modal 1.5.6.dev19__tar.gz → 1.5.6.dev20__tar.gz

{modal-1.5.6.dev19 → modal-1.5.6.dev20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: modal
-Version: 1.5.6.dev19
+Version: 1.5.6.dev20
 Summary: Python client library for Modal
 Author-email: Modal Labs <support@modal.com>
 License-Expression: Apache-2.0

{modal-1.5.6.dev19 → modal-1.5.6.dev20}/modal/__init__.py

@@ -23,6 +23,7 @@ try:
     from .functions import Function, FunctionCall
     from .image import Image
     from .network_file_system import NetworkFileSystem
+    from .outbound_policy import OutboundPolicy
     from .output import enable_output
     from .partial_function import (
         asgi_app,
@@ -71,6 +72,7 @@ __all__ = [
     "FunctionCall",
     "Image",
     "NetworkFileSystem",
+    "OutboundPolicy",
     "Period",
     "Probe",
     "Proxy",

{modal-1.5.6.dev19 → modal-1.5.6.dev20}/modal/_functions.py

@@ -1103,8 +1103,6 @@ class _Function(typing.Generic[P, ReturnType, OriginalReturnType], _Object, type
                         is_class=function_definition.is_class,
                         class_parameter_info=function_definition.class_parameter_info,
                         is_method=function_definition.is_method,
-                        use_function_id=function_definition.use_function_id,
-                        use_method_name=function_definition.use_method_name,
                         method_definitions=function_definition.method_definitions,
                         method_definitions_set=function_definition.method_definitions_set,
                         experimental_options=experimental_options or {},

{modal-1.5.6.dev19 → modal-1.5.6.dev20}/modal/_runtime/user_code_imports.py

@@ -562,7 +562,6 @@ def _get_cls_or_user_cls(
                 f"Internal error: Invalid 'service function' identifier {qual_name}. Please contact Modal support"
             )
 
-        assert not function_def.use_method_name  # new "placeholder methods" should not be invoked directly!
         cls_name = parts[0]
         cls_or_user_cls = getattr(module, cls_name)
     return cls_or_user_cls

{modal-1.5.6.dev19 → modal-1.5.6.dev20}/modal/_utils/task_command_router_client.py

@@ -1077,6 +1077,12 @@ class TaskCommandRouterClient:
                 lambda: self._call_with_auth_retry(self._stub.TaskSetNetworkAccess, request)
             )
 
+    async def set_outbound_policy(self, request: sr_pb2.TaskSetOutboundPolicyRequest):
+        with grpc_error_converter():
+            return await call_with_retries_on_transient_errors(
+                lambda: self._call_with_auth_retry(self._stub.TaskSetOutboundPolicy, request)
+            )
+
     async def reload_volumes(
         self, task_id: str, timeout: float, container_id: str = ""
     ) -> sr_pb2.TaskReloadVolumesResponse:

{modal-1.5.6.dev19 → modal-1.5.6.dev20}/modal/cli/app.py

@@ -726,7 +726,7 @@ async def info(app_identifier: str, *, env: str | None = None, json: bool = Fals
             if len(hardware) > 1:
                 metadata.append(f" ({', '.join(hardware[1:])})", style=None if no_color else "bright_black")
             if summary.web_function:
-                metadata.append(" · Web function")
+                metadata.append(" · Web Function")
             if schedule := _app_function_schedule(summary.schedule):
                 metadata.append(" · ")
                 metadata.append(schedule)

{modal-1.5.6.dev19 → modal-1.5.6.dev20}/modal/cli/utils.py

@@ -248,12 +248,21 @@ async def _resolve_function_id(
             raise
 
         print_server_warnings(response.server_warnings)
-        return response.function_id, response.handle_metadata
-
-    if _is_function_id(function_identifier):
+        function_id = response.function_id
+        function = response.function
+        metadata = response.handle_metadata
+    elif _is_function_id(function_identifier):
         get_by_id_response = await client.stub.FunctionGetById(
             api_pb2.FunctionGetByIdRequest(function_id=function_identifier)
         )
-        return function_identifier, get_by_id_response.handle_metadata
+        function_id = function_identifier
+        function = get_by_id_response.function
+        metadata = get_by_id_response.handle_metadata
+    else:
+        raise UsageError(usage)
+
+    if function.is_server != (object_type == "Server"):
+        actual_type = "Server" if function.is_server else "Function"
+        raise UsageError(f"'{function_identifier}' is a {actual_type}. Use `modal {actual_type.lower()} {command}`.")
 
-    raise UsageError(usage)
+    return function_id, metadata

{modal-1.5.6.dev19 → modal-1.5.6.dev20}/modal/client.pyi

@@ -77,7 +77,7 @@ class _Client:
         server_url: str,
         client_type: int,
         credentials: typing.Optional[tuple[str, str]],
-        version: str = "1.5.6.dev19",
+        version: str = "1.5.6.dev20",
         *,
         oauth_credentials: typing.Optional[_OAuthCredentials] = None,
     ):
@@ -277,7 +277,7 @@ class Client:
         server_url: str,
         client_type: int,
         credentials: typing.Optional[tuple[str, str]],
-        version: str = "1.5.6.dev19",
+        version: str = "1.5.6.dev20",
         *,
         oauth_credentials: typing.Optional[_OAuthCredentials] = None,
     ):

{modal-1.5.6.dev19 → modal-1.5.6.dev20}/modal/functions.pyi

@@ -653,7 +653,7 @@ class Function(
 
     _call_generator: ___call_generator_spec
 
-    class __remote_spec(typing_extensions.Protocol[P_INNER, ReturnType_INNER]):
+    class __remote_spec(typing_extensions.Protocol[ReturnType_INNER, P_INNER]):
         def __call__(self, /, *args: P_INNER.args, **kwargs: P_INNER.kwargs) -> ReturnType_INNER:
             """Calls the function remotely, executing it with the given arguments and returning the execution's result.
 
@@ -678,7 +678,7 @@ class Function(
             """
             ...
 
-    remote: __remote_spec[modal._functions.P, modal._functions.ReturnType]
+    remote: __remote_spec[modal._functions.ReturnType, modal._functions.P]
 
     class __remote_gen_spec(typing_extensions.Protocol):
         def __call__(self, /, *args, **kwargs) -> typing.Generator[typing.Any, None, None]:
@@ -728,7 +728,7 @@ class Function(
         """
         ...
 
-    class ___experimental_spawn_spec(typing_extensions.Protocol[P_INNER, ReturnType_INNER]):
+    class ___experimental_spawn_spec(typing_extensions.Protocol[ReturnType_INNER, P_INNER]):
         def __call__(self, /, *args: P_INNER.args, **kwargs: P_INNER.kwargs) -> FunctionCall[ReturnType_INNER]:
             """[Experimental] Calls the function with the given arguments, without waiting for the results.
 
@@ -761,7 +761,7 @@ class Function(
             """
             ...
 
-    _experimental_spawn: ___experimental_spawn_spec[modal._functions.P, modal._functions.ReturnType]
+    _experimental_spawn: ___experimental_spawn_spec[modal._functions.ReturnType, modal._functions.P]
 
     class ___spawn_map_inner_spec(typing_extensions.Protocol[P_INNER]):
         def __call__(self, /, *args: P_INNER.args, **kwargs: P_INNER.kwargs) -> None: ...
@@ -769,7 +769,7 @@ class Function(
 
     _spawn_map_inner: ___spawn_map_inner_spec[modal._functions.P]
 
-    class __spawn_spec(typing_extensions.Protocol[P_INNER, ReturnType_INNER]):
+    class __spawn_spec(typing_extensions.Protocol[ReturnType_INNER, P_INNER]):
         def __call__(self, /, *args: P_INNER.args, **kwargs: P_INNER.kwargs) -> FunctionCall[ReturnType_INNER]:
             """Calls the function with the given arguments, without waiting for the results.
 
@@ -802,7 +802,7 @@ class Function(
             """
             ...
 
-    spawn: __spawn_spec[modal._functions.P, modal._functions.ReturnType]
+    spawn: __spawn_spec[modal._functions.ReturnType, modal._functions.P]
 
     def get_raw_f(self) -> collections.abc.Callable[..., typing.Any]:
         """Return the inner Python object wrapped by this Modal Function.

{modal-1.5.6.dev19 → modal-1.5.6.dev20}/modal/network_file_system.py

@@ -22,6 +22,7 @@ from ._object import (
 from ._resolver import Resolver
 from ._utils.async_utils import TaskContext, aclosing, async_map, sync_or_async_iter, synchronize_api
 from ._utils.blob_utils import LARGE_FILE_LIMIT, blob_iter, blob_upload_file
+from ._utils.deprecation import deprecation_warning
 from ._utils.hash_utils import get_sha256_hex
 from ._utils.name_utils import check_object_name
 from .client import _Client
@@ -33,6 +34,14 @@ NETWORK_FILE_SYSTEM_PUT_FILE_CLIENT_TIMEOUT = (
 )  # 10 min max for transferring files (does not include upload time to s3)
 
 
+def _warn_network_file_system_deprecated() -> None:
+    deprecation_warning(
+        (2026, 9, 16),
+        "`modal.NetworkFileSystem` is deprecated and will be removed in a future release. Use `modal.Volume` instead.",
+        show_source=False,
+    )
+
+
 def network_file_system_mount_protos(
     validated_network_file_systems: list[tuple[str, "_NetworkFileSystem"]],
 ) -> list[api_pb2.SharedVolumeMount]:
@@ -119,6 +128,7 @@ class _NetworkFileSystem(_Object, type_prefix="sv"):
             ```
         """
         check_object_name(name, "NetworkFileSystem")
+        _warn_network_file_system_deprecated()
 
         async def _load(
             self: _NetworkFileSystem, resolver: Resolver, load_context: LoadContext, existing_object_id: str | None
@@ -175,6 +185,7 @@ class _NetworkFileSystem(_Object, type_prefix="sv"):
                 assert await nfs.listdir("/") == []
             ```
         """
+        _warn_network_file_system_deprecated()
         if client is None:
             client = await _Client.from_env()
         request = api_pb2.SharedVolumeGetOrCreateRequest(
@@ -201,6 +212,7 @@ class _NetworkFileSystem(_Object, type_prefix="sv"):
     ) -> str:
         """mdmd:hidden"""
         check_object_name(deployment_name, "NetworkFileSystem")
+        _warn_network_file_system_deprecated()
         if client is None:
             client = await _Client.from_env()
         request = api_pb2.SharedVolumeGetOrCreateRequest(

{modal-1.5.6.dev19 → modal-1.5.6.dev20}/modal/network_file_system.pyi

@@ -9,6 +9,7 @@ import synchronicity.combined_types
 import typing
 import typing_extensions
 
+def _warn_network_file_system_deprecated() -> None: ...
 def network_file_system_mount_protos(
     validated_network_file_systems: list[tuple[str, _NetworkFileSystem]],
 ) -> list[modal_proto.api_pb2.SharedVolumeMount]:

modal-1.5.6.dev20/modal/outbound_policy.py

@@ -0,0 +1,167 @@
+# Copyright Modal Labs 2026
+"""Immutable configuration for replacing headers in outbound HTTPS traffic."""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from typing import Mapping, Sequence
+
+from modal_proto import api_pb2
+
+from ._utils.async_utils import synchronize_api
+from .exception import InvalidError
+from .secret import _Secret
+
+_DOMAIN_RE = re.compile(
+    r"^(\*\.)?([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\Z"
+)
+_HEADER_NAME_RE = re.compile(r"^[A-Za-z0-9!#$%&'*+.^_`|~-]+\Z")
+
+_MAX_HEADER_REPLACEMENTS = 25
+
+
+def _header_value_has_invalid_chars(value: str) -> bool:
+    return any((ord(c) < 0x20 and c != "\t") or ord(c) == 0x7F for c in value)
+
+
+def _template_references_key(template: str) -> bool:
+    """Whether a header value template references a `$KEY`."""
+    i = template.find("$")
+    while i != -1 and i + 1 < len(template):
+        c = template[i + 1]
+        if c == "$":
+            i = template.find("$", i + 2)
+            continue
+        if c.isascii() and (c.isalpha() or c == "_"):
+            return True
+        i = template.find("$", i + 1)
+    return False
+
+
+@dataclass(frozen=True)
+class _HeaderReplacement:
+    domain: str
+    headers: dict[str, str]
+    secret: _Secret | None
+
+
+class _OutboundPolicy:
+    """Immutable configuration for replacing headers in outbound HTTPS requests
+    from a Sandbox.
+
+    Header values support templating with keys in a replacement's secret: a
+    `$`-prefixed key name in the secret is replaced with the secret value.
+    Literal `$` characters are written `$$`.
+
+    Secret values never enter the Sandbox: they are resolved and injected into
+    matching requests outside the container.
+
+    Examples:
+        ```python
+        import modal
+
+        secret = modal.Secret.from_name("api-token")
+
+        outbound_policy = (
+            modal.OutboundPolicy()
+            # Inject a secret-backed Authorization header.
+            .with_header_replacement(
+                domain="example.com",
+                secret=secret,
+                headers={"Authorization": "Bearer $API_TOKEN"},
+            )
+            # Inject a static header into requests to another domain.
+            .with_header_replacement(
+                domain="modal.com",
+                headers={"X-Trace-Token": "trace_abcd"},
+            )
+        )
+
+        sb = modal.Sandbox.create(outbound_policy=outbound_policy)
+        ```
+    """
+
+    _replacements: tuple[_HeaderReplacement, ...]
+
+    def __init__(self, _replacements: tuple[_HeaderReplacement, ...] = ()):
+        self._replacements = _replacements
+
+    def with_header_replacement(
+        self,
+        *,
+        domain: str,
+        headers: Mapping[str, str],
+        secret: _Secret | None = None,
+    ) -> _OutboundPolicy:
+        """Return a new `OutboundPolicy` with an added header replacement.
+
+        Args:
+            domain: Domain the replacements are scoped to. Supports `*.` wildcard
+                prefixes (matching the apex domain and subdomains) and a bare `"*"`.
+            headers: Header name -> header value. Values support `$KEY` templates
+                referencing keys in the replacement's `secret`.
+            secret: Named Secret (e.g. from `Secret.from_name`) whose keys may be
+                referenced in the header value templates. Static replacements pass no
+                secret.
+        """
+        replacement = _HeaderReplacement(domain=domain, headers=dict(headers), secret=secret)
+        return _OutboundPolicy(self._replacements + (replacement,))
+
+    def _validate(self) -> None:
+        """Check all replacements, raising `InvalidError` on the first violation found."""
+        total = 0
+        for replacement in self._replacements:
+            if replacement.domain != "*" and not _DOMAIN_RE.match(replacement.domain):
+                raise InvalidError(f"Invalid domain: {replacement.domain!r}")
+            if not replacement.headers:
+                raise InvalidError("`headers` must contain at least one header")
+            for name, value in replacement.headers.items():
+                if not _HEADER_NAME_RE.match(name):
+                    raise InvalidError(f"Invalid header name: {name!r}")
+                if _header_value_has_invalid_chars(value):
+                    raise InvalidError(f"Header value for {name!r} must not contain control characters (except tab)")
+                if replacement.secret is None and _template_references_key(value):
+                    raise InvalidError(f"Header value for {name!r} references a secret key, but no `secret` was passed")
+            if replacement.secret is not None and replacement.secret._is_ephemeral:
+                raise InvalidError(
+                    "Outbound policies only support named secrets (e.g. `Secret.from_name`); "
+                    "ephemeral secrets (e.g. `Secret.from_dict`) are not yet supported"
+                )
+            total += len(replacement.headers)
+        if total > _MAX_HEADER_REPLACEMENTS:
+            raise InvalidError(f"Outbound policy cannot have more than {_MAX_HEADER_REPLACEMENTS} header replacements")
+
+    def _secrets(self) -> list[_Secret]:
+        """Deduplicated list of secrets referenced by the policy's replacements."""
+        return list(dict.fromkeys(r.secret for r in self._replacements if r.secret is not None))
+
+    def _to_proto(self) -> api_pb2.OutboundPolicy:
+        """Convert to the wire format. Referenced secrets must be hydrated first."""
+        return api_pb2.OutboundPolicy(
+            header_replacements=[
+                api_pb2.OutboundPolicy.HeaderReplacement(
+                    domain=replacement.domain,
+                    secret_id=(replacement.secret.object_id if replacement.secret is not None else ""),
+                    headers=replacement.headers,
+                )
+                for replacement in self._replacements
+            ]
+        )
+
+
+def _validate_compatible_network_access(
+    outbound_policy: _OutboundPolicy | None,
+    block_network: bool,
+    outbound_domain_allowlist: Sequence[str] | None,
+) -> None:
+    """Reject combinations of network configuration and outbound policy that the server does not support."""
+    if outbound_policy is None:
+        return
+    if block_network:
+        raise InvalidError("`outbound_policy` cannot be used when `block_network` is enabled")
+    if outbound_domain_allowlist:
+        raise InvalidError("`outbound_policy` cannot be used with `outbound_domain_allowlist`")
+
+
+OutboundPolicy = synchronize_api(_OutboundPolicy)

modal-1.5.6.dev20/modal/outbound_policy.pyi

@@ -0,0 +1,184 @@
+import modal.secret
+import modal_proto.api_pb2
+import typing
+
+def _header_value_has_invalid_chars(value: str) -> bool: ...
+def _template_references_key(template: str) -> bool:
+    """Whether a header value template references a `$KEY`."""
+    ...
+
+class _HeaderReplacement:
+    """_HeaderReplacement(domain: 'str', headers: 'dict[str, str]', secret: '_Secret | None')"""
+
+    domain: str
+    headers: dict[str, str]
+    secret: typing.Optional[modal.secret._Secret]
+
+    def __init__(self, domain: str, headers: dict[str, str], secret: typing.Optional[modal.secret._Secret]) -> None:
+        """Initialize self.  See help(type(self)) for accurate signature."""
+        ...
+
+    def __repr__(self):
+        """Return repr(self)."""
+        ...
+
+    def __eq__(self, other):
+        """Return self==value."""
+        ...
+
+    def __setattr__(self, name, value):
+        """Implement setattr(self, name, value)."""
+        ...
+
+    def __delattr__(self, name):
+        """Implement delattr(self, name)."""
+        ...
+
+    def __hash__(self):
+        """Return hash(self)."""
+        ...
+
+class _OutboundPolicy:
+    """Immutable configuration for replacing headers in outbound HTTPS requests
+    from a Sandbox.
+
+    Header values support templating with keys in a replacement's secret: a
+    `$`-prefixed key name in the secret is replaced with the secret value.
+    Literal `$` characters are written `$$`.
+
+    Secret values never enter the Sandbox: they are resolved and injected into
+    matching requests outside the container.
+
+    Examples:
+        ```python
+        import modal
+
+        secret = modal.Secret.from_name("api-token")
+
+        outbound_policy = (
+            modal.OutboundPolicy()
+            # Inject a secret-backed Authorization header.
+            .with_header_replacement(
+                domain="example.com",
+                secret=secret,
+                headers={"Authorization": "Bearer $API_TOKEN"},
+            )
+            # Inject a static header into requests to another domain.
+            .with_header_replacement(
+                domain="modal.com",
+                headers={"X-Trace-Token": "trace_abcd"},
+            )
+        )
+
+        sb = modal.Sandbox.create(outbound_policy=outbound_policy)
+        ```
+    """
+
+    _replacements: tuple[_HeaderReplacement, ...]
+
+    def __init__(self, _replacements: tuple[_HeaderReplacement, ...] = ()):
+        """Initialize self.  See help(type(self)) for accurate signature."""
+        ...
+
+    def with_header_replacement(
+        self, *, domain: str, headers: typing.Mapping[str, str], secret: typing.Optional[modal.secret._Secret] = None
+    ) -> _OutboundPolicy:
+        """Return a new `OutboundPolicy` with an added header replacement.
+
+        Args:
+            domain: Domain the replacements are scoped to. Supports `*.` wildcard
+                prefixes (matching the apex domain and subdomains) and a bare `"*"`.
+            headers: Header name -> header value. Values support `$KEY` templates
+                referencing keys in the replacement's `secret`.
+            secret: Named Secret (e.g. from `Secret.from_name`) whose keys may be
+                referenced in the header value templates. Static replacements pass no
+                secret.
+        """
+        ...
+
+    def _validate(self) -> None:
+        """Check all replacements, raising `InvalidError` on the first violation found."""
+        ...
+
+    def _secrets(self) -> list[modal.secret._Secret]:
+        """Deduplicated list of secrets referenced by the policy's replacements."""
+        ...
+
+    def _to_proto(self) -> modal_proto.api_pb2.OutboundPolicy:
+        """Convert to the wire format. Referenced secrets must be hydrated first."""
+        ...
+
+def _validate_compatible_network_access(
+    outbound_policy: typing.Optional[_OutboundPolicy],
+    block_network: bool,
+    outbound_domain_allowlist: typing.Optional[typing.Sequence[str]],
+) -> None:
+    """Reject combinations of network configuration and outbound policy that the server does not support."""
+    ...
+
+class OutboundPolicy:
+    """Immutable configuration for replacing headers in outbound HTTPS requests
+    from a Sandbox.
+
+    Header values support templating with keys in a replacement's secret: a
+    `$`-prefixed key name in the secret is replaced with the secret value.
+    Literal `$` characters are written `$$`.
+
+    Secret values never enter the Sandbox: they are resolved and injected into
+    matching requests outside the container.
+
+    Examples:
+        ```python
+        import modal
+
+        secret = modal.Secret.from_name("api-token")
+
+        outbound_policy = (
+            modal.OutboundPolicy()
+            # Inject a secret-backed Authorization header.
+            .with_header_replacement(
+                domain="example.com",
+                secret=secret,
+                headers={"Authorization": "Bearer $API_TOKEN"},
+            )
+            # Inject a static header into requests to another domain.
+            .with_header_replacement(
+                domain="modal.com",
+                headers={"X-Trace-Token": "trace_abcd"},
+            )
+        )
+
+        sb = modal.Sandbox.create(outbound_policy=outbound_policy)
+        ```
+    """
+
+    _replacements: tuple[_HeaderReplacement, ...]
+
+    def __init__(self, _replacements: tuple[_HeaderReplacement, ...] = ()): ...
+    def with_header_replacement(
+        self, *, domain: str, headers: typing.Mapping[str, str], secret: typing.Optional[modal.secret.Secret] = None
+    ) -> OutboundPolicy:
+        """Return a new `OutboundPolicy` with an added header replacement.
+
+        Args:
+            domain: Domain the replacements are scoped to. Supports `*.` wildcard
+                prefixes (matching the apex domain and subdomains) and a bare `"*"`.
+            headers: Header name -> header value. Values support `$KEY` templates
+                referencing keys in the replacement's `secret`.
+            secret: Named Secret (e.g. from `Secret.from_name`) whose keys may be
+                referenced in the header value templates. Static replacements pass no
+                secret.
+        """
+        ...
+
+    def _validate(self) -> None:
+        """Check all replacements, raising `InvalidError` on the first violation found."""
+        ...
+
+    def _secrets(self) -> list[modal.secret.Secret]:
+        """Deduplicated list of secrets referenced by the policy's replacements."""
+        ...
+
+    def _to_proto(self) -> modal_proto.api_pb2.OutboundPolicy:
+        """Convert to the wire format. Referenced secrets must be hydrated first."""
+        ...