@blaxel/core 0.3.29 → 0.3.30-preview.324

package/dist/cjs-browser/types/client/types.gen.d.ts

@@ -663,6 +663,10 @@ export type CustomDomainSpec = {
     txtRecords?: {
         [key: string]: string;
     };
+    /**
+     * How the TLS certificate is validated. "dns" (default) requires the certificate validation CNAME records to be published; "http" validates over HTTP once the domain points to Blaxel and requires no validation record. HTTP validation is not available for wildcard domains (previews or "*." names) and cannot be changed after creation.
+     */
+    validationMethod?: 'dns' | 'http';
     /**
      * Error message if verification failed
      */
@@ -704,6 +708,10 @@ export type CustomDomainSpecWritable = {
     txtRecords?: {
         [key: string]: string;
     };
+    /**
+     * How the TLS certificate is validated. "dns" (default) requires the certificate validation CNAME records to be published; "http" validates over HTTP once the domain points to Blaxel and requires no validation record. HTTP validation is not available for wildcard domains (previews or "*." names) and cannot be changed after creation.
+     */
+    validationMethod?: 'dns' | 'http';
 };
 /**
  * Drive providing persistent storage that can be attached to agents, functions, and sandboxes. Drives can be mounted at runtime via the sbx API.
@@ -1041,7 +1049,7 @@ export type ExpirationPolicy = {
      */
     type?: 'ttl-idle' | 'ttl-max-age' | 'date';
     /**
-     * Duration value for TTL policies (e.g., '30m', '24h', '7d', minimum '5m') or ISO 8601 date for date policies
+     * Duration value for TTL policies (e.g., '30m', '24h', '7d'; minimum '60s' for ttl-idle, '5m' for ttl-max-age) or ISO 8601 date for date policies
      */
     value?: string;
 };
@@ -3910,7 +3918,7 @@ export type SandboxRuntime = {
      */
     expires?: string;
     /**
-     * Extra arguments for kernel selection. Supported keys: 'iptables', 'nfs' (mk3.0), 'tun', 'android' and 'landlock' (mk3.1). The android variant includes tun and iptables and cannot be combined with nfs. The landlock variant enables the Landlock LSM, includes tun and iptables, and cannot be combined with android or nfs. Android and landlock requests are rejected if routing selects mk3.0. Values: 'enabled' or 'disabled'. Determines which kernel variant the workload runs on. Immutable after creation.
+     * Extra arguments for kernel selection. Supported keys: 'iptables', 'nfs' (mk3.0), 'tun', 'android' and 'landlock' (mk3.1). The android variant includes tun and iptables and cannot be combined with nfs. The landlock variant enables the Landlock LSM, includes tun and iptables, and cannot be combined with android or nfs. Android and landlock requests are rejected if routing selects mk3.0. 'kernelExtensions' (mk3.1, android only for now) switches on the selected kernel's loadable modules and kernel tracing (eBPF, kprobes, perf); without it they are disabled, even for root. Values: 'enabled' or 'disabled'. Determines which kernel variant the workload runs on. Immutable after creation.
      */
     extraArgs?: {
         [key: string]: string;
@@ -4359,6 +4367,40 @@ export type SandboxSpec = {
      */
     vpc?: string;
 };
+/**
+ * Workspace secret, referenced from proxy routing as {{SECRET:name}}. Values are write-only and can never be read back. Every upsert stores a new immutable version and the latest one is resolved at runtime.
+ */
+export type Secret = {
+    /**
+     * The date and time when the secret was first created
+     */
+    readonly createdAt?: string;
+    /**
+     * Case-sensitive secret name
+     */
+    name: string;
+    /**
+     * The date and time of the latest version
+     */
+    readonly updatedAt?: string;
+    /**
+     * Secret value. Write-only, never returned by the API
+     */
+    value?: string;
+};
+/**
+ * Workspace secret, referenced from proxy routing as {{SECRET:name}}. Values are write-only and can never be read back. Every upsert stores a new immutable version and the latest one is resolved at runtime.
+ */
+export type SecretWritable = {
+    /**
+     * Case-sensitive secret name
+     */
+    name: string;
+    /**
+     * Secret value. Write-only, never returned by the API
+     */
+    value?: string;
+};
 /**
  * Deployment status of a resource deployed on Blaxel
  */
@@ -5934,6 +5976,56 @@ export type CreateDriveAccessTokenResponses = {
     };
 };
 export type CreateDriveAccessTokenResponse = CreateDriveAccessTokenResponses[keyof CreateDriveAccessTokenResponses];
+export type DeleteDriveFolderData = {
+    body?: never;
+    path: {
+        driveName: string;
+    };
+    query: {
+        /**
+         * Relative folder path ending in a slash, for example documents/reports/.
+         */
+        path: string;
+    };
+    url: '/drives/{driveName}/folders';
+};
+export type DeleteDriveFolderErrors = {
+    /**
+     * Invalid folder path
+     */
+    400: unknown;
+    /**
+     * Unauthorized
+     */
+    401: unknown;
+    /**
+     * Insufficient permissions, protected path, or drives feature disabled
+     */
+    403: unknown;
+    /**
+     * Drive not found
+     */
+    404: unknown;
+    /**
+     * Drive unavailable or requested path is not a folder
+     */
+    409: unknown;
+    /**
+     * Storage unavailable or deletion incomplete; retry to finish cleanup
+     */
+    502: unknown;
+    /**
+     * Deletion timed out and may be partially complete; retry to finish cleanup
+     */
+    504: unknown;
+};
+export type DeleteDriveFolderResponses = {
+    /**
+     * Folder and its contents deleted, or folder already absent
+     */
+    204: void;
+};
+export type DeleteDriveFolderResponse = DeleteDriveFolderResponses[keyof DeleteDriveFolderResponses];
 export type GetDriveByExternalIdData = {
     body?: never;
     path: {
@@ -8739,6 +8831,68 @@ export type GetSandboxScheduleMetricsResponses = {
     200: SandboxScheduleMetrics;
 };
 export type GetSandboxScheduleMetricsResponse = GetSandboxScheduleMetricsResponses[keyof GetSandboxScheduleMetricsResponses];
+export type DeleteSecretByQueryData = {
+    body?: never;
+    path?: never;
+    query: {
+        /**
+         * Name of the secret
+         */
+        name: string;
+    };
+    url: '/secrets';
+};
+export type DeleteSecretByQueryResponses = {
+    /**
+     * successful operation
+     */
+    200: Secret;
+};
+export type DeleteSecretByQueryResponse = DeleteSecretByQueryResponses[keyof DeleteSecretByQueryResponses];
+export type ListSecretsData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/secrets';
+};
+export type ListSecretsResponses = {
+    /**
+     * successful operation
+     */
+    200: Array<Secret>;
+};
+export type ListSecretsResponse = ListSecretsResponses[keyof ListSecretsResponses];
+export type UpsertSecretData = {
+    body: SecretWritable;
+    path?: never;
+    query?: never;
+    url: '/secrets';
+};
+export type UpsertSecretResponses = {
+    /**
+     * successful operation
+     */
+    200: Secret;
+};
+export type UpsertSecretResponse = UpsertSecretResponses[keyof UpsertSecretResponses];
+export type DeleteSecretData = {
+    body?: never;
+    path: {
+        /**
+         * Name of the secret
+         */
+        secretName: string;
+    };
+    query?: never;
+    url: '/secrets/{secretName}';
+};
+export type DeleteSecretResponses = {
+    /**
+     * successful operation
+     */
+    200: Secret;
+};
+export type DeleteSecretResponse = DeleteSecretResponses[keyof DeleteSecretResponses];
 export type GetWorkspaceServiceAccountsData = {
     body?: never;
     path?: never;

package/dist/cjs-browser/types/common/posthog.d.ts

@@ -0,0 +1,51 @@
+/**
+ * How long a capture may stay outstanding.
+ *
+ * Node keeps the event loop alive while a fetch is pending, so this is what a
+ * short-lived script waits for before it can exit. A capture against
+ * us.i.posthog.com takes ~250-350ms end to end (DNS + TLS handshake + POST), so
+ * a second covers the happy path with headroom. The ceiling matters because a
+ * version is only recorded after a successful delivery: when the endpoint is
+ * unreachable every later run tries again, and networks that silently drop
+ * traffic rather than refusing it would otherwise pay the full timeout each
+ * time.
+ */
+export declare const POSTHOG_FLUSH_BUDGET_MS = 1000;
+type TelemetryState = {
+    distinct_id: string;
+    cli?: string;
+    sdks?: Record<string, string>;
+};
+/**
+ * Combine this process's telemetry snapshot with what is on disk right now.
+ *
+ * `~/.blaxel/telemetry.json` is shared with the CLI and the Python SDK, and
+ * each of them caches it in memory for the lifetime of its process. Writing
+ * this snapshot back wholesale would roll back anything the others recorded in
+ * the meantime, which makes them re-send their "Installed" event on every later
+ * run. Anything already on disk is at least as fresh as what is held here, so
+ * it wins, except for the fields this process actually owns.
+ */
+export declare function mergeTelemetryState(onDisk: Record<string, unknown>, ours: TelemetryState): Record<string, unknown>;
+type SDKInstallTrackerOptions = {
+    getApiKey: () => string;
+    isTrackingEnabled: () => boolean;
+    getVersion: () => string;
+    isNode: () => boolean;
+    loadState: () => TelemetryState;
+    saveState: (state: TelemetryState) => void;
+    getDistinctId: () => string;
+    fetch: typeof globalThis.fetch;
+    getSignal: () => AbortSignal | undefined;
+};
+/**
+ * Create an SDK install tracker. Exported from this internal module so delivery
+ * and deduplication behavior can be tested without build-time credentials.
+ */
+export declare function createSDKInstallTracker(options: SDKInstallTrackerOptions): () => Promise<void> | undefined;
+/**
+ * Track SDK installation. Fires "Installed SDK" once per new version.
+ * Called during SDK autoload.
+ */
+export declare function trackSDKInstalled(): void;
+export {};