modal 0.11.1-dev.7 → 0.11.1-dev.9

package/dist/index.js

@@ -2141,6 +2141,9 @@ function environmentRoleFromJSON(object) {
     case 3:
     case "ENVIRONMENT_ROLE_NO_ACCESS":
       return 3 /* ENVIRONMENT_ROLE_NO_ACCESS */;
+    case 4:
+    case "ENVIRONMENT_ROLE_MODAL_ADMINISTERED_OBSERVER":
+      return 4 /* ENVIRONMENT_ROLE_MODAL_ADMINISTERED_OBSERVER */;
     case -1:
     case "UNRECOGNIZED":
     default:
@@ -2157,6 +2160,8 @@ function environmentRoleToJSON(object) {
       return "ENVIRONMENT_ROLE_CONTRIBUTOR";
     case 3 /* ENVIRONMENT_ROLE_NO_ACCESS */:
       return "ENVIRONMENT_ROLE_NO_ACCESS";
+    case 4 /* ENVIRONMENT_ROLE_MODAL_ADMINISTERED_OBSERVER */:
+      return "ENVIRONMENT_ROLE_MODAL_ADMINISTERED_OBSERVER";
     case -1 /* UNRECOGNIZED */:
     default:
       return "UNRECOGNIZED";
@@ -2170,6 +2175,9 @@ function environmentTypeFromJSON(object) {
     case 1:
     case "ENVIRONMENT_TYPE_PUBLIC":
       return 1 /* ENVIRONMENT_TYPE_PUBLIC */;
+    case 2:
+    case "ENVIRONMENT_TYPE_MODAL_ADMINISTERED":
+      return 2 /* ENVIRONMENT_TYPE_MODAL_ADMINISTERED */;
     case -1:
     case "UNRECOGNIZED":
     default:
@@ -2182,6 +2190,8 @@ function environmentTypeToJSON(object) {
       return "ENVIRONMENT_TYPE_UNSPECIFIED";
     case 1 /* ENVIRONMENT_TYPE_PUBLIC */:
       return "ENVIRONMENT_TYPE_PUBLIC";
+    case 2 /* ENVIRONMENT_TYPE_MODAL_ADMINISTERED */:
+      return "ENVIRONMENT_TYPE_MODAL_ADMINISTERED";
     case -1 /* UNRECOGNIZED */:
     default:
       return "UNRECOGNIZED";
@@ -12601,6 +12611,377 @@ var ClusterListResponse = {
     return message;
   }
 };
+function createBaseClusterReservation() {
+  return {
+    name: "",
+    gpuType: "",
+    region: "",
+    minReservedWorkers: 0,
+    reservedWorkers: 0,
+    activeWorkers: 0,
+    idleWorkers: 0,
+    unfulfilledWorkers: 0,
+    tasks: []
+  };
+}
+var ClusterReservation = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.name !== "") {
+      writer.uint32(10).string(message.name);
+    }
+    if (message.gpuType !== "") {
+      writer.uint32(18).string(message.gpuType);
+    }
+    if (message.region !== "") {
+      writer.uint32(26).string(message.region);
+    }
+    if (message.minReservedWorkers !== 0) {
+      writer.uint32(32).int32(message.minReservedWorkers);
+    }
+    if (message.reservedWorkers !== 0) {
+      writer.uint32(40).int32(message.reservedWorkers);
+    }
+    if (message.activeWorkers !== 0) {
+      writer.uint32(48).int32(message.activeWorkers);
+    }
+    if (message.idleWorkers !== 0) {
+      writer.uint32(56).int32(message.idleWorkers);
+    }
+    if (message.unfulfilledWorkers !== 0) {
+      writer.uint32(64).int32(message.unfulfilledWorkers);
+    }
+    for (const v of message.tasks) {
+      ClusterReservation_Task.encode(v, writer.uint32(74).fork()).join();
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseClusterReservation();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.name = reader.string();
+          continue;
+        }
+        case 2: {
+          if (tag !== 18) {
+            break;
+          }
+          message.gpuType = reader.string();
+          continue;
+        }
+        case 3: {
+          if (tag !== 26) {
+            break;
+          }
+          message.region = reader.string();
+          continue;
+        }
+        case 4: {
+          if (tag !== 32) {
+            break;
+          }
+          message.minReservedWorkers = reader.int32();
+          continue;
+        }
+        case 5: {
+          if (tag !== 40) {
+            break;
+          }
+          message.reservedWorkers = reader.int32();
+          continue;
+        }
+        case 6: {
+          if (tag !== 48) {
+            break;
+          }
+          message.activeWorkers = reader.int32();
+          continue;
+        }
+        case 7: {
+          if (tag !== 56) {
+            break;
+          }
+          message.idleWorkers = reader.int32();
+          continue;
+        }
+        case 8: {
+          if (tag !== 64) {
+            break;
+          }
+          message.unfulfilledWorkers = reader.int32();
+          continue;
+        }
+        case 9: {
+          if (tag !== 74) {
+            break;
+          }
+          message.tasks.push(ClusterReservation_Task.decode(reader, reader.uint32()));
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      name: isSet5(object.name) ? globalThis.String(object.name) : "",
+      gpuType: isSet5(object.gpuType) ? globalThis.String(object.gpuType) : "",
+      region: isSet5(object.region) ? globalThis.String(object.region) : "",
+      minReservedWorkers: isSet5(object.minReservedWorkers) ? globalThis.Number(object.minReservedWorkers) : 0,
+      reservedWorkers: isSet5(object.reservedWorkers) ? globalThis.Number(object.reservedWorkers) : 0,
+      activeWorkers: isSet5(object.activeWorkers) ? globalThis.Number(object.activeWorkers) : 0,
+      idleWorkers: isSet5(object.idleWorkers) ? globalThis.Number(object.idleWorkers) : 0,
+      unfulfilledWorkers: isSet5(object.unfulfilledWorkers) ? globalThis.Number(object.unfulfilledWorkers) : 0,
+      tasks: globalThis.Array.isArray(object?.tasks) ? object.tasks.map((e) => ClusterReservation_Task.fromJSON(e)) : []
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.name !== "") {
+      obj.name = message.name;
+    }
+    if (message.gpuType !== "") {
+      obj.gpuType = message.gpuType;
+    }
+    if (message.region !== "") {
+      obj.region = message.region;
+    }
+    if (message.minReservedWorkers !== 0) {
+      obj.minReservedWorkers = Math.round(message.minReservedWorkers);
+    }
+    if (message.reservedWorkers !== 0) {
+      obj.reservedWorkers = Math.round(message.reservedWorkers);
+    }
+    if (message.activeWorkers !== 0) {
+      obj.activeWorkers = Math.round(message.activeWorkers);
+    }
+    if (message.idleWorkers !== 0) {
+      obj.idleWorkers = Math.round(message.idleWorkers);
+    }
+    if (message.unfulfilledWorkers !== 0) {
+      obj.unfulfilledWorkers = Math.round(message.unfulfilledWorkers);
+    }
+    if (message.tasks?.length) {
+      obj.tasks = message.tasks.map((e) => ClusterReservation_Task.toJSON(e));
+    }
+    return obj;
+  },
+  create(base) {
+    return ClusterReservation.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseClusterReservation();
+    message.name = object.name ?? "";
+    message.gpuType = object.gpuType ?? "";
+    message.region = object.region ?? "";
+    message.minReservedWorkers = object.minReservedWorkers ?? 0;
+    message.reservedWorkers = object.reservedWorkers ?? 0;
+    message.activeWorkers = object.activeWorkers ?? 0;
+    message.idleWorkers = object.idleWorkers ?? 0;
+    message.unfulfilledWorkers = object.unfulfilledWorkers ?? 0;
+    message.tasks = object.tasks?.map((e) => ClusterReservation_Task.fromPartial(e)) || [];
+    return message;
+  }
+};
+function createBaseClusterReservation_Task() {
+  return { taskId: "", clusterRank: 0, appId: "", functionId: "" };
+}
+var ClusterReservation_Task = {
+  encode(message, writer = new BinaryWriter()) {
+    if (message.taskId !== "") {
+      writer.uint32(10).string(message.taskId);
+    }
+    if (message.clusterRank !== 0) {
+      writer.uint32(16).int32(message.clusterRank);
+    }
+    if (message.appId !== "") {
+      writer.uint32(26).string(message.appId);
+    }
+    if (message.functionId !== "") {
+      writer.uint32(34).string(message.functionId);
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseClusterReservation_Task();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.taskId = reader.string();
+          continue;
+        }
+        case 2: {
+          if (tag !== 16) {
+            break;
+          }
+          message.clusterRank = reader.int32();
+          continue;
+        }
+        case 3: {
+          if (tag !== 26) {
+            break;
+          }
+          message.appId = reader.string();
+          continue;
+        }
+        case 4: {
+          if (tag !== 34) {
+            break;
+          }
+          message.functionId = reader.string();
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      taskId: isSet5(object.taskId) ? globalThis.String(object.taskId) : "",
+      clusterRank: isSet5(object.clusterRank) ? globalThis.Number(object.clusterRank) : 0,
+      appId: isSet5(object.appId) ? globalThis.String(object.appId) : "",
+      functionId: isSet5(object.functionId) ? globalThis.String(object.functionId) : ""
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.taskId !== "") {
+      obj.taskId = message.taskId;
+    }
+    if (message.clusterRank !== 0) {
+      obj.clusterRank = Math.round(message.clusterRank);
+    }
+    if (message.appId !== "") {
+      obj.appId = message.appId;
+    }
+    if (message.functionId !== "") {
+      obj.functionId = message.functionId;
+    }
+    return obj;
+  },
+  create(base) {
+    return ClusterReservation_Task.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseClusterReservation_Task();
+    message.taskId = object.taskId ?? "";
+    message.clusterRank = object.clusterRank ?? 0;
+    message.appId = object.appId ?? "";
+    message.functionId = object.functionId ?? "";
+    return message;
+  }
+};
+function createBaseClusterReservationListRequest() {
+  return {};
+}
+var ClusterReservationListRequest = {
+  encode(_, writer = new BinaryWriter()) {
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseClusterReservationListRequest();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(_) {
+    return {};
+  },
+  toJSON(_) {
+    const obj = {};
+    return obj;
+  },
+  create(base) {
+    return ClusterReservationListRequest.fromPartial(base ?? {});
+  },
+  fromPartial(_) {
+    const message = createBaseClusterReservationListRequest();
+    return message;
+  }
+};
+function createBaseClusterReservationListResponse() {
+  return { reservations: [] };
+}
+var ClusterReservationListResponse = {
+  encode(message, writer = new BinaryWriter()) {
+    for (const v of message.reservations) {
+      ClusterReservation.encode(v, writer.uint32(10).fork()).join();
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof BinaryReader ? input : new BinaryReader(input);
+    let end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseClusterReservationListResponse();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.reservations.push(ClusterReservation.decode(reader, reader.uint32()));
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  fromJSON(object) {
+    return {
+      reservations: globalThis.Array.isArray(object?.reservations) ? object.reservations.map((e) => ClusterReservation.fromJSON(e)) : []
+    };
+  },
+  toJSON(message) {
+    const obj = {};
+    if (message.reservations?.length) {
+      obj.reservations = message.reservations.map((e) => ClusterReservation.toJSON(e));
+    }
+    return obj;
+  },
+  create(base) {
+    return ClusterReservationListResponse.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseClusterReservationListResponse();
+    message.reservations = object.reservations?.map((e) => ClusterReservation.fromPartial(e)) || [];
+    return message;
+  }
+};
 function createBaseClusterStats() {
   return { appId: "", taskIds: [], clusterId: "", startedAt: 0 };
 }
@@ -17804,7 +18185,8 @@ function createBaseEndpointCreateRequest() {
     environmentName: "",
     unauthenticated: false,
     servingMode: 0,
-    sharedEndpointNoticeAcknowledged: false
+    sharedEndpointNoticeAcknowledged: false,
+    recipeId: void 0
   };
 }
 var EndpointCreateRequest = {
@@ -17846,6 +18228,9 @@ var EndpointCreateRequest = {
     if (message.sharedEndpointNoticeAcknowledged !== false) {
       writer.uint32(88).bool(message.sharedEndpointNoticeAcknowledged);
     }
+    if (message.recipeId !== void 0) {
+      writer.uint32(98).string(message.recipeId);
+    }
     return writer;
   },
   decode(input, length) {
@@ -17946,6 +18331,13 @@ var EndpointCreateRequest = {
           message.sharedEndpointNoticeAcknowledged = reader.bool();
           continue;
         }
+        case 12: {
+          if (tag !== 98) {
+            break;
+          }
+          message.recipeId = reader.string();
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -17966,7 +18358,8 @@ var EndpointCreateRequest = {
       environmentName: isSet5(object.environmentName) ? globalThis.String(object.environmentName) : "",
       unauthenticated: isSet5(object.unauthenticated) ? globalThis.Boolean(object.unauthenticated) : false,
       servingMode: isSet5(object.servingMode) ? endpointServingModeFromJSON(object.servingMode) : 0,
-      sharedEndpointNoticeAcknowledged: isSet5(object.sharedEndpointNoticeAcknowledged) ? globalThis.Boolean(object.sharedEndpointNoticeAcknowledged) : false
+      sharedEndpointNoticeAcknowledged: isSet5(object.sharedEndpointNoticeAcknowledged) ? globalThis.Boolean(object.sharedEndpointNoticeAcknowledged) : false,
+      recipeId: isSet5(object.recipeId) ? globalThis.String(object.recipeId) : void 0
     };
   },
   toJSON(message) {
@@ -18004,6 +18397,9 @@ var EndpointCreateRequest = {
     if (message.sharedEndpointNoticeAcknowledged !== false) {
       obj.sharedEndpointNoticeAcknowledged = message.sharedEndpointNoticeAcknowledged;
     }
+    if (message.recipeId !== void 0) {
+      obj.recipeId = message.recipeId;
+    }
     return obj;
   },
   create(base) {
@@ -18022,6 +18418,7 @@ var EndpointCreateRequest = {
     message.unauthenticated = object.unauthenticated ?? false;
     message.servingMode = object.servingMode ?? 0;
     message.sharedEndpointNoticeAcknowledged = object.sharedEndpointNoticeAcknowledged ?? false;
+    message.recipeId = object.recipeId ?? void 0;
     return message;
   }
 };
@@ -61603,6 +62000,14 @@ var ModalClientDefinition = {
       responseStream: false,
       options: {}
     },
+    clusterReservationList: {
+      name: "ClusterReservationList",
+      requestType: ClusterReservationListRequest,
+      requestStream: false,
+      responseType: ClusterReservationListResponse,
+      responseStream: false,
+      options: {}
+    },
     /** Container */
     containerCheckpoint: {
       name: "ContainerCheckpoint",
@@ -64092,7 +64497,7 @@ var SecretService = class {
         "secret_name",
         name
       );
-      return new Secret(resp.secretId, name, void 0, resp.metadata?.keys);
+      return new Secret(resp.secretId, name);
     } catch (err) {
       if (err instanceof ClientError2 && err.code === Status2.NOT_FOUND)
         throw new NotFoundError(err.details);
@@ -64191,20 +64596,16 @@ var Secret = class {
   // constructed already-hydrated (e.g. from fromName), and not consulted again
   // once secretId is set.
   #hydrator;
-  // Names of the env vars a server-side Secret defines, as reported by the
-  // control plane on fromName. Undefined when unknown.
-  #keys;
   // Caches the single in-flight (or successfully completed) hydration so the
   // ephemeral Secret is created at most once, even if multiple callers hydrate
   // the same Secret concurrently. Cleared on failure so a transient error
   // doesn't permanently break the Secret; subsequent calls can retry.
   #hydratePromise;
   /** @ignore */
-  constructor(secretId, name, hydrator, keys) {
+  constructor(secretId, name, hydrator) {
     this.#secretId = secretId;
     this.name = name;
     this.#hydrator = hydrator;
-    this.#keys = keys !== void 0 ? new Set(keys) : void 0;
   }
   /** The ID of the server-side Secret, or an empty string if not yet hydrated. */
   get secretId() {
@@ -64220,16 +64621,6 @@ var Secret = class {
   get _hydrator() {
     return this.#hydrator;
   }
-  /**
-   * Names of the env vars this server-side Secret defines, or `undefined` if
-   * unknown (e.g. for lazy fromObject Secrets or Secrets constructed by id).
-   *
-   * @internal
-   * @hidden
-   */
-  get _keys() {
-    return this.#keys;
-  }
   /**
    * Lazily create the ephemeral server-side Secret backing a fromObject Secret
    * and populate {@link Secret#secretId secretId}. A no-op once secretId is set
@@ -64289,21 +64680,39 @@ function collectSecretIds(secrets) {
     return secret.secretId;
   });
 }
-function splitEnvDictAndResolvableSecrets(secrets) {
-  const envDict = {};
-  const resolvable = [];
-  for (const secret of secrets) {
+function resolvableSecrets(secrets) {
+  return secrets.filter(
+    (secret) => secret == null || secretEnvDictHydrator(secret) === void 0
+  );
+}
+function secretSources(secrets, env) {
+  const sources = [];
+  secrets.forEach((secret, i) => {
     const hydrator = secret != null ? secretEnvDictHydrator(secret) : void 0;
     if (hydrator !== void 0) {
-      Object.assign(envDict, hydrator.envDict);
-    } else {
-      for (const key of secret?._keys ?? []) {
-        delete envDict[key];
+      if (Object.keys(hydrator.envDict).length > 0) {
+        sources.push(
+          SecretSource.create({
+            env: StringMap.create({ contents: hydrator.envDict })
+          })
+        );
       }
-      resolvable.push(secret);
+      return;
+    }
+    if (secret == null) {
+      throw new InvalidError(`secret at index ${i} must not be null`);
+    }
+    if (secret.secretId === "") {
+      throw new InvalidError(`secret at index ${i} has not been hydrated`);
     }
+    sources.push(SecretSource.create({ secretId: secret.secretId }));
+  });
+  if (env && Object.keys(env).length > 0) {
+    sources.push(
+      SecretSource.create({ env: StringMap.create({ contents: env }) })
+    );
   }
-  return [envDict, resolvable];
+  return sources;
 }
 
 // src/image.ts
@@ -71744,16 +72153,14 @@ var SidecarService = class {
       }
     }
     validateEnvVarKeys(params?.env ?? {});
-    const [envDict, resolvableSecrets] = splitEnvDictAndResolvableSecrets(
-      params?.secrets ?? []
-    );
-    Object.assign(envDict, params?.env ?? {});
+    const resolvable = resolvableSecrets(params?.secrets ?? []);
     await hydrateSandboxSecrets(
       this.#access.client,
-      resolvableSecrets,
+      resolvable,
       params?.cloudBucketMounts
     );
-    const secretIds = collectSecretIds(resolvableSecrets);
+    const secretIds = collectSecretIds(resolvable);
+    const sources = secretSources(params?.secrets ?? [], params?.env);
     const volumeMounts = buildSidecarVolumeMounts(params?.volumes);
     const cloudBucketMounts = buildCloudBucketMountProtos(
       params?.cloudBucketMounts
@@ -71767,7 +72174,6 @@ var SidecarService = class {
     let resp;
     try {
       if (viaControlPlane) {
-        const ephemeralSecrets = Object.keys(envDict).length > 0 ? StringMap.create({ contents: envDict }) : void 0;
         resp = await this.#access.client.cpClient.sandboxContainerCreateV2(
           SandboxContainerCreateV2Request.create({
             sandboxId: this.#access.sandboxId,
@@ -71787,7 +72193,7 @@ var SidecarService = class {
                 memoryMb: params.experimentalMemoryReserveConsumeMiB
               }) : void 0
             }),
-            ephemeralSecrets
+            secretSources: sources
           })
         );
       } else {
@@ -71798,9 +72204,8 @@ var SidecarService = class {
             containerName: name,
             imageId: image.imageId,
             args: command,
-            env: envDict,
             workdir: params?.workdir ?? "",
-            secretIds,
+            secretSources: sources,
             volumeMounts,
             networkAccess,
             ptyInfo,
@@ -72595,16 +73000,15 @@ async function buildSandboxCreateRequestProto(appId, imageId, params = {}) {
     }
   });
 }
-async function buildSandboxCreateV2RequestProto(appId, imageId, params = {}) {
+async function buildSandboxCreateV2RequestProto(appId, imageId, params = {}, secretSources2 = []) {
   if (params.gpu) {
     throw new Error("GPUs are not supported by experimentalCreate");
   }
   const req = await buildSandboxCreateRequestProto(appId, imageId, params);
-  const ephemeralSecrets = params.env && Object.keys(params.env).length > 0 ? StringMap.create({ contents: params.env }) : void 0;
   return SandboxCreateV2Request.create({
     appId: req.appId,
     definition: req.definition,
-    ephemeralSecrets,
+    secretSources: secretSources2,
     tags: req.tags
   });
 }
@@ -72688,27 +73092,17 @@ var SandboxService = class {
   async experimentalCreate(app, image, params = {}) {
     await image.build(app);
     validateEnvVarKeys(params.env ?? {});
-    const [envDict, resolvableSecrets] = splitEnvDictAndResolvableSecrets(
-      params.secrets ?? []
-    );
-    Object.assign(envDict, params.env ?? {});
+    const resolvable = resolvableSecrets(params.secrets ?? []);
     await hydrateSandboxSecrets(
       this.#client,
-      [
-        ...resolvableSecrets,
-        ...params.experimentalOutboundPolicy?._secrets() ?? []
-      ],
+      [...resolvable, ...params.experimentalOutboundPolicy?._secrets() ?? []],
       params.cloudBucketMounts
     );
-    const mergedParams = {
-      ...params,
-      secrets: resolvableSecrets,
-      env: envDict
-    };
     const createReq = await buildSandboxCreateV2RequestProto(
       app.appId,
       image.imageId,
-      mergedParams
+      { ...params, secrets: resolvable },
+      secretSources(params.secrets ?? [], params.env)
     );
     let createResp;
     try {
@@ -73034,7 +73428,6 @@ function buildTaskExecStartRequestProto(taskId, execId, command, params, contain
     );
   }
   validateWorkdir(params?.workdir);
-  const secretIds = (params?.secrets || []).map((secret) => secret.secretId);
   const stdout = params?.stdout ?? "pipe";
   const stderr = params?.stderr ?? "pipe";
   let stdoutConfig;
@@ -73065,8 +73458,7 @@ function buildTaskExecStartRequestProto(taskId, execId, command, params, contain
     stderrConfig,
     timeoutSecs: params?.timeoutMs ? params.timeoutMs / 1e3 : void 0,
     workdir: params?.workdir,
-    secretIds,
-    env: params?.env ?? {},
+    secretSources: secretSources(params?.secrets ?? [], params?.env),
     ptyInfo,
     runtimeDebug: false,
     containerId: containerId ?? ""
@@ -73339,23 +73731,17 @@ var Sandbox2 = class {
     this.#ensureAttached();
     validateExecArgs(command);
     validateEnvVarKeys(params?.env ?? {});
-    const [envDict, resolvableSecrets] = splitEnvDictAndResolvableSecrets(
-      params?.secrets ?? []
+    await hydrateSecrets(
+      this.#client,
+      resolvableSecrets(params?.secrets ?? [])
     );
-    Object.assign(envDict, params?.env ?? {});
-    await hydrateSecrets(this.#client, resolvableSecrets);
-    const execParams = {
-      ...params,
-      env: envDict,
-      secrets: resolvableSecrets
-    };
     const [taskId, commandRouterClient] = await this.#getCommandRouter();
     const execId = uuidv42();
     const request = buildTaskExecStartRequestProto(
       taskId,
       execId,
       command,
-      execParams,
+      params,
       containerId
     );
     await commandRouterClient.execStart(request);
@@ -74543,7 +74929,7 @@ var AuthTokenManager = class {
 };
 
 // src/version.ts
-var SDK_VERSION = "0.11.1-dev.7";
+var SDK_VERSION = "0.11.1-dev.9";
 function getSDKVersion() {
   return SDK_VERSION;
 }