@blaxel/core 0.3.26-preview.315 → 0.3.27-preview.317

package/dist/esm/common/settings.js

@@ -24,8 +24,8 @@ function missingCredentialsMessage() {
     return "No Blaxel credentials found. Set the BL_API_KEY and BL_WORKSPACE environment variables, or run `bl login`.";
 }
 // Build info - these placeholders are replaced at build time by build:replace-imports
-const BUILD_VERSION = "0.3.26-preview.315";
-const BUILD_COMMIT = "18c2c73526c47b9ebc09aa3e16497b19854a02d0";
+const BUILD_VERSION = "0.3.27-preview.317";
+const BUILD_COMMIT = "b818d0f5560b92040baeb620b8d89bf148cba56d";
 const BUILD_SENTRY_DSN = "https://fd5e60e1c9820e1eef5ccebb84a07127@o4508714045276160.ingest.us.sentry.io/4510465864564736";
 const BLAXEL_API_VERSION = "2026-09-22";
 // Bun < 1.3.11 never sends connection-level WINDOW_UPDATE: the pooled h2

package/dist/esm/image/image.js

@@ -692,6 +692,39 @@ export class ImageInstance {
         const uploadUrl = response.headers.get("x-blaxel-upload-url");
         return { response, uploadUrl };
     }
+    /**
+     * Creates or updates the sandbox and returns its upload URL with the build
+     * metadata that URL was signed for, plus requested settings it was not.
+     */
+    async _requestUpload(sandbox, requested) {
+        const { response, uploadUrl } = await this._createSandboxWithUpload(sandbox);
+        if (response.status >= 400) {
+            const text = await response.text();
+            throw new Error(`Failed to create sandbox: ${response.status} - ${text}`);
+        }
+        if (!uploadUrl) {
+            throw new Error("No upload URL returned from API");
+        }
+        // Sign-matching headers come from the labels the control plane stored,
+        // which can include build settings already on an existing sandbox.
+        let storedLabels = sandbox.metadata?.labels;
+        try {
+            const stored = (await response.json());
+            storedLabels = stored.metadata?.labels ?? storedLabels;
+        }
+        catch {
+            // Fall back to the labels we sent
+        }
+        // Storage rejects headers the URL was not signed for, so drop those.
+        let metadata = buildUploadMetadata(storedLabels);
+        const query = new URL(uploadUrl).searchParams;
+        const signedHeaders = query.get("X-Amz-SignedHeaders") ?? query.get("X-Goog-SignedHeaders");
+        if (signedHeaders) {
+            const signed = new Set(signedHeaders.split(";").map((header) => header.trim().toLowerCase()));
+            metadata = Object.fromEntries(Object.entries(metadata).filter(([name]) => signed.has(`x-amz-meta-${name}`)));
+        }
+        return { uploadUrl, metadata, missing: Object.keys(requested).filter((name) => !(name in metadata)) };
+    }
     async _uploadZip(uploadUrl, zipContent, metadata = {}) {
         const headers = {
             "Content-Type": "application/zip",
@@ -792,26 +825,17 @@ export class ImageInstance {
             // Create sandbox payload
             const sandboxPayload = this._createSandboxPayload(name, memory, buildLabels);
             // Create/update sandbox and get upload URL
-            const { response, uploadUrl } = await this._createSandboxWithUpload(sandboxPayload);
-            if (response.status >= 400) {
-                const text = await response.text();
-                throw new Error(`Failed to create sandbox: ${response.status} - ${text}`);
-            }
-            if (!uploadUrl) {
-                throw new Error("No upload URL returned from API");
-            }
-            // Sign-matching headers come from the labels the control plane stored,
-            // which can include build settings already on an existing sandbox.
-            let storedLabels = sandboxPayload.metadata?.labels;
-            try {
-                const created = (await response.json());
-                storedLabels = created.metadata?.labels ?? storedLabels;
-            }
-            catch {
-                // Fall back to the labels we sent
+            let { uploadUrl, metadata, missing } = await this._requestUpload(sandboxPayload, buildLabels);
+            if (missing.length > 0) {
+                // Creating a sandbox can return a URL without the build settings
+                // signed; asking again updates the now existing sandbox, which does.
+                ({ uploadUrl, metadata, missing } = await this._requestUpload(sandboxPayload, buildLabels));
+                if (missing.length > 0) {
+                    throw new Error(`The platform did not accept build settings ${missing.join(", ")}; retry without them`);
+                }
             }
             // Upload the zip
-            await this._uploadZip(uploadUrl, zipContent, buildUploadMetadata(storedLabels));
+            await this._uploadZip(uploadUrl, zipContent, metadata);
             // Wait for deployment to complete
             await this._waitForDeployment(name, timeout, 3000, onStatusChange);
             // Get the final sandbox state

package/dist/esm/image/image.test.js

@@ -543,8 +543,12 @@ describe("Dockerfile instruction order", () => {
     });
 });
 describe("ImageInstance.build worker resources", () => {
-    async function buildWith(options, storedLabels) {
-        const calls = [];
+    // signing: "all" signs every build label, "update" signs only on PUT after a
+    // 404 then POST create (production today), "none" never signs them.
+    let calls = [];
+    async function buildWith(options, storedLabels, signing = "all") {
+        calls = [];
+        let created = false;
         vi.spyOn(settings, "authenticate").mockResolvedValue(undefined);
         vi.spyOn(settings, "headers", "get").mockReturnValue({});
         vi.spyOn(settings, "baseUrl", "get").mockReturnValue("https://api.test");
@@ -553,10 +557,18 @@ describe("ImageInstance.build worker resources", () => {
             const body = typeof init.body === "string" ? JSON.parse(init.body) : undefined;
             calls.push({ url, method: init.method ?? "GET", headers, body });
             if (url.includes("upload=true")) {
-                const sent = body.metadata?.labels;
-                return Promise.resolve(new Response(JSON.stringify({ metadata: { name: "img", labels: storedLabels ?? sent } }), {
+                if (signing === "update" && init.method === "PUT" && !created) {
+                    return Promise.resolve(new Response("{}", { status: 404 }));
+                }
+                created ||= init.method === "POST";
+                const labels = storedLabels ?? body.metadata?.labels ?? {};
+                const signed = ["host"];
+                if (signing === "all" || (signing === "update" && init.method === "PUT")) {
+                    signed.push(...Object.keys(labels).filter((k) => k.startsWith("x-blaxel-build")).map((k) => `x-amz-meta-${k}`));
+                }
+                return Promise.resolve(new Response(JSON.stringify({ metadata: { name: "img", labels } }), {
                     status: 200,
-                    headers: { "x-blaxel-upload-url": "https://upload.test/object" },
+                    headers: { "x-blaxel-upload-url": `https://upload.test/object?X-Amz-SignedHeaders=${signed.join(";")}` },
                 }));
             }
             if (url.startsWith("https://upload.test")) {
@@ -589,6 +601,19 @@ describe("ImageInstance.build worker resources", () => {
         expect(upload.headers["x-amz-meta-x-blaxel-build-volume"]).toBe("32768");
         expect(upload.headers["x-amz-meta-x-blaxel-auto-generated"]).toBeUndefined();
     });
+    it("asks again when creating a sandbox does not sign the settings", async () => {
+        const { upload } = await buildWith({ buildMemoryMb: 2048 }, undefined, "update");
+        expect(calls.filter((call) => call.url.includes("upload=true")).map((call) => call.method)).toEqual(["PUT", "POST", "PUT"]);
+        expect(upload.headers["x-amz-meta-x-blaxel-build-memory"]).toBe("2048");
+    });
+    it("fails clearly when the settings are never signed", async () => {
+        await expect(buildWith({ buildVolumeMb: 32768 }, undefined, "none")).rejects.toThrow("x-blaxel-build-volume");
+        expect(calls.some((call) => call.url.startsWith("https://upload.test"))).toBe(false);
+    });
+    it("drops stored labels the upload URL was not signed for", async () => {
+        const { upload } = await buildWith({}, { "x-blaxel-auto-generated": "true", "x-blaxel-build-memory": "8192" }, "none");
+        expect(upload.headers["x-amz-meta-x-blaxel-build-memory"]).toBeUndefined();
+    });
     it("keeps an explicit zero volume", async () => {
         const { upload } = await buildWith({ buildVolumeMb: 0 });
         expect(upload.headers["x-amz-meta-x-blaxel-build-volume"]).toBe("0");