modal 0.8.1 → 0.9.0

package/dist/index.d.cts

@@ -168,6 +168,16 @@ declare enum EnvironmentRole {
     ENVIRONMENT_ROLE_CONTRIBUTOR = 2,
     UNRECOGNIZED = -1
 }
+/**
+ * Creation-time environment classification. Captures whether an environment
+ * is public. is_managed and machine_generated may be folded in as future
+ * values.
+ */
+declare enum EnvironmentType {
+    ENVIRONMENT_TYPE_UNSPECIFIED = 0,
+    ENVIRONMENT_TYPE_PUBLIC = 1,
+    UNRECOGNIZED = -1
+}
 declare enum ExecOutputOption {
     EXEC_OUTPUT_OPTION_UNSPECIFIED = 0,
     EXEC_OUTPUT_OPTION_DEVNULL = 1,
@@ -1197,8 +1207,17 @@ declare const ContainerReloadVolumesRequest: MessageFns$1<ContainerReloadVolumes
 interface ContainerReloadVolumesResponse {
 }
 declare const ContainerReloadVolumesResponse: MessageFns$1<ContainerReloadVolumesResponse>;
+/**
+ * Sent by server containers once lifecycle enter methods have completed.
+ * Only handled on worker by server_io_manager.
+ */
+interface ContainerServerLifecycleReadyRequest {
+}
+declare const ContainerServerLifecycleReadyRequest: MessageFns$1<ContainerServerLifecycleReadyRequest>;
 interface ContainerStopRequest {
     taskId: string;
+    /** Let a Function container finish processing any inputs before exiting. */
+    graceful: boolean;
 }
 declare const ContainerStopRequest: MessageFns$1<ContainerStopRequest>;
 interface ContainerStopResponse {
@@ -1510,10 +1529,31 @@ declare const EndpointStopRequest: MessageFns$1<EndpointStopRequest>;
 interface EndpointStopResponse {
 }
 declare const EndpointStopResponse: MessageFns$1<EndpointStopResponse>;
+interface EnvironmentBillingSummaryRequest {
+    startTimestamp: Date | undefined;
+    endTimestamp: Date | undefined;
+    environmentId: string;
+}
+declare const EnvironmentBillingSummaryRequest: MessageFns$1<EnvironmentBillingSummaryRequest>;
+interface EnvironmentBillingSummaryResponse {
+    startTimestamp: Date | undefined;
+    endTimestamp: Date | undefined;
+    /**
+     * not showing credits, reservations, etc as those are applied
+     * at the workspace level
+     */
+    meteredCost: string;
+    /** keyed by deployed, ephemeral, volume, notebook */
+    meteredCostBreakdown: {
+        [key: string]: string;
+    };
+}
+declare const EnvironmentBillingSummaryResponse: MessageFns$1<EnvironmentBillingSummaryResponse>;
 interface EnvironmentCreateRequest {
     name: string;
     isManaged: boolean;
     settings: EnvironmentSettings | undefined;
+    environmentType: EnvironmentType;
 }
 declare const EnvironmentCreateRequest: MessageFns$1<EnvironmentCreateRequest>;
 interface EnvironmentDeleteRequest {
@@ -1580,6 +1620,7 @@ interface EnvironmentListItem {
     effectiveCycleSpendLimit: number;
     currentCycleUsage: number;
     spendLimitReached: boolean;
+    environmentType: EnvironmentType;
 }
 declare const EnvironmentListItem: MessageFns$1<EnvironmentListItem>;
 interface EnvironmentListResponse {
@@ -1589,6 +1630,7 @@ declare const EnvironmentListResponse: MessageFns$1<EnvironmentListResponse>;
 interface EnvironmentMetadata {
     name: string;
     settings: EnvironmentSettings | undefined;
+    environmentType: EnvironmentType;
 }
 declare const EnvironmentMetadata: MessageFns$1<EnvironmentMetadata>;
 interface EnvironmentRoleSetRequest {
@@ -1875,6 +1917,7 @@ declare const FunctionCallFromIdRequest: MessageFns$1<FunctionCallFromIdRequest>
 interface FunctionCallFromIdResponse {
     functionCallId: string;
     numInputs: number;
+    metadata: FunctionCallHandleMetadata | undefined;
 }
 declare const FunctionCallFromIdResponse: MessageFns$1<FunctionCallFromIdResponse>;
 interface FunctionCallGetDataRequest {
@@ -1883,6 +1926,11 @@ interface FunctionCallGetDataRequest {
     lastIndex: number;
 }
 declare const FunctionCallGetDataRequest: MessageFns$1<FunctionCallGetDataRequest>;
+interface FunctionCallHandleMetadata {
+    appId: string;
+    functionId: string;
+}
+declare const FunctionCallHandleMetadata: MessageFns$1<FunctionCallHandleMetadata>;
 interface FunctionCallInfo {
     functionCallId: string;
     idx: number;
@@ -2178,6 +2226,7 @@ interface FunctionHandleMetadata {
     ExperimentalFlashUrls: string[];
     supportedInputFormats: DataFormat[];
     supportedOutputFormats: DataFormat[];
+    appId: string;
 }
 declare const FunctionHandleMetadata: MessageFns$1<FunctionHandleMetadata>;
 interface FunctionInput {
@@ -2233,6 +2282,7 @@ interface FunctionOptions$1 {
     replaceCloudBucketMounts: boolean;
     cloudBucketMounts: CloudBucketMount$1[];
     pinnedAppVersion?: number | undefined;
+    routingRegion?: string | undefined;
 }
 declare const FunctionOptions$1: MessageFns$1<FunctionOptions$1>;
 interface FunctionPrecreateRequest {
@@ -2542,11 +2592,11 @@ interface ImageMetadata {
 declare const ImageMetadata: MessageFns$1<ImageMetadata>;
 interface ImagePublishRequest {
     imageId: string;
-    /** Full "name:tag" string. Must be non-empty. Each ImagePublish RPC writes exactly one tag. */
+    /** Full "name:tag" string. Must be non-empty. */
     tag: string;
     environmentName: string;
-    /** Marks the published tag as public. Public read protocol is defined separately. */
-    isPublic: boolean;
+    /** Explicit opt-in required when publishing to a public environment. */
+    allowPublic: boolean;
 }
 declare const ImagePublishRequest: MessageFns$1<ImagePublishRequest>;
 interface ImagePublishResponse {
@@ -2563,6 +2613,7 @@ interface ImageTagRevisionsItem {
     imageId: string;
     revisionId: string;
     createdAt: number;
+    publishedBy: string;
 }
 declare const ImageTagRevisionsItem: MessageFns$1<ImageTagRevisionsItem>;
 interface ImageTagRevisionsRequest {
@@ -2671,6 +2722,14 @@ interface MethodDefinition {
     supportedOutputFormats: DataFormat[];
 }
 declare const MethodDefinition: MessageFns$1<MethodDefinition>;
+interface MountBatchedCheckExistenceRequest {
+    sha256HexHashes: string[];
+}
+declare const MountBatchedCheckExistenceRequest: MessageFns$1<MountBatchedCheckExistenceRequest>;
+interface MountBatchedCheckExistenceResponse {
+    missingSha256HexHashes: string[];
+}
+declare const MountBatchedCheckExistenceResponse: MessageFns$1<MountBatchedCheckExistenceResponse>;
 interface MountFile {
     filename: string;
     /** SHA-256 checksum of the file. */
@@ -3220,6 +3279,7 @@ interface SandboxCreateV2Request {
     appId: string;
     definition: Sandbox$1 | undefined;
     ephemeralSecrets: StringMap | undefined;
+    tags: SandboxTag[];
 }
 declare const SandboxCreateV2Request: MessageFns$1<SandboxCreateV2Request>;
 interface SandboxCreateV2Response {
@@ -3233,7 +3293,8 @@ declare const SandboxCreateV2Response: MessageFns$1<SandboxCreateV2Response>;
  * For all other use cases, use TaskGetCommandRouterAccess instead.
  */
 interface SandboxGetCommandRouterAccessRequest {
-    sandboxId: string;
+    sandboxId?: string | undefined;
+    taskId?: string | undefined;
 }
 declare const SandboxGetCommandRouterAccessRequest: MessageFns$1<SandboxGetCommandRouterAccessRequest>;
 interface SandboxGetCommandRouterAccessResponse {
@@ -3662,6 +3723,7 @@ interface TaskClusterHelloRequest {
     taskId: string;
     containerIp: string;
     imexHostIp: string;
+    imexFabricId: string;
 }
 declare const TaskClusterHelloRequest: MessageFns$1<TaskClusterHelloRequest>;
 interface TaskClusterHelloResponse {
@@ -3671,7 +3733,7 @@ interface TaskClusterHelloResponse {
     containerIps: string[];
     containerIpv4Ips: string[];
     /**
-     * Host IPs of every gang member's nvidia-imex daemon, ordered by cluster rank,
+     * All nvidia-imex IPs in fabric, ordered by cluster rank,
      * and otherwise absent on non-NVL72 systems
      */
     imexPeerIps: string[];
@@ -3706,6 +3768,7 @@ interface TaskGetInfoResponse {
 declare const TaskGetInfoResponse: MessageFns$1<TaskGetInfoResponse>;
 interface TaskInfo {
     id: string;
+    /** For Function containers, this corresponds to the "ready" time, after startup phase */
     startedAt: number;
     finishedAt: number;
     result: GenericResult | undefined;
@@ -3918,6 +3981,12 @@ interface VolumeCopyFilesRequest {
     recursive: boolean;
 }
 declare const VolumeCopyFilesRequest: MessageFns$1<VolumeCopyFilesRequest>;
+interface VolumeCreateOptions {
+    experimentalOptions: {
+        [key: string]: string;
+    };
+}
+declare const VolumeCreateOptions: MessageFns$1<VolumeCreateOptions>;
 interface VolumeDeleteRequest {
     volumeId: string;
     /** @deprecated */
@@ -3977,6 +4046,7 @@ interface VolumeGetOrCreateRequest {
     /** only used with OBJECT_CREATION_TYPE_ANONYMOUS_OWNED_BY_APP */
     appId: string;
     version: VolumeFsVersion;
+    createOptions?: VolumeCreateOptions | undefined;
 }
 declare const VolumeGetOrCreateRequest: MessageFns$1<VolumeGetOrCreateRequest>;
 interface VolumeGetOrCreateResponse {
@@ -4225,10 +4295,6 @@ interface WorkspaceBillingReportItem {
     tags: {
         [key: string]: string;
     };
-    /** old field to be removed */
-    costByResourceFloat: {
-        [key: string]: number;
-    };
     costByResource: {
         [key: string]: string;
     };
@@ -4245,6 +4311,26 @@ interface WorkspaceBillingReportRequest {
     appIds: string[];
 }
 declare const WorkspaceBillingReportRequest: MessageFns$1<WorkspaceBillingReportRequest>;
+interface WorkspaceBillingSummaryRequest {
+    startTimestamp: Date | undefined;
+    endTimestamp: Date | undefined;
+}
+declare const WorkspaceBillingSummaryRequest: MessageFns$1<WorkspaceBillingSummaryRequest>;
+interface WorkspaceBillingSummaryResponse {
+    startTimestamp: Date | undefined;
+    endTimestamp: Date | undefined;
+    meteredCost: string;
+    planCost: string;
+    creditsApplied: string;
+    reservationsDiscount: string;
+    volumesDiscount: string;
+    billedCost: string;
+    /** keyed by deployed, ephemeral, volume, notebook */
+    meteredCostBreakdown: {
+        [key: string]: string;
+    };
+}
+declare const WorkspaceBillingSummaryResponse: MessageFns$1<WorkspaceBillingSummaryResponse>;
 interface WorkspaceDashboardUrlRequest {
     environmentName: string;
 }
@@ -4277,6 +4363,23 @@ interface WorkspaceNameLookupResponse {
     username: string;
 }
 declare const WorkspaceNameLookupResponse: MessageFns$1<WorkspaceNameLookupResponse>;
+interface WorkspaceSetDefaultEnvironmentRequest {
+    environmentName: string;
+}
+declare const WorkspaceSetDefaultEnvironmentRequest: MessageFns$1<WorkspaceSetDefaultEnvironmentRequest>;
+interface WorkspaceSetImageBuilderVersionRequest {
+    newImageBuilderVersion: string;
+}
+declare const WorkspaceSetImageBuilderVersionRequest: MessageFns$1<WorkspaceSetImageBuilderVersionRequest>;
+interface WorkspaceSetImageBuilderVersionResponse {
+    imageBuilderVersion: string;
+}
+declare const WorkspaceSetImageBuilderVersionResponse: MessageFns$1<WorkspaceSetImageBuilderVersionResponse>;
+interface WorkspaceSettingsResponse {
+    defaultEnvironmentName: string;
+    imageBuilderVersion: string;
+}
+declare const WorkspaceSettingsResponse: MessageFns$1<WorkspaceSettingsResponse>;
 type ModalClientDefinition = typeof ModalClientDefinition;
 declare const ModalClientDefinition: {
     readonly name: "ModalClient";
@@ -4642,6 +4745,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly containerServerLifecycleReady: {
+            readonly name: "ContainerServerLifecycleReady";
+            readonly requestType: MessageFns$1<ContainerServerLifecycleReadyRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$2<Empty>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly containerStop: {
             readonly name: "ContainerStop";
             readonly requestType: MessageFns$1<ContainerStopRequest>;
@@ -4823,6 +4934,14 @@ declare const ModalClientDefinition: {
             readonly options: {};
         };
         /** Environments */
+        readonly environmentBillingSummary: {
+            readonly name: "EnvironmentBillingSummary";
+            readonly requestType: MessageFns$1<EnvironmentBillingSummaryRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<EnvironmentBillingSummaryResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly environmentCreate: {
             readonly name: "EnvironmentCreate";
             readonly requestType: MessageFns$1<EnvironmentCreateRequest>;
@@ -5224,6 +5343,14 @@ declare const ModalClientDefinition: {
             readonly options: {};
         };
         /** Mounts */
+        readonly mountBatchedCheckExistence: {
+            readonly name: "MountBatchedCheckExistence";
+            readonly requestType: MessageFns$1<MountBatchedCheckExistenceRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<MountBatchedCheckExistenceResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly mountGetOrCreate: {
             readonly name: "MountGetOrCreate";
             readonly requestType: MessageFns$1<MountGetOrCreateRequest>;
@@ -5428,6 +5555,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly sandboxGetFromNameV2: {
+            readonly name: "SandboxGetFromNameV2";
+            readonly requestType: MessageFns$1<SandboxGetFromNameRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<SandboxGetFromNameResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly sandboxGetLogs: {
             readonly name: "SandboxGetLogs";
             readonly requestType: MessageFns$1<SandboxGetLogsRequest>;
@@ -5565,6 +5700,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly sandboxTagsGetV2: {
+            readonly name: "SandboxTagsGetV2";
+            readonly requestType: MessageFns$1<SandboxTagsGetRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<SandboxTagsGetResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly sandboxTagsSet: {
             readonly name: "SandboxTagsSet";
             readonly requestType: MessageFns$1<SandboxTagsSetRequest>;
@@ -5573,6 +5716,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly sandboxTagsSetV2: {
+            readonly name: "SandboxTagsSetV2";
+            readonly requestType: MessageFns$1<SandboxTagsSetRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$2<Empty>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly sandboxTerminate: {
             readonly name: "SandboxTerminate";
             readonly requestType: MessageFns$1<SandboxTerminateRequest>;
@@ -6039,6 +6190,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: true;
             readonly options: {};
         };
+        readonly workspaceBillingSummary: {
+            readonly name: "WorkspaceBillingSummary";
+            readonly requestType: MessageFns$1<WorkspaceBillingSummaryRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<WorkspaceBillingSummaryResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly workspaceDashboardUrlGet: {
             readonly name: "WorkspaceDashboardUrlGet";
             readonly requestType: MessageFns$1<WorkspaceDashboardUrlRequest>;
@@ -6063,6 +6222,30 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly workspaceSetDefaultEnvironment: {
+            readonly name: "WorkspaceSetDefaultEnvironment";
+            readonly requestType: MessageFns$1<WorkspaceSetDefaultEnvironmentRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$2<Empty>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
+        readonly workspaceSetImageBuilderVersion: {
+            readonly name: "WorkspaceSetImageBuilderVersion";
+            readonly requestType: MessageFns$1<WorkspaceSetImageBuilderVersionRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<WorkspaceSetImageBuilderVersionResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
+        readonly workspaceSettings: {
+            readonly name: "WorkspaceSettings";
+            readonly requestType: MessageFns$2<Empty>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<WorkspaceSettingsResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
     };
 };
 type Builtin$1 = Date | Function | Uint8Array | string | number | boolean | undefined;
@@ -6106,7 +6289,16 @@ declare class SecretService {
     constructor(client: ModalClient);
     /** Reference a {@link Secret} by its name. */
     fromName(name: string, params?: SecretFromNameParams): Promise<Secret>;
-    /** Create a {@link Secret} from a plain object of key-value pairs. */
+    /**
+     * Create a {@link Secret} from a plain object of key-value pairs.
+     *
+     * The returned Secret is lazy: no server-side Secret is created (and
+     * {@link Secret#secretId secretId} stays empty) until it is first used. When
+     * used with {@link Sandbox#exec Sandbox.exec()} or
+     * {@link SandboxService#experimentalCreate client.sandboxes.experimentalCreate()},
+     * the values are sent directly to the worker as environment variables,
+     * avoiding a `SecretGetOrCreate` round-trip entirely.
+     */
     fromObject(entries: Record<string, string>, params?: SecretFromObjectParams): Promise<Secret>;
     /**
      * Delete a named {@link Secret}.
@@ -6115,12 +6307,42 @@ declare class SecretService {
      */
     delete(name: string, params?: SecretDeleteParams): Promise<void>;
 }
+/**
+ * Resolves a lazy {@link Secret} to a server-side secretId. Each construction
+ * path (fromName, fromObject, ...) supplies its own implementation carrying
+ * whatever inputs that path needs.
+ *
+ * @internal
+ * @hidden
+ */
+interface SecretHydrator {
+    hydrate(client: ModalClient): Promise<string>;
+}
 /** Secrets provide a dictionary of environment variables for {@link Image}s. */
 declare class Secret {
-    readonly secretId: string;
+    #private;
     readonly name?: string;
     /** @ignore */
-    constructor(secretId: string, name?: string);
+    constructor(secretId: string, name?: string, hydrator?: SecretHydrator);
+    /** The ID of the server-side Secret, or an empty string if not yet hydrated. */
+    get secretId(): string;
+    /**
+     * The hydrator resolving a lazy Secret to a secretId, or `undefined` for
+     * Secrets that already reference a server-side Secret (e.g. from fromName).
+     *
+     * @internal
+     * @hidden
+     */
+    get _hydrator(): SecretHydrator | undefined;
+    /**
+     * Lazily create the ephemeral server-side Secret backing a fromObject Secret
+     * and populate {@link Secret#secretId secretId}. A no-op once secretId is set
+     * (e.g. for Secrets returned by fromName).
+     *
+     * @internal
+     * @hidden
+     */
+    _hydrate(client: ModalClient): Promise<void>;
 }
 
 declare class CloudBucketMountService {
@@ -6268,12 +6490,12 @@ declare class Volume {
      * Configure options used when mounting this Volume. Fields left undefined preserve their value
      * from any previous withMountOptions call on the same Volume (stacking).
      */
-    withMountOptions(params?: VolumeMountOptions): Volume;
+    withMountOptions(params?: VolumeMountOptionsParams): Volume;
     /** Delete the ephemeral Volume. Only usable with emphemeral Volumes. */
     closeEphemeral(): void;
 }
 /** Options for mounting a {@link Volume}. */
-type VolumeMountOptions = {
+type VolumeMountOptionsParams = {
     readOnly?: boolean;
     subPath?: string;
 };
@@ -6295,7 +6517,8 @@ declare class Retries {
 /** Optional parameters for `client.functions.fromName()`. */
 type FunctionFromNameParams = {
     environment?: string;
-    createIfMissing?: boolean;
+    /** Look up a version-pinned Function deployed at this App version. */
+    version?: number;
 };
 /**
  * Service for managing {@link Function_ Function}s.
@@ -6341,6 +6564,7 @@ type FunctionWithOptionsParams = {
     bufferContainers?: number;
     scaledownWindowMs?: number;
     timeoutMs?: number;
+    routingRegion?: string;
 };
 /** Configuration options for {@link Function_#withConcurrency Function_.withConcurrency()}. */
 type FunctionWithConcurrencyParams = {
@@ -6390,7 +6614,8 @@ declare class Function_ {
 /** Optional parameters for {@link ClsService#fromName client.cls.fromName()}. */
 type ClsFromNameParams = {
     environment?: string;
-    createIfMissing?: boolean;
+    /** Look up a version-pinned Cls deployed at this App version. */
+    version?: number;
 };
 /**
  * Service for managing {@link Cls}.
@@ -6438,6 +6663,13 @@ type ImageFromNameParams = {
     /** Modal Environment to resolve the named Image in. */
     environment?: string;
 };
+/**
+ * A closure that hydrates the registry-auth {@link Secret} (if any) and builds
+ * the {@link ImageRegistryConfig} for the base build layer. It runs at build
+ * time rather than when the Image is constructed, since the Secret may be lazy
+ * (created via {@link SecretService#fromObject}).
+ */
+type BuildRegistryConfig = (client: ModalClient) => Promise<ImageRegistryConfig>;
 /**
  * Service for managing {@link Image}s.
  *
@@ -6527,7 +6759,7 @@ type Layer = {
 declare class Image {
     #private;
     /** @ignore */
-    constructor(client: ModalClient, imageId: string, tag: string, imageRegistryConfig?: ImageRegistryConfig, layers?: Layer[], baseImageId?: string);
+    constructor(client: ModalClient, imageId: string, tag: string, buildRegistryConfig?: BuildRegistryConfig, layers?: Layer[], baseImageId?: string);
     get imageId(): string;
     private static validateDockerfileCommands;
     /**
@@ -6889,6 +7121,19 @@ interface TaskMountDirectoryRequest {
     customerSuppliedEncryptionKey?: Uint8Array | undefined;
 }
 declare const TaskMountDirectoryRequest: MessageFns<TaskMountDirectoryRequest>;
+interface TaskReloadVolumesRequest {
+    taskId: string;
+}
+declare const TaskReloadVolumesRequest: MessageFns<TaskReloadVolumesRequest>;
+interface TaskSetNetworkAccessRequest {
+    taskId: string;
+    /**
+     * Replaces the task's network access policy. Only ALLOWLIST is currently
+     * supported; open access is expressed as an allow-all allowlist.
+     */
+    networkAccess: NetworkAccess | undefined;
+}
+declare const TaskSetNetworkAccessRequest: MessageFns<TaskSetNetworkAccessRequest>;
 interface TaskSnapshotDirectoryRequest {
     taskId: string;
     path: Uint8Array;
@@ -7015,6 +7260,14 @@ declare class TaskCommandRouterClientImpl {
     snapshotDirectory(request: TaskSnapshotDirectoryRequest, options?: TimeoutOptions): Promise<TaskSnapshotDirectoryResponse>;
     snapshotFilesystem(request: TaskSnapshotFilesystemRequest, options?: TimeoutOptions): Promise<TaskSnapshotFilesystemResponse>;
     unmountDirectory(request: TaskUnmountDirectoryRequest): Promise<void>;
+    setNetworkAccess(request: TaskSetNetworkAccessRequest): Promise<void>;
+    /**
+     * Reload all Volumes mounted in the task to reflect their latest committed state.
+     *
+     * `timeoutMs` is the client-side deadline. If the reload does not complete
+     * within this window, the call is cancelled and a TimeoutError is thrown.
+     */
+    reloadVolumes(request: TaskReloadVolumesRequest, options?: TimeoutOptions): Promise<void>;
     sandboxWaitUntilReady(taskId: string, timeoutMs: number): Promise<SandboxWaitUntilReadyTcrResponse>;
     private refreshJwt;
     private callWithAuthRetry;
@@ -7037,6 +7290,20 @@ interface FileInfo {
     readonly modifiedTime: number;
     readonly symlinkTarget: string | null;
 }
+/** Type of a filesystem watch event. */
+type FileWatchEventType = "Access" | "Create" | "Modify" | "Remove" | "Unknown";
+/** A filesystem change event.
+ *
+ * `paths` contains the absolute path(s) affected by the event. For most event
+ * types it holds a single entry. Rename operations are reported as `Modify`
+ * events: when both the source and destination fall within the watched scope,
+ * `paths` holds `[source, destination]`; when only one side of the rename is
+ * visible, `paths` holds that single path.
+ */
+interface FileWatchEvent {
+    readonly eventType: FileWatchEventType;
+    readonly paths: string[];
+}
 /** Namespace for Sandbox filesystem APIs. */
 declare class SandboxFilesystem {
     private readonly exec;
@@ -7158,6 +7425,36 @@ declare class SandboxFilesystem {
      * @throws {SandboxFilesystemError} the command fails for any other reason.
      */
     stat(remotePath: string): Promise<FileInfo>;
+    /**
+     * Watch a path in the Sandbox for filesystem changes.
+     *
+     * `remotePath` must be an absolute path in the Sandbox. If it points to a
+     * file, events for that file are reported. If it points to a directory,
+     * events for entries directly inside it are reported. Set `recursive: true`
+     * to also receive events for all nested subdirectories. If `remotePath` is
+     * a symlink, it is followed and events reference paths under the resolved
+     * target.
+     *
+     * Yields {@link FileWatchEvent} objects as changes occur, until either the
+     * timeout elapses, the iterator is closed, or the Sandbox is terminated.
+     *
+     * Optionally restrict the kinds of events emitted to those included in
+     * `filter`. An undefined `filter` permits all types; passing an empty array
+     * suppresses all events.
+     *
+     * `timeoutMs` is truncated to whole seconds. Omit it to watch indefinitely.
+     * When the timeout elapses, the iterator stops without raising an exception.
+     *
+     * @throws {SandboxFilesystemNotFoundError} `remotePath` does not exist.
+     * @throws {SandboxFilesystemPermissionError} watch access is denied.
+     * @throws {InvalidError} the filesystem does not support watching.
+     * @throws {SandboxFilesystemError} the command fails for any other reason.
+     */
+    watch(remotePath: string, params?: {
+        filter?: FileWatchEventType[];
+        recursive?: boolean;
+        timeoutMs?: number;
+    }): AsyncIterable<FileWatchEvent>;
     /**
      * Write binary content to a file in the Sandbox.
      *
@@ -7190,6 +7487,7 @@ declare class SandboxFilesystem {
 
 type SandboxSidecarCommandRouter = Pick<TaskCommandRouterClientImpl, "containerCreate" | "containerGet" | "containerList" | "containerTerminate" | "containerWait">;
 type SandboxSidecarAccess = {
+    client: ModalClient;
     exec(command: string[], params: SandboxExecParams | undefined, containerId: string): Promise<ContainerProcess>;
     commandRouter(): Promise<[string, SandboxSidecarCommandRouter]>;
 };
@@ -7442,11 +7740,11 @@ declare class SandboxService {
      * supported.
      *
      * V2 sandboxes created with this method are not currently returned by
-     * {@link SandboxService#list client.sandboxes.list()} and cannot be looked up
-     * with {@link SandboxService#fromName client.sandboxes.fromName()}. Store
-     * {@link Sandbox#sandboxId sandbox.sandboxId} if you need to retrieve the
-     * sandbox later, and use {@link SandboxService#fromId client.sandboxes.fromId()}
-     * to reattach.
+     * {@link SandboxService#list client.sandboxes.list()}. A named Sandbox can be
+     * looked up with
+     * {@link SandboxService#experimentalFromName client.sandboxes.experimentalFromName()};
+     * otherwise store {@link Sandbox#sandboxId sandbox.sandboxId} and use
+     * {@link SandboxService#fromId client.sandboxes.fromId()} to reattach.
      */
     experimentalCreate(app: App, image: Image, params?: SandboxCreateParams): Promise<Sandbox>;
     /** Returns a running {@link Sandbox} object from an ID.
@@ -7465,11 +7763,39 @@ declare class SandboxService {
      * @returns Promise that resolves to a Sandbox
      */
     fromName(appName: string, name: string, params?: SandboxFromNameParams): Promise<Sandbox>;
+    /**
+     * Get a running V2 {@link Sandbox} by name from a deployed {@link App}.
+     *
+     * This looks up V2 Sandboxes, i.e. Sandboxes created via
+     * {@link SandboxService#experimentalCreate client.sandboxes.experimentalCreate()}.
+     *
+     * EXPERIMENTAL: the API is subject to change.
+     *
+     * @param appName - Name of the deployed App
+     * @param name - Name of the Sandbox
+     * @param params - Optional parameters for getting the Sandbox
+     * @returns Promise that resolves to a Sandbox
+     */
+    experimentalFromName(appName: string, name: string, params?: SandboxExperimentalFromNameParams): Promise<Sandbox>;
     /**
      * List all {@link Sandbox}es for the current Environment or App ID (if specified).
      * If tags are specified, only Sandboxes that have at least those tags are returned.
      */
     list(params?: SandboxListParams): AsyncGenerator<Sandbox, void, unknown>;
+    /**
+     * List the V2 {@link Sandbox}es in an {@link App}.
+     *
+     * This lists V2 Sandboxes, i.e. Sandboxes created via
+     * {@link SandboxService#experimentalCreate client.sandboxes.experimentalCreate()}.
+     * Such Sandboxes are not returned by
+     * {@link SandboxService#list client.sandboxes.list()}. If tags are specified,
+     * only Sandboxes that have at least those tags are returned.
+     *
+     * Yields {@link Sandbox} objects that are currently running in the App.
+     *
+     * EXPERIMENTAL: the API is subject to change.
+     */
+    experimentalList(params: SandboxExperimentalListParams): AsyncGenerator<Sandbox, void, unknown>;
 }
 /** Optional parameters for {@link SandboxService#list client.sandboxes.list()}. */
 type SandboxListParams = {
@@ -7480,10 +7806,21 @@ type SandboxListParams = {
     /** Override environment for the request; defaults to current profile. */
     environment?: string;
 };
+/** Parameters for {@link SandboxService#experimentalList client.sandboxes.experimentalList()}. */
+type SandboxExperimentalListParams = {
+    /** The App to list Sandboxes under. */
+    appId: string;
+    /** Only return Sandboxes that include all specified tags. */
+    tags?: Record<string, string>;
+};
 /** Optional parameters for {@link SandboxService#fromName client.sandboxes.fromName()}. */
 type SandboxFromNameParams = {
     environment?: string;
 };
+/** Optional parameters for {@link SandboxService#experimentalFromName client.sandboxes.experimentalFromName()}. */
+type SandboxExperimentalFromNameParams = {
+    environment?: string;
+};
 /** Optional parameters for {@link Sandbox#exec Sandbox.exec()}. */
 type SandboxExecParams = {
     /** Specifies text or binary encoding for input and output streams. */
@@ -7524,6 +7861,16 @@ type SandboxSnapshotFilesystemParams = {
      */
     ttlMs?: number | null;
 };
+/** Optional parameters for {@link Sandbox#reloadVolumes Sandbox.reloadVolumes()}. */
+type SandboxReloadVolumesParams = {
+    /**
+     * Overall budget for the reload call, in milliseconds. Defaults to 55000.
+     * If the reload does not complete within this window, the call is cancelled
+     * and a `TimeoutError` is thrown; note that the reload may still complete in
+     * the background.
+     */
+    timeoutMs?: number;
+};
 /** Optional parameters for {@link Sandbox#snapshotDirectory Sandbox.snapshotDirectory()}. */
 type SandboxSnapshotDirectoryParams = {
     /**
@@ -7560,6 +7907,21 @@ type SandboxCreateConnectTokenParams = {
     /** Container port that requests are routed to when using this token. Defaults to 8080. */
     port?: number;
 };
+/**
+ * Parameters for {@link Sandbox#updateNetworkPolicy Sandbox.updateNetworkPolicy()}.
+ *
+ * Each dimension is independent: `undefined` leaves that dimension unchanged,
+ * while a defined value replaces it (an empty array blocks all egress for that
+ * dimension; a wildcard entry such as `"0.0.0.0/0"` or `"*"` allows everything).
+ *
+ * Currently, both dimensions must be provided (the underlying transport does
+ * not yet support partial updates). This requirement will be relaxed in a
+ * future release.
+ */
+type SandboxUpdateNetworkPolicyParams = {
+    outboundCidrAllowlist?: string[];
+    outboundDomainAllowlist?: string[];
+};
 /** Credentials returned by {@link Sandbox#createConnectToken Sandbox.createConnectToken()}. */
 type SandboxCreateConnectCredentials = {
     url: string;
@@ -7670,6 +8032,25 @@ declare class Sandbox {
      * @param path - The mount path to unmount
      */
     unmountImage(path: string): Promise<void>;
+    /**
+     * Updates the outbound network policy of a running Sandbox.
+     *
+     * Established connections that the new policy no longer permits are terminated.
+     *
+     * @param params - Both `outboundCidrAllowlist` and `outboundDomainAllowlist` must be provided.
+     */
+    updateNetworkPolicy(params: SandboxUpdateNetworkPolicyParams): Promise<void>;
+    /**
+     * Reload all Volumes mounted in the Sandbox.
+     *
+     * Blocks until the Volumes have been reloaded, bounded by `timeoutMs` (55000
+     * by default). If the reload does not complete within that window, a
+     * `TimeoutError` is thrown; note that the reload may still complete in the
+     * background.
+     *
+     * @param params - Optional parameters; see {@link SandboxReloadVolumesParams}.
+     */
+    reloadVolumes(params?: SandboxReloadVolumesParams): Promise<void>;
     /**
      * Snapshots and creates a new {@link Image} from a directory in the running sandbox.
      *
@@ -7920,4 +8301,4 @@ declare class ClientClosedError extends Error {
 
 declare function checkForRenamedParams(params: any, renames: Record<string, string>): void;
 
-export { AlreadyExistsError, App, type AppFromNameParams, AppService, ClientClosedError, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ContainerProcess, type FileInfo, type FileType, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, FunctionCallService, type FunctionFromNameParams, FunctionService, type FunctionStats, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, type FunctionWithBatchingParams, type FunctionWithConcurrencyParams, type FunctionWithOptionsParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, type ImageFromNameParams, type ImagePublishParams, ImageService, InternalFailure, InvalidError, type LogLevel, type Logger, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, SandboxFilesystem, SandboxFilesystemDirectoryNotEmptyError, SandboxFilesystemError, SandboxFilesystemFileTooLargeError, SandboxFilesystemIsADirectoryError, SandboxFilesystemNotADirectoryError, SandboxFilesystemNotFoundError, SandboxFilesystemPathAlreadyExistsError, SandboxFilesystemPermissionError, type SandboxFromNameParams, type SandboxListParams, type SandboxMountImageParams, SandboxService, type SandboxSnapshotDirectoryParams, type SandboxSnapshotFilesystemParams, type SandboxTerminateParams, SandboxTimeoutError, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, SidecarContainer, type SidecarCreateParams, type SidecarExecParams, type SidecarGetParams, type SidecarListParams, SidecarService, type SidecarTerminateParams, type StdioBehavior, type StreamMode, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, type VolumeMountOptions, VolumeService, checkForRenamedParams };
+export { AlreadyExistsError, App, type AppFromNameParams, AppService, ClientClosedError, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ContainerProcess, type FileInfo, type FileType, type FileWatchEvent, type FileWatchEventType, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, FunctionCallService, type FunctionFromNameParams, FunctionService, type FunctionStats, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, type FunctionWithBatchingParams, type FunctionWithConcurrencyParams, type FunctionWithOptionsParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, type ImageFromNameParams, type ImagePublishParams, ImageService, InternalFailure, InvalidError, type LogLevel, type Logger, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, type SandboxExperimentalFromNameParams, type SandboxExperimentalListParams, SandboxFilesystem, SandboxFilesystemDirectoryNotEmptyError, SandboxFilesystemError, SandboxFilesystemFileTooLargeError, SandboxFilesystemIsADirectoryError, SandboxFilesystemNotADirectoryError, SandboxFilesystemNotFoundError, SandboxFilesystemPathAlreadyExistsError, SandboxFilesystemPermissionError, type SandboxFromNameParams, type SandboxListParams, type SandboxMountImageParams, type SandboxReloadVolumesParams, SandboxService, type SandboxSnapshotDirectoryParams, type SandboxSnapshotFilesystemParams, type SandboxTerminateParams, SandboxTimeoutError, type SandboxUpdateNetworkPolicyParams, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, SidecarContainer, type SidecarCreateParams, type SidecarExecParams, type SidecarGetParams, type SidecarListParams, SidecarService, type SidecarTerminateParams, type StdioBehavior, type StreamMode, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, type VolumeMountOptionsParams, VolumeService, checkForRenamedParams };