@blaxel/core 0.3.26 → 0.3.27

package/dist/cjs-browser/common/settings.js

@@ -30,8 +30,8 @@ function missingCredentialsMessage() {
     return "No Blaxel credentials found. Set the BL_API_KEY and BL_WORKSPACE environment variables, or run `bl login`.";
 }
 // Build info - these placeholders are replaced at build time by build:replace-imports
-const BUILD_VERSION = "0.3.26";
-const BUILD_COMMIT = "18c2c73526c47b9ebc09aa3e16497b19854a02d0";
+const BUILD_VERSION = "0.3.27";
+const BUILD_COMMIT = "b818d0f5560b92040baeb620b8d89bf148cba56d";
 const BUILD_SENTRY_DSN = "https://fd5e60e1c9820e1eef5ccebb84a07127@o4508714045276160.ingest.us.sentry.io/4510465864564736";
 const BLAXEL_API_VERSION = "2026-09-22";
 // Bun < 1.3.11 never sends connection-level WINDOW_UPDATE: the pooled h2

package/dist/cjs-browser/image/image.test.js

@@ -545,8 +545,12 @@ let tempSourceDir;
     });
 });
 (0, vitest_1.describe)("ImageInstance.build worker resources", () => {
-    async function buildWith(options, storedLabels) {
-        const calls = [];
+    // signing: "all" signs every build label, "update" signs only on PUT after a
+    // 404 then POST create (production today), "none" never signs them.
+    let calls = [];
+    async function buildWith(options, storedLabels, signing = "all") {
+        calls = [];
+        let created = false;
         vitest_1.vi.spyOn(settings_js_1.settings, "authenticate").mockResolvedValue(undefined);
         vitest_1.vi.spyOn(settings_js_1.settings, "headers", "get").mockReturnValue({});
         vitest_1.vi.spyOn(settings_js_1.settings, "baseUrl", "get").mockReturnValue("https://api.test");
@@ -555,10 +559,18 @@ let tempSourceDir;
             const body = typeof init.body === "string" ? JSON.parse(init.body) : undefined;
             calls.push({ url, method: init.method ?? "GET", headers, body });
             if (url.includes("upload=true")) {
-                const sent = body.metadata?.labels;
-                return Promise.resolve(new Response(JSON.stringify({ metadata: { name: "img", labels: storedLabels ?? sent } }), {
+                if (signing === "update" && init.method === "PUT" && !created) {
+                    return Promise.resolve(new Response("{}", { status: 404 }));
+                }
+                created ||= init.method === "POST";
+                const labels = storedLabels ?? body.metadata?.labels ?? {};
+                const signed = ["host"];
+                if (signing === "all" || (signing === "update" && init.method === "PUT")) {
+                    signed.push(...Object.keys(labels).filter((k) => k.startsWith("x-blaxel-build")).map((k) => `x-amz-meta-${k}`));
+                }
+                return Promise.resolve(new Response(JSON.stringify({ metadata: { name: "img", labels } }), {
                     status: 200,
-                    headers: { "x-blaxel-upload-url": "https://upload.test/object" },
+                    headers: { "x-blaxel-upload-url": `https://upload.test/object?X-Amz-SignedHeaders=${signed.join(";")}` },
                 }));
             }
             if (url.startsWith("https://upload.test")) {
@@ -591,6 +603,19 @@ let tempSourceDir;
         (0, vitest_1.expect)(upload.headers["x-amz-meta-x-blaxel-build-volume"]).toBe("32768");
         (0, vitest_1.expect)(upload.headers["x-amz-meta-x-blaxel-auto-generated"]).toBeUndefined();
     });
+    (0, vitest_1.it)("asks again when creating a sandbox does not sign the settings", async () => {
+        const { upload } = await buildWith({ buildMemoryMb: 2048 }, undefined, "update");
+        (0, vitest_1.expect)(calls.filter((call) => call.url.includes("upload=true")).map((call) => call.method)).toEqual(["PUT", "POST", "PUT"]);
+        (0, vitest_1.expect)(upload.headers["x-amz-meta-x-blaxel-build-memory"]).toBe("2048");
+    });
+    (0, vitest_1.it)("fails clearly when the settings are never signed", async () => {
+        await (0, vitest_1.expect)(buildWith({ buildVolumeMb: 32768 }, undefined, "none")).rejects.toThrow("x-blaxel-build-volume");
+        (0, vitest_1.expect)(calls.some((call) => call.url.startsWith("https://upload.test"))).toBe(false);
+    });
+    (0, vitest_1.it)("drops stored labels the upload URL was not signed for", async () => {
+        const { upload } = await buildWith({}, { "x-blaxel-auto-generated": "true", "x-blaxel-build-memory": "8192" }, "none");
+        (0, vitest_1.expect)(upload.headers["x-amz-meta-x-blaxel-build-memory"]).toBeUndefined();
+    });
     (0, vitest_1.it)("keeps an explicit zero volume", async () => {
         const { upload } = await buildWith({ buildVolumeMb: 0 });
         (0, vitest_1.expect)(upload.headers["x-amz-meta-x-blaxel-build-volume"]).toBe("0");

package/dist/cjs-browser/types/image/image.d.ts

@@ -287,6 +287,11 @@ export declare class ImageInstance {
     private _createZip;
     private _createSandboxPayload;
     private _createSandboxWithUpload;
+    /**
+     * Creates or updates the sandbox and returns its upload URL with the build
+     * metadata that URL was signed for, plus requested settings it was not.
+     */
+    private _requestUpload;
     private _uploadZip;
     private _getSandboxStatus;
     private _waitForDeployment;