modal 0.3.14 → 0.3.16

package/dist/index.cjs

@@ -55,7 +55,7 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/app.ts
-var import_nice_grpc3 = require("nice-grpc");
+var import_nice_grpc4 = require("nice-grpc");
 
 // node_modules/@bufbuild/protobuf/dist/esm/wire/varint.js
 function varint64read() {
@@ -18869,7 +18869,8 @@ function createBaseFunctionHandleMetadata() {
     methodHandleMetadata: {},
     functionSchema: void 0,
     inputPlaneUrl: void 0,
-    inputPlaneRegion: void 0
+    inputPlaneRegion: void 0,
+    maxObjectSizeBytes: void 0
   };
 }
 var FunctionHandleMetadata = {
@@ -18910,6 +18911,9 @@ var FunctionHandleMetadata = {
     if (message.inputPlaneRegion !== void 0) {
       writer.uint32(378).string(message.inputPlaneRegion);
     }
+    if (message.maxObjectSizeBytes !== void 0) {
+      writer.uint32(384).uint64(message.maxObjectSizeBytes);
+    }
     return writer;
   },
   decode(input, length) {
@@ -19006,6 +19010,13 @@ var FunctionHandleMetadata = {
           message.inputPlaneRegion = reader.string();
           continue;
         }
+        case 48: {
+          if (tag !== 384) {
+            break;
+          }
+          message.maxObjectSizeBytes = longToNumber(reader.uint64());
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -19033,7 +19044,8 @@ var FunctionHandleMetadata = {
       ) : {},
       functionSchema: isSet3(object.functionSchema) ? FunctionSchema.fromJSON(object.functionSchema) : void 0,
       inputPlaneUrl: isSet3(object.inputPlaneUrl) ? globalThis.String(object.inputPlaneUrl) : void 0,
-      inputPlaneRegion: isSet3(object.inputPlaneRegion) ? globalThis.String(object.inputPlaneRegion) : void 0
+      inputPlaneRegion: isSet3(object.inputPlaneRegion) ? globalThis.String(object.inputPlaneRegion) : void 0,
+      maxObjectSizeBytes: isSet3(object.maxObjectSizeBytes) ? globalThis.Number(object.maxObjectSizeBytes) : void 0
     };
   },
   toJSON(message) {
@@ -19080,6 +19092,9 @@ var FunctionHandleMetadata = {
     if (message.inputPlaneRegion !== void 0) {
       obj.inputPlaneRegion = message.inputPlaneRegion;
     }
+    if (message.maxObjectSizeBytes !== void 0) {
+      obj.maxObjectSizeBytes = Math.round(message.maxObjectSizeBytes);
+    }
     return obj;
   },
   create(base) {
@@ -19104,6 +19119,7 @@ var FunctionHandleMetadata = {
     message.functionSchema = object.functionSchema !== void 0 && object.functionSchema !== null ? FunctionSchema.fromPartial(object.functionSchema) : void 0;
     message.inputPlaneUrl = object.inputPlaneUrl ?? void 0;
     message.inputPlaneRegion = object.inputPlaneRegion ?? void 0;
+    message.maxObjectSizeBytes = object.maxObjectSizeBytes ?? void 0;
     return message;
   }
 };
@@ -38670,7 +38686,7 @@ function authMiddleware(profile) {
     options.metadata ??= new import_nice_grpc.Metadata();
     options.metadata.set(
       "x-modal-client-type",
-      String(7 /* CLIENT_TYPE_LIBMODAL */)
+      String(8 /* CLIENT_TYPE_LIBMODAL_JS */)
     );
     options.metadata.set("x-modal-client-version", "1.0.0");
     options.metadata.set("x-modal-token-id", tokenId);
@@ -38894,6 +38910,9 @@ ${result.exception}`
   return new Image2(resp.imageId);
 }
 
+// src/sandbox.ts
+var import_nice_grpc2 = require("nice-grpc");
+
 // src/errors.ts
 var FunctionTimeoutError = class extends Error {
   constructor(message) {
@@ -39191,7 +39210,7 @@ var Tunnel = class {
     return [this.unencryptedHost, this.unencryptedPort];
   }
 };
-var Sandbox2 = class {
+var Sandbox2 = class _Sandbox {
   sandboxId;
   stdin;
   stdout;
@@ -39213,6 +39232,23 @@ var Sandbox2 = class {
       ).pipeThrough(new TextDecoderStream())
     );
   }
+  /** Returns a running Sandbox object from an ID.
+   *
+   * @returns Sandbox with ID
+   */
+  static async fromId(sandboxId) {
+    try {
+      await client.sandboxWait({
+        sandboxId,
+        timeout: 0
+      });
+    } catch (err) {
+      if (err instanceof import_nice_grpc2.ClientError && err.code === import_nice_grpc2.Status.NOT_FOUND)
+        throw new NotFoundError(`Sandbox with id: '${sandboxId}' not found`);
+      throw err;
+    }
+    return new _Sandbox(sandboxId);
+  }
   /**
    * Open a file in the sandbox filesystem.
    * @param path - Path to the file to open
@@ -39233,11 +39269,13 @@ var Sandbox2 = class {
   }
   async exec(command, options) {
     const taskId = await this.#getTaskId();
+    const secretIds = options?.secrets ? options.secrets.map((secret) => secret.secretId) : [];
     const resp = await client.containerExec({
       taskId,
       command,
       workdir: options?.workdir,
-      timeoutSecs: options?.timeout ? options.timeout / 1e3 : 0
+      timeoutSecs: options?.timeout ? options.timeout / 1e3 : 0,
+      secretIds
     });
     return new ContainerProcess(resp.execId, options);
   }
@@ -39271,7 +39309,7 @@ var Sandbox2 = class {
         timeout: 55
       });
       if (resp.result) {
-        return resp.result.exitcode;
+        return _Sandbox.#getReturnCode(resp.result);
       }
     }
   }
@@ -39304,6 +39342,53 @@ var Sandbox2 = class {
     }
     return this.#tunnels;
   }
+  /**
+   * Snapshot the filesystem of the Sandbox.
+   *
+   * Returns an `Image` object which can be used to spawn a new Sandbox with the same filesystem.
+   *
+   * @param timeout - Timeout for the snapshot operation in milliseconds
+   * @returns Promise that resolves to an Image
+   */
+  async snapshotFilesystem(timeout = 55e3) {
+    const resp = await client.sandboxSnapshotFs({
+      sandboxId: this.sandboxId,
+      timeout: timeout / 1e3
+    });
+    if (resp.result?.status !== 1 /* GENERIC_STATUS_SUCCESS */) {
+      throw new Error(
+        `Sandbox snapshot failed: ${resp.result?.exception || "Unknown error"}`
+      );
+    }
+    if (!resp.imageId) {
+      throw new Error("Sandbox snapshot response missing image ID");
+    }
+    return new Image2(resp.imageId);
+  }
+  /**
+   * Check if the Sandbox has finished running.
+   *
+   * Returns `null` if the Sandbox is still running, else returns the exit code.
+   */
+  async poll() {
+    const resp = await client.sandboxWait({
+      sandboxId: this.sandboxId,
+      timeout: 0
+    });
+    return _Sandbox.#getReturnCode(resp.result);
+  }
+  static #getReturnCode(result) {
+    if (result === void 0 || result.status === 0 /* GENERIC_STATUS_UNSPECIFIED */) {
+      return null;
+    }
+    if (result.status === 4 /* GENERIC_STATUS_TIMEOUT */) {
+      return 124;
+    } else if (result.status === 3 /* GENERIC_STATUS_TERMINATED */) {
+      return 137;
+    } else {
+      return result.exitcode;
+    }
+  }
 };
 var ContainerProcess = class {
   stdin;
@@ -39458,7 +39543,7 @@ function encodeIfString(chunk) {
 }
 
 // src/secret.ts
-var import_nice_grpc2 = require("nice-grpc");
+var import_nice_grpc3 = require("nice-grpc");
 var Secret = class _Secret {
   secretId;
   /** @ignore */
@@ -39475,9 +39560,9 @@ var Secret = class _Secret {
       });
       return new _Secret(resp.secretId);
     } catch (err) {
-      if (err instanceof import_nice_grpc2.ClientError && err.code === import_nice_grpc2.Status.NOT_FOUND)
+      if (err instanceof import_nice_grpc3.ClientError && err.code === import_nice_grpc3.Status.NOT_FOUND)
         throw new NotFoundError(err.details);
-      if (err instanceof import_nice_grpc2.ClientError && err.code === import_nice_grpc2.Status.FAILED_PRECONDITION && err.details.includes("Secret is missing key"))
+      if (err instanceof import_nice_grpc3.ClientError && err.code === import_nice_grpc3.Status.FAILED_PRECONDITION && err.details.includes("Secret is missing key"))
         throw new NotFoundError(err.details);
       throw err;
     }
@@ -39501,7 +39586,7 @@ var App = class _App {
       });
       return new _App(resp.appId);
     } catch (err) {
-      if (err instanceof import_nice_grpc3.ClientError && err.code === import_nice_grpc3.Status.NOT_FOUND)
+      if (err instanceof import_nice_grpc4.ClientError && err.code === import_nice_grpc4.Status.NOT_FOUND)
         throw new NotFoundError(`App '${name}' not found`);
       throw err;
     }
@@ -39544,6 +39629,7 @@ var App = class _App {
         }))
       );
     }
+    const secretIds = options.secrets ? options.secrets.map((secret) => secret.secretId) : [];
     const createResp = await client.sandboxCreate({
       appId: this.appId,
       definition: {
@@ -39560,6 +39646,7 @@ var App = class _App {
           memoryMb: options.memory ?? 128
         },
         volumeMounts,
+        secretIds,
         openPorts: openPorts.length > 0 ? { ports: openPorts } : void 0
       }
     });
@@ -39607,7 +39694,7 @@ var App = class _App {
 };
 
 // src/cls.ts
-var import_nice_grpc5 = require("nice-grpc");
+var import_nice_grpc6 = require("nice-grpc");
 
 // src/function.ts
 var import_node_crypto = require("crypto");
@@ -40180,7 +40267,7 @@ var FunctionCall = class _FunctionCall {
 };
 
 // src/function.ts
-var import_nice_grpc4 = require("nice-grpc");
+var import_nice_grpc5 = require("nice-grpc");
 var maxObjectSizeBytes = 2 * 1024 * 1024;
 var maxSystemRetries = 8;
 var Function_ = class _Function_ {
@@ -40206,7 +40293,7 @@ var Function_ = class _Function_ {
         resp.handleMetadata?.inputPlaneUrl
       );
     } catch (err) {
-      if (err instanceof import_nice_grpc4.ClientError && err.code === import_nice_grpc4.Status.NOT_FOUND)
+      if (err instanceof import_nice_grpc5.ClientError && err.code === import_nice_grpc5.Status.NOT_FOUND)
         throw new NotFoundError(`Function '${appName}/${name}' not found`);
       throw err;
     }
@@ -40344,7 +40431,7 @@ var Cls = class _Cls {
         serviceFunction.handleMetadata?.inputPlaneUrl
       );
     } catch (err) {
-      if (err instanceof import_nice_grpc5.ClientError && err.code === import_nice_grpc5.Status.NOT_FOUND)
+      if (err instanceof import_nice_grpc6.ClientError && err.code === import_nice_grpc6.Status.NOT_FOUND)
         throw new NotFoundError(`Class '${appName}/${name}' not found`);
       throw err;
     }
@@ -40443,7 +40530,7 @@ var ClsInstance = class {
 };
 
 // src/queue.ts
-var import_nice_grpc6 = require("nice-grpc");
+var import_nice_grpc7 = require("nice-grpc");
 var ephemeralObjectHeartbeatSleep = 3e5;
 var queueInitialPutBackoff = 100;
 var queueDefaultPartitionTtl = 24 * 3600 * 1e3;
@@ -40597,7 +40684,7 @@ var Queue = class _Queue {
         });
         break;
       } catch (e) {
-        if (e instanceof import_nice_grpc6.ClientError && e.code === import_nice_grpc6.Status.RESOURCE_EXHAUSTED) {
+        if (e instanceof import_nice_grpc7.ClientError && e.code === import_nice_grpc7.Status.RESOURCE_EXHAUSTED) {
           delay = Math.min(delay * 2, 3e4);
           if (deadline !== void 0) {
             const remaining = deadline - Date.now();
@@ -40689,7 +40776,7 @@ var Queue = class _Queue {
 };
 
 // src/volume.ts
-var import_nice_grpc7 = require("nice-grpc");
+var import_nice_grpc8 = require("nice-grpc");
 var Volume = class _Volume {
   volumeId;
   /** @ignore */
@@ -40705,7 +40792,7 @@ var Volume = class _Volume {
       });
       return new _Volume(resp.volumeId);
     } catch (err) {
-      if (err instanceof import_nice_grpc7.ClientError && err.code === import_nice_grpc7.Status.NOT_FOUND)
+      if (err instanceof import_nice_grpc8.ClientError && err.code === import_nice_grpc8.Status.NOT_FOUND)
         throw new NotFoundError(err.details);
       throw err;
     }

package/dist/index.d.cts

@@ -124,6 +124,20 @@ interface ModalWriteStream<R = any> extends WritableStream<R> {
     writeBytes(bytes: Uint8Array): Promise<void>;
 }
 
+/** Options for `Secret.fromName()`. */
+type SecretFromNameOptions = {
+    environment?: string;
+    requiredKeys?: string[];
+};
+/** Secrets provide a dictionary of environment variables for images. */
+declare class Secret {
+    readonly secretId: string;
+    /** @ignore */
+    constructor(secretId: string);
+    /** Reference a Secret by its name. */
+    static fromName(name: string, options?: SecretFromNameOptions): Promise<Secret>;
+}
+
 /**
  * Stdin is always present, but this option allow you to drop stdout or stderr
  * if you don't need them. The default is "pipe", matching Node.js behavior.
@@ -149,6 +163,8 @@ type ExecOptions = {
     workdir?: string;
     /** Timeout for the process in milliseconds. Defaults to 0 (no timeout). */
     timeout?: number;
+    /** Secrets with environment variables for the command. */
+    secrets?: [Secret];
 };
 /** A port forwarded from within a running Modal sandbox. */
 declare class Tunnel {
@@ -174,6 +190,11 @@ declare class Sandbox {
     stderr: ModalReadStream<string>;
     /** @ignore */
     constructor(sandboxId: string);
+    /** Returns a running Sandbox object from an ID.
+     *
+     * @returns Sandbox with ID
+     */
+    static fromId(sandboxId: string): Promise<Sandbox>;
     /**
      * Open a file in the sandbox filesystem.
      * @param path - Path to the file to open
@@ -196,6 +217,21 @@ declare class Sandbox {
      * @returns A dictionary of Tunnel objects which are keyed by the container port.
      */
     tunnels(timeout?: number): Promise<Record<number, Tunnel>>;
+    /**
+     * Snapshot the filesystem of the Sandbox.
+     *
+     * Returns an `Image` object which can be used to spawn a new Sandbox with the same filesystem.
+     *
+     * @param timeout - Timeout for the snapshot operation in milliseconds
+     * @returns Promise that resolves to an Image
+     */
+    snapshotFilesystem(timeout?: number): Promise<Image>;
+    /**
+     * Check if the Sandbox has finished running.
+     *
+     * Returns `null` if the Sandbox is still running, else returns the exit code.
+     */
+    poll(): Promise<number | null>;
 }
 declare class ContainerProcess<R extends string | Uint8Array = any> {
     #private;
@@ -208,20 +244,6 @@ declare class ContainerProcess<R extends string | Uint8Array = any> {
     wait(): Promise<number>;
 }
 
-/** Options for `Secret.fromName()`. */
-type SecretFromNameOptions = {
-    environment?: string;
-    requiredKeys?: string[];
-};
-/** Secrets provide a dictionary of environment variables for images. */
-declare class Secret {
-    readonly secretId: string;
-    /** @ignore */
-    constructor(secretId: string);
-    /** Reference a Secret by its name. */
-    static fromName(name: string, options?: SecretFromNameOptions): Promise<Secret>;
-}
-
 /** Options for `Volume.fromName()`. */
 type VolumeFromNameOptions = {
     environment?: string;
@@ -261,6 +283,8 @@ type SandboxCreateOptions = {
      * Default behavior is to sleep indefinitely until timeout or termination.
      */
     command?: string[];
+    /** Secrets to inject into the sandbox. */
+    secrets?: Secret[];
     /** Mount points for Modal Volumes. */
     volumes?: Record<string, Volume>;
     /** List of ports to tunnel into the sandbox. Encrypted ports are tunneled with TLS. */

package/dist/index.d.ts

@@ -124,6 +124,20 @@ interface ModalWriteStream<R = any> extends WritableStream<R> {
     writeBytes(bytes: Uint8Array): Promise<void>;
 }
 
+/** Options for `Secret.fromName()`. */
+type SecretFromNameOptions = {
+    environment?: string;
+    requiredKeys?: string[];
+};
+/** Secrets provide a dictionary of environment variables for images. */
+declare class Secret {
+    readonly secretId: string;
+    /** @ignore */
+    constructor(secretId: string);
+    /** Reference a Secret by its name. */
+    static fromName(name: string, options?: SecretFromNameOptions): Promise<Secret>;
+}
+
 /**
  * Stdin is always present, but this option allow you to drop stdout or stderr
  * if you don't need them. The default is "pipe", matching Node.js behavior.
@@ -149,6 +163,8 @@ type ExecOptions = {
     workdir?: string;
     /** Timeout for the process in milliseconds. Defaults to 0 (no timeout). */
     timeout?: number;
+    /** Secrets with environment variables for the command. */
+    secrets?: [Secret];
 };
 /** A port forwarded from within a running Modal sandbox. */
 declare class Tunnel {
@@ -174,6 +190,11 @@ declare class Sandbox {
     stderr: ModalReadStream<string>;
     /** @ignore */
     constructor(sandboxId: string);
+    /** Returns a running Sandbox object from an ID.
+     *
+     * @returns Sandbox with ID
+     */
+    static fromId(sandboxId: string): Promise<Sandbox>;
     /**
      * Open a file in the sandbox filesystem.
      * @param path - Path to the file to open
@@ -196,6 +217,21 @@ declare class Sandbox {
      * @returns A dictionary of Tunnel objects which are keyed by the container port.
      */
     tunnels(timeout?: number): Promise<Record<number, Tunnel>>;
+    /**
+     * Snapshot the filesystem of the Sandbox.
+     *
+     * Returns an `Image` object which can be used to spawn a new Sandbox with the same filesystem.
+     *
+     * @param timeout - Timeout for the snapshot operation in milliseconds
+     * @returns Promise that resolves to an Image
+     */
+    snapshotFilesystem(timeout?: number): Promise<Image>;
+    /**
+     * Check if the Sandbox has finished running.
+     *
+     * Returns `null` if the Sandbox is still running, else returns the exit code.
+     */
+    poll(): Promise<number | null>;
 }
 declare class ContainerProcess<R extends string | Uint8Array = any> {
     #private;
@@ -208,20 +244,6 @@ declare class ContainerProcess<R extends string | Uint8Array = any> {
     wait(): Promise<number>;
 }
 
-/** Options for `Secret.fromName()`. */
-type SecretFromNameOptions = {
-    environment?: string;
-    requiredKeys?: string[];
-};
-/** Secrets provide a dictionary of environment variables for images. */
-declare class Secret {
-    readonly secretId: string;
-    /** @ignore */
-    constructor(secretId: string);
-    /** Reference a Secret by its name. */
-    static fromName(name: string, options?: SecretFromNameOptions): Promise<Secret>;
-}
-
 /** Options for `Volume.fromName()`. */
 type VolumeFromNameOptions = {
     environment?: string;
@@ -261,6 +283,8 @@ type SandboxCreateOptions = {
      * Default behavior is to sleep indefinitely until timeout or termination.
      */
     command?: string[];
+    /** Secrets to inject into the sandbox. */
+    secrets?: Secret[];
     /** Mount points for Modal Volumes. */
     volumes?: Record<string, Volume>;
     /** List of ports to tunnel into the sandbox. Encrypted ports are tunneled with TLS. */

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/app.ts
-import { ClientError as ClientError3, Status as Status3 } from "nice-grpc";
+import { ClientError as ClientError4, Status as Status4 } from "nice-grpc";
 
 // node_modules/@bufbuild/protobuf/dist/esm/wire/varint.js
 function varint64read() {
@@ -18813,7 +18813,8 @@ function createBaseFunctionHandleMetadata() {
     methodHandleMetadata: {},
     functionSchema: void 0,
     inputPlaneUrl: void 0,
-    inputPlaneRegion: void 0
+    inputPlaneRegion: void 0,
+    maxObjectSizeBytes: void 0
   };
 }
 var FunctionHandleMetadata = {
@@ -18854,6 +18855,9 @@ var FunctionHandleMetadata = {
     if (message.inputPlaneRegion !== void 0) {
       writer.uint32(378).string(message.inputPlaneRegion);
     }
+    if (message.maxObjectSizeBytes !== void 0) {
+      writer.uint32(384).uint64(message.maxObjectSizeBytes);
+    }
     return writer;
   },
   decode(input, length) {
@@ -18950,6 +18954,13 @@ var FunctionHandleMetadata = {
           message.inputPlaneRegion = reader.string();
           continue;
         }
+        case 48: {
+          if (tag !== 384) {
+            break;
+          }
+          message.maxObjectSizeBytes = longToNumber(reader.uint64());
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -18977,7 +18988,8 @@ var FunctionHandleMetadata = {
       ) : {},
       functionSchema: isSet3(object.functionSchema) ? FunctionSchema.fromJSON(object.functionSchema) : void 0,
       inputPlaneUrl: isSet3(object.inputPlaneUrl) ? globalThis.String(object.inputPlaneUrl) : void 0,
-      inputPlaneRegion: isSet3(object.inputPlaneRegion) ? globalThis.String(object.inputPlaneRegion) : void 0
+      inputPlaneRegion: isSet3(object.inputPlaneRegion) ? globalThis.String(object.inputPlaneRegion) : void 0,
+      maxObjectSizeBytes: isSet3(object.maxObjectSizeBytes) ? globalThis.Number(object.maxObjectSizeBytes) : void 0
     };
   },
   toJSON(message) {
@@ -19024,6 +19036,9 @@ var FunctionHandleMetadata = {
     if (message.inputPlaneRegion !== void 0) {
       obj.inputPlaneRegion = message.inputPlaneRegion;
     }
+    if (message.maxObjectSizeBytes !== void 0) {
+      obj.maxObjectSizeBytes = Math.round(message.maxObjectSizeBytes);
+    }
     return obj;
   },
   create(base) {
@@ -19048,6 +19063,7 @@ var FunctionHandleMetadata = {
     message.functionSchema = object.functionSchema !== void 0 && object.functionSchema !== null ? FunctionSchema.fromPartial(object.functionSchema) : void 0;
     message.inputPlaneUrl = object.inputPlaneUrl ?? void 0;
     message.inputPlaneRegion = object.inputPlaneRegion ?? void 0;
+    message.maxObjectSizeBytes = object.maxObjectSizeBytes ?? void 0;
     return message;
   }
 };
@@ -38620,7 +38636,7 @@ function authMiddleware(profile) {
     options.metadata ??= new Metadata();
     options.metadata.set(
       "x-modal-client-type",
-      String(7 /* CLIENT_TYPE_LIBMODAL */)
+      String(8 /* CLIENT_TYPE_LIBMODAL_JS */)
     );
     options.metadata.set("x-modal-client-version", "1.0.0");
     options.metadata.set("x-modal-token-id", tokenId);
@@ -38844,6 +38860,9 @@ ${result.exception}`
   return new Image2(resp.imageId);
 }
 
+// src/sandbox.ts
+import { ClientError as ClientError2, Status as Status2 } from "nice-grpc";
+
 // src/errors.ts
 var FunctionTimeoutError = class extends Error {
   constructor(message) {
@@ -39141,7 +39160,7 @@ var Tunnel = class {
     return [this.unencryptedHost, this.unencryptedPort];
   }
 };
-var Sandbox2 = class {
+var Sandbox2 = class _Sandbox {
   sandboxId;
   stdin;
   stdout;
@@ -39163,6 +39182,23 @@ var Sandbox2 = class {
       ).pipeThrough(new TextDecoderStream())
     );
   }
+  /** Returns a running Sandbox object from an ID.
+   *
+   * @returns Sandbox with ID
+   */
+  static async fromId(sandboxId) {
+    try {
+      await client.sandboxWait({
+        sandboxId,
+        timeout: 0
+      });
+    } catch (err) {
+      if (err instanceof ClientError2 && err.code === Status2.NOT_FOUND)
+        throw new NotFoundError(`Sandbox with id: '${sandboxId}' not found`);
+      throw err;
+    }
+    return new _Sandbox(sandboxId);
+  }
   /**
    * Open a file in the sandbox filesystem.
    * @param path - Path to the file to open
@@ -39183,11 +39219,13 @@ var Sandbox2 = class {
   }
   async exec(command, options) {
     const taskId = await this.#getTaskId();
+    const secretIds = options?.secrets ? options.secrets.map((secret) => secret.secretId) : [];
     const resp = await client.containerExec({
       taskId,
       command,
       workdir: options?.workdir,
-      timeoutSecs: options?.timeout ? options.timeout / 1e3 : 0
+      timeoutSecs: options?.timeout ? options.timeout / 1e3 : 0,
+      secretIds
     });
     return new ContainerProcess(resp.execId, options);
   }
@@ -39221,7 +39259,7 @@ var Sandbox2 = class {
         timeout: 55
       });
       if (resp.result) {
-        return resp.result.exitcode;
+        return _Sandbox.#getReturnCode(resp.result);
       }
     }
   }
@@ -39254,6 +39292,53 @@ var Sandbox2 = class {
     }
     return this.#tunnels;
   }
+  /**
+   * Snapshot the filesystem of the Sandbox.
+   *
+   * Returns an `Image` object which can be used to spawn a new Sandbox with the same filesystem.
+   *
+   * @param timeout - Timeout for the snapshot operation in milliseconds
+   * @returns Promise that resolves to an Image
+   */
+  async snapshotFilesystem(timeout = 55e3) {
+    const resp = await client.sandboxSnapshotFs({
+      sandboxId: this.sandboxId,
+      timeout: timeout / 1e3
+    });
+    if (resp.result?.status !== 1 /* GENERIC_STATUS_SUCCESS */) {
+      throw new Error(
+        `Sandbox snapshot failed: ${resp.result?.exception || "Unknown error"}`
+      );
+    }
+    if (!resp.imageId) {
+      throw new Error("Sandbox snapshot response missing image ID");
+    }
+    return new Image2(resp.imageId);
+  }
+  /**
+   * Check if the Sandbox has finished running.
+   *
+   * Returns `null` if the Sandbox is still running, else returns the exit code.
+   */
+  async poll() {
+    const resp = await client.sandboxWait({
+      sandboxId: this.sandboxId,
+      timeout: 0
+    });
+    return _Sandbox.#getReturnCode(resp.result);
+  }
+  static #getReturnCode(result) {
+    if (result === void 0 || result.status === 0 /* GENERIC_STATUS_UNSPECIFIED */) {
+      return null;
+    }
+    if (result.status === 4 /* GENERIC_STATUS_TIMEOUT */) {
+      return 124;
+    } else if (result.status === 3 /* GENERIC_STATUS_TERMINATED */) {
+      return 137;
+    } else {
+      return result.exitcode;
+    }
+  }
 };
 var ContainerProcess = class {
   stdin;
@@ -39408,7 +39493,7 @@ function encodeIfString(chunk) {
 }
 
 // src/secret.ts
-import { ClientError as ClientError2, Status as Status2 } from "nice-grpc";
+import { ClientError as ClientError3, Status as Status3 } from "nice-grpc";
 var Secret = class _Secret {
   secretId;
   /** @ignore */
@@ -39425,9 +39510,9 @@ var Secret = class _Secret {
       });
       return new _Secret(resp.secretId);
     } catch (err) {
-      if (err instanceof ClientError2 && err.code === Status2.NOT_FOUND)
+      if (err instanceof ClientError3 && err.code === Status3.NOT_FOUND)
         throw new NotFoundError(err.details);
-      if (err instanceof ClientError2 && err.code === Status2.FAILED_PRECONDITION && err.details.includes("Secret is missing key"))
+      if (err instanceof ClientError3 && err.code === Status3.FAILED_PRECONDITION && err.details.includes("Secret is missing key"))
         throw new NotFoundError(err.details);
       throw err;
     }
@@ -39451,7 +39536,7 @@ var App = class _App {
       });
       return new _App(resp.appId);
     } catch (err) {
-      if (err instanceof ClientError3 && err.code === Status3.NOT_FOUND)
+      if (err instanceof ClientError4 && err.code === Status4.NOT_FOUND)
         throw new NotFoundError(`App '${name}' not found`);
       throw err;
     }
@@ -39494,6 +39579,7 @@ var App = class _App {
         }))
       );
     }
+    const secretIds = options.secrets ? options.secrets.map((secret) => secret.secretId) : [];
     const createResp = await client.sandboxCreate({
       appId: this.appId,
       definition: {
@@ -39510,6 +39596,7 @@ var App = class _App {
           memoryMb: options.memory ?? 128
         },
         volumeMounts,
+        secretIds,
         openPorts: openPorts.length > 0 ? { ports: openPorts } : void 0
       }
     });
@@ -39557,7 +39644,7 @@ var App = class _App {
 };
 
 // src/cls.ts
-import { ClientError as ClientError5, Status as Status5 } from "nice-grpc";
+import { ClientError as ClientError6, Status as Status6 } from "nice-grpc";
 
 // src/function.ts
 import { createHash } from "node:crypto";
@@ -40130,7 +40217,7 @@ var FunctionCall = class _FunctionCall {
 };
 
 // src/function.ts
-import { ClientError as ClientError4, Status as Status4 } from "nice-grpc";
+import { ClientError as ClientError5, Status as Status5 } from "nice-grpc";
 var maxObjectSizeBytes = 2 * 1024 * 1024;
 var maxSystemRetries = 8;
 var Function_ = class _Function_ {
@@ -40156,7 +40243,7 @@ var Function_ = class _Function_ {
         resp.handleMetadata?.inputPlaneUrl
       );
     } catch (err) {
-      if (err instanceof ClientError4 && err.code === Status4.NOT_FOUND)
+      if (err instanceof ClientError5 && err.code === Status5.NOT_FOUND)
         throw new NotFoundError(`Function '${appName}/${name}' not found`);
       throw err;
     }
@@ -40294,7 +40381,7 @@ var Cls = class _Cls {
         serviceFunction.handleMetadata?.inputPlaneUrl
       );
     } catch (err) {
-      if (err instanceof ClientError5 && err.code === Status5.NOT_FOUND)
+      if (err instanceof ClientError6 && err.code === Status6.NOT_FOUND)
         throw new NotFoundError(`Class '${appName}/${name}' not found`);
       throw err;
     }
@@ -40393,7 +40480,7 @@ var ClsInstance = class {
 };
 
 // src/queue.ts
-import { ClientError as ClientError6, Status as Status6 } from "nice-grpc";
+import { ClientError as ClientError7, Status as Status7 } from "nice-grpc";
 var ephemeralObjectHeartbeatSleep = 3e5;
 var queueInitialPutBackoff = 100;
 var queueDefaultPartitionTtl = 24 * 3600 * 1e3;
@@ -40547,7 +40634,7 @@ var Queue = class _Queue {
         });
         break;
       } catch (e) {
-        if (e instanceof ClientError6 && e.code === Status6.RESOURCE_EXHAUSTED) {
+        if (e instanceof ClientError7 && e.code === Status7.RESOURCE_EXHAUSTED) {
           delay = Math.min(delay * 2, 3e4);
           if (deadline !== void 0) {
             const remaining = deadline - Date.now();
@@ -40639,7 +40726,7 @@ var Queue = class _Queue {
 };
 
 // src/volume.ts
-import { ClientError as ClientError7, Status as Status7 } from "nice-grpc";
+import { ClientError as ClientError8, Status as Status8 } from "nice-grpc";
 var Volume = class _Volume {
   volumeId;
   /** @ignore */
@@ -40655,7 +40742,7 @@ var Volume = class _Volume {
       });
       return new _Volume(resp.volumeId);
     } catch (err) {
-      if (err instanceof ClientError7 && err.code === Status7.NOT_FOUND)
+      if (err instanceof ClientError8 && err.code === Status8.NOT_FOUND)
         throw new NotFoundError(err.details);
       throw err;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "modal",
-  "version": "0.3.14",
+  "version": "0.3.16",
   "description": "Modal client library for JavaScript",
   "license": "Apache-2.0",
   "homepage": "https://modal.com/docs",