modal 0.7.5 → 0.8.0

package/dist/index.d.cts

@@ -140,6 +140,20 @@ declare enum EndpointInputModality {
     ENDPOINT_INPUT_MODALITY_AUDIO = 3,
     UNRECOGNIZED = -1
 }
+declare enum EndpointProvisioningStatus {
+    ENDPOINT_PROVISIONING_STATUS_UNSPECIFIED = 0,
+    ENDPOINT_PROVISIONING_STATUS_PENDING = 1,
+    ENDPOINT_PROVISIONING_STATUS_RUNNING = 2,
+    ENDPOINT_PROVISIONING_STATUS_SUCCEEDED = 3,
+    ENDPOINT_PROVISIONING_STATUS_FAILED = 4,
+    UNRECOGNIZED = -1
+}
+declare enum EndpointStopSource {
+    ENDPOINT_STOP_SOURCE_UNSPECIFIED = 0,
+    ENDPOINT_STOP_SOURCE_CLI = 1,
+    ENDPOINT_STOP_SOURCE_WEB = 2,
+    UNRECOGNIZED = -1
+}
 declare enum EnvironmentRole {
     ENVIRONMENT_ROLE_UNSPECIFIED = 0,
     ENVIRONMENT_ROLE_VIEWER = 1,
@@ -814,6 +828,10 @@ interface AutoscalerSettings {
     scaleupWindow?: number | undefined;
     /** Maximum amount of time a container can be idle before being scaled down, in seconds; pka "container_idle_timeout" */
     scaledownWindow?: number | undefined;
+    /** Target concurrent inputs per replica for Flash autoscaling. */
+    targetConcurrency?: number | undefined;
+    /** Maximum number of containers that can be scaled down per minute for Flash autoscaling. */
+    scaledownRateLimit?: number | undefined;
 }
 declare const AutoscalerSettings: MessageFns$1<AutoscalerSettings>;
 interface BaseImage {
@@ -890,6 +908,7 @@ interface ClassGetRequest {
     environmentName: string;
     /** True starting with 0.67.x clients, which don't create method placeholder functions */
     onlyClassFunction: boolean;
+    appVersion: number;
 }
 declare const ClassGetRequest: MessageFns$1<ClassGetRequest>;
 interface ClassGetResponse {
@@ -1375,6 +1394,7 @@ interface EndpointCreateRequest {
 declare const EndpointCreateRequest: MessageFns$1<EndpointCreateRequest>;
 interface EndpointCreateResponse {
     endpointId: string;
+    endpointPageUrl: string;
 }
 declare const EndpointCreateResponse: MessageFns$1<EndpointCreateResponse>;
 interface EndpointCustomModelSource {
@@ -1389,6 +1409,34 @@ interface EndpointHuggingFaceModelSource {
     huggingfaceToken: string;
 }
 declare const EndpointHuggingFaceModelSource: MessageFns$1<EndpointHuggingFaceModelSource>;
+interface EndpointListItem {
+    endpointId: string;
+    name: string;
+    description: string;
+    activeDeploymentId: string;
+    updatedAt: number;
+    metadata: EndpointMetadata | undefined;
+    appState: AppState;
+    functionId: string;
+    createdByAvatarUrl: string;
+    provisioningStatus: EndpointProvisioningStatus;
+}
+declare const EndpointListItem: MessageFns$1<EndpointListItem>;
+interface EndpointListRequest {
+    environmentName: string;
+    pagination: ListPagination | undefined;
+}
+declare const EndpointListRequest: MessageFns$1<EndpointListRequest>;
+interface EndpointListResponse {
+    items: EndpointListItem[];
+    environmentName: string;
+}
+declare const EndpointListResponse: MessageFns$1<EndpointListResponse>;
+interface EndpointMetadata {
+    name: string;
+    creationInfo: CreationInfo | undefined;
+}
+declare const EndpointMetadata: MessageFns$1<EndpointMetadata>;
 interface EndpointModalVolumeModelSource {
     volumeId: string;
     modelPath: string;
@@ -1399,9 +1447,18 @@ interface EndpointModelSource {
     custom?: EndpointCustomModelSource | undefined;
 }
 declare const EndpointModelSource: MessageFns$1<EndpointModelSource>;
+interface EndpointStopRequest {
+    endpointId: string;
+    source: EndpointStopSource;
+}
+declare const EndpointStopRequest: MessageFns$1<EndpointStopRequest>;
+interface EndpointStopResponse {
+}
+declare const EndpointStopResponse: MessageFns$1<EndpointStopResponse>;
 interface EnvironmentCreateRequest {
     name: string;
     isManaged: boolean;
+    settings: EnvironmentSettings | undefined;
 }
 declare const EnvironmentCreateRequest: MessageFns$1<EnvironmentCreateRequest>;
 interface EnvironmentDeleteRequest {
@@ -1483,6 +1540,8 @@ declare const EnvironmentSetManagedRequest: MessageFns$1<EnvironmentSetManagedRe
 interface EnvironmentSettings {
     imageBuilderVersion: string;
     webhookSuffix: string;
+    maxConcurrentGpus?: number | undefined;
+    maxConcurrentTasks?: number | undefined;
 }
 declare const EnvironmentSettings: MessageFns$1<EnvironmentSettings>;
 interface EnvironmentUpdateRequest {
@@ -1666,8 +1725,8 @@ interface FunctionMessage {
         [key: string]: string;
     };
     /**
-     * If set, client deps will be mounted into the container, and are
-     * no longer expected to exist in the image itself.
+     * Deprecated: still set by client but ignored by server. The scheduler
+     * derives this from the image's builder_version directly.
      */
     mountClientDependencies: boolean;
     flashServiceUrls: string[];
@@ -1706,7 +1765,7 @@ declare const FunctionAsyncInvokeResponse: MessageFns$1<FunctionAsyncInvokeRespo
 interface FunctionBindParamsRequest {
     functionId: string;
     serializedParams: Uint8Array;
-    functionOptions: FunctionOptions | undefined;
+    functionOptions: FunctionOptions$1 | undefined;
     environmentName: string;
     /** Only used for the input plane. */
     authSecret: string;
@@ -1745,7 +1804,6 @@ interface FunctionCallGetDataRequest {
     functionCallId?: string | undefined;
     attemptToken?: string | undefined;
     lastIndex: number;
-    useGaplessRead: boolean;
 }
 declare const FunctionCallGetDataRequest: MessageFns$1<FunctionCallGetDataRequest>;
 interface FunctionCallInfo {
@@ -1995,6 +2053,7 @@ interface FunctionGetRequest {
     appName: string;
     objectTag: string;
     environmentName: string;
+    appVersion: number;
 }
 declare const FunctionGetRequest: MessageFns$1<FunctionGetRequest>;
 interface FunctionGetResponse {
@@ -2073,7 +2132,8 @@ interface FunctionMapResponse {
     maxInputsOutstanding: number;
 }
 declare const FunctionMapResponse: MessageFns$1<FunctionMapResponse>;
-interface FunctionOptions {
+/** todo(ayush): update this to also use `autoscaler_settings` */
+interface FunctionOptions$1 {
     secretIds: string[];
     /** Currently not supported */
     mountIds: string[];
@@ -2095,8 +2155,9 @@ interface FunctionOptions {
     cloudProviderStr?: string | undefined;
     replaceCloudBucketMounts: boolean;
     cloudBucketMounts: CloudBucketMount$1[];
+    pinnedAppVersion?: number | undefined;
 }
-declare const FunctionOptions: MessageFns$1<FunctionOptions>;
+declare const FunctionOptions$1: MessageFns$1<FunctionOptions$1>;
 interface FunctionPrecreateRequest {
     appId: string;
     functionName: string;
@@ -2304,6 +2365,16 @@ interface ImageFromIdResponse {
     metadata: ImageMetadata | undefined;
 }
 declare const ImageFromIdResponse: MessageFns$1<ImageFromIdResponse>;
+interface ImageGetByTagRequest {
+    /** Full "name:tag" string. Must be non-empty. */
+    tag: string;
+    environmentName: string;
+}
+declare const ImageGetByTagRequest: MessageFns$1<ImageGetByTagRequest>;
+interface ImageGetByTagResponse {
+    imageId: string;
+}
+declare const ImageGetByTagResponse: MessageFns$1<ImageGetByTagResponse>;
 interface ImageGetOrCreateRequest {
     image: Image$1 | undefined;
     appId: string;
@@ -2344,6 +2415,29 @@ interface ImageJoinStreamingResponse {
     metadata: ImageMetadata | undefined;
 }
 declare const ImageJoinStreamingResponse: MessageFns$1<ImageJoinStreamingResponse>;
+interface ImageListTagsItem {
+    tag: string;
+    imageId: string;
+    revisionId: string;
+    createdAt: number;
+    updatedAt: number;
+}
+declare const ImageListTagsItem: MessageFns$1<ImageListTagsItem>;
+interface ImageListTagsRequest {
+    environmentName: string;
+    /** Prefix search over full "name:tag" strings. */
+    tagPrefix: string;
+    /** Defaults to 100. Values above 100 are rejected by the server. */
+    maxObjects: number;
+    pageToken: string;
+}
+declare const ImageListTagsRequest: MessageFns$1<ImageListTagsRequest>;
+interface ImageListTagsResponse {
+    items: ImageListTagsItem[];
+    nextPageToken: string;
+    environmentName: string;
+}
+declare const ImageListTagsResponse: MessageFns$1<ImageListTagsResponse>;
 interface ImageMetadata {
     /** The output of `python -VV. Not set if missing */
     pythonVersionInfo?: string | undefined;
@@ -2368,11 +2462,47 @@ interface ImageMetadata {
     imageBuilderVersion?: string | undefined;
 }
 declare const ImageMetadata: MessageFns$1<ImageMetadata>;
+interface ImagePublishRequest {
+    imageId: string;
+    /** Full "name:tag" string. Must be non-empty. Each ImagePublish RPC writes exactly one tag. */
+    tag: string;
+    environmentName: string;
+    /** Marks the published tag as public. Public read protocol is defined separately. */
+    isPublic: boolean;
+}
+declare const ImagePublishRequest: MessageFns$1<ImagePublishRequest>;
+interface ImagePublishResponse {
+    imageId: string;
+    revisionId: string;
+}
+declare const ImagePublishResponse: MessageFns$1<ImagePublishResponse>;
 interface ImageRegistryConfig {
     registryAuthType: RegistryAuthType;
     secretId: string;
 }
 declare const ImageRegistryConfig: MessageFns$1<ImageRegistryConfig>;
+interface ImageTagRevisionsItem {
+    imageId: string;
+    revisionId: string;
+    createdAt: number;
+}
+declare const ImageTagRevisionsItem: MessageFns$1<ImageTagRevisionsItem>;
+interface ImageTagRevisionsRequest {
+    /** Full "name:tag" string. Must be non-empty. */
+    tag: string;
+    environmentName: string;
+    /** Defaults to 100. Values above 100 are rejected by the server. */
+    maxObjects: number;
+    pageToken: string;
+}
+declare const ImageTagRevisionsRequest: MessageFns$1<ImageTagRevisionsRequest>;
+interface ImageTagRevisionsResponse {
+    items: ImageTagRevisionsItem[];
+    nextPageToken: string;
+    tag: string;
+    environmentName: string;
+}
+declare const ImageTagRevisionsResponse: MessageFns$1<ImageTagRevisionsResponse>;
 interface InputCallGraphInfo {
     inputId: string;
     status: GenericResult_GenericStatus;
@@ -2516,6 +2646,7 @@ declare const MultiPartUploadList: MessageFns$1<MultiPartUploadList>;
 interface NetworkAccess {
     networkAccessType: NetworkAccess_NetworkAccessType;
     allowedCidrs: string[];
+    allowedDomains: string[];
 }
 declare const NetworkAccess: MessageFns$1<NetworkAccess>;
 interface NotebookKernelPublishResultsRequest {
@@ -2937,10 +3068,18 @@ interface Sandbox$1 {
     verbose: boolean;
     /** If set, the sandbox will be created with a name. */
     name?: string | undefined;
-    /** Experimental options */
+    /**
+     * Deprecated: use experimental_options_v2 instead.
+     *
+     * @deprecated
+     */
     experimentalOptions: {
         [key: string]: boolean;
     };
+    /** Experimental options */
+    experimentalOptionsV2: {
+        [key: string]: string;
+    };
     /** Internal use only. */
     preloadPathPrefixes: string[];
     /** Optional idle timeout in seconds. If set, the sandbox will be terminated after being idle for this duration. */
@@ -2972,11 +3111,14 @@ interface Sandbox$1 {
      * (tunnels and auth proxy).
      */
     inboundCidrAllowlist: string[];
+    environmentVariables: StringMap | undefined;
 }
 declare const Sandbox$1: MessageFns$1<Sandbox$1>;
 interface SandboxCreateConnectTokenRequest {
     sandboxId: string;
     userMetadata: string;
+    /** Uses port 8080 if unspecified. */
+    port?: number | undefined;
 }
 declare const SandboxCreateConnectTokenRequest: MessageFns$1<SandboxCreateConnectTokenRequest>;
 interface SandboxCreateConnectTokenResponse {
@@ -3117,6 +3259,8 @@ interface SandboxRestoreRequest {
     snapshotId: string;
     sandboxNameOverride: string;
     sandboxNameOverrideType: SandboxRestoreRequest_SandboxNameOverrideType;
+    /** For internal debugging use only. */
+    workerId: string;
 }
 declare const SandboxRestoreRequest: MessageFns$1<SandboxRestoreRequest>;
 interface SandboxRestoreResponse {
@@ -3422,6 +3566,12 @@ interface SharedVolumeRemoveFileRequest {
     recursive: boolean;
 }
 declare const SharedVolumeRemoveFileRequest: MessageFns$1<SharedVolumeRemoveFileRequest>;
+interface StringMap {
+    contents: {
+        [key: string]: string;
+    };
+}
+declare const StringMap: MessageFns$1<StringMap>;
 interface SystemErrorMessage {
     errorCode: SystemErrorCode;
     errorMessage: string;
@@ -3967,6 +4117,7 @@ interface WorkspaceMembersListItem {
     identityProviderType: IdentityProviderType;
     email: string;
     avatarUrl: string;
+    idpExternalId: string;
 }
 declare const WorkspaceMembersListItem: MessageFns$1<WorkspaceMembersListItem>;
 interface WorkspaceMembersListResponse {
@@ -4483,6 +4634,22 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly endpointList: {
+            readonly name: "EndpointList";
+            readonly requestType: MessageFns$1<EndpointListRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<EndpointListResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
+        readonly endpointStop: {
+            readonly name: "EndpointStop";
+            readonly requestType: MessageFns$1<EndpointStopRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<EndpointStopResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         /** Environments */
         readonly environmentCreate: {
             readonly name: "EnvironmentCreate";
@@ -4795,6 +4962,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly imageGetByTag: {
+            readonly name: "ImageGetByTag";
+            readonly requestType: MessageFns$1<ImageGetByTagRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<ImageGetByTagResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly imageGetOrCreate: {
             readonly name: "ImageGetOrCreate";
             readonly requestType: MessageFns$1<ImageGetOrCreateRequest>;
@@ -4811,6 +4986,30 @@ declare const ModalClientDefinition: {
             readonly responseStream: true;
             readonly options: {};
         };
+        readonly imageListTags: {
+            readonly name: "ImageListTags";
+            readonly requestType: MessageFns$1<ImageListTagsRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<ImageListTagsResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
+        readonly imagePublish: {
+            readonly name: "ImagePublish";
+            readonly requestType: MessageFns$1<ImagePublishRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<ImagePublishResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
+        readonly imageTagRevisions: {
+            readonly name: "ImageTagRevisions";
+            readonly requestType: MessageFns$1<ImageTagRevisionsRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<ImageTagRevisionsResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         /** Input Plane Map */
         readonly mapAwait: {
             readonly name: "MapAwait";
@@ -5098,6 +5297,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly sandboxListV2: {
+            readonly name: "SandboxListV2";
+            readonly requestType: MessageFns$1<SandboxListRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<SandboxListResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly sandboxRestore: {
             readonly name: "SandboxRestore";
             readonly requestType: MessageFns$1<SandboxRestoreRequest>;
@@ -5669,14 +5876,6 @@ declare class Secret {
     readonly name?: string;
     /** @ignore */
     constructor(secretId: string, name?: string);
-    /**
-     * @deprecated Use {@link SecretService#fromName client.secrets.fromName()} instead.
-     */
-    static fromName(name: string, params?: SecretFromNameParams): Promise<Secret>;
-    /**
-     * @deprecated Use {@link SecretService#fromObject client.secrets.fromObject()} instead.
-     */
-    static fromObject(entries: Record<string, string>, params?: SecretFromObjectParams): Promise<Secret>;
 }
 
 declare class CloudBucketMountService {
@@ -5701,17 +5900,6 @@ declare class CloudBucketMount {
     readonly bucketEndpointUrl?: string;
     readonly keyPrefix?: string;
     readonly oidcAuthRoleArn?: string;
-    /**
-     * @deprecated Use {@link CloudBucketMountService#create client.cloudBucketMounts.create()} instead.
-     */
-    constructor(bucketName: string, params?: {
-        secret?: Secret;
-        readOnly?: boolean;
-        requesterPays?: boolean;
-        bucketEndpointUrl?: string;
-        keyPrefix?: string;
-        oidcAuthRoleArn?: string;
-    });
     /** @ignore */
     constructor(bucketName: string, secret: Secret | undefined, readOnly: boolean, requesterPays: boolean, bucketEndpointUrl: string | undefined, keyPrefix: string | undefined, oidcAuthRoleArn: string | undefined, bucketType: CloudBucketMount_BucketType);
     /** @ignore */
@@ -5753,87 +5941,13 @@ declare class FunctionCall {
     #private;
     readonly functionCallId: string;
     /** @ignore */
-    constructor(client: ModalClient | undefined, functionCallId: string);
-    /**
-     * @deprecated Use {@link FunctionCallService#fromId client.functionCalls.fromId()} instead.
-     */
-    static fromId(functionCallId: string): FunctionCall;
+    constructor(client: ModalClient, functionCallId: string);
     /** Get the result of a FunctionCall, optionally waiting with a timeout. */
     get(params?: FunctionCallGetParams): Promise<any>;
     /** Cancel a running FunctionCall. */
     cancel(params?: FunctionCallCancelParams): Promise<void>;
 }
 
-/** Optional parameters for `client.functions.fromName()`. */
-type FunctionFromNameParams = {
-    environment?: string;
-    createIfMissing?: boolean;
-};
-/**
- * Service for managing {@link Function_ Function}s.
- *
- * Normally only ever accessed via the client as:
- * ```typescript
- * const modal = new ModalClient();
- * const function = await modal.functions.fromName("my-app", "my-function");
- * ```
- */
-declare class FunctionService {
-    #private;
-    constructor(client: ModalClient);
-    /**
-     * Reference a {@link Function_ Function} by its name in an App.
-     */
-    fromName(appName: string, name: string, params?: FunctionFromNameParams): Promise<Function_>;
-}
-/** Simple data structure storing stats for a running {@link Function_ Function}. */
-interface FunctionStats {
-    backlog: number;
-    numTotalRunners: number;
-}
-/** Optional parameters for {@link Function_#updateAutoscaler Function_.updateAutoscaler()}. */
-interface FunctionUpdateAutoscalerParams {
-    minContainers?: number;
-    maxContainers?: number;
-    bufferContainers?: number;
-    scaledownWindowMs?: number;
-}
-/** Represents a deployed Modal Function, which can be invoked remotely. */
-declare class Function_ {
-    #private;
-    readonly functionId: string;
-    readonly methodName?: string;
-    /** @ignore */
-    constructor(client: ModalClient, functionId: string, methodName?: string, functionHandleMetadata?: FunctionHandleMetadata);
-    /**
-     * @deprecated Use `client.functions.fromName()` instead.
-     */
-    static lookup(appName: string, name: string, params?: FunctionFromNameParams): Promise<Function_>;
-    remote(args?: any[], kwargs?: Record<string, any>): Promise<any>;
-    spawn(args?: any[], kwargs?: Record<string, any>): Promise<FunctionCall>;
-    getCurrentStats(): Promise<FunctionStats>;
-    updateAutoscaler(params: FunctionUpdateAutoscalerParams): Promise<void>;
-    /**
-     * URL for addressing the Web Function via HTTP.
-     * @returns The web URL, or undefined if this is not a Web Function
-     */
-    getWebUrl(): Promise<string | undefined>;
-}
-
-/** Retry policy configuration for a Modal Function/Cls. */
-declare class Retries {
-    readonly maxRetries: number;
-    readonly backoffCoefficient: number;
-    readonly initialDelayMs: number;
-    readonly maxDelayMs: number;
-    constructor(params: {
-        maxRetries: number;
-        backoffCoefficient?: number;
-        initialDelayMs?: number;
-        maxDelayMs?: number;
-    });
-}
-
 type HeartbeatFunction = () => Promise<any>;
 declare class EphemeralHeartbeatManager {
     private readonly heartbeatFn;
@@ -5885,52 +5999,90 @@ declare class VolumeService {
      */
     delete(name: string, params?: VolumeDeleteParams): Promise<void>;
 }
+/**
+ * Resolved mount configuration stored on a Volume. `subPath: undefined` means "mount the
+ * whole volume" (no sub-path set on the resulting VolumeMount proto).
+ */
+type ResolvedMountOptions = {
+    readOnly: boolean;
+    subPath: string | undefined;
+};
 /** Volumes provide persistent storage that can be mounted in Modal {@link Function_ Function}s. */
 declare class Volume {
     #private;
     readonly volumeId: string;
     readonly name?: string;
-    private _readOnly;
-    /** @ignore */
-    constructor(volumeId: string, name?: string, readOnly?: boolean, ephemeralHbManager?: EphemeralHeartbeatManager);
     /**
-     * @deprecated Use {@link VolumeService#fromName client.volumes.fromName()} instead.
+     * @hidden
+     * @internal
      */
-    static fromName(name: string, options?: VolumeFromNameParams): Promise<Volume>;
-    /** Configure Volume to mount as read-only. */
-    readOnly(): Volume;
-    get isReadOnly(): boolean;
+    readonly _mountOptions: ResolvedMountOptions;
+    /** @ignore */
+    constructor(volumeId: string, name?: string, mountOptions?: ResolvedMountOptions, ephemeralHbManager?: EphemeralHeartbeatManager);
     /**
-     * @deprecated Use {@link VolumeService#ephemeral client.volumes.ephemeral()} instead.
+     * Configure options used when mounting this Volume. Fields left undefined preserve their value
+     * from any previous withMountOptions call on the same Volume (stacking).
      */
-    static ephemeral(options?: VolumeEphemeralParams): Promise<Volume>;
+    withMountOptions(params?: VolumeMountOptions): Volume;
     /** Delete the ephemeral Volume. Only usable with emphemeral Volumes. */
     closeEphemeral(): void;
 }
+/** Options for mounting a {@link Volume}. */
+type VolumeMountOptions = {
+    readOnly?: boolean;
+    subPath?: string;
+};
 
-/** Optional parameters for {@link ClsService#fromName client.cls.fromName()}. */
-type ClsFromNameParams = {
+/** Retry policy configuration for a Modal Function/Cls. */
+declare class Retries {
+    readonly maxRetries: number;
+    readonly backoffCoefficient: number;
+    readonly initialDelayMs: number;
+    readonly maxDelayMs: number;
+    constructor(params: {
+        maxRetries: number;
+        backoffCoefficient?: number;
+        initialDelayMs?: number;
+        maxDelayMs?: number;
+    });
+}
+
+/** Optional parameters for `client.functions.fromName()`. */
+type FunctionFromNameParams = {
     environment?: string;
     createIfMissing?: boolean;
 };
 /**
- * Service for managing {@link Cls}.
+ * Service for managing {@link Function_ Function}s.
  *
  * Normally only ever accessed via the client as:
  * ```typescript
  * const modal = new ModalClient();
- * const cls = await modal.cls.fromName("my-app", "MyCls");
+ * const function = await modal.functions.fromName("my-app", "my-function");
  * ```
  */
-declare class ClsService {
+declare class FunctionService {
     #private;
     constructor(client: ModalClient);
     /**
-     * Reference a {@link Cls} from a deployed {@link App} by its name.
+     * Reference a {@link Function_ Function} by its name in an App.
      */
-    fromName(appName: string, name: string, params?: ClsFromNameParams): Promise<Cls>;
+    fromName(appName: string, name: string, params?: FunctionFromNameParams): Promise<Function_>;
+}
+/** Simple data structure storing stats for a running {@link Function_ Function}. */
+interface FunctionStats {
+    backlog: number;
+    numTotalRunners: number;
+}
+/** Optional parameters for {@link Function_#updateAutoscaler Function_.updateAutoscaler()}. */
+interface FunctionUpdateAutoscalerParams {
+    minContainers?: number;
+    maxContainers?: number;
+    bufferContainers?: number;
+    scaledownWindowMs?: number;
 }
-type ClsWithOptionsParams = {
+/** Configuration options for {@link Function_#withOptions Function_.withOptions()}. */
+type FunctionWithOptionsParams = {
     cpu?: number;
     cpuLimit?: number;
     memoryMiB?: number;
@@ -5945,29 +6097,81 @@ type ClsWithOptionsParams = {
     scaledownWindowMs?: number;
     timeoutMs?: number;
 };
-type ClsWithConcurrencyParams = {
+/** Configuration options for {@link Function_#withConcurrency Function_.withConcurrency()}. */
+type FunctionWithConcurrencyParams = {
     maxInputs: number;
     targetInputs?: number;
 };
-type ClsWithBatchingParams = {
+/** Configuration options for {@link Function_#withBatching Function_.withBatching()}. */
+type FunctionWithBatchingParams = {
     maxBatchSize: number;
     waitMs: number;
 };
-type ServiceOptions = ClsWithOptionsParams & {
+/** Internal data structure holding configuration options for {@link Function_ Function}. */
+type FunctionOptions = FunctionWithOptionsParams & {
     maxConcurrentInputs?: number;
     targetConcurrentInputs?: number;
     batchMaxSize?: number;
     batchWaitMs?: number;
 };
-/** Represents a deployed Modal Cls. */
-declare class Cls {
+/** Represents a deployed Modal Function, which can be invoked remotely. */
+declare class Function_ {
     #private;
+    readonly functionId: string;
+    readonly methodName?: string;
     /** @ignore */
-    constructor(client: ModalClient, serviceFunctionId: string, serviceFunctionMetadata: FunctionHandleMetadata, options?: ServiceOptions);
+    constructor(client: ModalClient, functionId: string, methodName?: string, functionHandleMetadata?: FunctionHandleMetadata, options?: FunctionOptions);
+    /** Override the static Function configuration at runtime. */
+    withOptions(options: FunctionWithOptionsParams): Function_;
+    /** Override the static Function concurrency configuration at runtime. */
+    withConcurrency(params: FunctionWithConcurrencyParams): Function_;
+    /** Override the static Function batching configuration at runtime. */
+    withBatching(params: FunctionWithBatchingParams): Function_;
+    /** Create an instance of the Function with configuration specified by
+     * {@link Function_#withOptions withOptions}, {@link Function_#withConcurrency withConcurrency},
+     * and/or {@link Function_#withBatching withBatching}. */
+    instance(): Promise<Function_>;
+    remote(args?: any[], kwargs?: Record<string, any>): Promise<any>;
+    spawn(args?: any[], kwargs?: Record<string, any>): Promise<FunctionCall>;
+    getCurrentStats(): Promise<FunctionStats>;
+    updateAutoscaler(params: FunctionUpdateAutoscalerParams): Promise<void>;
     /**
-     * @deprecated Use {@link ClsService#fromName client.cls.fromName()} instead.
+     * URL for addressing the Web Function via HTTP.
+     * @returns The web URL, or undefined if this is not a Web Function
      */
-    static lookup(appName: string, name: string, params?: ClsFromNameParams): Promise<Cls>;
+    getWebUrl(): Promise<string | undefined>;
+}
+
+/** Optional parameters for {@link ClsService#fromName client.cls.fromName()}. */
+type ClsFromNameParams = {
+    environment?: string;
+    createIfMissing?: boolean;
+};
+/**
+ * Service for managing {@link Cls}.
+ *
+ * Normally only ever accessed via the client as:
+ * ```typescript
+ * const modal = new ModalClient();
+ * const cls = await modal.cls.fromName("my-app", "MyCls");
+ * ```
+ */
+declare class ClsService {
+    #private;
+    constructor(client: ModalClient);
+    /**
+     * Reference a {@link Cls} from a deployed {@link App} by its name.
+     */
+    fromName(appName: string, name: string, params?: ClsFromNameParams): Promise<Cls>;
+}
+type ClsWithOptionsParams = FunctionWithOptionsParams;
+type ClsWithConcurrencyParams = FunctionWithConcurrencyParams;
+type ClsWithBatchingParams = FunctionWithBatchingParams;
+/** Represents a deployed Modal Cls. */
+declare class Cls {
+    #private;
+    /** @ignore */
+    constructor(client: ModalClient, serviceFunctionId: string, serviceFunctionMetadata: FunctionHandleMetadata, options?: FunctionOptions);
     /** Create a new instance of the Cls with parameters and/or runtime options. */
     instance(parameters?: Record<string, any>): Promise<ClsInstance>;
     /** Override the static Function configuration at runtime. */
@@ -5984,6 +6188,11 @@ declare class ClsInstance {
     method(name: string): Function_;
 }
 
+/** Optional parameters for {@link ImageService#fromName client.images.fromName()}. */
+type ImageFromNameParams = {
+    /** Modal Environment to resolve the named Image in. */
+    environment?: string;
+};
 /**
  * Service for managing {@link Image}s.
  *
@@ -6002,6 +6211,14 @@ declare class ImageService {
      * @param imageId - Image ID.
      */
     fromId(imageId: string): Promise<Image>;
+    /**
+     * Reference a named {@link Image} that was previously published.
+     *
+     * @param name - Name of the published Image, optionally including a tag as `name:tag`.
+     * If no tag is included, `:latest` is used.
+     * @param params - Optional environment.
+     */
+    fromName(name: string, params?: ImageFromNameParams): Promise<Image>;
     /**
      * Creates an {@link Image} from a raw registry tag, optionally using a {@link Secret} for authentication.
      *
@@ -6037,6 +6254,11 @@ declare class ImageService {
 }
 /** Optional parameters for {@link ImageService#delete client.images.delete()}. */
 type ImageDeleteParams = Record<never, never>;
+/** Optional parameters for {@link Image#publish Image.publish()}. */
+type ImagePublishParams = {
+    /** Modal Environment to publish the named Image in. */
+    environment?: string;
+};
 /** Optional parameters for {@link Image#dockerfileCommands Image.dockerfileCommands()}. */
 type ImageDockerfileCommandsParams = {
     /** Environment variables to set in the build environment. */
@@ -6060,24 +6282,8 @@ type Layer = {
 declare class Image {
     #private;
     /** @ignore */
-    constructor(client: ModalClient, imageId: string, tag: string, imageRegistryConfig?: ImageRegistryConfig, layers?: Layer[]);
+    constructor(client: ModalClient, imageId: string, tag: string, imageRegistryConfig?: ImageRegistryConfig, layers?: Layer[], baseImageId?: string);
     get imageId(): string;
-    /**
-     * @deprecated Use {@link ImageService#fromId client.images.fromId()} instead.
-     */
-    static fromId(imageId: string): Promise<Image>;
-    /**
-     * @deprecated Use {@link ImageService#fromRegistry client.images.fromRegistry()} instead.
-     */
-    static fromRegistry(tag: string, secret?: Secret): Image;
-    /**
-     * @deprecated Use {@link ImageService#fromAwsEcr client.images.fromAwsEcr()} instead.
-     */
-    static fromAwsEcr(tag: string, secret: Secret): Image;
-    /**
-     * @deprecated Use {@link ImageService#fromGcpArtifactRegistry client.images.fromGcpArtifactRegistry()} instead.
-     */
-    static fromGcpArtifactRegistry(tag: string, secret: Secret): Image;
     private static validateDockerfileCommands;
     /**
      * Extend an image with arbitrary Dockerfile-like commands.
@@ -6097,9 +6303,13 @@ declare class Image {
      */
     build(app: App): Promise<Image>;
     /**
-     * @deprecated Use {@link ImageService#delete client.images.delete()} instead.
+     * Publish this built Image under a stable name and tag.
+     *
+     * @param name - Name to publish the Image under, optionally including a tag as `name:tag`.
+     * If no tag is included, `:latest` is used.
+     * @param params - Optional environment.
      */
-    static delete(imageId: string, _?: ImageDeleteParams): Promise<void>;
+    publish(name: string, params?: ImagePublishParams): Promise<void>;
 }
 
 /**
@@ -6128,10 +6338,6 @@ declare class Proxy {
     readonly proxyId: string;
     /** @ignore */
     constructor(proxyId: string);
-    /**
-     * @deprecated Use {@link ProxyService#fromName client.proxies.fromName()} instead.
-     */
-    static fromName(name: string, params?: ProxyFromNameParams): Promise<Proxy>;
 }
 
 /** Optional parameters for {@link QueueService#fromName client.queues.fromName()}. */
@@ -6226,20 +6432,8 @@ declare class Queue {
     readonly name?: string;
     /** @ignore */
     constructor(client: ModalClient, queueId: string, name?: string, ephemeralHbManager?: EphemeralHeartbeatManager);
-    /**
-     * @deprecated Use {@link QueueService#ephemeral client.queues.ephemeral()} instead.
-     */
-    static ephemeral(params?: QueueEphemeralParams): Promise<Queue>;
     /** Delete the ephemeral Queue. Only usable with ephemeral Queues. */
     closeEphemeral(): void;
-    /**
-     * @deprecated Use {@link QueueService#fromName client.queues.fromName()} instead.
-     */
-    static lookup(name: string, options?: QueueFromNameParams): Promise<Queue>;
-    /**
-     * @deprecated Use {@link QueueService#delete client.queues.delete()} instead.
-     */
-    static delete(name: string, options?: QueueDeleteParams): Promise<void>;
     /**
      * Remove all objects from a Queue partition.
      */
@@ -6301,6 +6495,70 @@ declare enum TaskExecStdoutConfig {
     TASK_EXEC_STDOUT_CONFIG_PIPE = 1,
     UNRECOGNIZED = -1
 }
+interface TaskContainerCreateRequest {
+    taskId: string;
+    /** Logical container name. */
+    containerName: string;
+    imageId: string;
+    args: string[];
+    env: {
+        [key: string]: string;
+    };
+    workdir: string;
+    /** Secret IDs to inject into the container as environment variables. */
+    secretIds: string[];
+}
+declare const TaskContainerCreateRequest: MessageFns<TaskContainerCreateRequest>;
+interface TaskContainerCreateResponse {
+    /** Fully qualified container ID (for example, ctr-<ulid>). */
+    containerId: string;
+    /** Logical container name associated with this container. */
+    containerName: string;
+}
+declare const TaskContainerCreateResponse: MessageFns<TaskContainerCreateResponse>;
+interface TaskContainerGetRequest {
+    taskId: string;
+    containerName: string;
+    /** Include the latest terminated container if the name is no longer active. */
+    includeTerminated: boolean;
+}
+declare const TaskContainerGetRequest: MessageFns<TaskContainerGetRequest>;
+interface TaskContainerGetResponse {
+    container: TaskContainerInfo | undefined;
+}
+declare const TaskContainerGetResponse: MessageFns<TaskContainerGetResponse>;
+interface TaskContainerInfo {
+    containerId: string;
+    containerName: string;
+    status: string;
+    result: GenericResult | undefined;
+}
+declare const TaskContainerInfo: MessageFns<TaskContainerInfo>;
+interface TaskContainerListRequest {
+    taskId: string;
+    /** Include all tracked terminated containers in addition to active ones. */
+    includeTerminated: boolean;
+}
+declare const TaskContainerListRequest: MessageFns<TaskContainerListRequest>;
+interface TaskContainerListResponse {
+    containers: TaskContainerInfo[];
+}
+declare const TaskContainerListResponse: MessageFns<TaskContainerListResponse>;
+interface TaskContainerTerminateRequest {
+    taskId: string;
+    containerId: string;
+}
+declare const TaskContainerTerminateRequest: MessageFns<TaskContainerTerminateRequest>;
+interface TaskContainerWaitRequest {
+    taskId: string;
+    containerId: string;
+    timeout: number;
+}
+declare const TaskContainerWaitRequest: MessageFns<TaskContainerWaitRequest>;
+interface TaskContainerWaitResponse {
+    result: GenericResult | undefined;
+}
+declare const TaskContainerWaitResponse: MessageFns<TaskContainerWaitResponse>;
 /**
  * The response to a TaskExecPollRequest. If the exec'd command has not
  * completed, exit_status will be unset.
@@ -6373,6 +6631,11 @@ interface TaskMountDirectoryRequest {
     taskId: string;
     path: Uint8Array;
     imageId: string;
+    /**
+     * Customer-supplied encryption key used to decrypt CSEK-encrypted image metadata keys.
+     * This key is not persisted by Modal.
+     */
+    customerSuppliedEncryptionKey?: Uint8Array | undefined;
 }
 declare const TaskMountDirectoryRequest: MessageFns<TaskMountDirectoryRequest>;
 interface TaskSnapshotDirectoryRequest {
@@ -6394,6 +6657,11 @@ interface TaskSnapshotDirectoryRequest {
      * server.
      */
     ttlSeconds?: number | undefined;
+    /**
+     * Customer-supplied encryption key used to encrypt the resulting image's data and tree
+     * metadata keys. This key is not persisted by Modal.
+     */
+    customerSuppliedEncryptionKey?: Uint8Array | undefined;
 }
 declare const TaskSnapshotDirectoryRequest: MessageFns<TaskSnapshotDirectoryRequest>;
 interface TaskSnapshotDirectoryResponse {
@@ -6414,6 +6682,11 @@ interface TaskSnapshotFilesystemRequest {
      * server.
      */
     ttlSeconds?: number | undefined;
+    /**
+     * Customer-supplied encryption key used to encrypt the resulting image's data and tree
+     * metadata keys. This key is not persisted by Modal.
+     */
+    customerSuppliedEncryptionKey?: Uint8Array | undefined;
 }
 declare const TaskSnapshotFilesystemRequest: MessageFns<TaskSnapshotFilesystemRequest>;
 interface TaskSnapshotFilesystemResponse {
@@ -6475,13 +6748,20 @@ declare class TaskCommandRouterClientImpl {
     static tryInit(serverClient: ModalGrpcClient, taskId: string, sandboxId: string, isV2: boolean, logger: Logger, profile: Profile): Promise<TaskCommandRouterClientImpl | null>;
     private constructor();
     close(): void;
+    /** Run a unary RPC against the command router with the default retry policy. */
+    private callUnary;
     execStart(request: TaskExecStartRequest): Promise<TaskExecStartResponse>;
+    containerCreate(request: TaskContainerCreateRequest): Promise<TaskContainerCreateResponse>;
+    containerGet(request: TaskContainerGetRequest): Promise<TaskContainerGetResponse>;
+    containerList(request: TaskContainerListRequest): Promise<TaskContainerListResponse>;
+    containerTerminate(request: TaskContainerTerminateRequest): Promise<void>;
+    containerWait(request: TaskContainerWaitRequest): Promise<TaskContainerWaitResponse>;
     execStdioRead(taskId: string, execId: string, fileDescriptor: FileDescriptor, deadline?: number | null): AsyncGenerator<TaskExecStdioReadResponse>;
     execStdinWrite(taskId: string, execId: string, offset: number, data: Uint8Array, eof: boolean): Promise<TaskExecStdinWriteResponse>;
     execPoll(taskId: string, execId: string, deadline?: number | null): Promise<TaskExecPollResponse>;
     execWait(taskId: string, execId: string, deadline?: number | null): Promise<TaskExecWaitResponse>;
     mountDirectory(request: TaskMountDirectoryRequest): Promise<void>;
-    snapshotDirectory(request: TaskSnapshotDirectoryRequest): Promise<TaskSnapshotDirectoryResponse>;
+    snapshotDirectory(request: TaskSnapshotDirectoryRequest, options?: TimeoutOptions): Promise<TaskSnapshotDirectoryResponse>;
     snapshotFilesystem(request: TaskSnapshotFilesystemRequest, options?: TimeoutOptions): Promise<TaskSnapshotFilesystemResponse>;
     unmountDirectory(request: TaskUnmountDirectoryRequest): Promise<void>;
     private refreshJwt;
@@ -6489,34 +6769,259 @@ declare class TaskCommandRouterClientImpl {
     private streamStdio;
 }
 
-/** File open modes supported by the filesystem API. */
-type SandboxFileMode = "r" | "w" | "a" | "r+" | "w+" | "a+";
-/**
- * SandboxFile represents an open file in the {@link Sandbox} filesystem.
- * Provides read/write operations similar to Node.js `fsPromises.FileHandle`.
- */
-declare class SandboxFile {
-    #private;
+/** Type of a filesystem entry. */
+type FileType = "file" | "directory" | "symlink";
+/** Metadata for a file or directory entry in a Sandbox. */
+interface FileInfo {
+    readonly name: string;
+    readonly path: string;
+    readonly type: FileType;
+    readonly size: number;
+    readonly mode: number;
+    readonly permissions: string;
+    readonly owner: string;
+    readonly group: string;
+    /** Unix epoch seconds. */
+    readonly modifiedTime: number;
+    readonly symlinkTarget: string | null;
+}
+/** Namespace for Sandbox filesystem APIs. */
+declare class SandboxFilesystem {
+    private readonly exec;
     /** @ignore */
-    constructor(client: ModalClient, fileDescriptor: string, taskId: string);
+    constructor(exec: (command: string[], params?: SandboxExecParams) => Promise<ContainerProcess>);
+    /**
+     * Copy a local file into the Sandbox.
+     *
+     * `remotePath` must be an absolute path to a file in the Sandbox.
+     * Parent directories are created if needed. The remote file is overwritten
+     * if it already exists.
+     *
+     * @throws {SandboxFilesystemNotADirectoryError} a parent component of `remotePath` is not a directory.
+     * @throws {SandboxFilesystemIsADirectoryError} `remotePath` points to a directory.
+     * @throws {SandboxFilesystemPermissionError} write permission is denied in the Sandbox.
+     * @throws {SandboxFilesystemError} the command fails for any other reason.
+     * @throws {Error} `localPath` does not exist, is a directory, or cannot be read (`ENOENT`, `EISDIR`, `EACCES`).
+     */
+    copyFromLocal(localPath: string, remotePath: string): Promise<void>;
+    /**
+     * Copy a file from the Sandbox to a local path.
+     *
+     * `remotePath` must be an absolute path to a file in the Sandbox.
+     * Parent directories for `localPath` are created if needed. The local file
+     * is overwritten if it already exists.
+     *
+     * @throws {SandboxFilesystemNotFoundError} the remote path does not exist.
+     * @throws {SandboxFilesystemIsADirectoryError} the remote path points to a directory.
+     * @throws {SandboxFilesystemFileTooLargeError} the file exceeds the read size limit.
+     * @throws {SandboxFilesystemPermissionError} read permission is denied in the Sandbox.
+     * @throws {SandboxFilesystemError} the command fails for any other reason.
+     * @throws {Error} `localPath` points to a directory, or writing it is not permitted.
+     */
+    copyToLocal(remotePath: string, localPath: string): Promise<void>;
+    /**
+     * List files and directories in a Sandbox directory.
+     *
+     * `remotePath` must be an absolute path to a directory in the Sandbox.
+     * Returns an array of {@link FileInfo} objects sorted by name.
+     *
+     * @throws {SandboxFilesystemNotFoundError} the path does not exist.
+     * @throws {SandboxFilesystemNotADirectoryError} the path is not a directory.
+     * @throws {SandboxFilesystemPermissionError} read permission is denied.
+     * @throws {SandboxFilesystemError} the command fails for any other reason.
+     */
+    listFiles(remotePath: string): Promise<FileInfo[]>;
+    /**
+     * Create a new directory in the Sandbox.
+     *
+     * `remotePath` must be an absolute path in the Sandbox.
+     *
+     * When `createParents` is `true` (the default), any missing parent
+     * directories are created and the call is idempotent (succeeds if the
+     * directory already exists). When `createParents` is `false`, the immediate
+     * parent must already exist and the path must not already exist.
+     *
+     * @throws {SandboxFilesystemNotFoundError} the parent does not exist and `createParents` is `false`.
+     * @throws {SandboxFilesystemPathAlreadyExistsError} the path already exists and `createParents` is `false`.
+     * @throws {SandboxFilesystemNotADirectoryError} a path component is not a directory.
+     * @throws {SandboxFilesystemPermissionError} creation is not permitted.
+     * @throws {InvalidError} the operation is not supported by the mount.
+     * @throws {SandboxFilesystemError} the command fails for any other reason.
+     */
+    makeDirectory(remotePath: string, options?: {
+        createParents?: boolean;
+    }): Promise<void>;
+    /**
+     * Read a file from the Sandbox and return its contents as bytes.
+     *
+     * `remotePath` must be an absolute path to a file in the Sandbox.
+     *
+     * @throws {SandboxFilesystemNotFoundError} the path does not exist.
+     * @throws {SandboxFilesystemIsADirectoryError} the path points to a directory.
+     * @throws {SandboxFilesystemFileTooLargeError} the file exceeds the read size limit.
+     * @throws {SandboxFilesystemPermissionError} read permission is denied.
+     * @throws {SandboxFilesystemError} the command fails for any other reason.
+     */
+    readBytes(remotePath: string): Promise<Uint8Array>;
+    /**
+     * Read a file from the Sandbox and return its contents as a UTF-8 string.
+     *
+     * `remotePath` must be an absolute path to a file in the Sandbox.
+     *
+     * @throws {SandboxFilesystemNotFoundError} the path does not exist.
+     * @throws {SandboxFilesystemIsADirectoryError} the path points to a directory.
+     * @throws {SandboxFilesystemFileTooLargeError} the file exceeds the read size limit.
+     * @throws {SandboxFilesystemPermissionError} read permission is denied.
+     * @throws {SandboxFilesystemError} the command fails for any other reason.
+     */
+    readText(remotePath: string): Promise<string>;
+    /**
+     * Remove a file or directory in the Sandbox.
+     *
+     * `remotePath` must be an absolute path in the Sandbox. When `remotePath`
+     * is a directory and `recursive` is `false` (the default), it is removed
+     * only if empty. When `recursive` is `true`, the directory and all its
+     * contents are removed. Recursive removal is not supported on all mounts —
+     * `CloudBucketMount` does not support it.
+     *
+     * @throws {SandboxFilesystemNotFoundError} the path does not exist.
+     * @throws {SandboxFilesystemDirectoryNotEmptyError} `recursive` is `false` and the directory is not empty.
+     * @throws {SandboxFilesystemPermissionError} removal is not permitted.
+     * @throws {InvalidError} the operation is not supported by the mount.
+     * @throws {SandboxFilesystemError} the command fails for any other reason.
+     */
+    remove(remotePath: string, options?: {
+        recursive?: boolean;
+    }): Promise<void>;
     /**
-     * Read data from the file.
-     * @returns Promise that resolves to the read data as Uint8Array
+     * Return metadata for a single file, directory, or symlink in the Sandbox.
+     *
+     * `remotePath` must be an absolute path in the Sandbox. If `remotePath` is
+     * a symlink, the returned {@link FileInfo} describes the symlink itself, not
+     * the target it points to.
+     *
+     * @throws {SandboxFilesystemNotFoundError} the path does not exist.
+     * @throws {SandboxFilesystemNotADirectoryError} a non-leaf component of the path is not a directory.
+     * @throws {SandboxFilesystemPermissionError} a path component is not searchable.
+     * @throws {SandboxFilesystemError} the command fails for any other reason.
      */
-    read(): Promise<Uint8Array>;
+    stat(remotePath: string): Promise<FileInfo>;
     /**
-     * Write data to the file.
-     * @param data - Data to write
+     * Write binary content to a file in the Sandbox.
+     *
+     * `remotePath` must be an absolute path to a file in the Sandbox.
+     * Parent directories are created if needed. The remote file is overwritten
+     * if it already exists.
+     *
+     * @throws {TypeError} `data` is not a `Uint8Array`, `ArrayBuffer`, or `Buffer`.
+     * @throws {SandboxFilesystemNotADirectoryError} a parent component of `remotePath` is not a directory.
+     * @throws {SandboxFilesystemIsADirectoryError} `remotePath` points to a directory.
+     * @throws {SandboxFilesystemPermissionError} write permission is denied.
+     * @throws {SandboxFilesystemError} the command fails for any other reason.
      */
-    write(data: Uint8Array): Promise<void>;
+    writeBytes(data: Uint8Array | ArrayBuffer | Buffer, remotePath: string): Promise<void>;
+    /**
+     * Write UTF-8 text to a file in the Sandbox.
+     *
+     * `remotePath` must be an absolute path to a file in the Sandbox.
+     * Parent directories are created if needed. The remote file is overwritten
+     * if it already exists.
+     *
+     * @throws {TypeError} `data` is not a string.
+     * @throws {SandboxFilesystemNotADirectoryError} a parent component of `remotePath` is not a directory.
+     * @throws {SandboxFilesystemIsADirectoryError} `remotePath` points to a directory.
+     * @throws {SandboxFilesystemPermissionError} write permission is denied.
+     * @throws {SandboxFilesystemError} the command fails for any other reason.
+     */
+    writeText(data: string, remotePath: string): Promise<void>;
+}
+
+type SandboxSidecarCommandRouter = Pick<TaskCommandRouterClientImpl, "containerCreate" | "containerGet" | "containerList" | "containerTerminate" | "containerWait">;
+type SandboxSidecarAccess = {
+    exec(command: string[], params: SandboxExecParams | undefined, containerId: string): Promise<ContainerProcess>;
+    commandRouter(): Promise<[string, SandboxSidecarCommandRouter]>;
+};
+/** Options for {@link SidecarService#create SidecarService.create()}. */
+type SidecarCreateParams = {
+    /** Command to run in the sidecar container on startup. */
+    command?: string[];
+    /** Environment variables to set in the sidecar container. */
+    env?: Record<string, string>;
+    /** {@link Secret}s to inject into the sidecar container as environment variables. */
+    secrets?: Secret[];
+    /** Working directory of the sidecar container. */
+    workdir?: string;
+};
+/** Options for {@link SidecarService#get SidecarService.get()}. */
+type SidecarGetParams = {
+    /** If true, return the latest container with the name even if it has terminated. */
+    includeTerminated?: boolean;
+};
+/** Options for {@link SidecarService#list SidecarService.list()}. */
+type SidecarListParams = {
+    /** If true, include terminated containers. */
+    includeTerminated?: boolean;
+};
+/** Options for {@link SidecarContainer#exec SidecarContainer.exec()}. */
+type SidecarExecParams = SandboxExecParams;
+/** Options for {@link SidecarContainer#terminate SidecarContainer.terminate()}. */
+type SidecarTerminateParams = {
+    /** If true, wait for the sidecar container to terminate. */
+    wait?: boolean;
+};
+/**
+ * Creates and manages sidecar containers inside a Sandbox.
+ *
+ * EXPERIMENTAL: the API is subject to change.
+ */
+declare class SidecarService {
+    #private;
+    /** @internal @hidden */
+    constructor(access: SandboxSidecarAccess);
     /**
-     * Flush any buffered data to the file.
+     * Start a new sidecar container in the Sandbox. The {@link Image} must
+     * already be built by calling {@link Image#build Image.build()} before it is
+     * passed to `create`.
      */
-    flush(): Promise<void>;
+    create(name: string, image: Image, params?: SidecarCreateParams): Promise<SidecarContainer>;
+    /** Return a sidecar container by name. */
+    get(name: string, params?: SidecarGetParams): Promise<SidecarContainer>;
+    /** Return all sidecar containers (not including the main container). */
+    list(params?: SidecarListParams): Promise<SidecarContainer[]>;
+}
+/**
+ * A handle to a sidecar container running in a Sandbox.
+ *
+ * EXPERIMENTAL: the API is subject to change.
+ */
+declare class SidecarContainer {
+    #private;
+    /** The fully qualified container ID. */
+    readonly containerId: string;
+    /** The logical name of the container within the Sandbox. */
+    readonly containerName: string;
+    /** @internal @hidden */
+    constructor(access: SandboxSidecarAccess, containerId: string, containerName: string, result?: GenericResult);
+    exec(command: string[], params?: SidecarExecParams & {
+        mode?: "text";
+    }): Promise<ContainerProcess<string>>;
+    exec(command: string[], params: SidecarExecParams & {
+        mode: "binary";
+    }): Promise<ContainerProcess<Uint8Array>>;
+    /** Namespace for filesystem APIs scoped to this sidecar container. */
+    get filesystem(): SandboxFilesystem;
+    /** Block until the sidecar container exits, and return its exit code. */
+    wait(): Promise<number>;
     /**
-     * Close the file handle.
+     * Check if the sidecar container has finished running.
+     *
+     * Returns `null` if the container is still running, else the exit code.
      */
-    close(): Promise<void>;
+    poll(): Promise<number | null>;
+    terminate(): Promise<void>;
+    terminate(params: {
+        wait: true;
+    }): Promise<number>;
 }
 
 /**
@@ -6626,10 +7131,8 @@ type SandboxCreateParams = {
     blockNetwork?: boolean;
     /** List of CIDRs the Sandbox is allowed to access. If not set, all CIDRs are allowed. Cannot be used with blockNetwork. */
     outboundCidrAllowlist?: string[];
-    /**
-     * @deprecated Use {@link outboundCidrAllowlist} instead.
-     */
-    cidrAllowlist?: string[];
+    /** List of domain names the Sandbox is allowed to access. Supports wildcard prefixes (`*.example.com`). Cannot be used with blockNetwork. */
+    outboundDomainAllowlist?: string[];
     /** List of CIDRs allowed to connect inbound to the Sandbox (tunnels and connection tokens). If not set, all IPs are allowed. Cannot be used with blockNetwork. */
     inboundCidrAllowlist?: string[];
     /** Cloud provider to run the Sandbox on. */
@@ -6644,7 +7147,7 @@ type SandboxCreateParams = {
     readinessProbe?: Probe;
     /** Optional name for the Sandbox. Unique within an App. */
     name?: string;
-    /** Tags to attach to the Sandbox. Filterable via {@link SandboxService#list Sandbox.list}. */
+    /** Tags to attach to the Sandbox. Filterable via {@link SandboxService#list client.sandboxes.list}. */
     tags?: Record<string, string>;
     /** Optional experimental options. */
     experimentalOptions?: Record<string, any>;
@@ -6673,6 +7176,22 @@ declare class SandboxService {
     create(app: App, image: Image, params?: SandboxCreateParams): Promise<Sandbox>;
     /**
      * Create a new {@link Sandbox} using the experimental V2 backend.
+     *
+     * Supported features include exec, encrypted tunnels, wait/poll/terminate,
+     * CPU and memory configuration, region placement, volumes, cloud bucket
+     * mounts (with static credentials via {@link Secret}), and filesystem
+     * snapshots.
+     *
+     * Features like tags, memory snapshots, GPUs, custom domains, OIDC identity
+     * tokens (including `oidcAuthRoleArn` on a {@link CloudBucketMount}),
+     * proxies, and readiness probes are not supported.
+     *
+     * V2 sandboxes created with this method are not currently returned by
+     * {@link SandboxService#list client.sandboxes.list()} and cannot be looked up
+     * with {@link SandboxService#fromName client.sandboxes.fromName()}. Store
+     * {@link Sandbox#sandboxId sandbox.sandboxId} if you need to retrieve the
+     * sandbox later, and use {@link SandboxService#fromId client.sandboxes.fromId()}
+     * to reattach.
      */
     experimentalCreate(app: App, image: Image, params?: SandboxCreateParams): Promise<Sandbox>;
     /** Returns a running {@link Sandbox} object from an ID.
@@ -6735,6 +7254,36 @@ type SandboxTerminateParams = {
     /** If true, wait for the Sandbox to finish and return the exit code. */
     wait?: boolean;
 };
+/** Optional parameters for {@link Sandbox#snapshotFilesystem Sandbox.snapshotFilesystem()}. */
+type SandboxSnapshotFilesystemParams = {
+    /**
+     * Overall budget for the snapshot call, in milliseconds. Defaults to
+     * 55000. If it elapses before a snapshot completes, the call is cancelled
+     * and an error is thrown.
+     */
+    timeoutMs?: number;
+    /**
+     * Lifetime of the resulting image in milliseconds, as a hard cutoff
+     * measured from creation. Defaults to 30 days. Pass `null` to retain
+     * the image indefinitely.
+     */
+    ttlMs?: number | null;
+};
+/** Optional parameters for {@link Sandbox#snapshotDirectory Sandbox.snapshotDirectory()}. */
+type SandboxSnapshotDirectoryParams = {
+    /**
+     * Overall budget for the snapshot call, in milliseconds. Defaults to
+     * 55000. If it elapses before a snapshot completes, the call is cancelled
+     * and an error is thrown.
+     */
+    timeoutMs?: number;
+    /**
+     * Lifetime of the resulting image in milliseconds, as a hard cutoff
+     * measured from creation. Defaults to 30 days. Pass `null` to retain
+     * the image indefinitely.
+     */
+    ttlMs?: number | null;
+};
 type SandboxCreateConnectTokenParams = {
     /** Optional user-provided metadata string that will be added to the headers by the proxy when forwarding requests to the Sandbox. */
     userMetadata?: string;
@@ -6772,25 +7321,18 @@ declare class Sandbox {
     get stdin(): ModalWriteStream<string>;
     get stdout(): ModalReadStream<string>;
     get stderr(): ModalReadStream<string>;
-    /** Set tags (key-value pairs) on the Sandbox. Tags can be used to filter results in {@link SandboxService#list Sandbox.list}. */
+    get filesystem(): SandboxFilesystem;
+    /**
+     * Operations for managing sidecar containers that run alongside the
+     * Sandbox's main container.
+     *
+     * EXPERIMENTAL: the API is subject to change.
+     */
+    get experimentalSidecars(): SidecarService;
+    /** Set tags (key-value pairs) on the Sandbox. Tags can be used to filter results in {@link SandboxService#list client.sandboxes.list}. */
     setTags(tags: Record<string, string>): Promise<void>;
     /** Get tags (key-value pairs) currently attached to this Sandbox from the server. */
     getTags(): Promise<Record<string, string>>;
-    /**
-     * @deprecated Use {@link SandboxService#fromId client.sandboxes.fromId()} instead.
-     */
-    static fromId(sandboxId: string): Promise<Sandbox>;
-    /**
-     * @deprecated Use {@link SandboxService#fromName client.sandboxes.fromName()} instead.
-     */
-    static fromName(appName: string, name: string, environment?: string): Promise<Sandbox>;
-    /**
-     * Open a file in the Sandbox filesystem.
-     * @param path - Path to the file to open
-     * @param mode - File open mode (r, w, a, r+, w+, a+)
-     * @returns Promise that resolves to a {@link SandboxFile}
-     */
-    open(path: string, mode?: SandboxFileMode): Promise<SandboxFile>;
     exec(command: string[], params?: SandboxExecParams & {
         mode?: "text";
     }): Promise<ContainerProcess<string>>;
@@ -6834,14 +7376,14 @@ declare class Sandbox {
      *
      * Returns an {@link Image} object which can be used to spawn a new Sandbox with the same filesystem.
      *
-     * `timeoutMs` is propagated as the gRPC deadline. If the snapshot does
-     * not return within that window, the call is cancelled and an error is
-     * thrown.
+     * The call has an overall `timeoutMs` budget (default: 55000). If it
+     * elapses before a snapshot completes, the call is cancelled and an
+     * error is thrown.
      *
-     * @param timeoutMs - Timeout for the snapshot operation in milliseconds.
+     * @param params - Optional parameters; see {@link SandboxSnapshotFilesystemParams}.
      * @returns Promise that resolves to an {@link Image}
      */
-    snapshotFilesystem(timeoutMs?: number): Promise<Image>;
+    snapshotFilesystem(params?: SandboxSnapshotFilesystemParams): Promise<Image>;
     /**
      * Mount an {@link Image} at a path in the Sandbox filesystem.
      *
@@ -6858,23 +7400,25 @@ declare class Sandbox {
     /**
      * Snapshots and creates a new {@link Image} from a directory in the running sandbox.
      *
-     * Directory snapshots are currently persisted for 30 days after they
-     * were created.
+     * The resulting Image is retained for `ttlMs` (default: 30 days),
+     * as a hard cutoff measured from creation — usage does not extend
+     * the lifetime. Pass `ttlMs: null` to retain indefinitely.
+     *
+     * The call has an overall `timeoutMs` budget (default: 55000). If it
+     * elapses before a snapshot completes, the call is cancelled and an
+     * error is thrown.
      *
      * @param path - The path of the directory to snapshot
+     * @param params - Optional parameters; see {@link SandboxSnapshotDirectoryParams}.
      * @returns Promise that resolves to an {@link Image}
      */
-    snapshotDirectory(path: string): Promise<Image>;
+    snapshotDirectory(path: string, params?: SandboxSnapshotDirectoryParams): Promise<Image>;
     /**
      * Check if the Sandbox has finished running.
      *
      * Returns `null` if the Sandbox is still running, else returns the exit code.
      */
     poll(): Promise<number | null>;
-    /**
-     * @deprecated Use {@link SandboxService#list client.sandboxes.list()} instead.
-     */
-    static list(params?: SandboxListParams): AsyncGenerator<Sandbox, void, unknown>;
 }
 declare class ContainerProcess<R extends string | Uint8Array = any> {
     #private;
@@ -6883,6 +7427,13 @@ declare class ContainerProcess<R extends string | Uint8Array = any> {
     stderr: ModalReadStream<R>;
     /** @ignore */
     constructor(taskId: string, execId: string, commandRouterClient: TaskCommandRouterClientImpl, params?: SandboxExecParams, deadline?: number | null);
+    /**
+     * @ignore
+     * Send stdin EOF directly, bypassing the WritableStream state machine.
+     *
+     * Useful for when an stdin write has failed.
+     */
+    closeStdin(): Promise<void>;
     /** Wait for process completion and return the exit code. */
     wait(): Promise<number>;
 }
@@ -6948,9 +7499,18 @@ declare class ModalClient {
     private ipClients;
     private authTokenManager;
     private customMiddleware;
+    private environmentManager;
     constructor(params?: ModalClientParams);
     environmentName(environment?: string): string;
-    imageBuilderVersion(version?: string): string;
+    /**
+     * Returns the image builder version by querying the server where the local profile takes
+     * precedence.
+     *
+     * The image builder version is an environment-scoped server setting, so pass the environment
+     * the image will be built in (e.g. an App's environment) to fetch the correct version. When
+     * omitted, the profile's default environment is used.
+     */
+    getImageBuilderVersion(environmentName?: string): Promise<string>;
     /** @ignore */
     ipClient(serverUrl: string): ModalGrpcClient;
     close(): void;
@@ -6976,23 +7536,6 @@ type RetryOptions = {
     /** Additional status codes to retry. */
     additionalStatusCodes?: Status[];
 };
-/**
- * @deprecated Use {@link ModalClient `new ModalClient()`} instead.
- */
-type ClientOptions = {
-    tokenId: string;
-    tokenSecret: string;
-    environment?: string;
-};
-/**
- * @deprecated Use {@link ModalClient `new ModalClient()`} instead.
- */
-declare function initializeClient(options: ClientOptions): void;
-/**
- * Stops the auth token refresh.
- * @deprecated Use {@link ModalClient#close modalClient.close()} instead.
- */
-declare function close(): void;
 
 /**
  * Service for managing {@link App}s.
@@ -7016,45 +7559,13 @@ type AppFromNameParams = {
     environment?: string;
     createIfMissing?: boolean;
 };
-/** @deprecated Use specific Params types instead. */
-type LookupOptions = {
-    environment?: string;
-    createIfMissing?: boolean;
-};
-/** @deprecated Use specific Params types instead. */
-type DeleteOptions = {
-    environment?: string;
-};
-/** @deprecated Use specific Params types instead. */
-type EphemeralOptions = {
-    environment?: string;
-};
 /** Represents a deployed Modal App. */
 declare class App {
     readonly appId: string;
     readonly name?: string;
+    readonly environmentName?: string;
     /** @ignore */
-    constructor(appId: string, name?: string);
-    /**
-     * @deprecated Use {@link AppService#fromName client.apps.fromName()} instead.
-     */
-    static lookup(name: string, options?: LookupOptions): Promise<App>;
-    /**
-     * @deprecated Use {@link SandboxService#create client.sandboxes.create()} instead.
-     */
-    createSandbox(image: Image, options?: SandboxCreateParams): Promise<Sandbox>;
-    /**
-     * @deprecated Use {@link ImageService#fromRegistry client.images.fromRegistry()} instead.
-     */
-    imageFromRegistry(tag: string, secret?: Secret): Promise<Image>;
-    /**
-     * @deprecated Use {@link ImageService#fromAwsEcr client.images.fromAwsEcr()} instead.
-     */
-    imageFromAwsEcr(tag: string, secret: Secret): Promise<Image>;
-    /**
-     * @deprecated Use {@link ImageService#fromGcpArtifactRegistry client.images.fromGcpArtifactRegistry()} instead.
-     */
-    imageFromGcpArtifactRegistry(tag: string, secret: Secret): Promise<Image>;
+    constructor(appId: string, name?: string, environmentName?: string);
 }
 
 /** An operation exceeds the allowed time limit. */
@@ -7093,6 +7604,38 @@ declare class QueueEmptyError extends Error {
 declare class QueueFullError extends Error {
     constructor(message: string);
 }
+/** Errors from invalid Sandbox FileSystem operations. */
+declare class SandboxFilesystemError extends Error {
+    constructor(message: string);
+}
+/** A directory was expected to be empty but is not. */
+declare class SandboxFilesystemDirectoryNotEmptyError extends SandboxFilesystemError {
+    constructor(message: string);
+}
+/** A file exceeds the maximum allowed size for a read operation. */
+declare class SandboxFilesystemFileTooLargeError extends SandboxFilesystemError {
+    constructor(message: string);
+}
+/** A file operation was attempted on a path that resolves to a directory. */
+declare class SandboxFilesystemIsADirectoryError extends SandboxFilesystemError {
+    constructor(message: string);
+}
+/** A directory operation encountered a path component that is not a directory. */
+declare class SandboxFilesystemNotADirectoryError extends SandboxFilesystemError {
+    constructor(message: string);
+}
+/** A file or directory is not found. */
+declare class SandboxFilesystemNotFoundError extends SandboxFilesystemError {
+    constructor(message: string);
+}
+/** A path already exists and the operation requires it to be absent. */
+declare class SandboxFilesystemPathAlreadyExistsError extends SandboxFilesystemError {
+    constructor(message: string);
+}
+/** Permission is denied for a file operation. */
+declare class SandboxFilesystemPermissionError extends SandboxFilesystemError {
+    constructor(message: string);
+}
 /** Sandbox operations that exceed the allowed time limit. */
 declare class SandboxTimeoutError extends Error {
     constructor(message?: string);
@@ -7104,4 +7647,4 @@ declare class ClientClosedError extends Error {
 
 declare function checkForRenamedParams(params: any, renames: Record<string, string>): void;
 
-export { AlreadyExistsError, App, type AppFromNameParams, AppService, ClientClosedError, type ClientOptions, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ContainerProcess, type DeleteOptions, type EphemeralOptions, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, FunctionCallService, type FunctionFromNameParams, FunctionService, type FunctionStats, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, ImageService, InternalFailure, InvalidError, type LogLevel, type Logger, type LookupOptions, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, SandboxFile, type SandboxFileMode, type SandboxFromNameParams, type SandboxListParams, SandboxService, type SandboxTerminateParams, SandboxTimeoutError, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, type StdioBehavior, type StreamMode, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, VolumeService, checkForRenamedParams, close, initializeClient };
+export { AlreadyExistsError, App, type AppFromNameParams, AppService, ClientClosedError, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ContainerProcess, type FileInfo, type FileType, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, FunctionCallService, type FunctionFromNameParams, FunctionService, type FunctionStats, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, type FunctionWithBatchingParams, type FunctionWithConcurrencyParams, type FunctionWithOptionsParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, type ImageFromNameParams, type ImagePublishParams, ImageService, InternalFailure, InvalidError, type LogLevel, type Logger, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, SandboxFilesystem, SandboxFilesystemDirectoryNotEmptyError, SandboxFilesystemError, SandboxFilesystemFileTooLargeError, SandboxFilesystemIsADirectoryError, SandboxFilesystemNotADirectoryError, SandboxFilesystemNotFoundError, SandboxFilesystemPathAlreadyExistsError, SandboxFilesystemPermissionError, type SandboxFromNameParams, type SandboxListParams, SandboxService, type SandboxSnapshotDirectoryParams, type SandboxSnapshotFilesystemParams, type SandboxTerminateParams, SandboxTimeoutError, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, SidecarContainer, type SidecarCreateParams, type SidecarExecParams, type SidecarGetParams, type SidecarListParams, SidecarService, type SidecarTerminateParams, type StdioBehavior, type StreamMode, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, type VolumeMountOptions, VolumeService, checkForRenamedParams };