminateParams, type SidecarUnmountImageParams, SnapshotCreationError, type StdioBehavior, type StreamMode, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, type VolumeMountOptionsParams, VolumeService, checkForRenamedParams };
+export { AlreadyExistsError, App, type AppFromNameParams, AppService, ClientClosedError, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ConflictError, ContainerProcess, ExecutionError, ExperimentalOutboundPolicy, type FileInfo, type FileType, type FileWatchEvent, type FileWatchEventType, type FunctionAutoscalerSettings, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, type FunctionCallLogFetchParams, type FunctionCallLogStreamParams, type FunctionCallLogTailParams, FunctionCallLogsManager, FunctionCallService, type FunctionFromNameParams, type FunctionLogFetchParams, type FunctionLogStreamParams, type FunctionLogTailParams, FunctionLogsManager, FunctionService, type FunctionStats, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, type FunctionWithBatchingParams, type FunctionWithConcurrencyParams, type FunctionWithOptionsParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, type ImageFromNameParams, type ImagePublishParams, ImageService, InternalFailure, InvalidError, type LogEntry, type FunctionLogFetchParams as LogFetchParams, type LogLevel, type LogSource, type Logger, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, type SandboxExperimentalFromNameParams, type SandboxExperimentalFromSnapshotParams, type SandboxExperimentalGetExitSnapshotParams, type SandboxExperimentalListParams, SandboxFilesystem, SandboxFilesystemDirectoryNotEmptyError, SandboxFilesystemError, SandboxFilesystemFileTooLargeError, SandboxFilesystemIsADirectoryError, SandboxFilesystemNotADirectoryError, SandboxFilesystemNotFoundError, SandboxFilesystemPathAlreadyExistsError, SandboxFilesystemPermissionError, type SandboxFromNameParams, type SandboxListParams, type SandboxLogFetchParams, type SandboxLogTailParams, SandboxLogsManager, type SandboxMountImageParams, type SandboxReloadVolumesParams, type SandboxRuntime, SandboxService, SandboxSnapshot, type SandboxSnapshotDirectoryParams, type SandboxSnapshotFilesystemParams, SandboxSnapshotService, type SandboxTerminateParams, SandboxTimeoutError, type SandboxUpdateNetworkPolicyParams, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, SidecarContainer, type SidecarCreateParams, type SidecarExecParams, type SidecarGetParams, type SidecarListParams, type SidecarMountImageParams, SidecarService, type SidecarSnapshotDirectoryParams, type SidecarSnapshotFilesystemParams, type SidecarTerminateParams, type SidecarUnmountImageParams, SnapshotCreationError, type StdioBehavior, type StreamMode, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, type VolumeMountOptionsParams, VolumeService, checkForRenamedParams };

package/dist/index.js

@@ -5491,7 +5491,7 @@ var AppGetInfoResponse = {
   }
 };
 function createBaseAppGetInfoResponse_FunctionInfoSummary() {
-  return { gpuConfig: [], schedule: void 0, webFunction: false, requiresProxyAuth: void 0 };
+  return { gpuConfig: [], schedule: void 0, webFunction: false, requiresProxyAuth: void 0, isSessioned: false };
 }
 var AppGetInfoResponse_FunctionInfoSummary = {
   encode(message, writer = new BinaryWriter()) {
@@ -5507,6 +5507,9 @@ var AppGetInfoResponse_FunctionInfoSummary = {
     if (message.requiresProxyAuth !== void 0) {
       writer.uint32(32).bool(message.requiresProxyAuth);
     }
+    if (message.isSessioned !== false) {
+      writer.uint32(40).bool(message.isSessioned);
+    }
     return writer;
   },
   decode(input, length) {
@@ -5544,6 +5547,13 @@ var AppGetInfoResponse_FunctionInfoSummary = {
           message.requiresProxyAuth = reader.bool();
           continue;
         }
+        case 5: {
+          if (tag !== 40) {
+            break;
+          }
+          message.isSessioned = reader.bool();
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -5557,7 +5567,8 @@ var AppGetInfoResponse_FunctionInfoSummary = {
       gpuConfig: globalThis.Array.isArray(object?.gpuConfig) ? object.gpuConfig.map((e) => GPUConfig.fromJSON(e)) : [],
       schedule: isSet5(object.schedule) ? Schedule.fromJSON(object.schedule) : void 0,
       webFunction: isSet5(object.webFunction) ? globalThis.Boolean(object.webFunction) : false,
-      requiresProxyAuth: isSet5(object.requiresProxyAuth) ? globalThis.Boolean(object.requiresProxyAuth) : void 0
+      requiresProxyAuth: isSet5(object.requiresProxyAuth) ? globalThis.Boolean(object.requiresProxyAuth) : void 0,
+      isSessioned: isSet5(object.isSessioned) ? globalThis.Boolean(object.isSessioned) : false
     };
   },
   toJSON(message) {
@@ -5574,6 +5585,9 @@ var AppGetInfoResponse_FunctionInfoSummary = {
     if (message.requiresProxyAuth !== void 0) {
       obj.requiresProxyAuth = message.requiresProxyAuth;
     }
+    if (message.isSessioned !== false) {
+      obj.isSessioned = message.isSessioned;
+    }
     return obj;
   },
   create(base) {
@@ -5585,6 +5599,7 @@ var AppGetInfoResponse_FunctionInfoSummary = {
     message.schedule = object.schedule !== void 0 && object.schedule !== null ? Schedule.fromPartial(object.schedule) : void 0;
     message.webFunction = object.webFunction ?? false;
     message.requiresProxyAuth = object.requiresProxyAuth ?? void 0;
+    message.isSessioned = object.isSessioned ?? false;
     return message;
   }
 };
@@ -58570,6 +58585,74 @@ var WebhookTokenListResponse = {
     return message;
   }
 };
+function createBaseWebhookTokenUpdateRequest() {
+  return { tokenId: "", name: void 0 };
+}
+var WebhookTokenUpdateRequest = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.tokenId !== "") {
+      writer.uint32(10).string(message.tokenId);
+    }
+    if (message.name !== void 0) {
+      writer.uint32(18).string(message.name);
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseWebhookTokenUpdateRequest();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.tokenId = reader.string();
+          continue;
+        }
+        case 2: {
+          if (tag !== 18) {
+            break;
+          }
+          message.name = reader.string();
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      tokenId: isSet5(object.tokenId) ? globalThis.String(object.tokenId) : "",
+      name: isSet5(object.name) ? globalThis.String(object.name) : void 0
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.tokenId !== "") {
+      obj.tokenId = message.tokenId;
+    }
+    if (message.name !== void 0) {
+      obj.name = message.name;
+    }
+    return obj;
+  },
+  create(base) {
+    return WebhookTokenUpdateRequest.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseWebhookTokenUpdateRequest();
+    message.tokenId = object.tokenId ?? "";
+    message.name = object.name ?? void 0;
+    return message;
+  }
+};
 function createBaseWorkspaceBillingRatesRequest() {
   return {};
 }
@@ -62542,6 +62625,14 @@ var ModalClientDefinition = {
       responseStream: false,
       options: {}
     },
+    webhookTokenUpdate: {
+      name: "WebhookTokenUpdate",
+      requestType: WebhookTokenUpdateRequest,
+      requestStream: false,
+      responseType: WebhookToken,
+      responseStream: false,
+      options: {}
+    },
     /** Workspaces */
     workspaceBillingRates: {
       name: "WorkspaceBillingRates",
@@ -68697,6 +68788,41 @@ import {
   Status as Status6
 } from "nice-grpc";
 
+// src/server_warnings.ts
+var SERVER_WARNING_HEADER = "x-modal-warning";
+var SERVER_WARNING_REGISTRY_LIMIT = 2048;
+function logServerWarnings(logger2, trailer, seen) {
+  const joined = trailer.get(SERVER_WARNING_HEADER);
+  if (typeof joined !== "string") return;
+  for (const encoded of joined.split(",")) {
+    let message;
+    try {
+      message = decodeURIComponent(encoded.trim());
+    } catch {
+      message = encoded.trim();
+    }
+    if (seen.size > SERVER_WARNING_REGISTRY_LIMIT) {
+      seen.clear();
+    }
+    if (seen.has(message)) continue;
+    seen.add(message);
+    logger2.warn(message);
+  }
+}
+function serverWarningMiddleware(logger2) {
+  const seen = /* @__PURE__ */ new Set();
+  return async function* serverWarningMiddleware2(call, options) {
+    const { onTrailer, ...restOptions } = options;
+    return yield* call.next(call.request, {
+      ...restOptions,
+      onTrailer: (trailer) => {
+        logServerWarnings(logger2, trailer, seen);
+        onTrailer?.(trailer);
+      }
+    });
+  };
+}
+
 // src/config.ts
 import { warn } from "node:console";
 import { readFileSync } from "node:fs";
@@ -68788,7 +68914,7 @@ function getProfile(profileName) {
       const ms = Math.round(parsed * 1e3);
       return parsed > 0 && ms === 0 ? 1 : ms;
     })(),
-    sandboxV2: process.env["MODAL_SANDBOX_V2"] ? parseBooleanFlag(process.env["MODAL_SANDBOX_V2"]) : parseBooleanFlag(profileData.sandbox_v2)
+    sandboxV2: process.env["MODAL_SANDBOX_V2"] ? parseBooleanFlag(process.env["MODAL_SANDBOX_V2"]) : profileData.sandbox_v2 !== void 0 ? parseBooleanFlag(profileData.sandbox_v2) : true
   };
   return profile;
 }
@@ -69010,7 +69136,7 @@ var TaskCommandRouterClientImpl = class _TaskCommandRouterClientImpl {
       options.metadata ??= new Metadata();
       options.metadata.set("authorization", `Bearer ${self.jwt}`);
       return yield* call.next(call.request, options);
-    });
+    }).use(serverWarningMiddleware(logger2));
     this.factory = factory;
     this.stub = factory.create(TaskCommandRouterDefinition, this.channel);
     this.armIdleTimer();
@@ -71321,6 +71447,19 @@ function getSandboxVersion(sandboxId) {
   }
   return "V2" /* V2 */;
 }
+function sandboxRuntimeToProto(runtime) {
+  switch (runtime) {
+    case void 0:
+      return void 0;
+    case "gvisor":
+    case "vm":
+      return runtime;
+    default:
+      throw new Error(
+        `runtime must be "gvisor" or "vm", got ${JSON.stringify(runtime)}`
+      );
+  }
+}
 var Probe2 = class _Probe {
   #tcpPort;
   #execArgv;
@@ -71454,6 +71593,7 @@ async function buildSandboxCreateRequestProto(appId, imageId, params = {}) {
   if (params.workdir && !params.workdir.startsWith("/")) {
     throw new Error(`workdir must be an absolute path, got: ${params.workdir}`);
   }
+  const runtime = sandboxRuntimeToProto(params.runtime);
   const volumeMounts = params.volumes ? Object.entries(params.volumes).map(
     ([mountPath, volume]) => volumeToMountProto(mountPath, volume)
   ) : [];
@@ -71505,16 +71645,16 @@ async function buildSandboxCreateRequestProto(appId, imageId, params = {}) {
       );
     }
   }
-  if (params.outboundPolicy !== void 0) {
-    params.outboundPolicy._validate();
+  if (params.experimentalOutboundPolicy !== void 0) {
+    params.experimentalOutboundPolicy._validate();
     if (params.blockNetwork) {
       throw new InvalidError(
-        "outboundPolicy cannot be used when blockNetwork is enabled"
+        "experimentalOutboundPolicy cannot be used when blockNetwork is enabled"
       );
     }
     if (params.outboundDomainAllowlist && params.outboundDomainAllowlist.length > 0) {
       throw new InvalidError(
-        "outboundPolicy cannot be used with outboundDomainAllowlist"
+        "experimentalOutboundPolicy cannot be used with outboundDomainAllowlist"
       );
     }
   }
@@ -71598,7 +71738,7 @@ async function buildSandboxCreateRequestProto(appId, imageId, params = {}) {
       idleTimeoutSecs: params.idleTimeoutMs != void 0 ? params.idleTimeoutMs / 1e3 : void 0,
       workdir: params.workdir ?? void 0,
       networkAccess,
-      outboundPolicy: params.outboundPolicy?._toProto(),
+      outboundPolicy: params.experimentalOutboundPolicy?._toProto(),
       resources: Resources.create({
         milliCpu,
         milliCpuMax,
@@ -71622,7 +71762,8 @@ async function buildSandboxCreateRequestProto(appId, imageId, params = {}) {
       includeOidcIdentityToken: params.includeOidcIdentityToken ?? false,
       inboundCidrAllowlist: params.inboundCidrAllowlist ?? [],
       i6pnEnabled: params.i6pn ?? false,
-      enableSnapshot: params.experimentalEnableSnapshot ?? false
+      enableSnapshot: params.experimentalEnableSnapshot ?? false,
+      runtime
     }
   });
 }
@@ -71659,7 +71800,10 @@ var SandboxService = class {
     );
     await hydrateSandboxSecrets(
       this.#client,
-      [...mergedSecrets, ...params.outboundPolicy?._secrets() ?? []],
+      [
+        ...mergedSecrets,
+        ...params.experimentalOutboundPolicy?._secrets() ?? []
+      ],
       params.cloudBucketMounts
     );
     const mergedParams = {
@@ -71720,7 +71864,10 @@ var SandboxService = class {
     Object.assign(envDict, params.env ?? {});
     await hydrateSandboxSecrets(
       this.#client,
-      [...resolvableSecrets, ...params.outboundPolicy?._secrets() ?? []],
+      [
+        ...resolvableSecrets,
+        ...params.experimentalOutboundPolicy?._secrets() ?? []
+      ],
       params.cloudBucketMounts
     );
     const mergedParams = {
@@ -72928,14 +73075,16 @@ var Sandbox2 = class _Sandbox {
   /**
    * Replace the outbound policy of a running Sandbox.
    *
+   * EXPERIMENTAL: the API is subject to change.
+   *
    * The new policy replaces all existing policy configuration on the
    * Sandbox; build a policy including any existing rules you want to keep.
    *
-   * Only Sandboxes created with an `outboundPolicy` can be updated this
+   * Only Sandboxes created with an `experimentalOutboundPolicy` can be updated this
    * way; for Sandboxes created without one this fails, since header
    * replacement is only set up at creation time.
    */
-  async updateOutboundPolicy(outboundPolicy) {
+  async experimentalUpdateOutboundPolicy(outboundPolicy) {
     this.#ensureAttached();
     outboundPolicy._validate();
     const [, [taskId, commandRouterClient]] = await Promise.all([
@@ -73505,7 +73654,7 @@ var AuthTokenManager = class {
 };
 
 // src/version.ts
-var SDK_VERSION = "0.10.2-dev.7";
+var SDK_VERSION = "0.10.2-dev.9";
 function getSDKVersion() {
   return SDK_VERSION;
 }
@@ -73777,7 +73926,7 @@ var ModalClient = class {
       "grpc.keepalive_timeout_ms": 1e4,
       "grpc.keepalive_permit_without_calls": 1
     });
-    let factory = createClientFactory2().use(this.authMiddleware(profile)).use(this.retryMiddleware()).use(timeoutMiddleware);
+    let factory = createClientFactory2().use(this.authMiddleware(profile)).use(this.retryMiddleware()).use(serverWarningMiddleware(this.logger)).use(timeoutMiddleware);
     for (const middleware of this.customMiddleware) {
       factory = factory.use(middleware);
     }
@@ -75961,7 +76110,7 @@ function templateReferencesKey(template) {
   }
   return false;
 }
-var OutboundPolicy2 = class _OutboundPolicy {
+var ExperimentalOutboundPolicy = class _ExperimentalOutboundPolicy {
   /** @internal */
   _replacements;
   /** @internal */
@@ -75969,7 +76118,7 @@ var OutboundPolicy2 = class _OutboundPolicy {
     this._replacements = _replacements;
   }
   /**
-   * Return a new {@link OutboundPolicy} with an added header replacement.
+   * Return a new {@link ExperimentalOutboundPolicy} with an added header replacement.
    *
    * @param params.domain Domain the replacements are scoped to. Supports `*.` wildcard
    *   prefixes (matching the apex domain and subdomains) and a bare `"*"`.
@@ -75980,7 +76129,7 @@ var OutboundPolicy2 = class _OutboundPolicy {
    */
   withHeaderReplacement(params) {
     const { domain, headers, secret } = params;
-    return new _OutboundPolicy([
+    return new _ExperimentalOutboundPolicy([
       ...this._replacements,
       { domain, headers: { ...headers }, secret }
     ]);
@@ -76067,6 +76216,7 @@ export {
   ConflictError,
   ContainerProcess2 as ContainerProcess,
   ExecutionError,
+  ExperimentalOutboundPolicy,
   FunctionCall,
   FunctionCallLogsManager,
   FunctionCallService,
@@ -76080,7 +76230,6 @@ export {
   InvalidError,
   ModalClient,
   NotFoundError,
-  OutboundPolicy2 as OutboundPolicy,
   Probe2 as Probe,
   Proxy2 as Proxy,
   ProxyService,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "modal",
-  "version": "0.10.2-dev.7",
+  "version": "0.10.2-dev.9",
   "description": "Modal SDK for JavaScript/TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://modal.com/docs/guide/sdk-javascript-go",