chalkcompute 2.3.3__tar.gz → 2.3.4__tar.gz

{chalkcompute-2.3.3 → chalkcompute-2.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: chalkcompute
-Version: 2.3.3
+Version: 2.3.4
 Requires-Dist: grpcio>=1.60.0
 Requires-Dist: protobuf>=4.25.0
 Requires-Dist: httpx>=0.25.0

{chalkcompute-2.3.3 → chalkcompute-2.3.4}/chalkcompute/__init__.py

@@ -9,6 +9,11 @@ _setup_logging()
 # Keep top-level imports lazy so `import chalkcompute` does not eagerly import
 # the grpc/protobuf/client modules. Update `__init__.pyi` when adding exports.
 _LAZY_MAP: dict[str, tuple[str, str]] = {
+    # _artifact.py
+    "Artifact": ("chalkcompute._artifact", "Artifact"),
+    "ArtifactClient": ("chalkcompute._artifact", "ArtifactClient"),
+    "ArtifactError": ("chalkcompute._artifact", "ArtifactError"),
+    "ArtifactNotFoundError": ("chalkcompute._artifact", "ArtifactNotFoundError"),
     # _container.py
     "Container": ("chalkcompute._container", "Container"),
     "ContainerError": ("chalkcompute._container", "ContainerError"),
@@ -71,12 +76,15 @@ _LAZY_MAP: dict[str, tuple[str, str]] = {
     "LazyLocalFile": ("chalkcompute._image", "LazyLocalFile"),
     # _secret.py
     "Secret": ("chalkcompute._secret", "Secret"),
+    "SecretScope": ("chalkcompute._secret", "SecretScope"),
     "resolve_lazy_secrets": ("chalkcompute._secret", "resolve_lazy_secrets"),
     # _sandbox.py
     "ExecError": ("chalkcompute._sandbox", "ExecError"),
     "ExecEvent": ("chalkcompute._sandbox", "ExecEvent"),
     "ExecProcess": ("chalkcompute._sandbox", "ExecProcess"),
     "ExecResult": ("chalkcompute._sandbox", "ExecResult"),
+    "PythonExecution": ("chalkcompute._sandbox", "PythonExecution"),
+    "PythonSkippedArtifact": ("chalkcompute._sandbox", "PythonSkippedArtifact"),
     "Sandbox": ("chalkcompute._sandbox", "Sandbox"),
     "SandboxBuildError": ("chalkcompute._sandbox", "SandboxBuildError"),
     "SandboxClient": ("chalkcompute._sandbox", "SandboxClient"),
@@ -89,6 +97,7 @@ _LAZY_MAP: dict[str, tuple[str, str]] = {
     "ScalingGroupBuildError": ("chalkcompute._scaling_group", "ScalingGroupBuildError"),
     "ScalingGroupError": ("chalkcompute._scaling_group", "ScalingGroupError"),
     "ScalingGroupInfo": ("chalkcompute._scaling_group", "ScalingGroupInfo"),
+    "ReadinessProbe": ("chalkcompute._scaling_group", "ReadinessProbe"),
     # _volume.py
     "FileInfo": ("chalkcompute._volume", "FileInfo"),
     "Volume": ("chalkcompute._volume", "make_volume"),

{chalkcompute-2.3.3 → chalkcompute-2.3.4}/chalkcompute/__init__.pyi

@@ -1,3 +1,7 @@
+from chalkcompute._artifact import Artifact as Artifact
+from chalkcompute._artifact import ArtifactClient as ArtifactClient
+from chalkcompute._artifact import ArtifactError as ArtifactError
+from chalkcompute._artifact import ArtifactNotFoundError as ArtifactNotFoundError
 from chalkcompute._cls import ClassBuildError as ClassBuildError
 from chalkcompute._cls import ClassError as ClassError
 from chalkcompute._cls import RemoteClass as RemoteClass
@@ -47,6 +51,8 @@ from chalkcompute._sandbox import ExecError as ExecError
 from chalkcompute._sandbox import ExecEvent as ExecEvent
 from chalkcompute._sandbox import ExecProcess as ExecProcess
 from chalkcompute._sandbox import ExecResult as ExecResult
+from chalkcompute._sandbox import PythonExecution as PythonExecution
+from chalkcompute._sandbox import PythonSkippedArtifact as PythonSkippedArtifact
 from chalkcompute._sandbox import Sandbox as Sandbox
 from chalkcompute._sandbox import SandboxBuildError as SandboxBuildError
 from chalkcompute._sandbox import SandboxClient as SandboxClient
@@ -58,7 +64,9 @@ from chalkcompute._scaling_group import ScalingGroup as ScalingGroup
 from chalkcompute._scaling_group import ScalingGroupBuildError as ScalingGroupBuildError
 from chalkcompute._scaling_group import ScalingGroupError as ScalingGroupError
 from chalkcompute._scaling_group import ScalingGroupInfo as ScalingGroupInfo
+from chalkcompute._scaling_group import ReadinessProbe as ReadinessProbe
 from chalkcompute._secret import Secret as Secret
+from chalkcompute._secret import SecretScope as SecretScope
 from chalkcompute._secret import resolve_lazy_secrets as resolve_lazy_secrets
 from chalkcompute._tracing import span as span
 from chalkcompute._tracing import traced as traced
@@ -79,6 +87,10 @@ from chalkcompute._vvolume import VersionedVolume as VersionedVolume
 from chalkcompute._vvolume import VersionedVolumeClient as VersionedVolumeClient
 
 __all__ = [
+    "Artifact",
+    "ArtifactClient",
+    "ArtifactError",
+    "ArtifactNotFoundError",
     "Container",
     "ContainerError",
     "ContainerInfo",
@@ -123,11 +135,14 @@ __all__ = [
     "Image",
     "LazyLocalFile",
     "Secret",
+    "SecretScope",
     "resolve_lazy_secrets",
     "ExecError",
     "ExecEvent",
     "ExecProcess",
     "ExecResult",
+    "PythonExecution",
+    "PythonSkippedArtifact",
     "Sandbox",
     "SandboxBuildError",
     "SandboxClient",
@@ -139,6 +154,7 @@ __all__ = [
     "ScalingGroupBuildError",
     "ScalingGroupError",
     "ScalingGroupInfo",
+    "ReadinessProbe",
     "FileInfo",
     "Volume",
     "SimpleVolume",

chalkcompute-2.3.4/chalkcompute/_artifact.py

@@ -0,0 +1,352 @@
+"""
+Client for the Chalk artifact store (chalk.artifactstore.v1.ArtifactService).
+
+Artifacts are durable, environment-scoped outputs: charts captured from
+``Sandbox.execute_python``, files saved with the in-sandbox ``save_artifact``
+helper, or content stored directly through :meth:`ArtifactClient.create`.
+
+Usage:
+    from chalkcompute import ArtifactClient, Sandbox
+
+    sandbox = Sandbox(image="python:3.12-slim").run()
+    execution = sandbox.execute_python(
+        "import altair as alt..."
+    )
+    for chart in execution.charts:
+        print(chart.name, chart.chart_encoding)
+
+    client = ArtifactClient.from_env()
+    for artifact in client.list(kinds=["chart"]):
+        print(artifact.id, artifact.name)
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterator
+from dataclasses import dataclass, field
+from typing import Any
+
+import grpc
+
+from chalkcompute._connect import (
+    ConnectClient,
+    grpc_target_from_url,
+    raise_for_grpc_error,
+)
+from chalkcompute._gen.chalk.artifactstore.v1 import service_pb2 as pb
+from chalkcompute._gen.chalk.artifactstore.v1 import service_pb2_grpc as pb_grpc
+from chalkcompute._tracing import _instrumented
+
+# Aliases defined before ArtifactClient, which has a ``.list()`` method that
+# would otherwise shadow the builtin ``list`` in class-scope name resolution.
+_GrpcMetadata = list[tuple[str, str]]
+_StrList = list[str]
+
+_KIND_TO_PROTO: dict[str, pb.ArtifactKind] = {
+    "file": pb.ARTIFACT_KIND_FILE,
+    "chart": pb.ARTIFACT_KIND_CHART,
+    "html": pb.ARTIFACT_KIND_HTML,
+    "image": pb.ARTIFACT_KIND_IMAGE,
+}
+_KIND_FROM_PROTO: dict[pb.ArtifactKind, str] = {v: k for k, v in _KIND_TO_PROTO.items()}
+
+_PRODUCER_TO_PROTO: dict[str, pb.ArtifactProducer] = {
+    "user": pb.ARTIFACT_PRODUCER_USER,
+    "system": pb.ARTIFACT_PRODUCER_SYSTEM,
+}
+_PRODUCER_FROM_PROTO: dict[pb.ArtifactProducer, str] = {
+    v: k for k, v in _PRODUCER_TO_PROTO.items()
+}
+
+
+class ArtifactError(Exception):
+    """Base exception for artifact store errors."""
+
+    pass
+
+
+class ArtifactNotFoundError(ArtifactError):
+    """Raised when an artifact is not found."""
+
+    pass
+
+
+@dataclass
+class Artifact:
+    """A stored artifact.
+
+    Small artifacts carry their content inline in ``data``; larger ones are
+    blob-backed and fetched on :meth:`download`.
+    """
+
+    id: str
+    """Artifact identifier."""
+
+    name: str
+    """User-facing label."""
+
+    kind: str
+    """One of ``"file"``, ``"chart"``, ``"html"``, ``"image"``."""
+
+    producer: str
+    """``"user"`` (saved explicitly) or ``"system"`` (discovered by Chalk)."""
+
+    content_type: str
+    """MIME type of the content."""
+
+    byte_size: int
+    """Content size in bytes."""
+
+    sandbox_id: str | None = None
+    """The sandbox that produced this artifact, when it came from one."""
+
+    execution_id: str | None = None
+    """The ExecutePython execution that produced this artifact, if any."""
+
+    chart_encoding: str | None = None
+    """For charts: ``"vega_lite"``, ``"tabular"``, or ``"plotly"``."""
+
+    chart_variable_name: str | None = None
+    """For captured charts: the variable the figure was bound to."""
+
+    data: bytes | None = None
+    """Inline content, when the artifact is small enough to travel inline."""
+
+    _client: ArtifactClient | None = field(default=None, repr=False, compare=False)
+
+    def download(self) -> bytes:
+        """Return the artifact's content bytes, fetching them if not inline."""
+        if self.data is not None:
+            return self.data
+        if self._client is None:
+            raise ArtifactError(
+                "Artifact has no attached client. Fetch it via ArtifactClient to download content."
+            )
+        self.data = self._client.download(self.id)
+        return self.data
+
+
+def _artifact_from_proto(msg: pb.Artifact, client: ArtifactClient | None) -> Artifact:
+    chart_encoding: str | None = None
+    chart_variable_name: str | None = None
+    if msg.HasField("chart"):
+        chart_variable_name = msg.chart.variable_name or None
+        which = msg.chart.WhichOneof("chart")
+        if which == "vega_lite":
+            chart_encoding = "vega_lite"
+        elif which == "tabular":
+            chart_encoding = "tabular"
+        elif which == "plotly":
+            chart_encoding = "plotly"
+
+    sandbox_id: str | None = None
+    execution_id: str | None = None
+    if msg.origin.WhichOneof("origin") == "sandbox_exec":
+        sandbox_id = msg.origin.sandbox_exec.sandbox_id or None
+        execution_id = msg.origin.sandbox_exec.execution_id or None
+
+    data: bytes | None = None
+    byte_size = 0
+    if msg.WhichOneof("content") == "inline":
+        data = msg.inline.data
+        byte_size = len(data)
+    elif msg.WhichOneof("content") == "blob":
+        byte_size = msg.blob.byte_size
+
+    return Artifact(
+        id=msg.id,
+        name=msg.name,
+        kind=_KIND_FROM_PROTO.get(msg.kind, "file"),
+        producer=_PRODUCER_FROM_PROTO.get(msg.producer, "user"),
+        content_type=msg.content_type,
+        byte_size=byte_size,
+        sandbox_id=sandbox_id,
+        execution_id=execution_id,
+        chart_encoding=chart_encoding,
+        chart_variable_name=chart_variable_name,
+        data=data,
+        _client=client,
+    )
+
+
+class ArtifactClient:
+    """Client for the artifact store gRPC service."""
+
+    def __init__(
+        self,
+        target: str = "localhost:50051",
+        *,
+        credentials: grpc.ChannelCredentials | None = None,
+        metadata: _GrpcMetadata | None = None,
+    ) -> None:
+        self._target = target
+        self._metadata = metadata
+        if credentials is not None:
+            self._channel = grpc.secure_channel(target, credentials)
+        else:
+            self._channel = grpc.insecure_channel(target)
+        self._stub = pb_grpc.ArtifactServiceStub(self._channel)
+
+    @classmethod
+    def _from_channel(
+        cls, channel: grpc.Channel, metadata: _GrpcMetadata | None
+    ) -> ArtifactClient:
+        """Internal: wrap an existing authenticated channel (no new connection)."""
+        client = cls.__new__(cls)
+        client._target = ""
+        client._metadata = metadata
+        client._channel = channel
+        client._stub = pb_grpc.ArtifactServiceStub(channel)
+        return client
+
+    @classmethod
+    def from_env(cls, *, chalk_client: Any | None = None) -> ArtifactClient:
+        """Create an ``ArtifactClient`` from ambient Chalk credentials."""
+        connect = ConnectClient(chalk_client=chalk_client)
+        connect._ensure_auth()
+        host, use_tls = grpc_target_from_url(connect._api_server or "")
+        return cls(
+            host,
+            credentials=grpc.ssl_channel_credentials() if use_tls else None,
+            metadata=[
+                ("authorization", f"Bearer {connect._access_token}"),
+                ("x-chalk-env-id", connect._env_id or ""),
+                ("x-chalk-server", "go-api"),
+            ],
+        )
+
+    def __enter__(self) -> ArtifactClient:
+        return self
+
+    def __exit__(self, *_args: object) -> None:
+        self.close()
+
+    def close(self) -> None:
+        """Close the gRPC channel."""
+        self._channel.close()
+
+    @_instrumented("chalkcompute.artifact.create")
+    def create(
+        self,
+        data: bytes | str,
+        *,
+        name: str,
+        kind: str = "file",
+        content_type: str = "application/octet-stream",
+    ) -> Artifact:
+        """Store an artifact with inline content (up to a few MiB)."""
+        if isinstance(data, str):
+            data = data.encode("utf-8")
+        if kind not in _KIND_TO_PROTO:
+            raise ArtifactError(
+                f"unknown artifact kind {kind!r}; expected one of {sorted(_KIND_TO_PROTO)}"
+            )
+        spec = pb.Artifact(
+            name=name,
+            kind=_KIND_TO_PROTO[kind],
+            producer=pb.ARTIFACT_PRODUCER_USER,
+            content_type=content_type,
+            inline=pb.ArtifactInlineContent(data=data),
+        )
+        try:
+            resp = self._stub.CreateArtifact(
+                pb.CreateArtifactRequest(artifact=spec), metadata=self._metadata
+            )
+        except grpc.RpcError as e:
+            _handle_artifact_rpc_error(e, name)
+            raise
+        return _artifact_from_proto(resp.artifact, self)
+
+    @_instrumented("chalkcompute.artifact.get")
+    def get(self, artifact_id: str) -> Artifact:
+        """Fetch a single artifact by id."""
+        try:
+            resp = self._stub.GetArtifact(
+                pb.GetArtifactRequest(artifact_id=artifact_id), metadata=self._metadata
+            )
+        except grpc.RpcError as e:
+            _handle_artifact_rpc_error(e, artifact_id)
+            raise
+        return _artifact_from_proto(resp.artifact, self)
+
+    @_instrumented("chalkcompute.artifact.list")
+    def list(
+        self,
+        *,
+        kinds: _StrList | None = None,
+        producers: _StrList | None = None,
+        sandbox_id: str | None = None,
+        limit: int | None = None,
+    ) -> Iterator[Artifact]:
+        """Iterate artifacts, newest first, paging transparently."""
+        cursor: str | None = None
+        remaining = limit
+        while True:
+            req = pb.ListArtifactsRequest(
+                kinds=[_KIND_TO_PROTO[k] for k in kinds or []],
+                producers=[_PRODUCER_TO_PROTO[p] for p in producers or []],
+            )
+            if sandbox_id is not None:
+                req.sandbox_id = sandbox_id
+            if cursor is not None:
+                req.cursor = cursor
+            if remaining is not None:
+                req.limit = min(remaining, 100)
+            try:
+                resp = self._stub.ListArtifacts(req, metadata=self._metadata)
+            except grpc.RpcError as e:
+                _handle_artifact_rpc_error(e, "list")
+                raise
+            for msg in resp.artifacts:
+                yield _artifact_from_proto(msg, self)
+                if remaining is not None:
+                    remaining -= 1
+                    if remaining <= 0:
+                        return
+            if not resp.HasField("next_cursor") or not resp.next_cursor:
+                return
+            cursor = resp.next_cursor
+
+    @_instrumented("chalkcompute.artifact.download")
+    def download(self, artifact_id: str) -> bytes:
+        """Download an artifact's content bytes."""
+        chunks: list[bytes] = []
+        try:
+            for frame in self._stub.DownloadArtifact(
+                pb.DownloadArtifactRequest(artifact_id=artifact_id),
+                metadata=self._metadata,
+            ):
+                chunks.append(frame.data)
+        except grpc.RpcError as e:
+            _handle_artifact_rpc_error(e, artifact_id)
+            raise
+        return b"".join(chunks)
+
+    @_instrumented("chalkcompute.artifact.delete")
+    def delete(self, artifact_id: str) -> None:
+        """Delete an artifact and its stored content."""
+        try:
+            self._stub.DeleteArtifact(
+                pb.DeleteArtifactRequest(artifact_id=artifact_id),
+                metadata=self._metadata,
+            )
+        except grpc.RpcError as e:
+            _handle_artifact_rpc_error(e, artifact_id)
+            raise
+
+
+def _handle_artifact_rpc_error(e: grpc.RpcError, subject: str) -> None:
+    """Translate mapped gRPC status codes to typed artifact errors.
+
+    Unmapped codes return so the caller re-raises the original gRPC error,
+    matching the sandbox/volume client convention.
+    """
+    raise_for_grpc_error(
+        e,
+        {
+            grpc.StatusCode.NOT_FOUND: (
+                ArtifactNotFoundError,
+                f"Artifact not found: {subject}",
+            ),
+        },
+    )

{chalkcompute-2.3.3 → chalkcompute-2.3.4}/chalkcompute/_cls.py

@@ -874,7 +874,7 @@ class RemoteClass:
     @classmethod
     def _make_empty(cls, name: str, *, chalk_client: Any | None = None) -> RemoteClass:
         rc = cls.__new__(cls)
-        rc._user_cls = None  # type: ignore[assignment]
+        rc._user_cls = None  # ty: ignore[invalid-assignment]
         rc._class_name = name
         rc._explicit_name = name
         rc._image = None
@@ -1059,6 +1059,20 @@ class RemoteClass:
             self._volume_driver = driver
             _cleanup_temp_files(temp_files)
 
+            # Resolve lazy secrets once, into a local rather than
+            # self._secrets: they're shared by every method (one FUNCTION
+            # scope for the class), and keeping self._secrets as the user's
+            # lazy originals means a later .deploy() on the same object
+            # re-upserts instead of reusing a stale resolution.
+            resolved_secrets = self._secrets
+            if self._secrets and any(s.is_lazy for s in self._secrets):
+                from chalkcompute._secret import SecretScope, resolve_lazy_secrets
+
+                scope = SecretScope.function(self._explicit_name or self._class_name)
+                resolved_secrets, _upserted = resolve_lazy_secrets(
+                    self._secrets, self._client, scope=scope
+                )
+
             # 3. Register each method as a function version
             sg_names: list[str] = []
             for method_info in self._methods.values():
@@ -1089,17 +1103,9 @@ class RemoteClass:
                     volumes=self._volumes,
                 )
 
-                # Resolve lazy secrets and add to container spec
-                if self._secrets:
-                    from chalkcompute._secret import resolve_lazy_secrets
-
-                    if any(s.is_lazy for s in self._secrets):
-                        resolved, _upserted = resolve_lazy_secrets(
-                            self._secrets, self._client
-                        )
-                        self._secrets = resolved
+                if resolved_secrets:
                     container_spec["secretRefs"] = [
-                        s._to_proto_dict() for s in self._secrets
+                        s._to_proto_dict() for s in resolved_secrets
                     ]
 
                 scaling_spec: dict[str, Any] = {

{chalkcompute-2.3.3 → chalkcompute-2.3.4}/chalkcompute/_container.py

@@ -1011,7 +1011,6 @@ class Container:
         self._built_image_uri: str | None = None
         self._container_id: str | None = None
         self._container_info: ContainerInfo | None = None
-        self._upserted_secret_names: list[str] = []
 
         self._client = ConnectClient(chalk_client=chalk_client)
         self._session_client: ContainerSessionClient | None = None
@@ -1101,7 +1100,7 @@ class Container:
     @classmethod
     def _make_empty(cls, *, chalk_client: Any | None = None) -> Container:
         c = cls.__new__(cls)
-        c._image = None  # type: ignore[assignment]
+        c._image = None  # ty: ignore[invalid-assignment]
         c._name = None
         c._cpu = None
         c._memory = None
@@ -1121,7 +1120,6 @@ class Container:
         c._built_image_uri = None
         c._container_id = None
         c._container_info = None
-        c._upserted_secret_names = []
         c._client = ConnectClient(chalk_client=chalk_client)
         c._session_client = None
         return c
@@ -1345,15 +1343,19 @@ class Container:
                     )
                 progress_done(vkey)
 
-            # 3. Resolve lazy secrets (from_local_env / from_local_env_file)
+            # 3. Resolve lazy secrets (from_local_env / from_local_env_file).
+            # Resolved into a local, not self._secrets, so a later .run() on
+            # the same object re-upserts instead of reusing a stale resolution.
+            resolved_secrets = self._secrets
             if any(s.is_lazy for s in self._secrets):
                 skey = f"secret:{container_name}"
                 progress_add(skey, "secret", "Resolving secrets", parent=ckey)
-                from chalkcompute._secret import resolve_lazy_secrets
+                from chalkcompute._secret import SecretScope, resolve_lazy_secrets
 
-                resolved, upserted = resolve_lazy_secrets(self._secrets, self._client)
-                self._secrets = resolved
-                self._upserted_secret_names = upserted
+                scope = SecretScope.sandbox(container_name)
+                resolved_secrets, upserted = resolve_lazy_secrets(
+                    self._secrets, self._client, scope=scope
+                )
                 logger.info(
                     "Upserted %d secret(s) from local environment.",
                     len(upserted),
@@ -1403,8 +1405,8 @@ class Container:
                         )
                 spec["volumes"] = [v.to_spec_dict() for v in self._volumes]
 
-            if self._secrets:
-                spec["secretRefs"] = [s._to_proto_dict() for s in self._secrets]
+            if resolved_secrets:
+                spec["secretRefs"] = [s._to_proto_dict() for s in resolved_secrets]
 
             logger.info("Starting container '%s'...", container_name)
             resp = self._client.rpc(
@@ -1687,7 +1689,7 @@ class Container:
 
     @_instrumented("chalkcompute.container.stop")
     def stop(self, grace_period_seconds: int | None = None) -> None:
-        """Stop the container and clean up temporary volumes and secrets.
+        """Stop the container and clean up temporary volumes.
 
         Parameters
         ----------
@@ -1718,12 +1720,6 @@ class Container:
         self._volumes = []
         self._volume_driver = None
 
-        if self._upserted_secret_names:
-            from chalkcompute._secret import delete_secrets
-
-            delete_secrets(self._client, self._upserted_secret_names)
-            self._upserted_secret_names = []
-
     def refresh(self) -> ContainerInfo:
         """Fetch latest container status from the server.
 

{chalkcompute-2.3.3 → chalkcompute-2.3.4}/chalkcompute/_function.py

@@ -1943,17 +1943,20 @@ class RemoteFunction:
                 "scalingSpec": scaling_spec,
             }
 
-            # 5b. Resolve lazy secrets and add to container spec
+            # 5b. Resolve lazy secrets and add to container spec. Resolved
+            # into a local, not self._secrets, so a later .deploy() on the
+            # same object re-upserts instead of reusing a stale resolution.
             if self._secrets:
-                from chalkcompute._secret import resolve_lazy_secrets
+                from chalkcompute._secret import SecretScope, resolve_lazy_secrets
 
+                resolved_secrets = self._secrets
                 if any(s.is_lazy for s in self._secrets):
-                    resolved, _upserted = resolve_lazy_secrets(
-                        self._secrets, self._client
+                    scope = SecretScope.function(self._explicit_name or self._func_name)
+                    resolved_secrets, _upserted = resolve_lazy_secrets(
+                        self._secrets, self._client, scope=scope
                     )
-                    self._secrets = resolved
                 container_spec["secretRefs"] = [
-                    s._to_proto_dict() for s in self._secrets
+                    s._to_proto_dict() for s in resolved_secrets
                 ]
 
             # 5c. Build function-level config