modal 0.11.1-dev.8 → 0.11.1-dev.9

package/dist/index.cjs

@@ -2236,6 +2236,9 @@ function environmentRoleFromJSON(object) {
     case 3:
     case "ENVIRONMENT_ROLE_NO_ACCESS":
       return 3 /* ENVIRONMENT_ROLE_NO_ACCESS */;
+    case 4:
+    case "ENVIRONMENT_ROLE_MODAL_ADMINISTERED_OBSERVER":
+      return 4 /* ENVIRONMENT_ROLE_MODAL_ADMINISTERED_OBSERVER */;
     case -1:
     case "UNRECOGNIZED":
     default:
@@ -2252,6 +2255,8 @@ function environmentRoleToJSON(object) {
       return "ENVIRONMENT_ROLE_CONTRIBUTOR";
     case 3 /* ENVIRONMENT_ROLE_NO_ACCESS */:
       return "ENVIRONMENT_ROLE_NO_ACCESS";
+    case 4 /* ENVIRONMENT_ROLE_MODAL_ADMINISTERED_OBSERVER */:
+      return "ENVIRONMENT_ROLE_MODAL_ADMINISTERED_OBSERVER";
     case -1 /* UNRECOGNIZED */:
     default:
       return "UNRECOGNIZED";
@@ -64581,7 +64586,7 @@ var SecretService = class {
         "secret_name",
         name
       );
-      return new Secret(resp.secretId, name, void 0, resp.metadata?.keys);
+      return new Secret(resp.secretId, name);
     } catch (err) {
       if (err instanceof import_nice_grpc2.ClientError && err.code === import_nice_grpc2.Status.NOT_FOUND)
         throw new NotFoundError(err.details);
@@ -64680,20 +64685,16 @@ var Secret = class {
   // constructed already-hydrated (e.g. from fromName), and not consulted again
   // once secretId is set.
   #hydrator;
-  // Names of the env vars a server-side Secret defines, as reported by the
-  // control plane on fromName. Undefined when unknown.
-  #keys;
   // Caches the single in-flight (or successfully completed) hydration so the
   // ephemeral Secret is created at most once, even if multiple callers hydrate
   // the same Secret concurrently. Cleared on failure so a transient error
   // doesn't permanently break the Secret; subsequent calls can retry.
   #hydratePromise;
   /** @ignore */
-  constructor(secretId, name, hydrator, keys) {
+  constructor(secretId, name, hydrator) {
     this.#secretId = secretId;
     this.name = name;
     this.#hydrator = hydrator;
-    this.#keys = keys !== void 0 ? new Set(keys) : void 0;
   }
   /** The ID of the server-side Secret, or an empty string if not yet hydrated. */
   get secretId() {
@@ -64709,16 +64710,6 @@ var Secret = class {
   get _hydrator() {
     return this.#hydrator;
   }
-  /**
-   * Names of the env vars this server-side Secret defines, or `undefined` if
-   * unknown (e.g. for lazy fromObject Secrets or Secrets constructed by id).
-   *
-   * @internal
-   * @hidden
-   */
-  get _keys() {
-    return this.#keys;
-  }
   /**
    * Lazily create the ephemeral server-side Secret backing a fromObject Secret
    * and populate {@link Secret#secretId secretId}. A no-op once secretId is set
@@ -64778,21 +64769,39 @@ function collectSecretIds(secrets) {
     return secret.secretId;
   });
 }
-function splitEnvDictAndResolvableSecrets(secrets) {
-  const envDict = {};
-  const resolvable = [];
-  for (const secret of secrets) {
+function resolvableSecrets(secrets) {
+  return secrets.filter(
+    (secret) => secret == null || secretEnvDictHydrator(secret) === void 0
+  );
+}
+function secretSources(secrets, env) {
+  const sources = [];
+  secrets.forEach((secret, i) => {
     const hydrator = secret != null ? secretEnvDictHydrator(secret) : void 0;
     if (hydrator !== void 0) {
-      Object.assign(envDict, hydrator.envDict);
-    } else {
-      for (const key of secret?._keys ?? []) {
-        delete envDict[key];
+      if (Object.keys(hydrator.envDict).length > 0) {
+        sources.push(
+          SecretSource.create({
+            env: StringMap.create({ contents: hydrator.envDict })
+          })
+        );
       }
-      resolvable.push(secret);
+      return;
     }
+    if (secret == null) {
+      throw new InvalidError(`secret at index ${i} must not be null`);
+    }
+    if (secret.secretId === "") {
+      throw new InvalidError(`secret at index ${i} has not been hydrated`);
+    }
+    sources.push(SecretSource.create({ secretId: secret.secretId }));
+  });
+  if (env && Object.keys(env).length > 0) {
+    sources.push(
+      SecretSource.create({ env: StringMap.create({ contents: env }) })
+    );
   }
-  return [envDict, resolvable];
+  return sources;
 }
 
 // src/image.ts
@@ -72226,16 +72235,14 @@ var SidecarService = class {
       }
     }
     validateEnvVarKeys(params?.env ?? {});
-    const [envDict, resolvableSecrets] = splitEnvDictAndResolvableSecrets(
-      params?.secrets ?? []
-    );
-    Object.assign(envDict, params?.env ?? {});
+    const resolvable = resolvableSecrets(params?.secrets ?? []);
     await hydrateSandboxSecrets(
       this.#access.client,
-      resolvableSecrets,
+      resolvable,
       params?.cloudBucketMounts
     );
-    const secretIds = collectSecretIds(resolvableSecrets);
+    const secretIds = collectSecretIds(resolvable);
+    const sources = secretSources(params?.secrets ?? [], params?.env);
     const volumeMounts = buildSidecarVolumeMounts(params?.volumes);
     const cloudBucketMounts = buildCloudBucketMountProtos(
       params?.cloudBucketMounts
@@ -72249,7 +72256,6 @@ var SidecarService = class {
     let resp;
     try {
       if (viaControlPlane) {
-        const ephemeralSecrets = Object.keys(envDict).length > 0 ? StringMap.create({ contents: envDict }) : void 0;
         resp = await this.#access.client.cpClient.sandboxContainerCreateV2(
           SandboxContainerCreateV2Request.create({
             sandboxId: this.#access.sandboxId,
@@ -72269,7 +72275,7 @@ var SidecarService = class {
                 memoryMb: params.experimentalMemoryReserveConsumeMiB
               }) : void 0
             }),
-            ephemeralSecrets
+            secretSources: sources
           })
         );
       } else {
@@ -72280,9 +72286,8 @@ var SidecarService = class {
             containerName: name,
             imageId: image.imageId,
             args: command,
-            env: envDict,
             workdir: params?.workdir ?? "",
-            secretIds,
+            secretSources: sources,
             volumeMounts,
             networkAccess,
             ptyInfo,
@@ -73077,16 +73082,15 @@ async function buildSandboxCreateRequestProto(appId, imageId, params = {}) {
     }
   });
 }
-async function buildSandboxCreateV2RequestProto(appId, imageId, params = {}) {
+async function buildSandboxCreateV2RequestProto(appId, imageId, params = {}, secretSources2 = []) {
   if (params.gpu) {
     throw new Error("GPUs are not supported by experimentalCreate");
   }
   const req = await buildSandboxCreateRequestProto(appId, imageId, params);
-  const ephemeralSecrets = params.env && Object.keys(params.env).length > 0 ? StringMap.create({ contents: params.env }) : void 0;
   return SandboxCreateV2Request.create({
     appId: req.appId,
     definition: req.definition,
-    ephemeralSecrets,
+    secretSources: secretSources2,
     tags: req.tags
   });
 }
@@ -73170,27 +73174,17 @@ var SandboxService = class {
   async experimentalCreate(app, image, params = {}) {
     await image.build(app);
     validateEnvVarKeys(params.env ?? {});
-    const [envDict, resolvableSecrets] = splitEnvDictAndResolvableSecrets(
-      params.secrets ?? []
-    );
-    Object.assign(envDict, params.env ?? {});
+    const resolvable = resolvableSecrets(params.secrets ?? []);
     await hydrateSandboxSecrets(
       this.#client,
-      [
-        ...resolvableSecrets,
-        ...params.experimentalOutboundPolicy?._secrets() ?? []
-      ],
+      [...resolvable, ...params.experimentalOutboundPolicy?._secrets() ?? []],
       params.cloudBucketMounts
     );
-    const mergedParams = {
-      ...params,
-      secrets: resolvableSecrets,
-      env: envDict
-    };
     const createReq = await buildSandboxCreateV2RequestProto(
       app.appId,
       image.imageId,
-      mergedParams
+      { ...params, secrets: resolvable },
+      secretSources(params.secrets ?? [], params.env)
     );
     let createResp;
     try {
@@ -73516,7 +73510,6 @@ function buildTaskExecStartRequestProto(taskId, execId, command, params, contain
     );
   }
   validateWorkdir(params?.workdir);
-  const secretIds = (params?.secrets || []).map((secret) => secret.secretId);
   const stdout = params?.stdout ?? "pipe";
   const stderr = params?.stderr ?? "pipe";
   let stdoutConfig;
@@ -73547,8 +73540,7 @@ function buildTaskExecStartRequestProto(taskId, execId, command, params, contain
     stderrConfig,
     timeoutSecs: params?.timeoutMs ? params.timeoutMs / 1e3 : void 0,
     workdir: params?.workdir,
-    secretIds,
-    env: params?.env ?? {},
+    secretSources: secretSources(params?.secrets ?? [], params?.env),
     ptyInfo,
     runtimeDebug: false,
     containerId: containerId ?? ""
@@ -73821,23 +73813,17 @@ var Sandbox2 = class {
     this.#ensureAttached();
     validateExecArgs(command);
     validateEnvVarKeys(params?.env ?? {});
-    const [envDict, resolvableSecrets] = splitEnvDictAndResolvableSecrets(
-      params?.secrets ?? []
+    await hydrateSecrets(
+      this.#client,
+      resolvableSecrets(params?.secrets ?? [])
     );
-    Object.assign(envDict, params?.env ?? {});
-    await hydrateSecrets(this.#client, resolvableSecrets);
-    const execParams = {
-      ...params,
-      env: envDict,
-      secrets: resolvableSecrets
-    };
     const [taskId, commandRouterClient] = await this.#getCommandRouter();
     const execId = (0, import_uuid2.v4)();
     const request = buildTaskExecStartRequestProto(
       taskId,
       execId,
       command,
-      execParams,
+      params,
       containerId
     );
     await commandRouterClient.execStart(request);
@@ -75025,7 +75011,7 @@ var AuthTokenManager = class {
 };
 
 // src/version.ts
-var SDK_VERSION = "0.11.1-dev.8";
+var SDK_VERSION = "0.11.1-dev.9";
 function getSDKVersion() {
   return SDK_VERSION;
 }

package/dist/index.d.cts

@@ -207,6 +207,7 @@ declare enum EnvironmentRole {
     ENVIRONMENT_ROLE_VIEWER = 1,
     ENVIRONMENT_ROLE_CONTRIBUTOR = 2,
     ENVIRONMENT_ROLE_NO_ACCESS = 3,
+    ENVIRONMENT_ROLE_MODAL_ADMINISTERED_OBSERVER = 4,
     UNRECOGNIZED = -1
 }
 /**
@@ -7358,7 +7359,7 @@ declare class Secret {
     #private;
     readonly name?: string;
     /** @ignore */
-    constructor(secretId: string, name?: string, hydrator?: SecretHydrator, keys?: readonly string[]);
+    constructor(secretId: string, name?: string, hydrator?: SecretHydrator);
     /** The ID of the server-side Secret, or an empty string if not yet hydrated. */
     get secretId(): string;
     /**
@@ -7369,14 +7370,6 @@ declare class Secret {
      * @hidden
      */
     get _hydrator(): SecretHydrator | undefined;
-    /**
-     * Names of the env vars this server-side Secret defines, or `undefined` if
-     * unknown (e.g. for lazy fromObject Secrets or Secrets constructed by id).
-     *
-     * @internal
-     * @hidden
-     */
-    get _keys(): ReadonlySet<string> | undefined;
     /**
      * Lazily create the ephemeral server-side Secret backing a fromObject Secret
      * and populate {@link Secret#secretId secretId}. A no-op once secretId is set

package/dist/index.d.ts

@@ -207,6 +207,7 @@ declare enum EnvironmentRole {
     ENVIRONMENT_ROLE_VIEWER = 1,
     ENVIRONMENT_ROLE_CONTRIBUTOR = 2,
     ENVIRONMENT_ROLE_NO_ACCESS = 3,
+    ENVIRONMENT_ROLE_MODAL_ADMINISTERED_OBSERVER = 4,
     UNRECOGNIZED = -1
 }
 /**
@@ -7358,7 +7359,7 @@ declare class Secret {
     #private;
     readonly name?: string;
     /** @ignore */
-    constructor(secretId: string, name?: string, hydrator?: SecretHydrator, keys?: readonly string[]);
+    constructor(secretId: string, name?: string, hydrator?: SecretHydrator);
     /** The ID of the server-side Secret, or an empty string if not yet hydrated. */
     get secretId(): string;
     /**
@@ -7369,14 +7370,6 @@ declare class Secret {
      * @hidden
      */
     get _hydrator(): SecretHydrator | undefined;
-    /**
-     * Names of the env vars this server-side Secret defines, or `undefined` if
-     * unknown (e.g. for lazy fromObject Secrets or Secrets constructed by id).
-     *
-     * @internal
-     * @hidden
-     */
-    get _keys(): ReadonlySet<string> | undefined;
     /**
      * Lazily create the ephemeral server-side Secret backing a fromObject Secret
      * and populate {@link Secret#secretId secretId}. A no-op once secretId is set

package/dist/index.js

@@ -2141,6 +2141,9 @@ function environmentRoleFromJSON(object) {
     case 3:
     case "ENVIRONMENT_ROLE_NO_ACCESS":
       return 3 /* ENVIRONMENT_ROLE_NO_ACCESS */;
+    case 4:
+    case "ENVIRONMENT_ROLE_MODAL_ADMINISTERED_OBSERVER":
+      return 4 /* ENVIRONMENT_ROLE_MODAL_ADMINISTERED_OBSERVER */;
     case -1:
     case "UNRECOGNIZED":
     default:
@@ -2157,6 +2160,8 @@ function environmentRoleToJSON(object) {
       return "ENVIRONMENT_ROLE_CONTRIBUTOR";
     case 3 /* ENVIRONMENT_ROLE_NO_ACCESS */:
       return "ENVIRONMENT_ROLE_NO_ACCESS";
+    case 4 /* ENVIRONMENT_ROLE_MODAL_ADMINISTERED_OBSERVER */:
+      return "ENVIRONMENT_ROLE_MODAL_ADMINISTERED_OBSERVER";
     case -1 /* UNRECOGNIZED */:
     default:
       return "UNRECOGNIZED";
@@ -64492,7 +64497,7 @@ var SecretService = class {
         "secret_name",
         name
       );
-      return new Secret(resp.secretId, name, void 0, resp.metadata?.keys);
+      return new Secret(resp.secretId, name);
     } catch (err) {
       if (err instanceof ClientError2 && err.code === Status2.NOT_FOUND)
         throw new NotFoundError(err.details);
@@ -64591,20 +64596,16 @@ var Secret = class {
   // constructed already-hydrated (e.g. from fromName), and not consulted again
   // once secretId is set.
   #hydrator;
-  // Names of the env vars a server-side Secret defines, as reported by the
-  // control plane on fromName. Undefined when unknown.
-  #keys;
   // Caches the single in-flight (or successfully completed) hydration so the
   // ephemeral Secret is created at most once, even if multiple callers hydrate
   // the same Secret concurrently. Cleared on failure so a transient error
   // doesn't permanently break the Secret; subsequent calls can retry.
   #hydratePromise;
   /** @ignore */
-  constructor(secretId, name, hydrator, keys) {
+  constructor(secretId, name, hydrator) {
     this.#secretId = secretId;
     this.name = name;
     this.#hydrator = hydrator;
-    this.#keys = keys !== void 0 ? new Set(keys) : void 0;
   }
   /** The ID of the server-side Secret, or an empty string if not yet hydrated. */
   get secretId() {
@@ -64620,16 +64621,6 @@ var Secret = class {
   get _hydrator() {
     return this.#hydrator;
   }
-  /**
-   * Names of the env vars this server-side Secret defines, or `undefined` if
-   * unknown (e.g. for lazy fromObject Secrets or Secrets constructed by id).
-   *
-   * @internal
-   * @hidden
-   */
-  get _keys() {
-    return this.#keys;
-  }
   /**
    * Lazily create the ephemeral server-side Secret backing a fromObject Secret
    * and populate {@link Secret#secretId secretId}. A no-op once secretId is set
@@ -64689,21 +64680,39 @@ function collectSecretIds(secrets) {
     return secret.secretId;
   });
 }
-function splitEnvDictAndResolvableSecrets(secrets) {
-  const envDict = {};
-  const resolvable = [];
-  for (const secret of secrets) {
+function resolvableSecrets(secrets) {
+  return secrets.filter(
+    (secret) => secret == null || secretEnvDictHydrator(secret) === void 0
+  );
+}
+function secretSources(secrets, env) {
+  const sources = [];
+  secrets.forEach((secret, i) => {
     const hydrator = secret != null ? secretEnvDictHydrator(secret) : void 0;
     if (hydrator !== void 0) {
-      Object.assign(envDict, hydrator.envDict);
-    } else {
-      for (const key of secret?._keys ?? []) {
-        delete envDict[key];
+      if (Object.keys(hydrator.envDict).length > 0) {
+        sources.push(
+          SecretSource.create({
+            env: StringMap.create({ contents: hydrator.envDict })
+          })
+        );
       }
-      resolvable.push(secret);
+      return;
     }
+    if (secret == null) {
+      throw new InvalidError(`secret at index ${i} must not be null`);
+    }
+    if (secret.secretId === "") {
+      throw new InvalidError(`secret at index ${i} has not been hydrated`);
+    }
+    sources.push(SecretSource.create({ secretId: secret.secretId }));
+  });
+  if (env && Object.keys(env).length > 0) {
+    sources.push(
+      SecretSource.create({ env: StringMap.create({ contents: env }) })
+    );
   }
-  return [envDict, resolvable];
+  return sources;
 }
 
 // src/image.ts
@@ -72144,16 +72153,14 @@ var SidecarService = class {
       }
     }
     validateEnvVarKeys(params?.env ?? {});
-    const [envDict, resolvableSecrets] = splitEnvDictAndResolvableSecrets(
-      params?.secrets ?? []
-    );
-    Object.assign(envDict, params?.env ?? {});
+    const resolvable = resolvableSecrets(params?.secrets ?? []);
     await hydrateSandboxSecrets(
       this.#access.client,
-      resolvableSecrets,
+      resolvable,
       params?.cloudBucketMounts
     );
-    const secretIds = collectSecretIds(resolvableSecrets);
+    const secretIds = collectSecretIds(resolvable);
+    const sources = secretSources(params?.secrets ?? [], params?.env);
     const volumeMounts = buildSidecarVolumeMounts(params?.volumes);
     const cloudBucketMounts = buildCloudBucketMountProtos(
       params?.cloudBucketMounts
@@ -72167,7 +72174,6 @@ var SidecarService = class {
     let resp;
     try {
       if (viaControlPlane) {
-        const ephemeralSecrets = Object.keys(envDict).length > 0 ? StringMap.create({ contents: envDict }) : void 0;
         resp = await this.#access.client.cpClient.sandboxContainerCreateV2(
           SandboxContainerCreateV2Request.create({
             sandboxId: this.#access.sandboxId,
@@ -72187,7 +72193,7 @@ var SidecarService = class {
                 memoryMb: params.experimentalMemoryReserveConsumeMiB
               }) : void 0
             }),
-            ephemeralSecrets
+            secretSources: sources
           })
         );
       } else {
@@ -72198,9 +72204,8 @@ var SidecarService = class {
             containerName: name,
             imageId: image.imageId,
             args: command,
-            env: envDict,
             workdir: params?.workdir ?? "",
-            secretIds,
+            secretSources: sources,
             volumeMounts,
             networkAccess,
             ptyInfo,
@@ -72995,16 +73000,15 @@ async function buildSandboxCreateRequestProto(appId, imageId, params = {}) {
     }
   });
 }
-async function buildSandboxCreateV2RequestProto(appId, imageId, params = {}) {
+async function buildSandboxCreateV2RequestProto(appId, imageId, params = {}, secretSources2 = []) {
   if (params.gpu) {
     throw new Error("GPUs are not supported by experimentalCreate");
   }
   const req = await buildSandboxCreateRequestProto(appId, imageId, params);
-  const ephemeralSecrets = params.env && Object.keys(params.env).length > 0 ? StringMap.create({ contents: params.env }) : void 0;
   return SandboxCreateV2Request.create({
     appId: req.appId,
     definition: req.definition,
-    ephemeralSecrets,
+    secretSources: secretSources2,
     tags: req.tags
   });
 }
@@ -73088,27 +73092,17 @@ var SandboxService = class {
   async experimentalCreate(app, image, params = {}) {
     await image.build(app);
     validateEnvVarKeys(params.env ?? {});
-    const [envDict, resolvableSecrets] = splitEnvDictAndResolvableSecrets(
-      params.secrets ?? []
-    );
-    Object.assign(envDict, params.env ?? {});
+    const resolvable = resolvableSecrets(params.secrets ?? []);
     await hydrateSandboxSecrets(
       this.#client,
-      [
-        ...resolvableSecrets,
-        ...params.experimentalOutboundPolicy?._secrets() ?? []
-      ],
+      [...resolvable, ...params.experimentalOutboundPolicy?._secrets() ?? []],
       params.cloudBucketMounts
     );
-    const mergedParams = {
-      ...params,
-      secrets: resolvableSecrets,
-      env: envDict
-    };
     const createReq = await buildSandboxCreateV2RequestProto(
       app.appId,
       image.imageId,
-      mergedParams
+      { ...params, secrets: resolvable },
+      secretSources(params.secrets ?? [], params.env)
     );
     let createResp;
     try {
@@ -73434,7 +73428,6 @@ function buildTaskExecStartRequestProto(taskId, execId, command, params, contain
     );
   }
   validateWorkdir(params?.workdir);
-  const secretIds = (params?.secrets || []).map((secret) => secret.secretId);
   const stdout = params?.stdout ?? "pipe";
   const stderr = params?.stderr ?? "pipe";
   let stdoutConfig;
@@ -73465,8 +73458,7 @@ function buildTaskExecStartRequestProto(taskId, execId, command, params, contain
     stderrConfig,
     timeoutSecs: params?.timeoutMs ? params.timeoutMs / 1e3 : void 0,
     workdir: params?.workdir,
-    secretIds,
-    env: params?.env ?? {},
+    secretSources: secretSources(params?.secrets ?? [], params?.env),
     ptyInfo,
     runtimeDebug: false,
     containerId: containerId ?? ""
@@ -73739,23 +73731,17 @@ var Sandbox2 = class {
     this.#ensureAttached();
     validateExecArgs(command);
     validateEnvVarKeys(params?.env ?? {});
-    const [envDict, resolvableSecrets] = splitEnvDictAndResolvableSecrets(
-      params?.secrets ?? []
+    await hydrateSecrets(
+      this.#client,
+      resolvableSecrets(params?.secrets ?? [])
     );
-    Object.assign(envDict, params?.env ?? {});
-    await hydrateSecrets(this.#client, resolvableSecrets);
-    const execParams = {
-      ...params,
-      env: envDict,
-      secrets: resolvableSecrets
-    };
     const [taskId, commandRouterClient] = await this.#getCommandRouter();
     const execId = uuidv42();
     const request = buildTaskExecStartRequestProto(
       taskId,
       execId,
       command,
-      execParams,
+      params,
       containerId
     );
     await commandRouterClient.execStart(request);
@@ -74943,7 +74929,7 @@ var AuthTokenManager = class {
 };
 
 // src/version.ts
-var SDK_VERSION = "0.11.1-dev.8";
+var SDK_VERSION = "0.11.1-dev.9";
 function getSDKVersion() {
   return SDK_VERSION;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "modal",
-  "version": "0.11.1-dev.8",
+  "version": "0.11.1-dev.9",
   "description": "Modal SDK for JavaScript/TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://modal.com/docs/guide/sdk-javascript-go",