modal 0.9.0 → 0.10.1

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { Client, Status, ClientMiddleware } from 'nice-grpc';
+import { createChannel, Client, Status, ClientMiddleware } from 'nice-grpc';
 import { BinaryWriter, BinaryReader } from '@bufbuild/protobuf/wire';
 
 /**
@@ -28,6 +28,13 @@ interface MessageFns$2<T> {
     fromPartial(object: DeepPartial$2<T>): T;
 }
 
+/**
+ * gRPC protos for Modal's public API surface.
+ * Warning: direct usage of Modal's gRPC API is discouraged,
+ * and no support or compatibility guarantees are provided.
+ * Message fields or entire RPCs may be changed or removed
+ * without notice. We recommend using official SDKs instead.
+ */
 declare enum AppDeployVisibility {
     APP_DEPLOY_VISIBILITY_UNSPECIFIED = 0,
     APP_DEPLOY_VISIBILITY_WORKSPACE = 1,
@@ -79,6 +86,13 @@ declare enum AppStopSource {
     APP_STOP_SOURCE_WEB = 3,
     UNRECOGNIZED = -1
 }
+/** CPU architecture an image is built for and must run on. */
+declare enum Arch {
+    ARCH_UNSPECIFIED = 0,
+    ARCH_X86_64 = 1,
+    ARCH_AARCH64 = 2,
+    UNRECOGNIZED = -1
+}
 declare enum CertificateStatus {
     CERTIFICATE_STATUS_PENDING = 0,
     CERTIFICATE_STATUS_ISSUED = 1,
@@ -126,6 +140,15 @@ declare enum DeploymentNamespace {
     DEPLOYMENT_NAMESPACE_GLOBAL = 3,
     UNRECOGNIZED = -1
 }
+declare enum DeploymentType {
+    DEPLOYMENT_TYPE_UNSPECIFIED = 0,
+    DEPLOYMENT_TYPE_STANDARD = 1,
+    DEPLOYMENT_TYPE_ROLLBACK = 2,
+    DEPLOYMENT_TYPE_ROLLOVER = 3,
+    DEPLOYMENT_TYPE_PROMOTION = 4,
+    DEPLOYMENT_TYPE_STAGED = 5,
+    UNRECOGNIZED = -1
+}
 declare enum EndpointApiSurface {
     ENDPOINT_API_SURFACE_UNSPECIFIED = 0,
     ENDPOINT_API_SURFACE_OPENAI_CHAT_COMPLETIONS = 1,
@@ -156,16 +179,34 @@ declare enum EndpointProvisioningStatus {
     ENDPOINT_PROVISIONING_STATUS_CANCELLED = 6,
     UNRECOGNIZED = -1
 }
+declare enum EndpointServingMode {
+    ENDPOINT_SERVING_MODE_UNSPECIFIED = 0,
+    ENDPOINT_SERVING_MODE_DEDICATED = 1,
+    ENDPOINT_SERVING_MODE_SHARED = 2,
+    UNRECOGNIZED = -1
+}
 declare enum EndpointStopSource {
     ENDPOINT_STOP_SOURCE_UNSPECIFIED = 0,
     ENDPOINT_STOP_SOURCE_CLI = 1,
     ENDPOINT_STOP_SOURCE_WEB = 2,
     UNRECOGNIZED = -1
 }
+/**
+ * Partial-update signal for EnvironmentUpdateRequest. Omitted means no-op.
+ * INHERIT clears the environment override so the workspace default applies.
+ */
+declare enum EnvironmentBlockUnauthenticatedResources {
+    ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_UNSPECIFIED = 0,
+    ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_INHERIT = 1,
+    ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_BLOCK = 2,
+    ENVIRONMENT_BLOCK_UNAUTHENTICATED_RESOURCES_ALLOW = 3,
+    UNRECOGNIZED = -1
+}
 declare enum EnvironmentRole {
     ENVIRONMENT_ROLE_UNSPECIFIED = 0,
     ENVIRONMENT_ROLE_VIEWER = 1,
     ENVIRONMENT_ROLE_CONTRIBUTOR = 2,
+    ENVIRONMENT_ROLE_NO_ACCESS = 3,
     UNRECOGNIZED = -1
 }
 /**
@@ -443,6 +484,11 @@ declare enum GenericResult_GenericStatus {
     GENERIC_STATUS_INTERNAL_FAILURE = 6,
     /** GENERIC_STATUS_IDLE_TIMEOUT - Used when sandboxes are terminated due to idle_timeout */
     GENERIC_STATUS_IDLE_TIMEOUT = 7,
+    /**
+     * GENERIC_STATUS_MEMORY_MANAGER_EVICTION - Used when a task was killed because it was evicted by the memory manager when the worker was
+     * under memory pressure.
+     */
+    GENERIC_STATUS_MEMORY_MANAGER_EVICTION = 8,
     UNRECOGNIZED = -1
 }
 declare enum NetworkAccess_NetworkAccessType {
@@ -461,6 +507,12 @@ declare enum PTYInfo_PTYType {
     PTY_TYPE_SHELL = 2,
     UNRECOGNIZED = -1
 }
+declare enum SandboxGetExitSnapshotResponse_ErrorCode {
+    ERROR_CODE_UNSPECIFIED = 0,
+    ERROR_CODE_TIMEOUT = 1,
+    ERROR_CODE_INTERNAL = 2,
+    UNRECOGNIZED = -1
+}
 declare enum SandboxRestoreRequest_SandboxNameOverrideType {
     SANDBOX_NAME_OVERRIDE_TYPE_UNSPECIFIED = 0,
     SANDBOX_NAME_OVERRIDE_TYPE_NONE = 1,
@@ -546,6 +598,7 @@ interface AppDeploymentHistory {
     rollbackVersion: number;
     rollbackAllowed: boolean;
     commitInfo?: CommitInfo | undefined;
+    deploymentType: DeploymentType;
 }
 declare const AppDeploymentHistory: MessageFns$1<AppDeploymentHistory>;
 interface AppDeploymentHistoryRequest {
@@ -554,6 +607,7 @@ interface AppDeploymentHistoryRequest {
 declare const AppDeploymentHistoryRequest: MessageFns$1<AppDeploymentHistoryRequest>;
 interface AppDeploymentHistoryResponse {
     appDeploymentHistories: AppDeploymentHistory[];
+    productionAppVersion: number;
 }
 declare const AppDeploymentHistoryResponse: MessageFns$1<AppDeploymentHistoryResponse>;
 interface AppFetchLogsRequest {
@@ -589,6 +643,14 @@ interface AppGetByDeploymentNameResponse {
     lifecycle: AppLifecycle | undefined;
 }
 declare const AppGetByDeploymentNameResponse: MessageFns$1<AppGetByDeploymentNameResponse>;
+interface AppGetInfoRequest {
+    appId: string;
+}
+declare const AppGetInfoRequest: MessageFns$1<AppGetInfoRequest>;
+interface AppGetInfoResponse {
+    info: AppHandleMetadata | undefined;
+}
+declare const AppGetInfoResponse: MessageFns$1<AppGetInfoResponse>;
 interface AppGetLayoutRequest {
     appId: string;
 }
@@ -643,6 +705,7 @@ interface AppGetOrCreateRequest {
 declare const AppGetOrCreateRequest: MessageFns$1<AppGetOrCreateRequest>;
 interface AppGetOrCreateResponse {
     appId: string;
+    handleMetadata: AppHandleMetadata | undefined;
 }
 declare const AppGetOrCreateResponse: MessageFns$1<AppGetOrCreateResponse>;
 interface AppGetTagsRequest {
@@ -655,6 +718,21 @@ interface AppGetTagsResponse {
     };
 }
 declare const AppGetTagsResponse: MessageFns$1<AppGetTagsResponse>;
+interface AppHandleMetadata {
+    description: string;
+    appId: string;
+    environmentName: string;
+    lifecycle: AppLifecycle | undefined;
+    /** tag -> function id */
+    functions: {
+        [key: string]: string;
+    };
+    /** tag -> function id */
+    servers: {
+        [key: string]: string;
+    };
+}
+declare const AppHandleMetadata: MessageFns$1<AppHandleMetadata>;
 interface AppHeartbeatRequest {
     appId: string;
 }
@@ -715,6 +793,17 @@ interface AppLookupResponse {
     appId: string;
 }
 declare const AppLookupResponse: MessageFns$1<AppLookupResponse>;
+interface AppPromoteRequest {
+    appId: string;
+    version: number;
+}
+declare const AppPromoteRequest: MessageFns$1<AppPromoteRequest>;
+interface AppPromoteResponse {
+    url: string;
+    serverWarnings: Warning[];
+    deployedAt: number;
+}
+declare const AppPromoteResponse: MessageFns$1<AppPromoteResponse>;
 interface AppPublishRequest {
     appId: string;
     name: string;
@@ -744,6 +833,12 @@ interface AppPublishRequest {
     tags: {
         [key: string]: string;
     };
+    /**
+     * If true, create a version pinned deployment but don't update the production deployment
+     * definition on publish
+     */
+    staged: boolean;
+    deploymentType: DeploymentType;
 }
 declare const AppPublishRequest: MessageFns$1<AppPublishRequest>;
 interface AppPublishResponse {
@@ -823,6 +918,7 @@ interface AttemptStartRequest {
     functionId: string;
     parentInputId: string;
     input: FunctionPutInputsItem | undefined;
+    proxied: boolean;
 }
 declare const AttemptStartRequest: MessageFns$1<AttemptStartRequest>;
 interface AttemptStartResponse {
@@ -852,10 +948,15 @@ interface AutoscalerSettings {
     scaleupWindow?: number | undefined;
     /** Maximum amount of time a container can be idle before being scaled down, in seconds; pka "container_idle_timeout" */
     scaledownWindow?: number | undefined;
-    /** Target concurrent inputs per replica for Flash autoscaling. */
+    /**
+     * Integer-valued target concurrent requests per replica for Flash autoscaling.
+     * Superseded by `target_concurrency_float`, which allows non-integer targets.
+     */
     targetConcurrency?: number | undefined;
     /** Maximum number of containers that can be scaled down per minute for Flash autoscaling. */
     scaledownRateLimit?: number | undefined;
+    /** Target concurrent requests per replica for Flash autoscaling; may be fractional. */
+    targetConcurrencyFloat?: number | undefined;
 }
 declare const AutoscalerSettings: MessageFns$1<AutoscalerSettings>;
 interface BaseImage {
@@ -1022,6 +1123,11 @@ interface ClusterStats {
     startedAt: number;
 }
 declare const ClusterStats: MessageFns$1<ClusterStats>;
+interface CommandRouterAccess$1 {
+    jwt: string;
+    url: string;
+}
+declare const CommandRouterAccess$1: MessageFns$1<CommandRouterAccess$1>;
 interface CommitInfo {
     /** Only git is supported for now */
     vcs: string;
@@ -1432,6 +1538,7 @@ interface EndpointCreateRequest {
     inputModalities: EndpointInputModality[];
     environmentName: string;
     unauthenticated: boolean;
+    servingMode: EndpointServingMode;
 }
 declare const EndpointCreateRequest: MessageFns$1<EndpointCreateRequest>;
 interface EndpointCreateResponse {
@@ -1494,6 +1601,8 @@ interface EndpointListItem {
     createdByAvatarUrl: string;
     provisioningStatus: EndpointProvisioningStatus;
     status: string;
+    servingMode: EndpointServingMode;
+    unauthenticated: boolean;
 }
 declare const EndpointListItem: MessageFns$1<EndpointListItem>;
 interface EndpointListRequest {
@@ -1530,8 +1639,8 @@ interface EndpointStopResponse {
 }
 declare const EndpointStopResponse: MessageFns$1<EndpointStopResponse>;
 interface EnvironmentBillingSummaryRequest {
+    /** all query intervals are implicitly one month long (to line up with billing cycles) */
     startTimestamp: Date | undefined;
-    endTimestamp: Date | undefined;
     environmentId: string;
 }
 declare const EnvironmentBillingSummaryRequest: MessageFns$1<EnvironmentBillingSummaryRequest>;
@@ -1554,6 +1663,9 @@ interface EnvironmentCreateRequest {
     isManaged: boolean;
     settings: EnvironmentSettings | undefined;
     environmentType: EnvironmentType;
+    defaultMemberRole?: EnvironmentRole | undefined;
+    /** String representation; parsed when the enum is unspecified. */
+    defaultMemberRoleStr: string;
 }
 declare const EnvironmentCreateRequest: MessageFns$1<EnvironmentCreateRequest>;
 interface EnvironmentDeleteRequest {
@@ -1604,6 +1716,33 @@ interface EnvironmentGetOrCreateResponse {
     metadata: EnvironmentMetadata | undefined;
 }
 declare const EnvironmentGetOrCreateResponse: MessageFns$1<EnvironmentGetOrCreateResponse>;
+interface EnvironmentGetRolesRequest {
+    environmentId: string;
+}
+declare const EnvironmentGetRolesRequest: MessageFns$1<EnvironmentGetRolesRequest>;
+interface EnvironmentGetRolesResponse {
+    name: string;
+    createdAt: number;
+    principalRoles: EnvironmentGetRolesResponse_Principal[];
+    defaultMemberRole?: EnvironmentRole | undefined;
+}
+declare const EnvironmentGetRolesResponse: MessageFns$1<EnvironmentGetRolesResponse>;
+interface EnvironmentGetRolesResponse_Principal {
+    userId: string;
+    serviceUserId: string;
+    email: string;
+    avatarUrl: string;
+    userName: string;
+    serviceUserName: string;
+    role: EnvironmentRole;
+    /** String representation for the CLI */
+    roleStr: string;
+    choosableRoles: EnvironmentRole[];
+    memberRole: MemberRole;
+    inheritsDefaultMemberRole?: boolean | undefined;
+    hasRoleAssignment?: boolean | undefined;
+}
+declare const EnvironmentGetRolesResponse_Principal: MessageFns$1<EnvironmentGetRolesResponse_Principal>;
 interface EnvironmentListItem {
     name: string;
     webhookSuffix: string;
@@ -1621,6 +1760,8 @@ interface EnvironmentListItem {
     currentCycleUsage: number;
     spendLimitReached: boolean;
     environmentType: EnvironmentType;
+    defaultMemberRole?: EnvironmentRole | undefined;
+    blockUnauthenticatedResources?: boolean | undefined;
 }
 declare const EnvironmentListItem: MessageFns$1<EnvironmentListItem>;
 interface EnvironmentListResponse {
@@ -1638,6 +1779,8 @@ interface EnvironmentRoleSetRequest {
     userId: string;
     serviceUserId: string;
     role: EnvironmentRole;
+    /** String representation from the CLI; parsed when role is unspecified */
+    roleStr: string;
 }
 declare const EnvironmentRoleSetRequest: MessageFns$1<EnvironmentRoleSetRequest>;
 interface EnvironmentSetBudgetRequest {
@@ -1646,9 +1789,15 @@ interface EnvironmentSetBudgetRequest {
     clearBudget: boolean;
 }
 declare const EnvironmentSetBudgetRequest: MessageFns$1<EnvironmentSetBudgetRequest>;
+interface EnvironmentSetDefaultMemberRoleRequest {
+    environmentId: string;
+    defaultMemberRole: EnvironmentRole;
+}
+declare const EnvironmentSetDefaultMemberRoleRequest: MessageFns$1<EnvironmentSetDefaultMemberRoleRequest>;
 interface EnvironmentSetManagedRequest {
     environmentId: string;
     managed: boolean;
+    defaultMemberRole?: EnvironmentRole | undefined;
 }
 declare const EnvironmentSetManagedRequest: MessageFns$1<EnvironmentSetManagedRequest>;
 /**
@@ -1661,6 +1810,12 @@ interface EnvironmentSettings {
     webhookSuffix: string;
     maxConcurrentGpus?: number | undefined;
     maxConcurrentTasks?: number | undefined;
+    /**
+     * When true, new unauthenticated web functions, Servers, tunnels, and
+     * Endpoints in this environment are rejected. Unset inherits the workspace
+     * default.
+     */
+    blockUnauthenticatedResources?: boolean | undefined;
 }
 declare const EnvironmentSettings: MessageFns$1<EnvironmentSettings>;
 interface EnvironmentUpdateRequest {
@@ -1669,6 +1824,7 @@ interface EnvironmentUpdateRequest {
     webSuffix: string | undefined;
     maxConcurrentTasks?: number | undefined;
     maxConcurrentGpus?: number | undefined;
+    blockUnauthenticatedResources?: EnvironmentBlockUnauthenticatedResources | undefined;
 }
 declare const EnvironmentUpdateRequest: MessageFns$1<EnvironmentUpdateRequest>;
 /** A file entry when listing files in a volume or network file system. */
@@ -1805,6 +1961,11 @@ interface FunctionMessage {
      * to schedule in tandem.
      */
     ExperimentalGroupSize: number;
+    /**
+     * When set on a "grouped" function, constrains placement across GPU-memory
+     * fabrics: the cluster is placed in co-fabric blocks of this size.
+     */
+    ExperimentalFabricSize: number;
     /** If set, the function will be run in an untrusted environment. */
     untrusted: boolean;
     /** To be replaced by autoscaler_settings.buffer_containers */
@@ -1868,6 +2029,8 @@ interface FunctionMessage {
     isServer: boolean;
     /** Where inputs to a function should be routed through. */
     routingRegion: string;
+    /** True when the function is a Sessioned Server. Only valid together with is_server. */
+    isSessioned: boolean;
 }
 declare const FunctionMessage: MessageFns$1<FunctionMessage>;
 interface FunctionAsyncInvokeRequest {
@@ -1926,6 +2089,15 @@ interface FunctionCallGetDataRequest {
     lastIndex: number;
 }
 declare const FunctionCallGetDataRequest: MessageFns$1<FunctionCallGetDataRequest>;
+interface FunctionCallGetInfoRequest {
+    functionId: string;
+    functionCallId: string;
+}
+declare const FunctionCallGetInfoRequest: MessageFns$1<FunctionCallGetInfoRequest>;
+interface FunctionCallGetInfoResponse {
+    info: FunctionCallInfo | undefined;
+}
+declare const FunctionCallGetInfoResponse: MessageFns$1<FunctionCallGetInfoResponse>;
 interface FunctionCallHandleMetadata {
     appId: string;
     functionId: string;
@@ -1982,9 +2154,11 @@ interface FunctionCreateResponse {
      * @deprecated
      */
     DeprecatedWebUrl: string;
+    /** deprecated soon */
     function: FunctionMessage | undefined;
     handleMetadata: FunctionHandleMetadata | undefined;
     serverWarnings: Warning[];
+    functionData: FunctionData | undefined;
 }
 declare const FunctionCreateResponse: MessageFns$1<FunctionCreateResponse>;
 /**
@@ -2010,6 +2184,7 @@ interface FunctionData {
      * to schedule in tandem.
      */
     ExperimentalGroupSize: number;
+    ExperimentalFabricSize: number;
     ExperimentalBufferContainers: number;
     ExperimentalCustomScaling: boolean;
     ExperimentalEnableGpuSnapshot: boolean;
@@ -2069,6 +2244,8 @@ interface FunctionData {
     isServer: boolean;
     /** Where inputs to a function should be routed through. */
     routingRegion: string;
+    /** True when the function is a Sessioned Server. Only valid together with is_server. */
+    isSessioned: boolean;
 }
 declare const FunctionData: MessageFns$1<FunctionData>;
 interface FunctionData_RankedFunction {
@@ -2082,6 +2259,15 @@ interface FunctionFinishInputsRequest {
     numInputs: number;
 }
 declare const FunctionFinishInputsRequest: MessageFns$1<FunctionFinishInputsRequest>;
+interface FunctionGetByIdRequest {
+    functionId: string;
+}
+declare const FunctionGetByIdRequest: MessageFns$1<FunctionGetByIdRequest>;
+interface FunctionGetByIdResponse {
+    function: FunctionData | undefined;
+    handleMetadata: FunctionHandleMetadata | undefined;
+}
+declare const FunctionGetByIdResponse: MessageFns$1<FunctionGetByIdResponse>;
 interface FunctionGetCallGraphRequest {
     functionCallId: string;
 }
@@ -2089,6 +2275,8 @@ declare const FunctionGetCallGraphRequest: MessageFns$1<FunctionGetCallGraphRequ
 interface FunctionGetCallGraphResponse {
     inputs: InputCallGraphInfo[];
     functionCalls: FunctionCallCallGraphInfo[];
+    /** Set by the server when the graph has more nodes than it will return, so `inputs` is a prefix of the graph. */
+    truncated: boolean;
 }
 declare const FunctionGetCallGraphResponse: MessageFns$1<FunctionGetCallGraphResponse>;
 interface FunctionGetCurrentStatsRequest {
@@ -2105,6 +2293,14 @@ interface FunctionGetDynamicConcurrencyResponse {
     concurrency: number;
 }
 declare const FunctionGetDynamicConcurrencyResponse: MessageFns$1<FunctionGetDynamicConcurrencyResponse>;
+interface FunctionGetFlashAuthTokenRequest {
+    functionId: string;
+}
+declare const FunctionGetFlashAuthTokenRequest: MessageFns$1<FunctionGetFlashAuthTokenRequest>;
+interface FunctionGetFlashAuthTokenResponse {
+    token: string;
+}
+declare const FunctionGetFlashAuthTokenResponse: MessageFns$1<FunctionGetFlashAuthTokenResponse>;
 interface FunctionGetInputsItem {
     inputId: string;
     input: FunctionInput | undefined;
@@ -2120,8 +2316,6 @@ interface FunctionGetInputsItem {
 declare const FunctionGetInputsItem: MessageFns$1<FunctionGetInputsItem>;
 interface FunctionGetInputsRequest {
     functionId: string;
-    maxValues: number;
-    averageCallTime: number;
     /** Container aims to fetch multiple inputs at the same time */
     inputConcurrency: number;
     /** Maximum number of inputs to fetch at once */
@@ -2185,6 +2379,7 @@ interface FunctionGetResponse {
     functionId: string;
     handleMetadata: FunctionHandleMetadata | undefined;
     serverWarnings: Warning[];
+    function: FunctionData | undefined;
 }
 declare const FunctionGetResponse: MessageFns$1<FunctionGetResponse>;
 interface FunctionGetSerializedRequest {
@@ -2196,6 +2391,58 @@ interface FunctionGetSerializedResponse {
     classSerialized: Uint8Array;
 }
 declare const FunctionGetSerializedResponse: MessageFns$1<FunctionGetSerializedResponse>;
+interface FunctionGetTimeRangeStatsRequest {
+    functionId: string;
+    /** Inclusive. */
+    since: Date | undefined;
+    /** Exclusive. */
+    until: Date | undefined;
+    /** Aggregate the root Function pool and its non-version-pinned variant pools. */
+    rollup: boolean;
+    /** Filter stats for a specific container */
+    containerId?: string | undefined;
+}
+declare const FunctionGetTimeRangeStatsRequest: MessageFns$1<FunctionGetTimeRangeStatsRequest>;
+interface FunctionGetTimeRangeStatsResponse {
+    /** Inclusive. */
+    since: Date | undefined;
+    /** Exclusive. */
+    until: Date | undefined;
+    /** Counts of inputs that finish in the requested time range. */
+    inputSuccessCount: number;
+    inputFailureCount: number;
+    inputTimeoutCount: number;
+    /** Number of inputs assigned but not finished at the exclusive end of the time range. */
+    inputRunningAtEndCount: number;
+    /**
+     * Metrics include execution_time, end_to_end_latency, subject to change
+     * as requirements evolve
+     */
+    inputPercentileStats: {
+        [key: string]: StatsPercentileDistribution;
+    };
+    /**
+     * Container lifecycle counts. Started and errored containers are counted when
+     * the corresponding event occurs in the requested time range. Creating containers
+     * were enqueued but had not started or finished at the exclusive end of the range.
+     */
+    containerStartedCount: number;
+    containerErrorCount: number;
+    containerCreatingAtEndCount: number;
+    /**
+     * Metrics include cpu_usage, memory_usage, gpu_utilization subject to change
+     * as requirements evolve
+     */
+    containerPercentileStats: {
+        [key: string]: StatsPercentileDistribution;
+    };
+    /**
+     * Number of direct non-version-pinned variants included in the roll-up.
+     * Zero when roll-up is disabled or the base Function has no variants.
+     */
+    variantCount: number;
+}
+declare const FunctionGetTimeRangeStatsResponse: MessageFns$1<FunctionGetTimeRangeStatsResponse>;
 /**
  * contains all the info about a function that is needed to trigger the right
  * behaviour when using a FunctionHandler. Notably excludes things purely
@@ -2222,6 +2469,7 @@ interface FunctionHandleMetadata {
     inputPlaneRegion?: string | undefined;
     /** Use optional to ensure unset values default to None instead of 0 */
     maxObjectSizeBytes?: number | undefined;
+    maxAsyncObjectSizeBytes?: number | undefined;
     /** (Optional) urls for flash services */
     ExperimentalFlashUrls: string[];
     supportedInputFormats: DataFormat[];
@@ -2398,6 +2646,7 @@ interface FunctionUpdateSchedulingParamsRequest {
 }
 declare const FunctionUpdateSchedulingParamsRequest: MessageFns$1<FunctionUpdateSchedulingParamsRequest>;
 interface FunctionUpdateSchedulingParamsResponse {
+    currentSettings: AutoscalerSettings | undefined;
 }
 declare const FunctionUpdateSchedulingParamsResponse: MessageFns$1<FunctionUpdateSchedulingParamsResponse>;
 interface GPUConfig {
@@ -2473,8 +2722,29 @@ interface Image$1 {
     };
     /** Volume mount for RUN commands */
     volumeMounts: VolumeMount[];
+    /**
+     * CPU architecture the image is built for. Images with an unspecified
+     * arch predate this field and are treated as x86_64.
+     */
+    arch: Arch;
 }
 declare const Image$1: MessageFns$1<Image$1>;
+interface ImageBuildChainGetRequest {
+    imageId: string;
+}
+declare const ImageBuildChainGetRequest: MessageFns$1<ImageBuildChainGetRequest>;
+interface ImageBuildChainGetResponse {
+    buildSteps: ImageBuildStep[];
+}
+declare const ImageBuildChainGetResponse: MessageFns$1<ImageBuildChainGetResponse>;
+interface ImageBuildStep {
+    imageId: string;
+    startedAt: Date | undefined;
+    finishedAt: Date | undefined;
+    builderAppId: string;
+    builderTaskId: string;
+}
+declare const ImageBuildStep: MessageFns$1<ImageBuildStep>;
 interface ImageContextFile {
     filename: string;
     data: Uint8Array;
@@ -2494,8 +2764,15 @@ interface ImageFromIdResponse {
 }
 declare const ImageFromIdResponse: MessageFns$1<ImageFromIdResponse>;
 interface ImageGetByTagRequest {
-    /** Full "name:tag" string. Must be non-empty. */
+    /**
+     * Named image reference: "[[workspace/]environment/]name[:tag]".
+     * The tag suffix defaults to "latest" when omitted.
+     */
     tag: string;
+    /**
+     * New clients should send environment name as a /-separated prefix of the `tag` field.
+     * environment_name only accepted when tag has no environment or workspace prefix.
+     */
     environmentName: string;
 }
 declare const ImageGetByTagRequest: MessageFns$1<ImageGetByTagRequest>;
@@ -2592,8 +2869,15 @@ interface ImageMetadata {
 declare const ImageMetadata: MessageFns$1<ImageMetadata>;
 interface ImagePublishRequest {
     imageId: string;
-    /** Full "name:tag" string. Must be non-empty. */
+    /**
+     * Named image reference: "[[workspace/]environment/]name[:tag]".
+     * The tag suffix defaults to "latest" when omitted.
+     */
     tag: string;
+    /**
+     * New clients should send environment name as a /-separated prefix of the `tag` field.
+     * environment_name only accepted when tag has no environment or workspace prefix.
+     */
     environmentName: string;
     /** Explicit opt-in required when publishing to a public environment. */
     allowPublic: boolean;
@@ -2617,8 +2901,15 @@ interface ImageTagRevisionsItem {
 }
 declare const ImageTagRevisionsItem: MessageFns$1<ImageTagRevisionsItem>;
 interface ImageTagRevisionsRequest {
-    /** Full "name:tag" string. Must be non-empty. */
+    /**
+     * Named image reference: "[[workspace/]environment/]name[:tag]".
+     * The tag suffix defaults to "latest" when omitted.
+     */
     tag: string;
+    /**
+     * New clients should send environment name as a /-separated prefix of the `tag` field.
+     * environment_name only accepted when tag has no environment or workspace prefix.
+     */
     environmentName: string;
     /** Defaults to 100. Values above 100 are rejected by the server. */
     maxObjects: number;
@@ -2695,6 +2986,7 @@ interface MapStartOrContinueRequest {
     functionCallId?: string | undefined;
     mapToken?: string | undefined;
     items: MapStartOrContinueItem[];
+    proxied: boolean;
 }
 declare const MapStartOrContinueRequest: MessageFns$1<MapStartOrContinueRequest>;
 interface MapStartOrContinueResponse {
@@ -2878,6 +3170,35 @@ interface ObjectDependency {
     objectId: string;
 }
 declare const ObjectDependency: MessageFns$1<ObjectDependency>;
+/** Policy for outbound traffic from a sandbox. */
+interface OutboundPolicy {
+    /** Replace headers in outbound HTTPS requests, potentially with secret values. */
+    headerReplacements: OutboundPolicy_HeaderReplacement[];
+}
+declare const OutboundPolicy: MessageFns$1<OutboundPolicy>;
+interface OutboundPolicy_HeaderReplacement {
+    /**
+     * Domain that the header replacement is scoped to. Supports wildcards in
+     * subdomain positions.
+     */
+    domain: string;
+    /** Header name to replace. */
+    headerName: string;
+    /**
+     * Header value to replace.
+     *
+     * Supports templating with keys in a given secret_id: a $-prefixed key
+     * name in the secret will be replaced with the secret value. Literal $
+     * characters can be represented by two dollars: `$$`.
+     */
+    headerValue: string;
+    /**
+     * Reference to a secret to use in the header_value template. Can be empty
+     * if no secret value is used in header_value.
+     */
+    secretId: string;
+}
+declare const OutboundPolicy_HeaderReplacement: MessageFns$1<OutboundPolicy_HeaderReplacement>;
 interface PTYInfo {
     /** Soon deprecated */
     enabled: boolean;
@@ -3249,8 +3570,30 @@ interface Sandbox$1 {
      */
     inboundCidrAllowlist: string[];
     environmentVariables: StringMap | undefined;
+    outboundPolicy?: OutboundPolicy | undefined;
 }
 declare const Sandbox$1: MessageFns$1<Sandbox$1>;
+interface SandboxContainerCreateV2Request {
+    /** Sandbox the container joins; it runs inside that sandbox's task. */
+    sandboxId: string;
+    /** Logical container name, unique within the sandbox. */
+    containerName: string;
+    /**
+     * Same definition type as SandboxCreateV2. Fields a container cannot honor
+     * (resources, timeouts, scheduling constraints, ...) are rejected.
+     */
+    definition: Sandbox$1 | undefined;
+    ephemeralSecrets: StringMap | undefined;
+    cloudBucketMountCredentials: {
+        [key: string]: StringMap;
+    };
+}
+declare const SandboxContainerCreateV2Request: MessageFns$1<SandboxContainerCreateV2Request>;
+interface SandboxContainerCreateV2Response {
+    containerId: string;
+    containerName: string;
+}
+declare const SandboxContainerCreateV2Response: MessageFns$1<SandboxContainerCreateV2Response>;
 interface SandboxCreateConnectTokenRequest {
     sandboxId: string;
     userMetadata: string;
@@ -3273,6 +3616,7 @@ interface SandboxCreateRequest {
 declare const SandboxCreateRequest: MessageFns$1<SandboxCreateRequest>;
 interface SandboxCreateResponse {
     sandboxId: string;
+    metadata: SandboxHandleMetadata | undefined;
 }
 declare const SandboxCreateResponse: MessageFns$1<SandboxCreateResponse>;
 interface SandboxCreateV2Request {
@@ -3280,12 +3624,17 @@ interface SandboxCreateV2Request {
     definition: Sandbox$1 | undefined;
     ephemeralSecrets: StringMap | undefined;
     tags: SandboxTag[];
+    cloudBucketMountCredentials: {
+        [key: string]: StringMap;
+    };
 }
 declare const SandboxCreateV2Request: MessageFns$1<SandboxCreateV2Request>;
 interface SandboxCreateV2Response {
     sandboxId: string;
     tunnels: TunnelData[];
     taskId: string;
+    metadata: SandboxHandleMetadata | undefined;
+    commandRouterAccess: CommandRouterAccess$1 | undefined;
 }
 declare const SandboxCreateV2Response: MessageFns$1<SandboxCreateV2Response>;
 /**
@@ -3308,6 +3657,29 @@ interface SandboxGetCommandRouterAccessResponse {
     workerIpv4Address: string;
 }
 declare const SandboxGetCommandRouterAccessResponse: MessageFns$1<SandboxGetCommandRouterAccessResponse>;
+interface SandboxGetExitSnapshotRequest {
+    sandboxId: string;
+    timeout: number;
+}
+declare const SandboxGetExitSnapshotRequest: MessageFns$1<SandboxGetExitSnapshotRequest>;
+interface SandboxGetExitSnapshotResponse {
+    success?: SandboxGetExitSnapshotResponse_Success | undefined;
+    pending?: SandboxGetExitSnapshotResponse_Pending | undefined;
+    error?: SandboxGetExitSnapshotResponse_Error | undefined;
+}
+declare const SandboxGetExitSnapshotResponse: MessageFns$1<SandboxGetExitSnapshotResponse>;
+interface SandboxGetExitSnapshotResponse_Success {
+    imageId: string;
+}
+declare const SandboxGetExitSnapshotResponse_Success: MessageFns$1<SandboxGetExitSnapshotResponse_Success>;
+interface SandboxGetExitSnapshotResponse_Pending {
+}
+declare const SandboxGetExitSnapshotResponse_Pending: MessageFns$1<SandboxGetExitSnapshotResponse_Pending>;
+interface SandboxGetExitSnapshotResponse_Error {
+    errorCode: SandboxGetExitSnapshotResponse_ErrorCode;
+    message: string;
+}
+declare const SandboxGetExitSnapshotResponse_Error: MessageFns$1<SandboxGetExitSnapshotResponse_Error>;
 interface SandboxGetFromNameRequest {
     sandboxName: string;
     environmentName: string;
@@ -3316,6 +3688,7 @@ interface SandboxGetFromNameRequest {
 declare const SandboxGetFromNameRequest: MessageFns$1<SandboxGetFromNameRequest>;
 interface SandboxGetFromNameResponse {
     sandboxId: string;
+    metadata: SandboxHandleMetadata | undefined;
 }
 declare const SandboxGetFromNameResponse: MessageFns$1<SandboxGetFromNameResponse>;
 interface SandboxGetLogsRequest {
@@ -3363,6 +3736,7 @@ interface SandboxGetTunnelsResponse {
 declare const SandboxGetTunnelsResponse: MessageFns$1<SandboxGetTunnelsResponse>;
 interface SandboxHandleMetadata {
     result: GenericResult | undefined;
+    appId: string;
 }
 declare const SandboxHandleMetadata: MessageFns$1<SandboxHandleMetadata>;
 interface SandboxInfo {
@@ -3381,6 +3755,7 @@ interface SandboxInfo {
     readyAt?: number | undefined;
     readinessProbe?: Probe$1 | undefined;
     tunnels: TunnelData[];
+    metadata: SandboxHandleMetadata | undefined;
 }
 declare const SandboxInfo: MessageFns$1<SandboxInfo>;
 interface SandboxListRequest {
@@ -3409,6 +3784,30 @@ interface SandboxRestoreResponse {
     sandboxId: string;
 }
 declare const SandboxRestoreResponse: MessageFns$1<SandboxRestoreResponse>;
+interface SandboxRestoreV2Request {
+    snapshotId: string;
+    sandboxNameOverride: string;
+    sandboxNameOverrideType: SandboxRestoreRequest_SandboxNameOverrideType;
+    /** For internal debugging use only. */
+    workerId: string;
+}
+declare const SandboxRestoreV2Request: MessageFns$1<SandboxRestoreV2Request>;
+interface SandboxRestoreV2Response {
+    sandboxId: string;
+    tunnels: TunnelData[];
+    taskId: string;
+    metadata: SandboxHandleMetadata | undefined;
+    commandRouterAccess: CommandRouterAccess$1 | undefined;
+}
+declare const SandboxRestoreV2Response: MessageFns$1<SandboxRestoreV2Response>;
+interface SandboxSetNameRequest {
+    sandboxId: string;
+    name: string;
+}
+declare const SandboxSetNameRequest: MessageFns$1<SandboxSetNameRequest>;
+interface SandboxSetNameResponse {
+}
+declare const SandboxSetNameResponse: MessageFns$1<SandboxSetNameResponse>;
 interface SandboxSnapshotFsAsyncGetRequest {
     imageId: string;
     timeout: number;
@@ -3440,8 +3839,13 @@ interface SandboxSnapshotGetRequest {
 declare const SandboxSnapshotGetRequest: MessageFns$1<SandboxSnapshotGetRequest>;
 interface SandboxSnapshotGetResponse {
     snapshotId: string;
+    handleMetadata: SandboxSnapshotHandleMetadata | undefined;
 }
 declare const SandboxSnapshotGetResponse: MessageFns$1<SandboxSnapshotGetResponse>;
+interface SandboxSnapshotHandleMetadata {
+    isV2: boolean;
+}
+declare const SandboxSnapshotHandleMetadata: MessageFns$1<SandboxSnapshotHandleMetadata>;
 interface SandboxSnapshotRequest {
     sandboxId: string;
 }
@@ -3503,6 +3907,7 @@ interface SandboxWaitRequest {
 declare const SandboxWaitRequest: MessageFns$1<SandboxWaitRequest>;
 interface SandboxWaitResponse {
     result: GenericResult | undefined;
+    metadata: SandboxHandleMetadata | undefined;
 }
 declare const SandboxWaitResponse: MessageFns$1<SandboxWaitResponse>;
 interface SandboxWaitUntilReadyRequest {
@@ -3708,6 +4113,18 @@ interface SharedVolumeRemoveFileRequest {
     recursive: boolean;
 }
 declare const SharedVolumeRemoveFileRequest: MessageFns$1<SharedVolumeRemoveFileRequest>;
+interface StatsPercentile {
+    /** The percentile expressed in basis points: 5000 is p50 and 9990 is p99.9. */
+    percentileBasisPoints: number;
+    value: number;
+}
+declare const StatsPercentile: MessageFns$1<StatsPercentile>;
+interface StatsPercentileDistribution {
+    /** Unit identifier such as "seconds", "cores", "gibibytes", or "fraction". */
+    unit: string;
+    percentiles: StatsPercentile[];
+}
+declare const StatsPercentileDistribution: MessageFns$1<StatsPercentileDistribution>;
 interface StringMap {
     contents: {
         [key: string]: string;
@@ -3723,7 +4140,6 @@ interface TaskClusterHelloRequest {
     taskId: string;
     containerIp: string;
     imexHostIp: string;
-    imexFabricId: string;
 }
 declare const TaskClusterHelloRequest: MessageFns$1<TaskClusterHelloRequest>;
 interface TaskClusterHelloResponse {
@@ -3737,6 +4153,8 @@ interface TaskClusterHelloResponse {
      * and otherwise absent on non-NVL72 systems
      */
     imexPeerIps: string[];
+    /** GPU-memory-fabric labels, ordered by cluster rank */
+    fabricIds: string[];
 }
 declare const TaskClusterHelloResponse: MessageFns$1<TaskClusterHelloResponse>;
 interface TaskCurrentInputsResponse {
@@ -3796,7 +4214,7 @@ interface TaskLogs {
     taskProgress: TaskProgress | undefined;
     functionCallId: string;
     inputId: string;
-    timestampNs: number;
+    timestampNs: string;
     containerId: string;
     containerName: string;
 }
@@ -3944,6 +4362,12 @@ interface UploadUrlList {
     items: string[];
 }
 declare const UploadUrlList: MessageFns$1<UploadUrlList>;
+interface UserGroupEnvironmentSetRequest {
+    environmentId: string;
+    userGroupId: string;
+    role: EnvironmentRole;
+}
+declare const UserGroupEnvironmentSetRequest: MessageFns$1<UserGroupEnvironmentSetRequest>;
 interface UserIdentity {
     userId: string;
     username: string;
@@ -4008,6 +4432,11 @@ interface VolumeGetFile2Request {
     start: number;
     /** 0 is interpreted as 'read to end' */
     len: number;
+    /**
+     * The client extends each block body it downloads with zero bytes up to the
+     * block's expected length, so responses may omit trailing zero bytes.
+     */
+    clientPadsBlocks: boolean;
 }
 declare const VolumeGetFile2Request: MessageFns$1<VolumeGetFile2Request>;
 interface VolumeGetFile2Response {
@@ -4286,6 +4715,23 @@ interface WebhookTokenListResponse {
     tokens: WebhookToken[];
 }
 declare const WebhookTokenListResponse: MessageFns$1<WebhookTokenListResponse>;
+interface WorkspaceBillingRatesRequest {
+}
+declare const WorkspaceBillingRatesRequest: MessageFns$1<WorkspaceBillingRatesRequest>;
+interface WorkspaceBillingRatesResponse {
+    /** compute rates are per unit per hour, storage rate is per GiB-month */
+    rates: {
+        [key: string]: string;
+    };
+    deprecationWarnings: {
+        [key: string]: string;
+    };
+    deprecationErrors: {
+        [key: string]: string;
+    };
+    formatted: string;
+}
+declare const WorkspaceBillingRatesResponse: MessageFns$1<WorkspaceBillingRatesResponse>;
 interface WorkspaceBillingReportItem {
     objectId: string;
     description: string;
@@ -4312,23 +4758,23 @@ interface WorkspaceBillingReportRequest {
 }
 declare const WorkspaceBillingReportRequest: MessageFns$1<WorkspaceBillingReportRequest>;
 interface WorkspaceBillingSummaryRequest {
+    /** all query intervals are implicitly one month long (to line up with billing cycles) */
     startTimestamp: Date | undefined;
-    endTimestamp: Date | undefined;
 }
 declare const WorkspaceBillingSummaryRequest: MessageFns$1<WorkspaceBillingSummaryRequest>;
 interface WorkspaceBillingSummaryResponse {
     startTimestamp: Date | undefined;
     endTimestamp: Date | undefined;
     meteredCost: string;
-    planCost: string;
-    creditsApplied: string;
-    reservationsDiscount: string;
-    volumesDiscount: string;
     billedCost: string;
-    /** keyed by deployed, ephemeral, volume, notebook */
+    /** keyed by deployed, ephemeral, volume, notebook, tokens */
     meteredCostBreakdown: {
         [key: string]: string;
     };
+    /** keyed by plan, credits, reservations, storage */
+    adjustments: {
+        [key: string]: string;
+    };
 }
 declare const WorkspaceBillingSummaryResponse: MessageFns$1<WorkspaceBillingSummaryResponse>;
 interface WorkspaceDashboardUrlRequest {
@@ -4442,6 +4888,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly appGetInfo: {
+            readonly name: "AppGetInfo";
+            readonly requestType: MessageFns$1<AppGetInfoRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<AppGetInfoResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly appGetLayout: {
             readonly name: "AppGetLayout";
             readonly requestType: MessageFns$1<AppGetLayoutRequest>;
@@ -4514,6 +4968,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly appPromote: {
+            readonly name: "AppPromote";
+            readonly requestType: MessageFns$1<AppPromoteRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<AppPromoteResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly appPublish: {
             readonly name: "AppPublish";
             readonly requestType: MessageFns$1<AppPublishRequest>;
@@ -4982,6 +5444,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly environmentGetRoles: {
+            readonly name: "EnvironmentGetRoles";
+            readonly requestType: MessageFns$1<EnvironmentGetRolesRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<EnvironmentGetRolesResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly environmentList: {
             readonly name: "EnvironmentList";
             readonly requestType: MessageFns$2<Empty>;
@@ -5006,6 +5476,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly environmentSetDefaultMemberRole: {
+            readonly name: "EnvironmentSetDefaultMemberRole";
+            readonly requestType: MessageFns$1<EnvironmentSetDefaultMemberRoleRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$2<Empty>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly environmentSetManaged: {
             readonly name: "EnvironmentSetManaged";
             readonly requestType: MessageFns$1<EnvironmentSetManagedRequest>;
@@ -5104,6 +5582,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: true;
             readonly options: {};
         };
+        readonly functionCallGetInfo: {
+            readonly name: "FunctionCallGetInfo";
+            readonly requestType: MessageFns$1<FunctionCallGetInfoRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<FunctionCallGetInfoResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly functionCallList: {
             readonly name: "FunctionCallList";
             readonly requestType: MessageFns$1<FunctionCallListRequest>;
@@ -5145,6 +5631,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly functionGetById: {
+            readonly name: "FunctionGetById";
+            readonly requestType: MessageFns$1<FunctionGetByIdRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<FunctionGetByIdResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly functionGetCallGraph: {
             readonly name: "FunctionGetCallGraph";
             readonly requestType: MessageFns$1<FunctionGetCallGraphRequest>;
@@ -5169,6 +5663,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly functionGetFlashAuthToken: {
+            readonly name: "FunctionGetFlashAuthToken";
+            readonly requestType: MessageFns$1<FunctionGetFlashAuthTokenRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<FunctionGetFlashAuthTokenResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         /** For containers to request next call */
         readonly functionGetInputs: {
             readonly name: "FunctionGetInputs";
@@ -5195,6 +5697,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly functionGetTimeRangeStats: {
+            readonly name: "FunctionGetTimeRangeStats";
+            readonly requestType: MessageFns$1<FunctionGetTimeRangeStatsRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<FunctionGetTimeRangeStatsResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly functionMap: {
             readonly name: "FunctionMap";
             readonly requestType: MessageFns$1<FunctionMapRequest>;
@@ -5253,6 +5763,14 @@ declare const ModalClientDefinition: {
             readonly options: {};
         };
         /** Images */
+        readonly imageBuildChainGet: {
+            readonly name: "ImageBuildChainGet";
+            readonly requestType: MessageFns$1<ImageBuildChainGetRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<ImageBuildChainGetResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly imageDelete: {
             readonly name: "ImageDelete";
             readonly requestType: MessageFns$1<ImageDeleteRequest>;
@@ -5515,6 +6033,14 @@ declare const ModalClientDefinition: {
             readonly options: {};
         };
         /** Sandboxes */
+        readonly sandboxContainerCreateV2: {
+            readonly name: "SandboxContainerCreateV2";
+            readonly requestType: MessageFns$1<SandboxContainerCreateV2Request>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<SandboxContainerCreateV2Response>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly sandboxCreate: {
             readonly name: "SandboxCreate";
             readonly requestType: MessageFns$1<SandboxCreateRequest>;
@@ -5531,6 +6057,14 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly sandboxCreateConnectTokenV2: {
+            readonly name: "SandboxCreateConnectTokenV2";
+            readonly requestType: MessageFns$1<SandboxCreateConnectTokenRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<SandboxCreateConnectTokenResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly sandboxCreateV2: {
             readonly name: "SandboxCreateV2";
             readonly requestType: MessageFns$1<SandboxCreateV2Request>;
@@ -5547,6 +6081,22 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly sandboxGetExitSnapshot: {
+            readonly name: "SandboxGetExitSnapshot";
+            readonly requestType: MessageFns$1<SandboxGetExitSnapshotRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<SandboxGetExitSnapshotResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
+        readonly sandboxGetExitSnapshotV2: {
+            readonly name: "SandboxGetExitSnapshotV2";
+            readonly requestType: MessageFns$1<SandboxGetExitSnapshotRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<SandboxGetExitSnapshotResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly sandboxGetFromName: {
             readonly name: "SandboxGetFromName";
             readonly requestType: MessageFns$1<SandboxGetFromNameRequest>;
@@ -5636,6 +6186,22 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        readonly sandboxRestoreV2: {
+            readonly name: "SandboxRestoreV2";
+            readonly requestType: MessageFns$1<SandboxRestoreV2Request>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<SandboxRestoreV2Response>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
+        readonly sandboxSetName: {
+            readonly name: "SandboxSetName";
+            readonly requestType: MessageFns$1<SandboxSetNameRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<SandboxSetNameResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly sandboxSnapshot: {
             readonly name: "SandboxSnapshot";
             readonly requestType: MessageFns$1<SandboxSnapshotRequest>;
@@ -5979,6 +6545,15 @@ declare const ModalClientDefinition: {
             readonly responseStream: false;
             readonly options: {};
         };
+        /** User groups */
+        readonly userGroupEnvironmentSet: {
+            readonly name: "UserGroupEnvironmentSet";
+            readonly requestType: MessageFns$1<UserGroupEnvironmentSetRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$2<Empty>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         /** Volumes */
         readonly volumeCommit: {
             readonly name: "VolumeCommit";
@@ -6182,6 +6757,14 @@ declare const ModalClientDefinition: {
             readonly options: {};
         };
         /** Workspaces */
+        readonly workspaceBillingRates: {
+            readonly name: "WorkspaceBillingRates";
+            readonly requestType: MessageFns$1<WorkspaceBillingRatesRequest>;
+            readonly requestStream: false;
+            readonly responseType: MessageFns$1<WorkspaceBillingRatesResponse>;
+            readonly responseStream: false;
+            readonly options: {};
+        };
         readonly workspaceBillingReport: {
             readonly name: "WorkspaceBillingReport";
             readonly requestType: MessageFns$1<WorkspaceBillingReportRequest>;
@@ -6373,7 +6956,228 @@ declare class CloudBucketMount {
     toProto(mountPath: string): CloudBucketMount$1;
 }
 
-/**
+type LogSource = "system" | "stdout" | "stderr";
+interface LogEntry {
+    readonly message: string;
+    readonly source: LogSource;
+    readonly timestamp: Date;
+    readonly objectId: string;
+    readonly contextIds: string[];
+}
+interface FunctionLogFetchParams {
+    /** Start of the UTC time range. */
+    since: Date;
+    /** End of the UTC time range. Defaults to the current time. */
+    until?: Date;
+    /** Filter by source: `stdout`, `stderr`, or `system`. */
+    source?: LogSource;
+    /** Filter by text contained in the log message. */
+    searchText?: string;
+}
+interface FunctionLogTailParams {
+    /** Number of log entries to return. Defaults to 100. */
+    entries?: number;
+    /** Filter by source: `stdout`, `stderr`, or `system`. */
+    source?: LogSource;
+}
+interface FunctionCallLogTailParams {
+    /** Number of log entries to return. Defaults to 100. */
+    entries?: number;
+    /** Filter by source: `stdout`, `stderr`, or `system`. */
+    source?: LogSource;
+}
+type LogTailParams = FunctionCallLogTailParams | FunctionLogTailParams;
+interface FunctionLogStreamParams {
+    /**
+     * Number of milliseconds to wait between log entries before ending the
+     * stream. By default, the stream blocks until it is interrupted.
+     */
+    timeoutMs?: number;
+}
+interface FunctionCallLogStreamParams {
+    /**
+     * Number of milliseconds to wait between log entries before ending the
+     * stream. By default, the stream blocks until it is interrupted.
+     */
+    timeoutMs?: number;
+}
+type LogStreamParams = FunctionCallLogStreamParams | FunctionLogStreamParams;
+interface FunctionCallLogFetchParams {
+    /**
+     * Start of the UTC time range. Defaults to the start of the FunctionCall.
+     */
+    since?: Date;
+    /** End of the UTC time range. Defaults to the current time. */
+    until?: Date;
+    /** Filter by source: `stdout`, `stderr`, or `system`. */
+    source?: LogSource;
+    /** Filter by text contained in the log message. */
+    searchText?: string;
+}
+interface FunctionLogs {
+    fetch(params: FunctionLogFetchParams): AsyncIterable<LogEntry>;
+    tail(params?: FunctionLogTailParams): AsyncIterable<LogEntry>;
+    stream(params?: FunctionLogStreamParams): AsyncIterable<LogEntry>;
+}
+interface FunctionCallLogs extends Omit<FunctionLogs, "fetch"> {
+    fetch(params?: FunctionCallLogFetchParams): AsyncIterable<LogEntry>;
+    tail(params?: FunctionCallLogTailParams): AsyncIterable<LogEntry>;
+    stream(params?: FunctionCallLogStreamParams): AsyncIterable<LogEntry>;
+}
+interface LogQueryParams {
+    client: ModalClient;
+    objectId: string;
+    appId: string;
+    functionId: string;
+    functionCallId: string;
+}
+declare class LogsManager {
+    protected readonly params: LogQueryParams;
+    constructor(params: LogQueryParams);
+    fetch(params: FunctionLogFetchParams): AsyncIterable<LogEntry>;
+    tail(params?: LogTailParams): AsyncIterable<LogEntry>;
+    stream(params?: LogStreamParams): AsyncIterable<LogEntry>;
+}
+/** Namespace for Function log APIs. */
+declare class FunctionLogsManager extends LogsManager implements FunctionLogs {
+    /** @ignore */
+    constructor(client: ModalClient, objectId: string, appId: string);
+    /**
+     * Fetch Function logs corresponding to a UTC time range and optional
+     * filters.
+     *
+     * Entries are returned in chronological order.
+     *
+     * @returns An async iterable of {@link LogEntry} objects.
+     *
+     * @example
+     * ```typescript
+     * import { ModalClient } from "modal";
+     *
+     * const modal = new ModalClient();
+     * const function_ = await modal.functions.fromName("my-app", "train");
+     *
+     * for await (const entry of function_.logs.fetch({
+     *   since: new Date(Date.now() - 4 * 60 * 60 * 1_000),
+     *   source: "stdout",
+     * })) {
+     *   process.stdout.write(entry.message);
+     * }
+     * ```
+     */
+    fetch(params: FunctionLogFetchParams): AsyncIterable<LogEntry>;
+    /**
+     * Fetch the most recent Function logs.
+     *
+     * Entries are returned in chronological order.
+     *
+     * @returns An async iterable of {@link LogEntry} objects.
+     *
+     * @example
+     * ```typescript
+     * import { ModalClient } from "modal";
+     *
+     * const modal = new ModalClient();
+     * const function_ = await modal.functions.fromName("my-app", "train");
+     *
+     * for await (const entry of function_.logs.tail({ entries: 20 })) {
+     *   process.stdout.write(entry.message);
+     * }
+     * ```
+     */
+    tail(params?: FunctionLogTailParams): AsyncIterable<LogEntry>;
+    /**
+     * Stream new Function logs until the timeout is reached.
+     *
+     * @returns An async iterable of {@link LogEntry} objects as they arrive.
+     *
+     * @example
+     * ```typescript
+     * import { ModalClient } from "modal";
+     *
+     * const modal = new ModalClient();
+     * const function_ = await modal.functions.fromName("my-app", "train");
+     *
+     * for await (const entry of function_.logs.stream({ timeoutMs: 60_000 })) {
+     *   process.stdout.write(entry.message);
+     * }
+     * ```
+     */
+    stream(params?: FunctionLogStreamParams): AsyncIterable<LogEntry>;
+}
+/** Namespace for FunctionCall log APIs. */
+declare class FunctionCallLogsManager extends LogsManager implements FunctionCallLogs {
+    constructor(client: ModalClient, objectId: string, appId: string, functionId: string);
+    /**
+     * Fetch logs associated with this FunctionCall corresponding to a UTC time
+     * range and optional filters.
+     *
+     * When `since` is omitted, logs are fetched from the start of the
+     * FunctionCall. Entries are returned in chronological order.
+     *
+     * @returns An async iterable of {@link LogEntry} objects.
+     *
+     * @example
+     * ```typescript
+     * import { ModalClient } from "modal";
+     *
+     * const modal = new ModalClient();
+     * const function_ = await modal.functions.fromName("my-app", "train");
+     * const call = await function_.spawn([]);
+     *
+     * for await (const entry of call.logs.fetch()) {
+     *   console.log(entry.timestamp, entry.message);
+     * }
+     * ```
+     */
+    fetch(params?: FunctionCallLogFetchParams): AsyncIterable<LogEntry>;
+    /**
+     * Fetch the most recent FunctionCall logs.
+     *
+     * Entries are returned in chronological order.
+     *
+     * @returns An async iterable of {@link LogEntry} objects.
+     *
+     * @example
+     * ```typescript
+     * import { ModalClient } from "modal";
+     *
+     * const modal = new ModalClient();
+     * const function_ = await modal.functions.fromName("my-app", "train");
+     * const call = await function_.spawn([]);
+     *
+     * for await (const entry of call.logs.tail({ entries: 10 })) {
+     *   console.log(entry.timestamp, entry.message);
+     * }
+     * ```
+     */
+    tail(params?: FunctionCallLogTailParams): AsyncIterable<LogEntry>;
+    /**
+     * Stream new FunctionCall logs until the timeout is reached or the
+     * FunctionCall is observed to have completed.
+     *
+     * The completion check is best-effort. If completion cannot be determined,
+     * the stream continues until the timeout is reached.
+     *
+     * @returns An async iterable of {@link LogEntry} objects as they arrive.
+     *
+     * @example
+     * ```typescript
+     * import { ModalClient } from "modal";
+     *
+     * const modal = new ModalClient();
+     * const function_ = await modal.functions.fromName("my-app", "train");
+     * const call = await function_.spawn([]);
+     *
+     * for await (const entry of call.logs.stream()) {
+     *   process.stdout.write(entry.message);
+     * }
+     * ```
+     */
+    stream(params?: FunctionCallLogStreamParams): AsyncIterable<LogEntry>;
+}
+
+/**
  * Service for managing {@link FunctionCall}s.
  *
  * Normally only ever accessed via the client as:
@@ -6408,11 +7212,23 @@ declare class FunctionCall {
     #private;
     readonly functionCallId: string;
     /** @ignore */
-    constructor(client: ModalClient, functionCallId: string);
+    constructor(client: ModalClient, functionCallId: string, appId: string, functionId: string);
     /** Get the result of a FunctionCall, optionally waiting with a timeout. */
     get(params?: FunctionCallGetParams): Promise<any>;
     /** Cancel a running FunctionCall. */
     cancel(params?: FunctionCallCancelParams): Promise<void>;
+    /**
+     * Access logs for this FunctionCall.
+     *
+     * Use {@link FunctionCallLogsManager#fetch fetch()} to read logs from a UTC
+     * time range, {@link FunctionCallLogsManager#tail tail()} to read the most
+     * recent logs, and {@link FunctionCallLogsManager#stream stream()} to follow
+     * new logs as they arrive.
+     *
+     * See also: [`modal app logs`](https://modal.com/docs/cli/latest/app#modal-app-logs)
+     * for CLI access to logs for an App.
+     */
+    get logs(): FunctionCallLogsManager;
 }
 
 type HeartbeatFunction = () => Promise<any>;
@@ -6549,6 +7365,12 @@ interface FunctionUpdateAutoscalerParams {
     bufferContainers?: number;
     scaledownWindowMs?: number;
 }
+type FunctionAutoscalerSettings = {
+    minContainers?: number;
+    maxContainers?: number;
+    bufferContainers?: number;
+    scaledownWindowMs?: number;
+};
 /** Configuration options for {@link Function_#withOptions Function_.withOptions()}. */
 type FunctionWithOptionsParams = {
     cpu?: number;
@@ -6590,6 +7412,18 @@ declare class Function_ {
     readonly methodName?: string;
     /** @ignore */
     constructor(client: ModalClient, functionId: string, methodName?: string, functionHandleMetadata?: FunctionHandleMetadata, options?: FunctionOptions);
+    /**
+     * Access logs for this Function.
+     *
+     * Use {@link FunctionLogsManager#fetch fetch()} to read logs from a UTC time
+     * range, {@link FunctionLogsManager#tail tail()} to read the most recent
+     * logs, and {@link FunctionLogsManager#stream stream()} to follow new logs as
+     * they arrive.
+     *
+     * See also: [`modal app logs`](https://modal.com/docs/cli/latest/app#modal-app-logs)
+     * for CLI access to logs for an App.
+     */
+    get logs(): FunctionLogsManager;
     /** Override the static Function configuration at runtime. */
     withOptions(options: FunctionWithOptionsParams): Function_;
     /** Override the static Function concurrency configuration at runtime. */
@@ -6603,7 +7437,7 @@ declare class Function_ {
     remote(args?: any[], kwargs?: Record<string, any>): Promise<any>;
     spawn(args?: any[], kwargs?: Record<string, any>): Promise<FunctionCall>;
     getCurrentStats(): Promise<FunctionStats>;
-    updateAutoscaler(params: FunctionUpdateAutoscalerParams): Promise<void>;
+    updateAutoscaler(params: FunctionUpdateAutoscalerParams): Promise<FunctionAutoscalerSettings>;
     /**
      * URL for addressing the Web Function via HTTP.
      * @returns The web URL, or undefined if this is not a Web Function
@@ -6972,6 +7806,14 @@ declare enum TaskExecStdoutConfig {
     TASK_EXEC_STDOUT_CONFIG_PIPE = 1,
     UNRECOGNIZED = -1
 }
+interface SandboxStdinWriteV2Response {
+}
+declare const SandboxStdinWriteV2Response: MessageFns<SandboxStdinWriteV2Response>;
+interface SandboxStdioReadV2Response {
+    data: Uint8Array;
+    startingOffset: number;
+}
+declare const SandboxStdioReadV2Response: MessageFns<SandboxStdioReadV2Response>;
 interface SandboxWaitUntilReadyTcrResponse {
     readyAt: number;
 }
@@ -6990,6 +7832,14 @@ interface TaskContainerCreateRequest {
     secretIds: string[];
     /** Volumes to mount into the container. */
     volumeMounts: VolumeMount[];
+    /**
+     * Outbound network policy for the sidecar, independent of the main
+     * container. When unset, defaults to open network access. BLOCKED is not
+     * accepted: a blocked sidecar has no IP and cannot reach the main container.
+     */
+    networkAccess?: NetworkAccess | undefined;
+    /** Optional PTY info for sidecar. */
+    ptyInfo?: PTYInfo | undefined;
 }
 declare const TaskContainerCreateRequest: MessageFns<TaskContainerCreateRequest>;
 interface TaskContainerCreateResponse {
@@ -7095,6 +7945,17 @@ declare const TaskExecStartRequest: MessageFns<TaskExecStartRequest>;
 interface TaskExecStartResponse {
 }
 declare const TaskExecStartResponse: MessageFns<TaskExecStartResponse>;
+interface TaskExecStdinStatusResponse {
+    /**
+     * Number of bytes the server has accepted for this exec so far.
+     * A streaming client that lost its connection should resume sending at this
+     * offset.
+     */
+    numBytesWritten: number;
+    /** True if stdin has already been closed (EOF sent) for this exec. */
+    closed: boolean;
+}
+declare const TaskExecStdinStatusResponse: MessageFns<TaskExecStdinStatusResponse>;
 interface TaskExecStdinWriteResponse {
 }
 declare const TaskExecStdinWriteResponse: MessageFns<TaskExecStdinWriteResponse>;
@@ -7119,10 +7980,14 @@ interface TaskMountDirectoryRequest {
      * This key is not persisted by Modal.
      */
     customerSuppliedEncryptionKey?: Uint8Array | undefined;
+    /** Fully qualified target container ID. Empty targets the main container. */
+    containerId: string;
 }
 declare const TaskMountDirectoryRequest: MessageFns<TaskMountDirectoryRequest>;
 interface TaskReloadVolumesRequest {
     taskId: string;
+    /** Fully qualified target container ID. Empty targets the main container. */
+    containerId: string;
 }
 declare const TaskReloadVolumesRequest: MessageFns<TaskReloadVolumesRequest>;
 interface TaskSetNetworkAccessRequest {
@@ -7158,6 +8023,8 @@ interface TaskSnapshotDirectoryRequest {
      * metadata keys. This key is not persisted by Modal.
      */
     customerSuppliedEncryptionKey?: Uint8Array | undefined;
+    /** Fully qualified target container ID. Empty targets the main container. */
+    containerId: string;
 }
 declare const TaskSnapshotDirectoryRequest: MessageFns<TaskSnapshotDirectoryRequest>;
 interface TaskSnapshotDirectoryResponse {
@@ -7183,15 +8050,28 @@ interface TaskSnapshotFilesystemRequest {
      * metadata keys. This key is not persisted by Modal.
      */
     customerSuppliedEncryptionKey?: Uint8Array | undefined;
+    /** Fully qualified target container ID. Empty targets the main container. */
+    containerId: string;
 }
 declare const TaskSnapshotFilesystemRequest: MessageFns<TaskSnapshotFilesystemRequest>;
 interface TaskSnapshotFilesystemResponse {
     imageId: string;
 }
 declare const TaskSnapshotFilesystemResponse: MessageFns<TaskSnapshotFilesystemResponse>;
+interface TaskSnapshotMemoryRequest {
+    taskId: string;
+    idempotencyKey: string;
+}
+declare const TaskSnapshotMemoryRequest: MessageFns<TaskSnapshotMemoryRequest>;
+interface TaskSnapshotMemoryResponse {
+    snapshotId: string;
+}
+declare const TaskSnapshotMemoryResponse: MessageFns<TaskSnapshotMemoryResponse>;
 interface TaskUnmountDirectoryRequest {
     taskId: string;
     path: Uint8Array;
+    /** Fully qualified target container ID. Empty targets the main container. */
+    containerId: string;
 }
 declare const TaskUnmountDirectoryRequest: MessageFns<TaskUnmountDirectoryRequest>;
 type Builtin = Date | Function | Uint8Array | string | number | boolean | undefined;
@@ -7220,17 +8100,83 @@ interface Profile {
     serverUrl: string;
     tokenId?: string;
     tokenSecret?: string;
+    oauthRefreshToken?: string;
+    oauthClientId?: string;
+    oauthClientSecret?: string;
+    oauthJwtKey?: string;
     environment?: string;
     imageBuilderVersion?: string;
     logLevel?: string;
     /** Parsed from MODAL_MAX_THROTTLE_WAIT. null means unlimited. */
     maxThrottleWaitSecs?: number;
+    /**
+     * How long a Sandbox connection may sit idle before the client gives it up.
+     * The Sandbox stays usable: the next operation reconnects. Zero keeps
+     * connections open until the client closes.
+     */
+    sandboxChannelIdleTimeoutMs: number;
+    /**
+     * Set by the MODAL_SANDBOX_V2 environment variable or the sandbox_v2
+     * profile key in .modal.toml.
+     */
+    sandboxV2: boolean;
 }
 
+/**
+ * @internal
+ * @hidden
+ */
+type CommandRouterAccess = {
+    url: string;
+    jwt: string;
+};
+/**
+ * Seekable byte source for streaming stdin uploads.
+ *
+ * @internal
+ * @hidden
+ */
+interface StdinSource {
+    /**
+     * Return a fresh iterable over the source's bytes starting at `offset`,
+     * so an upload can resume mid-stream after a transient failure.
+     */
+    readFrom(offset: number): AsyncIterable<Uint8Array>;
+}
 /** @ignore */
 declare class TaskCommandRouterClientImpl {
     private stub;
+    /**
+     * The connection, absent while it is released. It is dialled again by the
+     * next operation, so nothing may hold `stub` across one.
+     */
     private channel;
+    private dial;
+    private factory;
+    /**
+     * How many operations are using the connection. A count rather than a flag
+     * because operations overlap: only the last one out starts the idle clock.
+     */
+    private inFlight;
+    private idle;
+    /**
+     * Bumped every time a connection is dialled. A stream opened on an earlier
+     * one is stale: the connection under it has since been given up.
+     */
+    private generation;
+    /**
+     * Streams open right now, tracked so they can be ended on release.
+     *
+     * grpc-js does not cancel a call in flight when its channel is closed, and a
+     * subchannel with a live call on it is never collected - so closing alone
+     * leaves the socket up. Aborting the calls first is what actually frees it.
+     */
+    private liveStreams;
+    /**
+     * How long the client may go unused before its connection is given up. Zero
+     * keeps it up until the client is closed. Overridable in tests.
+     */
+    idleTimeoutMs: number;
     private serverClient;
     private taskId;
     private sandboxId;
@@ -7241,9 +8187,36 @@ declare class TaskCommandRouterClientImpl {
     private jwtRefreshLock;
     private logger;
     private closed;
-    static tryInit(serverClient: ModalGrpcClient, taskId: string, sandboxId: string, isV2: boolean, logger: Logger, profile: Profile): Promise<TaskCommandRouterClientImpl | null>;
-    private constructor();
+    private draining;
+    /**
+     * `access` is the router access returned by SandboxCreateV2, which lets a
+     * freshly created sandbox connect without a round-trip. Pass undefined to look
+     * it up — a re-attached sandbox, or the server could not mint a token.
+     */
+    static tryInit(serverClient: ModalGrpcClient, taskId: string, sandboxId: string, isV2: boolean, access: CommandRouterAccess | undefined, logger: Logger, profile: Profile): Promise<TaskCommandRouterClientImpl | null>;
+    /**
+     * Builds a client around an already-resolved connection. Public so a test can
+     * construct one without the control-plane round trip `tryInit` makes; the
+     * class is not exported from the package, so this is not API surface.
+     */
+    constructor(serverClient: ModalGrpcClient, taskId: string, sandboxId: string, isV2: boolean, serverUrl: string, jwt: string, dial: () => ReturnType<typeof createChannel>, logger: Logger, idleTimeoutMs: number);
+    /**
+     * Says the client is about to be used: holds off the idle timer, and dials
+     * again if the connection was already given up. Returns the generation being
+     * used; pair every call with endOp.
+     */
+    private beginOp;
+    /** Says the caller is done. The last one out starts the clock. */
+    private endOp;
+    /**
+     * Starts the countdown to giving the connection back. Call it with nothing
+     * in flight.
+     */
+    private armIdleTimer;
+    /** Refuse new operations and release resources after current operations finish. */
+    closeWhenIdle(): void;
     close(): void;
+    private callWithRetries;
     /** Run a unary RPC against the command router with the default retry policy. */
     private callUnary;
     execStart(request: TaskExecStartRequest): Promise<TaskExecStartResponse>;
@@ -7252,13 +8225,31 @@ declare class TaskCommandRouterClientImpl {
     containerList(request: TaskContainerListRequest): Promise<TaskContainerListResponse>;
     containerTerminate(request: TaskContainerTerminateRequest): Promise<void>;
     containerWait(request: TaskContainerWaitRequest): Promise<TaskContainerWaitResponse>;
-    execStdioRead(taskId: string, execId: string, fileDescriptor: FileDescriptor, deadline?: number | null): AsyncGenerator<TaskExecStdioReadResponse>;
+    execStdioRead(taskId: string, execId: string, fileDescriptor: FileDescriptor, deadline?: number | null, signal?: AbortSignal): AsyncGenerator<TaskExecStdioReadResponse>;
     execStdinWrite(taskId: string, execId: string, offset: number, data: Uint8Array, eof: boolean): Promise<TaskExecStdinWriteResponse>;
+    /**
+     * Read the current stdin write status for an exec'd command.
+     *
+     * Used by streaming clients to find the resume offset after a stream
+     * failure. Evicts any in-flight stdin stream for the exec.
+     */
+    execStdinStatus(taskId: string, execId: string): Promise<TaskExecStdinStatusResponse>;
+    /**
+     * Stream `source` into the exec's stdin, with bounded resume on transient
+     * failures.
+     *
+     * Streams the full contents of `source` in one client-streaming RPC and
+     * closes stdin (EOF) on success. On a resumable error, queries
+     * `execStdinStatus` for the server's offset and reopens the
+     * stream from that point. Returns the total bytes streamed.
+     */
+    execStdinWriteStream(taskId: string, execId: string, source: StdinSource, chunkSize?: number, maxResumeAttempts?: number): Promise<number>;
     execPoll(taskId: string, execId: string, deadline?: number | null): Promise<TaskExecPollResponse>;
     execWait(taskId: string, execId: string, deadline?: number | null): Promise<TaskExecWaitResponse>;
     mountDirectory(request: TaskMountDirectoryRequest): Promise<void>;
     snapshotDirectory(request: TaskSnapshotDirectoryRequest, options?: TimeoutOptions): Promise<TaskSnapshotDirectoryResponse>;
     snapshotFilesystem(request: TaskSnapshotFilesystemRequest, options?: TimeoutOptions): Promise<TaskSnapshotFilesystemResponse>;
+    snapshotMemory(request: TaskSnapshotMemoryRequest, options?: TimeoutOptions): Promise<TaskSnapshotMemoryResponse>;
     unmountDirectory(request: TaskUnmountDirectoryRequest): Promise<void>;
     setNetworkAccess(request: TaskSetNetworkAccessRequest): Promise<void>;
     /**
@@ -7268,10 +8259,20 @@ declare class TaskCommandRouterClientImpl {
      * within this window, the call is cancelled and a TimeoutError is thrown.
      */
     reloadVolumes(request: TaskReloadVolumesRequest, options?: TimeoutOptions): Promise<void>;
+    sandboxStdioReadV2(taskId: string, fileDescriptor: FileDescriptor, signal?: AbortSignal): AsyncGenerator<SandboxStdioReadV2Response>;
+    sandboxStdinWriteV2(taskId: string, offset: number, data: Uint8Array, eof: boolean): Promise<SandboxStdinWriteV2Response>;
     sandboxWaitUntilReady(taskId: string, timeoutMs: number): Promise<SandboxWaitUntilReadyTcrResponse>;
     private refreshJwt;
+    /** The caller holds an operation lease across authentication and all retries. */
     private callWithAuthRetry;
-    private streamStdio;
+    /**
+     * Yields the next chunk of stdio, opening or reopening the stream as it needs
+     * to, and determining whether or not to retry a failed open or read. It waits
+     * out the backoff itself.
+     */
+    private streamStdioWithRetries;
+    private streamExecStdio;
+    private streamSandboxStdio;
 }
 
 /** Type of a filesystem entry. */
@@ -7306,6 +8307,7 @@ interface FileWatchEvent {
 }
 /** Namespace for Sandbox filesystem APIs. */
 declare class SandboxFilesystem {
+    #private;
     private readonly exec;
     /** @ignore */
     constructor(exec: (command: string[], params?: SandboxExecParams) => Promise<ContainerProcess>);
@@ -7485,11 +8487,13 @@ declare class SandboxFilesystem {
     writeText(data: string, remotePath: string): Promise<void>;
 }
 
-type SandboxSidecarCommandRouter = Pick<TaskCommandRouterClientImpl, "containerCreate" | "containerGet" | "containerList" | "containerTerminate" | "containerWait">;
+type SandboxSidecarCommandRouter = Pick<TaskCommandRouterClientImpl, "containerCreate" | "containerGet" | "containerList" | "containerTerminate" | "containerWait" | "mountDirectory" | "snapshotDirectory" | "unmountDirectory">;
 type SandboxSidecarAccess = {
     client: ModalClient;
     exec(command: string[], params: SandboxExecParams | undefined, containerId: string): Promise<ContainerProcess>;
     commandRouter(): Promise<[string, SandboxSidecarCommandRouter]>;
+    reloadVolumes(containerId: string, params: SidecarReloadVolumesParams | undefined): Promise<void>;
+    snapshotFilesystem(containerId: string, params: SidecarSnapshotFilesystemParams | undefined): Promise<Image>;
 };
 /** Options for {@link SidecarService#create SidecarService.create()}. */
 type SidecarCreateParams = {
@@ -7501,6 +8505,19 @@ type SidecarCreateParams = {
     secrets?: Secret[];
     /** Working directory of the sidecar container. */
     workdir?: string;
+    /**
+     * List of CIDRs the sidecar is allowed to access. Independent of the main
+     * container; if not set, all CIDRs are allowed. An empty list blocks all
+     * external egress while preserving connectivity to the main container.
+     */
+    outboundCidrAllowlist?: string[];
+    /**
+     * List of domain names the sidecar is allowed to access. Supports wildcard
+     * prefixes (`*.example.com`). Independent of the main container.
+     */
+    outboundDomainAllowlist?: string[];
+    /** Enable a PTY for the sidecar. */
+    pty?: boolean;
 };
 /** Options for {@link SidecarService#get SidecarService.get()}. */
 type SidecarGetParams = {
@@ -7519,6 +8536,24 @@ type SidecarTerminateParams = {
     /** If true, wait for the sidecar container to terminate. */
     wait?: boolean;
 };
+/** Optional parameters for {@link SidecarContainer#snapshotFilesystem SidecarContainer.snapshotFilesystem()}. */
+type SidecarSnapshotFilesystemParams = {
+    /** Overall budget for the snapshot call, in milliseconds. Defaults to 55000. */
+    timeoutMs?: number;
+    /** Lifetime of the resulting image in milliseconds. Defaults to 30 days. Pass `null` for no expiry. */
+    ttlMs?: number | null;
+};
+/** Optional parameters for {@link SidecarContainer#reloadVolumes SidecarContainer.reloadVolumes()}. */
+type SidecarReloadVolumesParams = {
+    /** Overall budget in milliseconds. Defaults to 55000. */
+    timeoutMs?: number;
+};
+/** Optional parameters for {@link SidecarContainer#mountImage SidecarContainer.mountImage()}. */
+type SidecarMountImageParams = SandboxMountImageParams;
+/** Optional parameters for {@link SidecarContainer#unmountImage SidecarContainer.unmountImage()}. */
+type SidecarUnmountImageParams = Record<string, never>;
+/** Optional parameters for {@link SidecarContainer#snapshotDirectory SidecarContainer.snapshotDirectory()}. */
+type SidecarSnapshotDirectoryParams = SandboxSnapshotDirectoryParams;
 /**
  * Creates and manages sidecar containers inside a Sandbox.
  *
@@ -7572,6 +8607,48 @@ declare class SidecarContainer {
     terminate(params: {
         wait: true;
     }): Promise<number>;
+    /** Snapshot this Sidecar container's filesystem into an Image. */
+    snapshotFilesystem(params?: SidecarSnapshotFilesystemParams): Promise<Image>;
+    /**
+     * Reload all Volumes mounted in this sidecar container.
+     *
+     * Blocks until the reload completes, or throws a `TimeoutError` on timeout
+     * (the reload may still complete in the background).
+     */
+    reloadVolumes(params?: SidecarReloadVolumesParams): Promise<void>;
+    /**
+     * Mount an {@link Image} at a path in this Sidecar container's filesystem.
+     *
+     * @param path - The path where the directory should be mounted
+     * @param image - Optional {@link Image} to mount. If undefined, mounts an empty directory.
+     * @param params - Optional parameters; see {@link SidecarMountImageParams}.
+     */
+    mountImage(path: string, image?: Image, params?: SidecarMountImageParams): Promise<void>;
+    /**
+     * Unmounts an {@link Image} previously mounted at a path in this Sidecar container's filesystem.
+     *
+     * @param path - The mount path to unmount
+     */
+    unmountImage(path: string, _params?: SidecarUnmountImageParams): Promise<void>;
+    /**
+     * Snapshots and creates a new {@link Image} from a directory in the running Sidecar container.
+     *
+     * The resulting Image is retained for `ttlMs` (default: 30 days),
+     * as a hard cutoff measured from creation — usage does not extend
+     * the lifetime. Pass `ttlMs: null` to retain indefinitely.
+     *
+     * The call has an overall `timeoutMs` budget (default: 55000). If it
+     * elapses before a snapshot completes, the call is cancelled and an
+     * error is thrown.
+     *
+     * The Image can be used anywhere an Image is accepted, including as a mount
+     * or as the base filesystem for another container.
+     *
+     * @param path - The path of the directory to snapshot
+     * @param params - Optional parameters; see {@link SidecarSnapshotDirectoryParams}.
+     * @returns Promise that resolves to an {@link Image}
+     */
+    snapshotDirectory(path: string, params?: SidecarSnapshotDirectoryParams): Promise<Image>;
 }
 
 /**
@@ -7611,6 +8688,48 @@ interface ModalWriteStream<R = any> extends WritableStream<R> {
     writeBytes(bytes: Uint8Array): Promise<void>;
 }
 
+/**
+ * > Sandbox memory snapshots are in **early preview**.
+ *
+ * A `SandboxSnapshot` object lets you interact with a stored Sandbox snapshot that was created by calling
+ * {@link Sandbox#experimentalSnapshot} on a Sandbox instance. This includes both the filesystem and memory state of
+ * the original Sandbox at the time the snapshot was taken.
+ */
+declare class SandboxSnapshot {
+    #private;
+    readonly snapshotId: string;
+    /** @ignore */
+    constructor(client: ModalClient, snapshotId: string, params?: {
+        isV2?: boolean;
+    });
+    /**
+     * @internal
+     * Whether the snapshot came from a V2 sandbox. `undefined` until hydrated.
+     */
+    get _isV2(): boolean | undefined;
+    /** @internal */
+    _hydrate(): Promise<void>;
+}
+/**
+ * Service for managing {@link SandboxSnapshot}s.
+ *
+ * Normally only ever accessed via the client as:
+ * ```typescript
+ * const modal = new ModalClient();
+ * const snapshot = await modal.sandboxSnapshots.fromId(snapshotId);
+ * ```
+ */
+declare class SandboxSnapshotService {
+    #private;
+    constructor(client: ModalClient);
+    /**
+     * Construct a {@link SandboxSnapshot} for an existing snapshot ID.
+     *
+     * @param snapshotId - Snapshot ID returned when the snapshot was created.
+     */
+    fromId(snapshotId: string): Promise<SandboxSnapshot>;
+}
+
 /**
  * Stdin is always present, but this option allow you to drop stdout or stderr
  * if you don't need them. The default is "pipe", matching Node.js behavior.
@@ -7703,7 +8822,9 @@ type SandboxCreateParams = {
     name?: string;
     /** Tags to attach to the Sandbox. Filterable via {@link SandboxService#list client.sandboxes.list}. */
     tags?: Record<string, string>;
-    /** Optional experimental options. */
+    /**
+     * Optional experimental options. Values must be booleans or strings.
+     */
     experimentalOptions?: Record<string, any>;
     /** If set, connections to this Sandbox will be subdomains of this domain rather than the default.
      * This requires prior manual setup by Modal and is only available for Enterprise customers.
@@ -7711,6 +8832,8 @@ type SandboxCreateParams = {
     customDomain?: string;
     /** If true, the sandbox will receive a MODAL_IDENTITY_TOKEN env var for OIDC-based auth (e.g. to AWS, GCP). */
     includeOidcIdentityToken?: boolean;
+    /** Enable memory snapshots. */
+    experimentalEnableSnapshot?: boolean;
 };
 /**
  * Service for managing {@link Sandbox}es.
@@ -7734,10 +8857,14 @@ declare class SandboxService {
      * Supported features include exec, encrypted tunnels, wait/poll/terminate,
      * CPU and memory configuration, region placement, volumes, cloud bucket
      * mounts (with static credentials via {@link Secret} or `oidcAuthRoleArn`),
-     * OIDC identity tokens, {@link Proxy proxies}, and filesystem snapshots.
+     * OIDC identity tokens, {@link Proxy proxies}, filesystem snapshots, and
+     * custom domains (`customDomain` allows connections to the Sandbox via a
+     * subdomain of that parent domain rather than a default Modal domain;
+     * requires prior setup by Modal).
      *
-     * Features like tags, memory snapshots, GPUs, and custom domains are not
-     * supported.
+     * Pass `experimentalEnableSnapshot: true` to create a sandbox that can be
+     * snapshotted with {@link Sandbox#experimentalSnapshot}. Features like network
+     * file systems and GPUs are not supported.
      *
      * V2 sandboxes created with this method are not currently returned by
      * {@link SandboxService#list client.sandboxes.list()}. A named Sandbox can be
@@ -7777,25 +8904,33 @@ declare class SandboxService {
      * @returns Promise that resolves to a Sandbox
      */
     experimentalFromName(appName: string, name: string, params?: SandboxExperimentalFromNameParams): Promise<Sandbox>;
+    /**
+     * Restore a {@link Sandbox} from a memory snapshot.
+     *
+     * The restore targets the same backend the snapshot was taken from. A V1
+     * snapshot restores as a V1 sandbox, a V2 snapshot as a V2 sandbox.
+     *
+     * EXPERIMENTAL: the API is subject to change.
+     */
+    experimentalFromSnapshot(snapshot: SandboxSnapshot, params?: SandboxExperimentalFromSnapshotParams): Promise<Sandbox>;
     /**
      * List all {@link Sandbox}es for the current Environment or App ID (if specified).
      * If tags are specified, only Sandboxes that have at least those tags are returned.
      */
     list(params?: SandboxListParams): AsyncGenerator<Sandbox, void, unknown>;
     /**
-     * List the V2 {@link Sandbox}es in an {@link App}.
+     * List V2 {@link Sandbox}es.
      *
-     * This lists V2 Sandboxes, i.e. Sandboxes created via
-     * {@link SandboxService#experimentalCreate client.sandboxes.experimentalCreate()}.
-     * Such Sandboxes are not returned by
-     * {@link SandboxService#list client.sandboxes.list()}. If tags are specified,
+     * This lists all Sandboxes (both v1 and v2).
+     * Pass `appId` to scope to an App; omit it to list across the current
+     * environment (deprecated — prefer scoping by `appId`). If tags are specified,
      * only Sandboxes that have at least those tags are returned.
      *
-     * Yields {@link Sandbox} objects that are currently running in the App.
+     * Yields {@link Sandbox} objects that are currently running.
      *
      * EXPERIMENTAL: the API is subject to change.
      */
-    experimentalList(params: SandboxExperimentalListParams): AsyncGenerator<Sandbox, void, unknown>;
+    experimentalList(params?: SandboxExperimentalListParams): AsyncGenerator<Sandbox, void, unknown>;
 }
 /** Optional parameters for {@link SandboxService#list client.sandboxes.list()}. */
 type SandboxListParams = {
@@ -7808,10 +8943,12 @@ type SandboxListParams = {
 };
 /** Parameters for {@link SandboxService#experimentalList client.sandboxes.experimentalList()}. */
 type SandboxExperimentalListParams = {
-    /** The App to list Sandboxes under. */
-    appId: string;
+    /** The App to list Sandboxes under. Omit to list across the environment (deprecated). */
+    appId?: string;
     /** Only return Sandboxes that include all specified tags. */
     tags?: Record<string, string>;
+    /** Override environment for the request; defaults to current profile. */
+    environment?: string;
 };
 /** Optional parameters for {@link SandboxService#fromName client.sandboxes.fromName()}. */
 type SandboxFromNameParams = {
@@ -7821,6 +8958,14 @@ type SandboxFromNameParams = {
 type SandboxExperimentalFromNameParams = {
     environment?: string;
 };
+/** Optional parameters for {@link SandboxService#experimentalFromSnapshot client.sandboxes.experimentalFromSnapshot()}. */
+type SandboxExperimentalFromSnapshotParams = {
+    /**
+     * Name for the restored Sandbox. Omit to reuse the original Sandbox's name,
+     * pass `null` to leave it unnamed, or pass a string to override it.
+     */
+    name?: string | null;
+};
 /** Optional parameters for {@link Sandbox#exec Sandbox.exec()}. */
 type SandboxExecParams = {
     /** Specifies text or binary encoding for input and output streams. */
@@ -7861,16 +9006,21 @@ type SandboxSnapshotFilesystemParams = {
      */
     ttlMs?: number | null;
 };
-/** Optional parameters for {@link Sandbox#reloadVolumes Sandbox.reloadVolumes()}. */
-type SandboxReloadVolumesParams = {
+/** Optional parameters for Sandbox.experimentalGetExitSnapshot(). */
+type SandboxExperimentalGetExitSnapshotParams = {
     /**
-     * Overall budget for the reload call, in milliseconds. Defaults to 55000.
-     * If the reload does not complete within this window, the call is cancelled
-     * and a `TimeoutError` is thrown; note that the reload may still complete in
-     * the background.
+     * Total time to wait in milliseconds, spread across repeated long polls of
+     * at most `EXIT_SNAPSHOT_LONG_POLL_TIMEOUT` seconds each. `undefined` (the
+     * default) waits until the snapshot reaches a terminal state. `0` performs
+     * an immediate check without waiting.
      */
     timeoutMs?: number;
 };
+/** Optional parameters for {@link Sandbox#reloadVolumes Sandbox.reloadVolumes()}. */
+type SandboxReloadVolumesParams = {
+    /** Overall budget in milliseconds. Defaults to 55000. */
+    timeoutMs?: number;
+};
 /** Optional parameters for {@link Sandbox#snapshotDirectory Sandbox.snapshotDirectory()}. */
 type SandboxSnapshotDirectoryParams = {
     /**
@@ -7946,11 +9096,16 @@ declare class Tunnel {
 declare class Sandbox {
     #private;
     readonly sandboxId: string;
-    /** @ignore */
+    /**
+     * Creates a Sandbox handle for a server-returned ID, deducing the backend
+     * version from the ID shape.
+     *
+     * @ignore
+     */
     constructor(client: ModalClient, sandboxId: string, params?: {
-        isV2?: boolean;
         taskId?: string;
         tunnels?: Record<number, Tunnel>;
+        initCommandRouterAccess?: CommandRouterAccess;
     });
     get stdin(): ModalWriteStream<string>;
     get stdout(): ModalReadStream<string>;
@@ -7963,10 +9118,31 @@ declare class Sandbox {
      * EXPERIMENTAL: the API is subject to change.
      */
     get experimentalSidecars(): SidecarService;
-    /** Set tags (key-value pairs) on the Sandbox. Tags can be used to filter results in {@link SandboxService#list client.sandboxes.list}. */
+    /**
+     * Set tags (key-value pairs) on the Sandbox. Tags can be used to filter results in {@link SandboxService#list client.sandboxes.list}.
+     *
+     * Setting tags replaces the Sandbox's entire tag set; passing an empty object clears all tags.
+     */
     setTags(tags: Record<string, string>): Promise<void>;
     /** Get tags (key-value pairs) currently attached to this Sandbox from the server. */
     getTags(): Promise<Record<string, string>>;
+    /**
+     * Assign a name to a running V2 {@link Sandbox} that was created without one.
+     *
+     * This is only supported for V2 Sandboxes, i.e. Sandboxes created via
+     * {@link SandboxService#experimentalCreate client.sandboxes.experimentalCreate()}.
+     * A name may only be set once, and only on a Sandbox that has never had one;
+     * afterwards the Sandbox can be looked up with
+     * {@link SandboxService#experimentalFromName client.sandboxes.experimentalFromName()}.
+     *
+     * EXPERIMENTAL: the API is subject to change.
+     *
+     * @param name - Name to assign to the Sandbox. Must be unique within the App.
+     * @throws {AlreadyExistsError} If another running Sandbox in the App already holds the name.
+     * @throws {InvalidError} If the server rejects the name as invalid.
+     * @throws {ConflictError} If the Sandbox already has a name or is no longer running.
+     */
+    experimentalSetName(name: string): Promise<void>;
     exec(command: string[], params?: SandboxExecParams & {
         mode?: "text";
     }): Promise<ContainerProcess<string>>;
@@ -7985,6 +9161,9 @@ declare class Sandbox {
      * Disconnect from the Sandbox, cleaning up local resources.
      * The Sandbox continues running on Modal's infrastructure.
      * After calling detach(), most operations on this Sandbox object will throw.
+     *
+     * This does not block on or interrupt ongoing reads or calls. Connection
+     * resources are closed promptly once those operations finish.
      */
     detach(): void;
     wait(): Promise<number>;
@@ -8018,6 +9197,55 @@ declare class Sandbox {
      * @returns Promise that resolves to an {@link Image}
      */
     snapshotFilesystem(params?: SandboxSnapshotFilesystemParams): Promise<Image>;
+    /**
+     * Get the exit filesystem snapshot image.
+     *
+     * An exit snapshot captures the Sandbox filesystem when the Sandbox exits,
+     * whether its entrypoint finishes gracefully, abruptly, or it is stopped with
+     * {@link Sandbox#terminate}. The resulting {@link Image} can be passed to
+     * {@link SandboxService#create client.sandboxes.create()} to start a new
+     * Sandbox from the saved filesystem.
+     *
+     * Exit snapshots are opt-in: the Sandbox must have been created with
+     * `experimentalOptions: { enable_exit_snapshot: true }`. Calling this on a
+     * Sandbox created without that option throws an {@link InvalidError}.
+     *
+     * @example
+     * ```ts
+     * const sb = await modal.sandboxes.create(app, image, {
+     *   experimentalOptions: { enable_exit_snapshot: true },
+     * });
+     * // ... use the Sandbox ...
+     * await sb.terminate();
+     * const image = await sb.experimentalGetExitSnapshot();
+     * const sb2 = await modal.sandboxes.create(app, image);
+     * ```
+     *
+     * EXPERIMENTAL: the API is subject to change.
+     *
+     * @param params - Optional parameters; see SandboxExperimentalGetExitSnapshotParams.
+     * @returns The exit snapshot Image.
+     * @throws {InvalidError} If `timeoutMs` is negative, or if exit snapshots
+     *   were not enabled when the Sandbox was created.
+     * @throws {TimeoutError} If `timeoutMs` elapses before the snapshot
+     *   reaches a terminal state. This includes `timeoutMs = 0` when the
+     *   snapshot is still pending.
+     * @throws {SnapshotCreationError} Snapshot operation is done and failed.
+     *   Polling again will not produce an Image; filesystem state is gone.
+     * @throws {NotFoundError} If the Sandbox does not exist.
+     */
+    experimentalGetExitSnapshot(params?: SandboxExperimentalGetExitSnapshotParams): Promise<Image>;
+    /**
+     * Snapshot the filesystem and memory of the Sandbox.
+     *
+     * Returns a {@link SandboxSnapshot} which can be restored into a new Sandbox
+     * with {@link SandboxService#experimentalFromSnapshot client.sandboxes.experimentalFromSnapshot()}.
+     *
+     * The Sandbox must have been created with `experimentalEnableSnapshot: true`.
+     *
+     * EXPERIMENTAL: the API is subject to change.
+     */
+    experimentalSnapshot(): Promise<SandboxSnapshot>;
     /**
      * Mount an {@link Image} at a path in the Sandbox filesystem.
      *
@@ -8043,10 +9271,8 @@ declare class Sandbox {
     /**
      * Reload all Volumes mounted in the Sandbox.
      *
-     * Blocks until the Volumes have been reloaded, bounded by `timeoutMs` (55000
-     * by default). If the reload does not complete within that window, a
-     * `TimeoutError` is thrown; note that the reload may still complete in the
-     * background.
+     * Blocks until the reload completes, or throws a `TimeoutError` on timeout
+     * (the reload may still complete in the background).
      *
      * @param params - Optional parameters; see {@link SandboxReloadVolumesParams}.
      */
@@ -8088,6 +9314,23 @@ declare class ContainerProcess<R extends string | Uint8Array = any> {
      * Useful for when an stdin write has failed.
      */
     closeStdin(): Promise<void>;
+    /**
+     * @internal
+     * @hidden
+     * Stream `source` into the process's stdin and close it (EOF) on success.
+     *
+     * Returns the total bytes streamed.
+     */
+    _stdinWriteStream(source: StdinSource): Promise<number>;
+    /**
+     * @internal
+     * @hidden
+     * Check if the container process has finished running.
+     *
+     * Returns `null` if the process is still running, else returns the exit
+     * code.
+     */
+    _poll(): Promise<number | null>;
     /** Wait for process completion and return the exit code. */
     wait(): Promise<number>;
 }
@@ -8095,6 +9338,14 @@ declare class ContainerProcess<R extends string | Uint8Array = any> {
 interface ModalClientParams {
     tokenId?: string;
     tokenSecret?: string;
+    /** OAuth refresh token returned by Modal's token endpoint. */
+    oauthRefreshToken?: string;
+    /** Modal-issued OAuth client ID, with an `oc-` prefix. */
+    oauthClientId?: string;
+    /** Modal-issued OAuth client secret, with an `ov-` prefix. */
+    oauthClientSecret?: string;
+    /** Unencrypted RSA private key encoded as PEM, with literal or escaped newlines. */
+    oauthJwtKey?: string;
     environment?: string;
     endpoint?: string;
     timeoutMs?: number;
@@ -8121,7 +9372,7 @@ type ModalGrpcClient = Client<typeof ModalClientDefinition, TimeoutOptions & Ret
  *
  * ModalClient provides access to all Modal services through service properties.
  * Create a client instance and use its service properties to manage {@link App}s,
- * {@link Function_ Function}s, * {@link Sandbox}es, and other Modal resources.
+ * {@link Function_ Function}s, {@link Sandbox}es, and other Modal resources.
  *
  * @example
  * ```typescript
@@ -8144,6 +9395,7 @@ declare class ModalClient {
     readonly proxies: ProxyService;
     readonly queues: QueueService;
     readonly sandboxes: SandboxService;
+    readonly sandboxSnapshots: SandboxSnapshotService;
     readonly secrets: SecretService;
     readonly volumes: VolumeService;
     /** @ignore */
@@ -8154,8 +9406,10 @@ declare class ModalClient {
     private authTokenManager;
     private customMiddleware;
     private environmentManager;
+    private oauthJwtKey?;
     constructor(params?: ModalClientParams);
     environmentName(environment?: string): string;
+    private validateProfileCredentials;
     /**
      * Returns the image builder version by querying the server where the local profile takes
      * precedence.
@@ -8234,6 +9488,10 @@ declare class FunctionTimeoutError extends Error {
 declare class RemoteError extends Error {
     constructor(message: string);
 }
+/** Something unexpected happened during runtime. */
+declare class ExecutionError extends Error {
+    constructor(message: string);
+}
 /** A retryable internal error from Modal. */
 declare class InternalFailure extends Error {
     constructor(message: string);
@@ -8246,6 +9504,10 @@ declare class NotFoundError extends Error {
 declare class AlreadyExistsError extends Error {
     constructor(message: string);
 }
+/** The current state of a resource conflicts with the requested operation. */
+declare class ConflictError extends Error {
+    constructor(message: string);
+}
 /** A request or other operation was invalid. */
 declare class InvalidError extends Error {
     constructor(message: string);
@@ -8294,6 +9556,10 @@ declare class SandboxFilesystemPermissionError extends SandboxFilesystemError {
 declare class SandboxTimeoutError extends Error {
     constructor(message?: string);
 }
+/** Snapshot operation is done and failed. Polling again will not produce an Image; filesystem state is gone. */
+declare class SnapshotCreationError extends Error {
+    constructor(message: string);
+}
 /** Thrown when attempting operations on a detached Sandbox. */
 declare class ClientClosedError extends Error {
     constructor(message?: string);
@@ -8301,4 +9567,4 @@ declare class ClientClosedError extends Error {
 
 declare function checkForRenamedParams(params: any, renames: Record<string, string>): void;
 
-export { AlreadyExistsError, App, type AppFromNameParams, AppService, ClientClosedError, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ContainerProcess, type FileInfo, type FileType, type FileWatchEvent, type FileWatchEventType, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, FunctionCallService, type FunctionFromNameParams, FunctionService, type FunctionStats, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, type FunctionWithBatchingParams, type FunctionWithConcurrencyParams, type FunctionWithOptionsParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, type ImageFromNameParams, type ImagePublishParams, ImageService, InternalFailure, InvalidError, type LogLevel, type Logger, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, type SandboxExperimentalFromNameParams, type SandboxExperimentalListParams, SandboxFilesystem, SandboxFilesystemDirectoryNotEmptyError, SandboxFilesystemError, SandboxFilesystemFileTooLargeError, SandboxFilesystemIsADirectoryError, SandboxFilesystemNotADirectoryError, SandboxFilesystemNotFoundError, SandboxFilesystemPathAlreadyExistsError, SandboxFilesystemPermissionError, type SandboxFromNameParams, type SandboxListParams, type SandboxMountImageParams, type SandboxReloadVolumesParams, SandboxService, type SandboxSnapshotDirectoryParams, type SandboxSnapshotFilesystemParams, type SandboxTerminateParams, SandboxTimeoutError, type SandboxUpdateNetworkPolicyParams, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, SidecarContainer, type SidecarCreateParams, type SidecarExecParams, type SidecarGetParams, type SidecarListParams, SidecarService, type SidecarTerminateParams, type StdioBehavior, type StreamMode, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, type VolumeMountOptionsParams, VolumeService, checkForRenamedParams };
+export { AlreadyExistsError, App, type AppFromNameParams, AppService, ClientClosedError, CloudBucketMount, CloudBucketMountService, Cls, type ClsFromNameParams, ClsInstance, ClsService, type ClsWithBatchingParams, type ClsWithConcurrencyParams, type ClsWithOptionsParams, ConflictError, ContainerProcess, ExecutionError, type FileInfo, type FileType, type FileWatchEvent, type FileWatchEventType, type FunctionAutoscalerSettings, FunctionCall, type FunctionCallCancelParams, type FunctionCallGetParams, type FunctionCallLogFetchParams, type FunctionCallLogStreamParams, type FunctionCallLogTailParams, FunctionCallLogsManager, FunctionCallService, type FunctionFromNameParams, type FunctionLogFetchParams, type FunctionLogStreamParams, type FunctionLogTailParams, FunctionLogsManager, FunctionService, type FunctionStats, FunctionTimeoutError, type FunctionUpdateAutoscalerParams, type FunctionWithBatchingParams, type FunctionWithConcurrencyParams, type FunctionWithOptionsParams, Function_, Image, type ImageDeleteParams, type ImageDockerfileCommandsParams, type ImageFromNameParams, type ImagePublishParams, ImageService, InternalFailure, InvalidError, type LogEntry, type FunctionLogFetchParams as LogFetchParams, type LogLevel, type LogSource, type Logger, ModalClient, type ModalClientParams, type ModalReadStream, type ModalWriteStream, NotFoundError, Probe, type ProbeParams, type Profile, Proxy, type ProxyFromNameParams, ProxyService, Queue, type QueueClearParams, type QueueDeleteParams, QueueEmptyError, type QueueEphemeralParams, type QueueFromNameParams, QueueFullError, type QueueGetParams, type QueueIterateParams, type QueueLenParams, type QueuePutParams, QueueService, RemoteError, Retries, Sandbox, type SandboxCreateConnectCredentials, type SandboxCreateConnectTokenParams, type SandboxCreateParams, type SandboxExecParams, type SandboxExperimentalFromNameParams, type SandboxExperimentalFromSnapshotParams, type SandboxExperimentalGetExitSnapshotParams, type SandboxExperimentalListParams, SandboxFilesystem, SandboxFilesystemDirectoryNotEmptyError, SandboxFilesystemError, SandboxFilesystemFileTooLargeError, SandboxFilesystemIsADirectoryError, SandboxFilesystemNotADirectoryError, SandboxFilesystemNotFoundError, SandboxFilesystemPathAlreadyExistsError, SandboxFilesystemPermissionError, type SandboxFromNameParams, type SandboxListParams, type SandboxMountImageParams, type SandboxReloadVolumesParams, SandboxService, SandboxSnapshot, type SandboxSnapshotDirectoryParams, type SandboxSnapshotFilesystemParams, SandboxSnapshotService, type SandboxTerminateParams, SandboxTimeoutError, type SandboxUpdateNetworkPolicyParams, Secret, type SecretDeleteParams, type SecretFromNameParams, type SecretFromObjectParams, SecretService, SidecarContainer, type SidecarCreateParams, type SidecarExecParams, type SidecarGetParams, type SidecarListParams, type SidecarMountImageParams, SidecarService, type SidecarSnapshotDirectoryParams, type SidecarSnapshotFilesystemParams, type SidecarTerminateParams, type SidecarUnmountImageParams, SnapshotCreationError, type StdioBehavior, type StreamMode, TimeoutError, Tunnel, Volume, type VolumeDeleteParams, type VolumeEphemeralParams, type VolumeFromNameParams, type VolumeMountOptionsParams, VolumeService, checkForRenamedParams };