@blaxel/core 0.3.26 → 0.3.27

package/dist/esm-browser/common/settings.js

@@ -24,8 +24,8 @@ function missingCredentialsMessage() {
     return "No Blaxel credentials found. Set the BL_API_KEY and BL_WORKSPACE environment variables, or run `bl login`.";
 }
 // Build info - these placeholders are replaced at build time by build:replace-imports
-const BUILD_VERSION = "0.3.26";
-const BUILD_COMMIT = "18c2c73526c47b9ebc09aa3e16497b19854a02d0";
+const BUILD_VERSION = "0.3.27";
+const BUILD_COMMIT = "b818d0f5560b92040baeb620b8d89bf148cba56d";
 const BUILD_SENTRY_DSN = "https://fd5e60e1c9820e1eef5ccebb84a07127@o4508714045276160.ingest.us.sentry.io/4510465864564736";
 const BLAXEL_API_VERSION = "2026-09-22";
 // Bun < 1.3.11 never sends connection-level WINDOW_UPDATE: the pooled h2

package/dist/esm-browser/image/image.test.js

@@ -543,8 +543,12 @@ describe("Dockerfile instruction order", () => {
     });
 });
 describe("ImageInstance.build worker resources", () => {
-    async function buildWith(options, storedLabels) {
-        const calls = [];
+    // signing: "all" signs every build label, "update" signs only on PUT after a
+    // 404 then POST create (production today), "none" never signs them.
+    let calls = [];
+    async function buildWith(options, storedLabels, signing = "all") {
+        calls = [];
+        let created = false;
         vi.spyOn(settings, "authenticate").mockResolvedValue(undefined);
         vi.spyOn(settings, "headers", "get").mockReturnValue({});
         vi.spyOn(settings, "baseUrl", "get").mockReturnValue("https://api.test");
@@ -553,10 +557,18 @@ describe("ImageInstance.build worker resources", () => {
             const body = typeof init.body === "string" ? JSON.parse(init.body) : undefined;
             calls.push({ url, method: init.method ?? "GET", headers, body });
             if (url.includes("upload=true")) {
-                const sent = body.metadata?.labels;
-                return Promise.resolve(new Response(JSON.stringify({ metadata: { name: "img", labels: storedLabels ?? sent } }), {
+                if (signing === "update" && init.method === "PUT" && !created) {
+                    return Promise.resolve(new Response("{}", { status: 404 }));
+                }
+                created ||= init.method === "POST";
+                const labels = storedLabels ?? body.metadata?.labels ?? {};
+                const signed = ["host"];
+                if (signing === "all" || (signing === "update" && init.method === "PUT")) {
+                    signed.push(...Object.keys(labels).filter((k) => k.startsWith("x-blaxel-build")).map((k) => `x-amz-meta-${k}`));
+                }
+                return Promise.resolve(new Response(JSON.stringify({ metadata: { name: "img", labels } }), {
                     status: 200,
-                    headers: { "x-blaxel-upload-url": "https://upload.test/object" },
+                    headers: { "x-blaxel-upload-url": `https://upload.test/object?X-Amz-SignedHeaders=${signed.join(";")}` },
                 }));
             }
             if (url.startsWith("https://upload.test")) {
@@ -589,6 +601,19 @@ describe("ImageInstance.build worker resources", () => {
         expect(upload.headers["x-amz-meta-x-blaxel-build-volume"]).toBe("32768");
         expect(upload.headers["x-amz-meta-x-blaxel-auto-generated"]).toBeUndefined();
     });
+    it("asks again when creating a sandbox does not sign the settings", async () => {
+        const { upload } = await buildWith({ buildMemoryMb: 2048 }, undefined, "update");
+        expect(calls.filter((call) => call.url.includes("upload=true")).map((call) => call.method)).toEqual(["PUT", "POST", "PUT"]);
+        expect(upload.headers["x-amz-meta-x-blaxel-build-memory"]).toBe("2048");
+    });
+    it("fails clearly when the settings are never signed", async () => {
+        await expect(buildWith({ buildVolumeMb: 32768 }, undefined, "none")).rejects.toThrow("x-blaxel-build-volume");
+        expect(calls.some((call) => call.url.startsWith("https://upload.test"))).toBe(false);
+    });
+    it("drops stored labels the upload URL was not signed for", async () => {
+        const { upload } = await buildWith({}, { "x-blaxel-auto-generated": "true", "x-blaxel-build-memory": "8192" }, "none");
+        expect(upload.headers["x-amz-meta-x-blaxel-build-memory"]).toBeUndefined();
+    });
     it("keeps an explicit zero volume", async () => {
         const { upload } = await buildWith({ buildVolumeMb: 0 });
         expect(upload.headers["x-amz-meta-x-blaxel-build-volume"]).toBe("0");

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@blaxel/core",
-	"version": "0.3.26",
+	"version": "0.3.27",
 	"description": "Blaxel Core SDK for TypeScript",
 	"license": "MIT",
 	"author": "Blaxel, INC (https://blaxel.ai)",