modal 0.11.1-dev.8 → 0.11.1

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { createChannel, Client, Status, ClientMiddleware } from 'nice-grpc';
 import { BinaryWriter, BinaryReader } from '@bufbuild/protobuf/wire';
+import { createChannel, Client, Status, ClientMiddleware } from 'nice-grpc';
 
 /**
  * A generic empty message that you can re-use to avoid defining duplicated
@@ -54,7 +54,7 @@ declare enum AppDisconnectReason {
  * NOTE: make sure to update the frontend if we add a new state here
  * https://github.com/modal-labs/modal/blob/main/frontend/src/routes/(dashboard)/%5B%5Bworkspace%5D%5D/apps/+page.svelte#L95
  */
-declare enum AppState {
+declare enum AppState$1 {
     APP_STATE_UNSPECIFIED = 0,
     /** APP_STATE_EPHEMERAL - Will be discharged when the client disconnects */
     APP_STATE_EPHEMERAL = 1,
@@ -207,6 +207,7 @@ declare enum EnvironmentRole {
     ENVIRONMENT_ROLE_VIEWER = 1,
     ENVIRONMENT_ROLE_CONTRIBUTOR = 2,
     ENVIRONMENT_ROLE_NO_ACCESS = 3,
+    ENVIRONMENT_ROLE_MODAL_ADMINISTERED_OBSERVER = 4,
     UNRECOGNIZED = -1
 }
 /**
@@ -372,36 +373,6 @@ declare enum ServerInferenceStatsStatus {
     SERVER_INFERENCE_STATS_STATUS_UNAVAILABLE = 3,
     UNRECOGNIZED = -1
 }
-declare enum SystemErrorCode {
-    SYSTEM_ERROR_CODE_UNSPECIFIED = 0,
-    /** SYSTEM_ERROR_CODE_PERM - EPERM: Operation not permitted */
-    SYSTEM_ERROR_CODE_PERM = 1,
-    /** SYSTEM_ERROR_CODE_NOENT - ENOENT: No such file or directory */
-    SYSTEM_ERROR_CODE_NOENT = 2,
-    /** SYSTEM_ERROR_CODE_IO - EIO: Input/output error */
-    SYSTEM_ERROR_CODE_IO = 5,
-    /** SYSTEM_ERROR_CODE_NXIO - ENXIO: No such device or address */
-    SYSTEM_ERROR_CODE_NXIO = 6,
-    /** SYSTEM_ERROR_CODE_NOMEM - ENOMEM: Out of memory */
-    SYSTEM_ERROR_CODE_NOMEM = 12,
-    /** SYSTEM_ERROR_CODE_ACCES - EACCES: Permission denied */
-    SYSTEM_ERROR_CODE_ACCES = 13,
-    /** SYSTEM_ERROR_CODE_EXIST - EEXIST: File exists */
-    SYSTEM_ERROR_CODE_EXIST = 17,
-    /** SYSTEM_ERROR_CODE_NOTDIR - ENOTDIR: Not a directory */
-    SYSTEM_ERROR_CODE_NOTDIR = 20,
-    /** SYSTEM_ERROR_CODE_ISDIR - EISDIR: Is a directory */
-    SYSTEM_ERROR_CODE_ISDIR = 21,
-    /** SYSTEM_ERROR_CODE_INVAL - EINVAL: Invalid argument */
-    SYSTEM_ERROR_CODE_INVAL = 22,
-    /** SYSTEM_ERROR_CODE_MFILE - EMFILE: Too many open files */
-    SYSTEM_ERROR_CODE_MFILE = 24,
-    /** SYSTEM_ERROR_CODE_FBIG - EFBIG: File too large */
-    SYSTEM_ERROR_CODE_FBIG = 27,
-    /** SYSTEM_ERROR_CODE_NOSPC - ENOSPC: No space left on device */
-    SYSTEM_ERROR_CODE_NOSPC = 28,
-    UNRECOGNIZED = -1
-}
 declare enum TaskSnapshotBehavior {
     TASK_SNAPSHOT_BEHAVIOR_UNSPECIFIED = 0,
     TASK_SNAPSHOT_BEHAVIOR_SNAPSHOT = 1,
@@ -539,6 +510,12 @@ declare enum GenericResult_GenericStatus {
     GENERIC_STATUS_MEMORY_MANAGER_EVICTION = 8,
     UNRECOGNIZED = -1
 }
+declare enum MetricsGetInfoRequest_MetricsTargetType {
+    METRICS_TARGET_TYPE_UNSPECIFIED = 0,
+    METRICS_TARGET_TYPE_FUNCTION = 1,
+    METRICS_TARGET_TYPE_SERVER = 2,
+    UNRECOGNIZED = -1
+}
 declare enum NetworkAccess_NetworkAccessType {
     UNSPECIFIED = 0,
     OPEN = 1,
@@ -546,6 +523,14 @@ declare enum NetworkAccess_NetworkAccessType {
     ALLOWLIST = 3,
     UNRECOGNIZED = -1
 }
+declare enum OutboundPolicy_Transport {
+    /** TRANSPORT_UNSPECIFIED - The route type's default, described on each route's transport field. */
+    TRANSPORT_UNSPECIFIED = 0,
+    TRANSPORT_ANY = 1,
+    TRANSPORT_TCP = 2,
+    TRANSPORT_UDP = 3,
+    UNRECOGNIZED = -1
+}
 declare enum PTYInfo_PTYType {
     /** PTY_TYPE_UNSPECIFIED - Nothing */
     PTY_TYPE_UNSPECIFIED = 0,
@@ -617,7 +602,7 @@ interface AppCreateRequest {
     /** Human readable label for the app */
     description: string;
     environmentName: string;
-    appState: AppState;
+    appState: AppState$1;
     /** Additional metadata to attach to the App */
     tags: {
         [key: string]: string;
@@ -697,7 +682,7 @@ interface AppGetByDeploymentNameResponse {
     /** Populated because server may resolve default environment */
     environmentName: string;
     /** Lifecycle of current App or recently stopped App */
-    lifecycle: AppLifecycle | undefined;
+    lifecycle: AppLifecycle$1 | undefined;
 }
 declare const AppGetByDeploymentNameResponse: MessageFns$1<AppGetByDeploymentNameResponse>;
 interface AppGetInfoRequest {
@@ -734,7 +719,7 @@ interface AppGetLifecycleRequest {
 }
 declare const AppGetLifecycleRequest: MessageFns$1<AppGetLifecycleRequest>;
 interface AppGetLifecycleResponse {
-    lifecycle: AppLifecycle | undefined;
+    lifecycle: AppLifecycle$1 | undefined;
 }
 declare const AppGetLifecycleResponse: MessageFns$1<AppGetLifecycleResponse>;
 interface AppGetLogsRequest {
@@ -792,7 +777,7 @@ interface AppHandleMetadata {
     description: string;
     appId: string;
     environmentName: string;
-    lifecycle: AppLifecycle | undefined;
+    lifecycle: AppLifecycle$1 | undefined;
     /** tag -> function id */
     functions: {
         [key: string]: string;
@@ -819,8 +804,8 @@ interface AppLayout {
     };
 }
 declare const AppLayout: MessageFns$1<AppLayout>;
-interface AppLifecycle {
-    appState: AppState;
+interface AppLifecycle$1 {
+    appState: AppState$1;
     createdAt: number;
     /** User or service user name */
     createdBy: string;
@@ -835,7 +820,7 @@ interface AppLifecycle {
     /** User or service user name, null if running or ephemeral App that finished normally */
     stoppedBy: string;
 }
-declare const AppLifecycle: MessageFns$1<AppLifecycle>;
+declare const AppLifecycle$1: MessageFns$1<AppLifecycle$1>;
 interface AppListRequest {
     environmentName: string;
 }
@@ -847,7 +832,7 @@ declare const AppListResponse: MessageFns$1<AppListResponse>;
 interface AppListResponse_AppListItem {
     appId: string;
     description: string;
-    state: AppState;
+    state: AppState$1;
     createdAt: number;
     stoppedAt: number;
     nRunningTasks: number;
@@ -881,7 +866,7 @@ interface AppPublishRequest {
     /** Additional metadata to identify a deployment */
     deploymentTag: string;
     /** Published app will be in this state */
-    appState: AppState;
+    appState: AppState$1;
     /** function_name -> function_id */
     functionIds: {
         [key: string]: string;
@@ -948,7 +933,7 @@ interface AppSetObjectsRequest {
     clientId: string;
     unindexedObjectIds: string[];
     /** promotes an app from initializing to this new state */
-    newAppState: AppState;
+    newAppState: AppState$1;
 }
 declare const AppSetObjectsRequest: MessageFns$1<AppSetObjectsRequest>;
 interface AppSetTagsRequest {
@@ -1396,11 +1381,6 @@ interface ContainerFileWriteRequest {
     data: Uint8Array;
 }
 declare const ContainerFileWriteRequest: MessageFns$1<ContainerFileWriteRequest>;
-interface ContainerFilesystemExecGetOutputRequest {
-    execId: string;
-    timeout: number;
-}
-declare const ContainerFilesystemExecGetOutputRequest: MessageFns$1<ContainerFilesystemExecGetOutputRequest>;
 interface ContainerFilesystemExecRequest {
     fileOpenRequest?: ContainerFileOpenRequest | undefined;
     fileWriteRequest?: ContainerFileWriteRequest | undefined;
@@ -1764,7 +1744,7 @@ interface EndpointListItem {
     activeDeploymentId: string;
     updatedAt: number;
     metadata: EndpointMetadata | undefined;
-    appState: AppState;
+    appState: AppState$1;
     functionId: string;
     createdByAvatarUrl: string;
     provisioningStatus: EndpointProvisioningStatus;
@@ -1950,6 +1930,9 @@ interface EnvironmentRoleSetRequest {
     role: EnvironmentRole;
     /** String representation from the CLI; parsed when role is unspecified */
     roleStr: string;
+    serviceUserName: string;
+    /** Sent by the client when an environment ID is unavailable */
+    environmentName: string;
 }
 declare const EnvironmentRoleSetRequest: MessageFns$1<EnvironmentRoleSetRequest>;
 interface EnvironmentSetBudgetRequest {
@@ -1996,6 +1979,38 @@ interface EnvironmentUpdateRequest {
     blockUnauthenticatedResources?: EnvironmentBlockUnauthenticatedResources | undefined;
 }
 declare const EnvironmentUpdateRequest: MessageFns$1<EnvironmentUpdateRequest>;
+/**
+ * Experimental policy for outbound traffic from a sandbox: header
+ * replacements.
+ */
+interface ExperimentalOutboundPolicy$1 {
+    /** Replace headers in outbound HTTPS requests, potentially with secret values. */
+    headerReplacements: ExperimentalOutboundPolicy_HeaderReplacement[];
+}
+declare const ExperimentalOutboundPolicy$1: MessageFns$1<ExperimentalOutboundPolicy$1>;
+interface ExperimentalOutboundPolicy_HeaderReplacement {
+    /**
+     * Domain that the header replacements are scoped to. Supports wildcards in
+     * subdomain positions.
+     */
+    domain: string;
+    /**
+     * Reference to a secret usable in the header value templates. Can be
+     * empty if no secret value is used.
+     */
+    secretId: string;
+    /**
+     * Header name -> header value.
+     *
+     * Values support templating with keys in the stanza's secret_id: a
+     * $-prefixed key name in the secret will be replaced with the secret
+     * value. Literal $ characters can be represented by two dollars: `$$`.
+     */
+    headers: {
+        [key: string]: string;
+    };
+}
+declare const ExperimentalOutboundPolicy_HeaderReplacement: MessageFns$1<ExperimentalOutboundPolicy_HeaderReplacement>;
 /** A file entry when listing files in a volume or network file system. */
 interface FileEntry {
     path: string;
@@ -2004,13 +2019,6 @@ interface FileEntry {
     size: number;
 }
 declare const FileEntry: MessageFns$1<FileEntry>;
-interface FilesystemRuntimeOutputBatch {
-    output: Uint8Array[];
-    error?: SystemErrorMessage | undefined;
-    batchIndex: number;
-    eof: boolean;
-}
-declare const FilesystemRuntimeOutputBatch: MessageFns$1<FilesystemRuntimeOutputBatch>;
 interface FlashContainerDeregisterRequest {
     serviceName: string;
 }
@@ -2230,20 +2238,58 @@ interface FunctionCallCancelRequest {
     functionId?: string | undefined;
 }
 declare const FunctionCallCancelRequest: MessageFns$1<FunctionCallCancelRequest>;
+interface FunctionCallCountRequest {
+    functionId: string;
+    /** Inclusive, based on input enqueue time. */
+    since: Date | undefined;
+    /** Exclusive, based on input enqueue time. */
+    until: Date | undefined;
+    bucketSecs: number;
+    /** Include the root Function and its eligible variants. */
+    allVariants: boolean;
+}
+declare const FunctionCallCountRequest: MessageFns$1<FunctionCallCountRequest>;
+interface FunctionCallCountResponse {
+    /**
+     * Ordered by bucket start time, from oldest to newest.
+     * Counts include only inputs within the requested time range.
+     */
+    buckets: FunctionCallCountResponse_InputBucket[];
+}
+declare const FunctionCallCountResponse: MessageFns$1<FunctionCallCountResponse>;
+interface FunctionCallCountResponse_InputBucket {
+    bucketStartAt: Date | undefined;
+    /** Number of unique inputs, matching FunctionCallFetch. */
+    count: number;
+}
+declare const FunctionCallCountResponse_InputBucket: MessageFns$1<FunctionCallCountResponse_InputBucket>;
 interface FunctionCallFetchRequest {
     functionId: string;
     tail?: FunctionCallFetchRequest_Tail | undefined;
+    range?: FunctionCallFetchRequest_Range | undefined;
     /** Include the root Function and its eligible variants. */
     allVariants: boolean;
 }
 declare const FunctionCallFetchRequest: MessageFns$1<FunctionCallFetchRequest>;
+interface FunctionCallFetchRequest_Range {
+    /** Inclusive, based on input enqueue time. */
+    since: Date | undefined;
+    /** Exclusive, based on input enqueue time. */
+    until: Date | undefined;
+    /** Maximum number of inputs to return. Must be between 1 and 20000. */
+    limit: number;
+}
+declare const FunctionCallFetchRequest_Range: MessageFns$1<FunctionCallFetchRequest_Range>;
 interface FunctionCallFetchRequest_Tail {
     /** Number of most recent inputs to return. Must be between 1 and 1000. */
     count: number;
 }
 declare const FunctionCallFetchRequest_Tail: MessageFns$1<FunctionCallFetchRequest_Tail>;
 interface FunctionCallFetchResponse {
-    /** The requested number of most recent inputs from the last seven days, ordered from newest to oldest. */
+    /**
+     * Tail queries return the most recent inputs from the last seven days, ordered from newest to oldest.
+     * Range queries return inputs ordered from oldest to newest.
+     */
     functionCallInputs: FunctionCallInputInfo[];
 }
 declare const FunctionCallFetchResponse: MessageFns$1<FunctionCallFetchResponse>;
@@ -2505,6 +2551,36 @@ interface FunctionGetInputsResponse {
     rateLimitSleepDuration: number;
 }
 declare const FunctionGetInputsResponse: MessageFns$1<FunctionGetInputsResponse>;
+interface FunctionGetMetricsRequest {
+    functionId: string;
+    /** Required; rounded down to a UTC bucket boundary. */
+    since: Date | undefined;
+    /** Required; rounded down; at most 31 days after since. */
+    until: Date | undefined;
+    /**
+     * If omitted, choose a supported width targeting approximately 100 buckets.
+     * Allowed widths are documented in MetricsGetInfoRequest.bucket_secs.
+     * At most 500 points per series in the rounded interval.
+     */
+    bucketSecs?: number | undefined;
+    /**
+     * Metric groups: containers, calls.
+     * Empty selects all applicable groups. Each group returns its standard series.
+     */
+    groups: string[];
+    /** Restrict the root Function's metrics to one of its parametrized Functions. */
+    rollup: boolean;
+}
+declare const FunctionGetMetricsRequest: MessageFns$1<FunctionGetMetricsRequest>;
+interface FunctionGetMetricsResponse {
+    /** Inclusive effective bound, rounded down. */
+    since: Date | undefined;
+    /** Exclusive effective bound, rounded down. */
+    until: Date | undefined;
+    bucketSecs: number;
+    series: FunctionMetricSeries[];
+}
+declare const FunctionGetMetricsResponse: MessageFns$1<FunctionGetMetricsResponse>;
 interface FunctionGetOutputsItem {
     result: GenericResult | undefined;
     idx: number;
@@ -2705,6 +2781,25 @@ interface FunctionMapResponse {
     maxInputsOutstanding: number;
 }
 declare const FunctionMapResponse: MessageFns$1<FunctionMapResponse>;
+interface FunctionMetricPoint {
+    /** UTC-aligned bucket start within the response's effective [since, until). */
+    timestamp: Date | undefined;
+    value?: number | undefined;
+}
+declare const FunctionMetricPoint: MessageFns$1<FunctionMetricPoint>;
+interface FunctionMetricSeries {
+    /**
+     * Unique within the response; identifies one aggregate series for this metric.
+     * The metric name defines the aggregation semantics.
+     */
+    name: string;
+    /** Public semantic unit, such as seconds, calls, containers, or requests. */
+    unit: string;
+    /** Ascending timestamps; absent points are gaps. */
+    points: FunctionMetricPoint[];
+    description: string;
+}
+declare const FunctionMetricSeries: MessageFns$1<FunctionMetricSeries>;
 /** todo(ayush): update this to also use `autoscaler_settings` */
 interface FunctionOptions$1 {
     secretIds: string[];
@@ -3043,6 +3138,8 @@ interface ImageListTagsRequest {
     /** Defaults to 100. Values above 100 are rejected by the server. */
     maxObjects: number;
     pageToken: string;
+    /** Returns only the tags that currently point at this image. Optional. */
+    imageId: string;
 }
 declare const ImageListTagsRequest: MessageFns$1<ImageListTagsRequest>;
 interface ImageListTagsResponse {
@@ -3075,6 +3172,11 @@ interface ImageMetadata {
     imageBuilderVersion?: string | undefined;
 }
 declare const ImageMetadata: MessageFns$1<ImageMetadata>;
+interface ImageNameDeleteRequest {
+    /** Named image reference: "[environment/]name[:tag]". */
+    tag: string;
+}
+declare const ImageNameDeleteRequest: MessageFns$1<ImageNameDeleteRequest>;
 interface ImagePublishRequest {
     imageId: string;
     /**
@@ -3225,12 +3327,59 @@ interface MethodDefinition {
     supportedOutputFormats: DataFormat[];
 }
 declare const MethodDefinition: MessageFns$1<MethodDefinition>;
+interface MetricDefinition$1 {
+    /** Exact series name returned by the metrics RPC. */
+    name: string;
+    /** Matches FunctionMetricSeries.unit. */
+    unit: string;
+    /** Meaning and aggregation semantics of the series. */
+    description: string;
+}
+declare const MetricDefinition$1: MessageFns$1<MetricDefinition$1>;
+interface MetricGroupDefinition {
+    /** Group selector, such as "calls". Multiple catalogue rows can share this name. */
+    name: string;
+    /** Shared description of this catalogue row's series. */
+    description: string;
+    /** Individual series represented by this row, ordered by name; all have the same unit. */
+    metrics: MetricDefinition$1[];
+    /** Display label, such as "execution_time_{p50,p90,p99}". */
+    displayName: string;
+}
+declare const MetricGroupDefinition: MessageFns$1<MetricGroupDefinition>;
+interface MetricsGetInfoRequest {
+    /** Required; unspecified and unrecognized targets are rejected. */
+    targetType: MetricsGetInfoRequest_MetricsTargetType;
+    /** Required; rounded down to a UTC bucket boundary. */
+    since: Date | undefined;
+    /** Required; rounded down; at most 31 days after since. */
+    until: Date | undefined;
+    /** If omitted, choose a supported width targeting approximately 100 buckets. */
+    bucketSecs?: number | undefined;
+    groups: string[];
+}
+declare const MetricsGetInfoRequest: MessageFns$1<MetricsGetInfoRequest>;
+interface MetricsGetInfoResponse {
+    /**
+     * Catalogue rows for the requested target type, ordered by name then display_name.
+     * Rows sharing a name belong under the same group heading. Each series appears once per group.
+     * Describes the catalog; individual exports may omit unavailable series.
+     */
+    groups: MetricGroupDefinition[];
+    /** Resolved bucket width. */
+    bucketSecs: number;
+    /** Projected buckets per series, not observed sample count. */
+    bucketCount: number;
+}
+declare const MetricsGetInfoResponse: MessageFns$1<MetricsGetInfoResponse>;
 interface MountBatchedCheckExistenceRequest {
     sha256HexHashes: string[];
 }
 declare const MountBatchedCheckExistenceRequest: MessageFns$1<MountBatchedCheckExistenceRequest>;
 interface MountBatchedCheckExistenceResponse {
     missingSha256HexHashes: string[];
+    /** Server time of the check. Clients send the earliest one back as earliest_checked_at on the commit. */
+    checkedAt: Date | undefined;
 }
 declare const MountBatchedCheckExistenceResponse: MessageFns$1<MountBatchedCheckExistenceResponse>;
 interface MountFile {
@@ -3251,6 +3400,8 @@ interface MountGetOrCreateRequest {
     files: MountFile[];
     /** only used with OBJECT_CREATION_TYPE_ANONYMOUS_OWNED_BY_APP */
     appId: string;
+    /** Earliest checked_at the client received from the existence checks for these files. Telemetry only. */
+    earliestCheckedAt: Date | undefined;
 }
 declare const MountGetOrCreateRequest: MessageFns$1<MountGetOrCreateRequest>;
 interface MountGetOrCreateResponse {
@@ -3270,6 +3421,8 @@ interface MountPutFileRequest {
 declare const MountPutFileRequest: MessageFns$1<MountPutFileRequest>;
 interface MountPutFileResponse {
     exists: boolean;
+    /** Server time of the check. Clients send the earliest one back as earliest_checked_at on the commit. */
+    checkedAt: Date | undefined;
 }
 declare const MountPutFileResponse: MessageFns$1<MountPutFileResponse>;
 interface MultiPartUpload {
@@ -3381,35 +3534,119 @@ interface ObjectDependency {
     objectId: string;
 }
 declare const ObjectDependency: MessageFns$1<ObjectDependency>;
-/** Policy for outbound traffic from a sandbox. */
+/**
+ * Route-based policy for outbound network traffic. A sandbox applies it to
+ * its main container.
+ *
+ * Routes are evaluated in order and the first match decides what happens to
+ * a connection or packet. The last route must be the policy's only
+ * `any` route, which decides what happens to traffic no other route
+ * matches. Traffic a route matches without a redirect goes to its original
+ * destination.
+ */
 interface OutboundPolicy {
-    /** Replace headers in outbound HTTPS requests, potentially with secret values. */
-    headerReplacements: OutboundPolicy_HeaderReplacement[];
+    tlsDecryption: OutboundPolicy_TLSDecryption | undefined;
+    routes: OutboundPolicy_Route[];
 }
 declare const OutboundPolicy: MessageFns$1<OutboundPolicy>;
+/** An inclusive range of ports. A single port has start == end. */
+interface OutboundPolicy_PortRange {
+    start: number;
+    end: number;
+}
+declare const OutboundPolicy_PortRange: MessageFns$1<OutboundPolicy_PortRange>;
+/** Traffic to these CIDRs. */
+interface OutboundPolicy_IPRoute {
+    /** Unspecified means any transport. */
+    transport: OutboundPolicy_Transport;
+    /** Empty means every port. */
+    ports: OutboundPolicy_PortRange[];
+    cidrs: string[];
+    redirect: OutboundPolicy_Redirect | undefined;
+}
+declare const OutboundPolicy_IPRoute: MessageFns$1<OutboundPolicy_IPRoute>;
+/**
+ * Connections that carry TLS from the first byte to these domains. Never
+ * decrypted.
+ */
+interface OutboundPolicy_TLSRoute {
+    /** Unspecified means TCP. */
+    transport: OutboundPolicy_Transport;
+    /** Empty means port 443. */
+    ports: OutboundPolicy_PortRange[];
+    /** Supports `*.` wildcard prefixes and a bare `*`. */
+    domains: string[];
+    redirect: OutboundPolicy_Redirect | undefined;
+}
+declare const OutboundPolicy_TLSRoute: MessageFns$1<OutboundPolicy_TLSRoute>;
+/**
+ * HTTPS connections to these domains. Always decrypted, which requires TLS
+ * decryption to be allowed.
+ */
+interface OutboundPolicy_HTTPSRoute {
+    /** Unspecified means TCP. */
+    transport: OutboundPolicy_Transport;
+    /** Empty means port 443. */
+    ports: OutboundPolicy_PortRange[];
+    /** Supports `*.` wildcard prefixes and a bare `*`. */
+    domains: string[];
+    headerReplacements: OutboundPolicy_HeaderReplacement[];
+    redirect: OutboundPolicy_Redirect | undefined;
+}
+declare const OutboundPolicy_HTTPSRoute: MessageFns$1<OutboundPolicy_HTTPSRoute>;
+/** Everything earlier routes didn't match. */
+interface OutboundPolicy_AnyRoute {
+    redirect: OutboundPolicy_Redirect | undefined;
+}
+declare const OutboundPolicy_AnyRoute: MessageFns$1<OutboundPolicy_AnyRoute>;
 interface OutboundPolicy_HeaderReplacement {
     /**
-     * Domain that the header replacements are scoped to. Supports wildcards in
-     * subdomain positions.
-     */
-    domain: string;
-    /**
-     * Reference to a secret usable in the header value templates. Can be
-     * empty if no secret value is used.
+     * Secret whose keys the header value templates may reference. Empty for
+     * static values.
      */
     secretId: string;
     /**
-     * Header name -> header value.
-     *
-     * Values support templating with keys in the stanza's secret_id: a
-     * $-prefixed key name in the secret will be replaced with the secret
-     * value. Literal $ characters can be represented by two dollars: `$$`.
+     * Header name -> value template. A $-prefixed key name in the secret is
+     * replaced with the secret value; `$$` is a literal `$`.
      */
     headers: {
         [key: string]: string;
     };
 }
 declare const OutboundPolicy_HeaderReplacement: MessageFns$1<OutboundPolicy_HeaderReplacement>;
+interface OutboundPolicy_Redirect {
+    block?: OutboundPolicy_Redirect_Block | undefined;
+    viaProxy?: OutboundPolicy_Redirect_ViaProxy | undefined;
+    viaSidecar?: OutboundPolicy_Redirect_ViaSidecar | undefined;
+}
+declare const OutboundPolicy_Redirect: MessageFns$1<OutboundPolicy_Redirect>;
+interface OutboundPolicy_Redirect_Block {
+}
+declare const OutboundPolicy_Redirect_Block: MessageFns$1<OutboundPolicy_Redirect_Block>;
+interface OutboundPolicy_Redirect_ViaProxy {
+    proxyId: string;
+}
+declare const OutboundPolicy_Redirect_ViaProxy: MessageFns$1<OutboundPolicy_Redirect_ViaProxy>;
+interface OutboundPolicy_Redirect_ViaSidecar {
+    sidecarName: string;
+}
+declare const OutboundPolicy_Redirect_ViaSidecar: MessageFns$1<OutboundPolicy_Redirect_ViaSidecar>;
+interface OutboundPolicy_Route {
+    ip?: OutboundPolicy_IPRoute | undefined;
+    tls?: OutboundPolicy_TLSRoute | undefined;
+    https?: OutboundPolicy_HTTPSRoute | undefined;
+    any?: OutboundPolicy_AnyRoute | undefined;
+}
+declare const OutboundPolicy_Route: MessageFns$1<OutboundPolicy_Route>;
+interface OutboundPolicy_TLSDecryption {
+    /**
+     * Generate a certificate authority for the sandbox and attempt to make the
+     * sandbox trust it, so that routes that need to can decrypt its TLS traffic.
+     * Decrypts nothing on its own. Required by HTTPS routes. Fixed at creation.
+     */
+    allowed: boolean;
+}
+declare const OutboundPolicy_TLSDecryption: MessageFns$1<OutboundPolicy_TLSDecryption>;
 interface PTYInfo {
     /** Soon deprecated */
     enabled: boolean;
@@ -3422,6 +3659,47 @@ interface PTYInfo {
     noTerminateOnIdleStdin: boolean;
 }
 declare const PTYInfo: MessageFns$1<PTYInfo>;
+interface PersistentSandboxCreateRequest {
+    appId: string;
+    definition: Sandbox$1 | undefined;
+}
+declare const PersistentSandboxCreateRequest: MessageFns$1<PersistentSandboxCreateRequest>;
+interface PersistentSandboxCreateResponse {
+    persistentSandboxId: string;
+    sandboxId: string;
+}
+declare const PersistentSandboxCreateResponse: MessageFns$1<PersistentSandboxCreateResponse>;
+interface PersistentSandboxGetRequest {
+    persistentSandboxId?: string | undefined;
+    name?: PersistentSandboxNameLookup | undefined;
+}
+declare const PersistentSandboxGetRequest: MessageFns$1<PersistentSandboxGetRequest>;
+interface PersistentSandboxGetResponse {
+    persistentSandboxId: string;
+    sandboxId: string;
+}
+declare const PersistentSandboxGetResponse: MessageFns$1<PersistentSandboxGetResponse>;
+interface PersistentSandboxNameLookup {
+    appName: string;
+    environmentName: string;
+    name: string;
+}
+declare const PersistentSandboxNameLookup: MessageFns$1<PersistentSandboxNameLookup>;
+interface PersistentSandboxResumeRequest {
+    persistentSandboxId: string;
+}
+declare const PersistentSandboxResumeRequest: MessageFns$1<PersistentSandboxResumeRequest>;
+interface PersistentSandboxResumeResponse {
+    sandboxId: string;
+}
+declare const PersistentSandboxResumeResponse: MessageFns$1<PersistentSandboxResumeResponse>;
+interface PersistentSandboxTerminateRequest {
+    persistentSandboxId: string;
+}
+declare const PersistentSandboxTerminateRequest: MessageFns$1<PersistentSandboxTerminateRequest>;
+interface PersistentSandboxTerminateResponse {
+}
+declare const PersistentSandboxTerminateResponse: MessageFns$1<PersistentSandboxTerminateResponse>;
 interface PortSpec {
     port: number;
     unencrypted: boolean;
@@ -3784,7 +4062,7 @@ interface Sandbox$1 {
      */
     inboundCidrAllowlist: string[];
     environmentVariables: StringMap | undefined;
-    outboundPolicy?: OutboundPolicy | undefined;
+    experimentalOutboundPolicy?: ExperimentalOutboundPolicy$1 | undefined;
     /**
      * If set, the sandbox's main container is served an X.509-SVID over a
      * SPIFFE Workload API socket, addressed by SPIFFE_ENDPOINT_SOCKET. The
@@ -3792,6 +4070,12 @@ interface Sandbox$1 {
      * Sidecars are not served one.
      */
     includeX509Svid: boolean;
+    /**
+     * Route-based outbound policy. Mutually exclusive with
+     * experimental_outbound_policy (superseded, experimental API) and with any
+     * network_access other than OPEN.
+     */
+    outboundPolicy?: OutboundPolicy | undefined;
 }
 declare const Sandbox$1: MessageFns$1<Sandbox$1>;
 interface SandboxContainerCreateV2Request {
@@ -4261,6 +4545,53 @@ interface SecretUpdateRequest_Update {
     value?: string | undefined;
 }
 declare const SecretUpdateRequest_Update: MessageFns$1<SecretUpdateRequest_Update>;
+interface ServerCountRequestsRequest {
+    functionId: string;
+    /** Inclusive, based on request timestamp. */
+    since: Date | undefined;
+    /** Exclusive, based on request timestamp. */
+    until: Date | undefined;
+    bucketSecs: number;
+}
+declare const ServerCountRequestsRequest: MessageFns$1<ServerCountRequestsRequest>;
+interface ServerCountRequestsResponse {
+    /**
+     * Ordered by bucket start time, from oldest to newest.
+     * Counts include only requests within the requested time range.
+     */
+    buckets: ServerCountRequestsResponse_RequestBucket[];
+}
+declare const ServerCountRequestsResponse: MessageFns$1<ServerCountRequestsResponse>;
+interface ServerCountRequestsResponse_RequestBucket {
+    bucketStartAt: Date | undefined;
+    /** Number of request records, matching ServerRequestFetch. */
+    count: number;
+}
+declare const ServerCountRequestsResponse_RequestBucket: MessageFns$1<ServerCountRequestsResponse_RequestBucket>;
+interface ServerGetMetricsRequest {
+    functionId: string;
+    /** Required; rounded down to a UTC bucket boundary. */
+    since: Date | undefined;
+    /** Required; rounded down; at most 31 days after since. */
+    until: Date | undefined;
+    /**
+     * If omitted, choose a supported width targeting approximately 100 buckets.
+     * At most 500 points per series in the rounded interval.
+     */
+    bucketSecs?: number | undefined;
+    /** Metric groups: containers, requests, etc. */
+    groups: string[];
+}
+declare const ServerGetMetricsRequest: MessageFns$1<ServerGetMetricsRequest>;
+interface ServerGetMetricsResponse {
+    /** Inclusive effective bound, rounded down. */
+    since: Date | undefined;
+    /** Exclusive effective bound, rounded down. */
+    until: Date | undefined;
+    bucketSecs: number;
+    series: FunctionMetricSeries[];
+}
+declare const ServerGetMetricsResponse: MessageFns$1<ServerGetMetricsResponse>;
 interface ServerGetTimeRangeStatsRequest {
     functionId: string;
     /** Inclusive. */
@@ -4331,15 +4662,28 @@ declare const ServerGetTimeRangeStatsResponse_ServerStatusCodeCount: MessageFns$
 interface ServerRequestFetchRequest {
     functionId: string;
     tail?: ServerRequestFetchRequest_Tail | undefined;
+    range?: ServerRequestFetchRequest_Range | undefined;
 }
 declare const ServerRequestFetchRequest: MessageFns$1<ServerRequestFetchRequest>;
+interface ServerRequestFetchRequest_Range {
+    /** Inclusive, based on request timestamp. */
+    since: Date | undefined;
+    /** Exclusive, based on request timestamp. */
+    until: Date | undefined;
+    /** Maximum number of requests to return. Must be between 1 and 20000. */
+    limit: number;
+}
+declare const ServerRequestFetchRequest_Range: MessageFns$1<ServerRequestFetchRequest_Range>;
 interface ServerRequestFetchRequest_Tail {
     /** Number of most recent requests to return. Must be between 1 and 1000. */
     count: number;
 }
 declare const ServerRequestFetchRequest_Tail: MessageFns$1<ServerRequestFetchRequest_Tail>;
 interface ServerRequestFetchResponse {
-    /** The requested number of most recent requests from the last seven days, ordered from newest to oldest. */
+    /**
+     * Tail queries return the most recent requests from the last seven days, ordered from newest to oldest.
+     * Range queries return requests ordered from oldest to newest.
+     */
     requests: ServerRequestInfo[];
 }
 declare const ServerRequestFetchResponse: MessageFns$1<ServerRequestFetchResponse>;
@@ -4359,14 +4703,52 @@ interface ServiceUser {
     lastUsedAt: number;
     createdByAvatarUrl: string;
     serviceUserId: string;
+    status: string;
+    scoped: boolean;
+    environmentRoles: ServiceUser_EnvironmentRoleEntry[];
+    /** This should be a TImestamp type, but keeping as a double for compatibility with public_api.proto */
+    expiresAt?: number | undefined;
 }
 declare const ServiceUser: MessageFns$1<ServiceUser>;
+interface ServiceUser_EnvironmentRoleEntry {
+    environmentId: string;
+    role: EnvironmentRole;
+    environmentName: string;
+    roleStr: string;
+}
+declare const ServiceUser_EnvironmentRoleEntry: MessageFns$1<ServiceUser_EnvironmentRoleEntry>;
+interface ServiceUserCreateRequest {
+    name: string;
+    scoped: boolean;
+    expiresInSeconds: number;
+}
+declare const ServiceUserCreateRequest: MessageFns$1<ServiceUserCreateRequest>;
+interface ServiceUserCreateResponse {
+    tokenId: string;
+    tokenSecret: string;
+    serviceUserId: string;
+    expiresAt: Date | undefined;
+}
+declare const ServiceUserCreateResponse: MessageFns$1<ServiceUserCreateResponse>;
+interface ServiceUserDeleteRequest {
+    serviceUserId: string;
+    serviceUserName: string;
+}
+declare const ServiceUserDeleteRequest: MessageFns$1<ServiceUserDeleteRequest>;
 interface ServiceUserIdentity {
     serviceUserId: string;
     serviceUserName: string;
     createdBy: UserIdentity | undefined;
 }
 declare const ServiceUserIdentity: MessageFns$1<ServiceUserIdentity>;
+interface ServiceUserInfoRequest {
+    serviceUserName: string;
+}
+declare const ServiceUserInfoRequest: MessageFns$1<ServiceUserInfoRequest>;
+interface ServiceUserInfoResponse {
+    serviceUser: ServiceUser | undefined;
+}
+declare const ServiceUserInfoResponse: MessageFns$1<ServiceUserInfoResponse>;
 interface ServiceUserListResponse {
     serviceUsers: ServiceUser[];
 }
@@ -4471,11 +4853,6 @@ interface StringMap {
     };
 }
 declare const StringMap: MessageFns$1<StringMap>;
-interface SystemErrorMessage {
-    errorCode: SystemErrorCode;
-    errorMessage: string;
-}
-declare const SystemErrorMessage: MessageFns$1<SystemErrorMessage>;
 interface TaskClusterHelloRequest {
     taskId: string;
     containerIp: string;
@@ -4976,6 +5353,8 @@ interface VolumePutFilesRequest {
      * existing directories with uploaded files regardless.)
      */
     disallowOverwriteExistingFiles: boolean;
+    /** Earliest checked_at the client received from the existence checks for these files. Telemetry only. */
+    earliestCheckedAt: Date | undefined;
 }
 declare const VolumePutFilesRequest: MessageFns$1<VolumePutFilesRequest>;
 interface VolumeReloadRequest {
@@ -5546,14 +5925,6 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
-        readonly containerFilesystemExecGetOutput: {
-            readonly name: "ContainerFilesystemExecGetOutput";
-            readonly requestType: MessageFns$1<ContainerFilesystemExecGetOutputRequest>;
-            readonly requestStream: false;
-            readonly responseType: MessageFns$1<FilesystemRuntimeOutputBatch>;
-            readonly responseStream: true;
-            readonly options: {};
-        };
         readonly containerHeartbeat: {
             readonly name: "ContainerHeartbeat";
             readonly requestType: MessageFns$1<ContainerHeartbeatRequest>;
@@ -5945,6 +6316,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly functionCallCount: {
+            readonly name: "FunctionCallCount";
+            readonly requestType: MessageFns$1<FunctionCallCountRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<FunctionCallCountResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly functionCallFetch: {
             readonly name: "FunctionCallFetch";
             readonly requestType: MessageFns$1<FunctionCallFetchRequest>;
@@ -6075,6 +6454,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly functionGetMetrics: {
+            readonly name: "FunctionGetMetrics";
+            readonly requestType: MessageFns$1<FunctionGetMetricsRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<FunctionGetMetricsResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         /** Returns the next result(s) for an entire function call (FunctionMap) */
         readonly functionGetOutputs: {
             readonly name: "FunctionGetOutputs";
@@ -6230,6 +6617,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly imageNameDelete: {
+            readonly name: "ImageNameDelete";
+            readonly requestType: MessageFns$1<ImageNameDeleteRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$2<Empty>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly imagePublish: {
             readonly name: "ImagePublish";
             readonly requestType: MessageFns$1<ImagePublishRequest>;
@@ -6271,6 +6666,15 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        /** Metrics discovery */
+        readonly metricsGetInfo: {
+            readonly name: "MetricsGetInfo";
+            readonly requestType: MessageFns$1<MetricsGetInfoRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<MetricsGetInfoResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         /** Mounts */
         readonly mountBatchedCheckExistence: {
             readonly name: "MountBatchedCheckExistence";
@@ -6305,6 +6709,39 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        /** Persistent sandboxes */
+        readonly persistentSandboxCreate: {
+            readonly name: "PersistentSandboxCreate";
+            readonly requestType: MessageFns$1<PersistentSandboxCreateRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<PersistentSandboxCreateResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
+        readonly persistentSandboxGet: {
+            readonly name: "PersistentSandboxGet";
+            readonly requestType: MessageFns$1<PersistentSandboxGetRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<PersistentSandboxGetResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
+        readonly persistentSandboxResume: {
+            readonly name: "PersistentSandboxResume";
+            readonly requestType: MessageFns$1<PersistentSandboxResumeRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<PersistentSandboxResumeResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
+        readonly persistentSandboxTerminate: {
+            readonly name: "PersistentSandboxTerminate";
+            readonly requestType: MessageFns$1<PersistentSandboxTerminateRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<PersistentSandboxTerminateResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         /** Proxies */
         readonly proxyAddIp: {
             readonly name: "ProxyAddIp";
@@ -6783,6 +7220,22 @@ declare const ModalClientDefinition: {
             readonly options: {};
         };
         /** Servers */
+        readonly serverCountRequests: {
+            readonly name: "ServerCountRequests";
+            readonly requestType: MessageFns$1<ServerCountRequestsRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<ServerCountRequestsResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
+        readonly serverGetMetrics: {
+            readonly name: "ServerGetMetrics";
+            readonly requestType: MessageFns$1<ServerGetMetricsRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<ServerGetMetricsResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly serverGetTimeRangeStats: {
             readonly name: "ServerGetTimeRangeStats";
             readonly requestType: MessageFns$1<ServerGetTimeRangeStatsRequest>;
@@ -6800,6 +7253,30 @@ declare const ModalClientDefinition: {
             readonly options: {};
         };
         /** Service users */
+        readonly serviceUserCreate: {
+            readonly name: "ServiceUserCreate";
+            readonly requestType: MessageFns$1<ServiceUserCreateRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<ServiceUserCreateResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
+        readonly serviceUserDelete: {
+            readonly name: "ServiceUserDelete";
+            readonly requestType: MessageFns$1<ServiceUserDeleteRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$2<Empty>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
+        readonly serviceUserInfo: {
+            readonly name: "ServiceUserInfo";
+            readonly requestType: MessageFns$1<ServiceUserInfoRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<ServiceUserInfoResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly serviceUserList: {
             readonly name: "ServiceUserList";
             readonly requestType: MessageFns$2<Empty>;
@@ -7358,7 +7835,7 @@ declare class Secret {
     #private;
     readonly name?: string;
     /** @ignore */
-    constructor(secretId: string, name?: string, hydrator?: SecretHydrator, keys?: readonly string[]);
+    constructor(secretId: string, name?: string, hydrator?: SecretHydrator);
     /** The ID of the server-side Secret, or an empty string if not yet hydrated. */
     get secretId(): string;
     /**
@@ -7369,14 +7846,6 @@ declare class Secret {
      * @hidden
      */
     get _hydrator(): SecretHydrator | undefined;
-    /**
-     * Names of the env vars this server-side Secret defines, or `undefined` if
-     * unknown (e.g. for lazy fromObject Secrets or Secrets constructed by id).
-     *
-     * @internal
-     * @hidden
-     */
-    get _keys(): ReadonlySet<string> | undefined;
     /**
      * Lazily create the ephemeral server-side Secret backing a fromObject Secret
      * and populate {@link Secret#secretId secretId}. A no-op once secretId is set
@@ -7732,7 +8201,12 @@ declare class FunctionCall {
     readonly functionCallId: string;
     /** @ignore */
     constructor(client: ModalClient, functionCallId: string, appId: string, functionId: string);
-    /** Get the result of a FunctionCall, optionally waiting with a timeout. */
+    /**
+     * Get the result of a FunctionCall, optionally waiting with a timeout.
+     *
+     * @throws {@link TimeoutError} if `timeoutMs` elapses before the Function finishes.
+     * @throws {@link FunctionTimeoutError} if the Function exceeds its execution timeout.
+     */
     get(params?: FunctionCallGetParams): Promise<any>;
     /** Cancel a running FunctionCall. */
     cancel(params?: FunctionCallCancelParams): Promise<void>;
@@ -7750,6 +8224,91 @@ declare class FunctionCall {
     get logs(): FunctionCallLogsManager;
 }
 
+/** An observation at a UTC-aligned bucket start. */
+interface TimeSeriesPoint {
+    time: Date;
+    /** Missing observations are null; observed zeroes remain zero. */
+    value: number | null;
+}
+/** An individual metric series with points ordered by time. */
+interface MetricSeries {
+    name: string;
+    unit: string;
+    aggregation: string;
+    description: string;
+    points: TimeSeriesPoint[];
+}
+/** The name, unit, and meaning of an exportable series. */
+interface MetricDefinition {
+    name: string;
+    unit: string;
+    description: string;
+}
+/** A metrics group and its individual series definitions. */
+interface MetricsSchema {
+    name: string;
+    definitions: MetricDefinition[];
+}
+/** Exported metrics over the effective, UTC-aligned [since, until) range. */
+interface ObjectMetrics {
+    objectId: string;
+    since: Date;
+    until: Date;
+    bucketSizeSecs: number;
+    /** Total points across series, including missing observations. */
+    pointCount: number;
+    series: Record<string, MetricSeries>;
+}
+/** Options for discovering metric definitions. */
+interface MetricsSchemaParams {
+    /** Omit or pass an empty array to select all groups. */
+    groups?: string[];
+}
+/** Options for exporting Function metric samples. */
+interface FunctionMetricsExportParams extends MetricsSchemaParams {
+    /** Defaults to one hour before until. */
+    since?: Date;
+    /** Defaults to the current time. */
+    until?: Date;
+    /** Bucket width in whole seconds. */
+    bucketSizeSecs?: number;
+    /** Include the root Function and all its variants. Defaults to false. */
+    allVariants?: boolean;
+}
+/** Namespace for Function metric samples and definitions. */
+declare class FunctionMetricsManager {
+    #private;
+    /** @hidden */
+    constructor(client: ModalClient, functionId: string);
+    /**
+     * Fetch metric samples, defaulting to all groups over the last hour.
+     *
+     * The maximum range is 31 days, with at most 500 points per series. Omit
+     * bucketSizeSecs to let Modal select a supported width targeting approximately
+     * 100 buckets. Bounds round down to UTC bucket boundaries: data before since
+     * may be included, and the partial bucket at until is excluded.
+     * Missing observations have value null. Use schema() to discover definitions.
+     *
+     * @example
+     * ```typescript
+     * const metrics = await fn.metrics.export({
+     *   bucketSizeSecs: 5 * 60,
+     *   groups: ["calls"],
+     * });
+     * for (const point of metrics.series["successful_calls_count"].points) {
+     *   console.log(point.time, point.value);
+     * }
+     * ```
+     */
+    export(params?: FunctionMetricsExportParams): Promise<ObjectMetrics>;
+    /**
+     * Return metric definitions keyed by group name, without fetching samples.
+     * Omit groups to return all groups. Each group's definitions include all its
+     * individual series.
+     */
+    schema(params?: MetricsSchemaParams): Promise<Record<string, MetricsSchema>>;
+}
+
 type HeartbeatFunction = () => Promise<any>;
 declare class EphemeralHeartbeatManager {
     private readonly heartbeatFn;
@@ -7763,6 +8322,8 @@ declare class EphemeralHeartbeatManager {
 type VolumeFromNameParams = {
     environment?: string;
     createIfMissing?: boolean;
+    /** Experimental VolumeFS version; omit to accept either version. */
+    version?: 1 | 2;
 };
 /** Optional parameters for {@link VolumeService#ephemeral client.volumes.ephemeral()}. */
 type VolumeEphemeralParams = {
@@ -7986,6 +8547,8 @@ declare class Function_ {
      * for CLI access to logs for an App.
      */
     get logs(): FunctionLogsManager;
+    /** Access metric samples with export() and series definitions with schema(). */
+    get metrics(): FunctionMetricsManager;
     /** Override the static Function configuration at runtime. */
     withOptions(options: FunctionWithOptionsParams): Function_;
     /** Override the static Function concurrency configuration at runtime. */
@@ -8585,6 +9148,12 @@ interface TaskReloadVolumesRequest {
     containerId: string;
 }
 declare const TaskReloadVolumesRequest: MessageFns<TaskReloadVolumesRequest>;
+interface TaskSetExperimentalOutboundPolicyRequest {
+    taskId: string;
+    /** Replaces the task's experimental outbound policy. */
+    experimentalOutboundPolicy: ExperimentalOutboundPolicy$1 | undefined;
+}
+declare const TaskSetExperimentalOutboundPolicyRequest: MessageFns<TaskSetExperimentalOutboundPolicyRequest>;
 interface TaskSetNetworkAccessRequest {
     taskId: string;
     /**
@@ -8594,12 +9163,6 @@ interface TaskSetNetworkAccessRequest {
     networkAccess: NetworkAccess | undefined;
 }
 declare const TaskSetNetworkAccessRequest: MessageFns<TaskSetNetworkAccessRequest>;
-interface TaskSetOutboundPolicyRequest {
-    taskId: string;
-    /** Replaces the task's outbound policy. */
-    outboundPolicy: OutboundPolicy | undefined;
-}
-declare const TaskSetOutboundPolicyRequest: MessageFns<TaskSetOutboundPolicyRequest>;
 interface TaskSnapshotDirectoryRequest {
     taskId: string;
     path: Uint8Array;
@@ -8846,14 +9409,14 @@ declare class TaskCommandRouterClientImpl {
      */
     execStdinWriteStream(taskId: string, execId: string, source: StdinSource, chunkSize?: number, maxResumeAttempts?: number): Promise<number>;
     execPoll(taskId: string, execId: string, deadline?: number | null): Promise<TaskExecPollResponse>;
-    execWait(taskId: string, execId: string, deadline?: number | null): Promise<TaskExecWaitResponse>;
+    execWait(taskId: string, execId: string, deadline?: number | null, signal?: AbortSignal): Promise<TaskExecWaitResponse>;
     mountDirectory(request: TaskMountDirectoryRequest): Promise<void>;
     snapshotDirectory(request: TaskSnapshotDirectoryRequest, options?: TimeoutOptions): Promise<TaskSnapshotDirectoryResponse>;
     snapshotFilesystem(request: TaskSnapshotFilesystemRequest, options?: TimeoutOptions): Promise<TaskSnapshotFilesystemResponse>;
     snapshotMemory(request: TaskSnapshotMemoryRequest, options?: TimeoutOptions): Promise<TaskSnapshotMemoryResponse>;
     unmountDirectory(request: TaskUnmountDirectoryRequest): Promise<void>;
     setNetworkAccess(request: TaskSetNetworkAccessRequest): Promise<void>;
-    setOutboundPolicy(request: TaskSetOutboundPolicyRequest): Promise<void>;
+    setOutboundPolicy(request: TaskSetExperimentalOutboundPolicyRequest): Promise<void>;
     /**
      * Reload all Volumes mounted in the task to reflect their latest committed state.
      *
@@ -8952,7 +9515,7 @@ declare class ExperimentalOutboundPolicy {
     /** Convert to the wire format. Referenced secrets must be hydrated first.
      * @internal
      */
-    _toProto(): OutboundPolicy;
+    _toProto(): ExperimentalOutboundPolicy$1;
 }
 
 /** Type of a filesystem entry. */
@@ -9600,6 +10163,8 @@ declare class SandboxService {
     /** Get a running {@link Sandbox} by name from a deployed {@link App}.
      *
      * Raises a {@link NotFoundError} if no running Sandbox is found with the given name.
+     * If `includeTerminated` is set to `true` and no Sandbox with the name is currently
+     * running, the most recent terminated Sandbox will be returned instead.
      * A Sandbox's name is the `name` argument passed to {@link SandboxService#create sandboxes.create()}.
      *
      * @param appName - Name of the deployed App
@@ -9671,10 +10236,20 @@ type SandboxExperimentalListParams = {
 /** Optional parameters for {@link SandboxService#fromName client.sandboxes.fromName()}. */
 type SandboxFromNameParams = {
     environment?: string;
+    /**
+     * If `includeTerminated` is set to `true` and no Sandbox with the name is
+     * currently running, the most recent terminated Sandbox will be returned instead.
+     */
+    includeTerminated?: boolean;
 };
 /** Optional parameters for {@link SandboxService#experimentalFromName client.sandboxes.experimentalFromName()}. */
 type SandboxExperimentalFromNameParams = {
     environment?: string;
+    /**
+     * If `includeTerminated` is set to `true` and no Sandbox with the name is
+     * currently running, the most recent terminated Sandbox will be returned instead.
+     */
+    includeTerminated?: boolean;
 };
 /** Optional parameters for {@link SandboxService#experimentalFromSnapshot client.sandboxes.experimentalFromSnapshot()}. */
 type SandboxExperimentalFromSnapshotParams = {
@@ -10085,6 +10660,86 @@ declare class ContainerProcess<R extends string | Uint8Array = any> {
     _poll(): Promise<number | null>;
     /** Wait for process completion and return the exit code. */
     wait(): Promise<number>;
+    /**
+     * @internal
+     * @hidden
+     * Like `wait()`, but stops waiting when `signal` is aborted.
+     */
+    _wait(signal?: AbortSignal): Promise<number>;
+}
+
+/** Service for looking up {@link Environment}s through `client.environments`. */
+declare class EnvironmentService {
+    #private;
+    /** Namespace for creating, listing, and deleting Environments. */
+    readonly objects: EnvironmentObjectsService;
+    /** @ignore */
+    constructor(client: ModalClient);
+    /**
+     * Look up an Environment by name, optionally creating it if it does not exist.
+     * @throws {InvalidError} The Environment name is invalid.
+     */
+    fromName(name: string, params?: EnvironmentFromNameParams): Promise<Environment>;
+}
+/** Optional parameters for {@link EnvironmentService#fromName client.environments.fromName()}. */
+type EnvironmentFromNameParams = {
+    createIfMissing?: boolean;
+};
+/** Namespace for creating, listing, and deleting Environments. */
+declare class EnvironmentObjectsService {
+    #private;
+    /** @ignore */
+    constructor(client: ModalClient);
+    /** Create an Environment with the given name. */
+    create(name: string, params?: EnvironmentCreateParams): Promise<void>;
+    /**
+     * Yield Environment handles without additional lookup requests.
+     *
+     * ```typescript
+     * for await (const environment of client.environments.objects.list()) {
+     *   console.log(environment.environmentId, environment.name);
+     * }
+     * ```
+     */
+    list(): AsyncGenerator<Environment, void, unknown>;
+    /**
+     * Delete an Environment by name.
+     * This permanently deletes the Environment and all objects in it.
+     */
+    delete(name: string): Promise<void>;
+}
+/** Optional parameters for {@link EnvironmentObjectsService#create}. */
+type EnvironmentCreateParams = {
+    /** Restrict access to users with explicitly assigned Environment roles. */
+    restricted?: boolean;
+    /** Default Environment role for workspace members. */
+    defaultRole?: string;
+};
+/** A Modal Environment, with namespaces for accessing its resources. */
+declare class Environment {
+    readonly environmentId: string;
+    readonly name: string;
+    readonly apps: EnvironmentAppsService;
+    /** @ignore */
+    constructor(client: ModalClient, environmentId: string, name: string);
+}
+/** Namespace for accessing Apps in an {@link Environment}. */
+declare class EnvironmentAppsService {
+    #private;
+    /** @ignore */
+    constructor(client: ModalClient, environmentName: string);
+    /**
+     * Yield handles for live Apps in this Environment, excluding stopped and disabled Apps.
+     * Listing Apps does not create Apps.
+     *
+     * ```typescript
+     * const environment = await client.environments.fromName("prod");
+     * for await (const app of environment.apps.list()) {
+     *   console.log(app.appId, app.name);
+     * }
+     * ```
+     */
+    list(): AsyncGenerator<App, void, unknown>;
 }
 
 interface ModalClientParams {
@@ -10141,6 +10796,7 @@ declare class ModalClient {
     readonly apps: AppService;
     readonly cloudBucketMounts: CloudBucketMountService;
     readonly cls: ClsService;
+    readonly environments: EnvironmentService;
     readonly functions: FunctionService;
     readonly functionCalls: FunctionCallService;
     readonly images: ImageService;
@@ -10219,22 +10875,64 @@ type AppFromNameParams = {
     environment?: string;
     createIfMissing?: boolean;
 };
-/** Represents a deployed Modal App. */
+/** Lifecycle state of a Modal App. */
+type AppState = "ephemeral" | "detached" | "deployed" | "stopping" | "stopped" | "initializing" | "disabled" | "unknown";
+/** Timestamps and attributions for events in an App's lifecycle. */
+interface AppLifecycle {
+    state: AppState;
+    version?: number;
+    createdAt: Date;
+    createdBy: string;
+    deployedAt?: Date;
+    deployedBy?: string;
+    stoppedAt?: Date;
+    stoppedBy?: string;
+}
+/** Information about an App, its lifecycle, and its member Functions and Servers. */
+interface AppInfo {
+    appId: string;
+    description: string;
+    lifecycle: AppLifecycle;
+    /** Function names mapped to Function IDs. */
+    functions: Record<string, string>;
+    /** Server names mapped to Function IDs. */
+    servers: Record<string, string>;
+}
+/** Optional parameters for {@link App#info}. */
+type AppInfoParams = {
+    /** Fetch current information rather than the cached lookup or listing snapshot. */
+    refresh?: boolean;
+};
+/** Represents a Modal App. */
 declare class App {
+    #private;
     readonly appId: string;
     readonly name?: string;
     readonly environmentName?: string;
     /** @ignore */
-    constructor(appId: string, name?: string, environmentName?: string);
+    constructor(appId: string, name?: string, environmentName?: string, client?: ModalClient, metadata?: AppHandleMetadata);
+    /**
+     * Return information about this App, including its lifecycle and member Functions and Servers.
+     * By default, returns the snapshot from the previous lookup, listing, or refresh.
+     */
+    info(params?: AppInfoParams): Promise<AppInfo>;
 }
 
 /** An operation exceeds the allowed time limit. */
 declare class TimeoutError extends Error {
     constructor(message?: string);
 }
-/** Function execution exceeds the allowed time limit. */
+/**
+ * Function execution exceeds the allowed time limit.
+ *
+ * {@link FunctionCall#get FunctionCall.get()} throws {@link TimeoutError}
+ * instead when `timeoutMs` elapses before the Function finishes. Matching that
+ * case with `instanceof FunctionTimeoutError` is deprecated and will stop
+ * working in a future release.
+ */
 declare class FunctionTimeoutError extends Error {
     constructor(message: string);
+    static [Symbol.hasInstance](instance: unknown): boolean;
 }
 /** An error on the Modal server, or a Python exception. */
 declare class RemoteError extends Error {
@@ -10323,4 +11021,4 @@ declare class ClientClosedError extends Error {
 
 declare function checkForRenamedParams(params: any, renames: Record<string, string>): void;
 
-export { AlreadyExistsError, App, type AppFromNameParams, AppService, ClientClosedError, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ConflictError, ContainerProcess, ExecutionError, ExperimentalOutboundPolicy, type FileInfo, type FileType, type FileWatchEvent, type FileWatchEventType, type FunctionAutoscalerSettings, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, type FunctionCallLogFetchParams, type FunctionCallLogStreamParams, type FunctionCallLogTailParams, FunctionCallLogsManager, FunctionCallService, type FunctionCurrentStats, type FunctionFromNameParams, type FunctionLogFetchParams, type FunctionLogStreamParams, type FunctionLogTailParams, FunctionLogsManager, FunctionService, type FunctionStats, type FunctionStatsParams, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, type FunctionWithBatchingParams, type FunctionWithConcurrencyParams, type FunctionWithOptionsParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, type ImageFromNameParams, type ImagePublishParams, ImageService, InternalFailure, InvalidError, type LogEntry, type FunctionLogFetchParams as LogFetchParams, type LogLevel, type LogSource, type Logger, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, ResourceExhaustedError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, type SandboxExperimentalFromNameParams, type SandboxExperimentalFromSnapshotParams, type SandboxExperimentalGetExitSnapshotParams, type SandboxExperimentalListParams, SandboxFilesystem, SandboxFilesystemDirectoryNotEmptyError, SandboxFilesystemError, SandboxFilesystemFileTooLargeError, SandboxFilesystemIsADirectoryError, SandboxFilesystemNotADirectoryError, SandboxFilesystemNotFoundError, SandboxFilesystemPathAlreadyExistsError, SandboxFilesystemPermissionError, type SandboxFromNameParams, type SandboxListParams, type SandboxLogFetchParams, type SandboxLogTailParams, SandboxLogsManager, type SandboxMountImageParams, type SandboxReloadVolumesParams, type SandboxRuntime, SandboxService, SandboxSnapshot, type SandboxSnapshotDirectoryParams, type SandboxSnapshotFilesystemParams, SandboxSnapshotService, type SandboxTerminateParams, SandboxTimeoutError, type SandboxUpdateNetworkPolicyParams, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, SidecarContainer, type SidecarCreateParams, type SidecarExecParams, type SidecarGetParams, type SidecarListParams, type SidecarMountImageParams, SidecarService, type SidecarSnapshotDirectoryParams, type SidecarSnapshotFilesystemParams, type SidecarTerminateParams, type SidecarUnmountImageParams, SnapshotCreationError, type StatsPercentile, type StatsPercentileDistribution, type StdioBehavior, type StreamMode, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, type VolumeMountOptionsParams, VolumeService, checkForRenamedParams };
+export { AlreadyExistsError, App, type AppFromNameParams, type AppInfo, type AppInfoParams, type AppLifecycle, AppService, type AppState, ClientClosedError, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ConflictError, ContainerProcess, Environment, EnvironmentAppsService, type EnvironmentCreateParams, type EnvironmentFromNameParams, EnvironmentObjectsService, EnvironmentService, ExecutionError, ExperimentalOutboundPolicy, type FileInfo, type FileType, type FileWatchEvent, type FileWatchEventType, type FunctionAutoscalerSettings, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, type FunctionCallLogFetchParams, type FunctionCallLogStreamParams, type FunctionCallLogTailParams, FunctionCallLogsManager, FunctionCallService, type FunctionCurrentStats, type FunctionFromNameParams, type FunctionLogFetchParams, type FunctionLogStreamParams, type FunctionLogTailParams, FunctionLogsManager, type FunctionMetricsExportParams, FunctionMetricsManager, FunctionService, type FunctionStats, type FunctionStatsParams, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, type FunctionWithBatchingParams, type FunctionWithConcurrencyParams, type FunctionWithOptionsParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, type ImageFromNameParams, type ImagePublishParams, ImageService, InternalFailure, InvalidError, type LogEntry, type FunctionLogFetchParams as LogFetchParams, type LogLevel, type LogSource, type Logger, type MetricDefinition, type MetricSeries, type MetricsSchema, type MetricsSchemaParams, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, type ObjectMetrics, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, ResourceExhaustedError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, type SandboxExperimentalFromNameParams, type SandboxExperimentalFromSnapshotParams, type SandboxExperimentalGetExitSnapshotParams, type SandboxExperimentalListParams, SandboxFilesystem, SandboxFilesystemDirectoryNotEmptyError, SandboxFilesystemError, SandboxFilesystemFileTooLargeError, SandboxFilesystemIsADirectoryError, SandboxFilesystemNotADirectoryError, SandboxFilesystemNotFoundError, SandboxFilesystemPathAlreadyExistsError, SandboxFilesystemPermissionError, type SandboxFromNameParams, type SandboxListParams, type SandboxLogFetchParams, type SandboxLogTailParams, SandboxLogsManager, type SandboxMountImageParams, type SandboxReloadVolumesParams, type SandboxRuntime, SandboxService, SandboxSnapshot, type SandboxSnapshotDirectoryParams, type SandboxSnapshotFilesystemParams, SandboxSnapshotService, type SandboxTerminateParams, SandboxTimeoutError, type SandboxUpdateNetworkPolicyParams, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, SidecarContainer, type SidecarCreateParams, type SidecarExecParams, type SidecarGetParams, type SidecarListParams, type SidecarMountImageParams, SidecarService, type SidecarSnapshotDirectoryParams, type SidecarSnapshotFilesystemParams, type SidecarTerminateParams, type SidecarUnmountImageParams, SnapshotCreationError, type StatsPercentile, type StatsPercentileDistribution, type StdioBehavior, type StreamMode, type TimeSeriesPoint, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, type VolumeMountOptionsParams, VolumeService, checkForRenamedParams };