@deployfoundation/foundation-deploy 0.2.40 → 0.2.41

package/dist/bin/app.js

@@ -8,7 +8,7 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-fwqmac5n.js";
+} from "../chunk-sgh3agpa.js";
 import {
   adminsFor,
   instanceNames,

package/dist/bin/foundation-deploy.js

@@ -1043,6 +1043,21 @@ var SMOKE_EXPECT = ['"authenticated":true', '"config_source":"s3"'];
 function smokeSessionId(prefix) {
   return `${prefix}-${Math.floor(Date.now() / 1000)}`.padEnd(40, "0");
 }
+async function stopSmokeSession(runner, opts, log) {
+  try {
+    await runner.capture([
+      "bedrock-agentcore",
+      "stop-runtime-session",
+      "--agent-runtime-arn",
+      opts.arn,
+      ...opts.qualifier === undefined ? [] : ["--qualifier", opts.qualifier],
+      "--runtime-session-id",
+      opts.sessionId
+    ]);
+  } catch {
+    log("  (could not stop the smoke session; it ends at the idle timeout)");
+  }
+}
 async function smokeInvoke(runner, opts) {
   const log = opts.log ?? ((line) => console.log(line));
   const payload = opts.payload ?? '{"_smoke_test":true}';
@@ -1070,6 +1085,7 @@ async function smokeInvoke(runner, opts) {
   } finally {
     await rm(dir, { recursive: true, force: true });
   }
+  await stopSmokeSession(runner, opts, log);
   log(`  ${out.replaceAll(`
 `, `
   `)}`);

package/dist/{chunk-fwqmac5n.js → chunk-sgh3agpa.js}

@@ -1104,6 +1104,14 @@ class FoundationApi extends cdk2.Stack {
         `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*/runtime-endpoint/*`
       ]
     }));
+    invokerRole.addToPolicy(new iam2.PolicyStatement({
+      sid: "StopSingleUseRuntimeSessions",
+      actions: ["bedrock-agentcore:StopRuntimeSession"],
+      resources: [
+        `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*`,
+        `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*/runtime-endpoint/*`
+      ]
+    }));
     invokerRole.addToPolicy(new iam2.PolicyStatement({
       sid: "ReadRuntimeEndpointVersion",
       actions: ["bedrock-agentcore:GetAgentRuntimeEndpoint"],
@@ -1937,6 +1945,7 @@ function deployStatements(stack, names, targets, instance) {
       sid: "SmokeTestRuntime",
       actions: [
         "bedrock-agentcore:InvokeAgentRuntime",
+        "bedrock-agentcore:StopRuntimeSession",
         "bedrock-agentcore:GetAgentRuntime",
         "bedrock-agentcore:ListAgentRuntimeVersions",
         "bedrock-agentcore:GetAgentRuntimeEndpoint",

package/dist/src/index.js

@@ -10,7 +10,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-fwqmac5n.js";
+} from "../chunk-sgh3agpa.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.40",
+  "version": "0.2.41",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/deploy/endpoint.ts

@@ -214,6 +214,32 @@ export interface SmokeOptions {
   log?: (line: string) => void;
 }
 
+/**
+ * End a smoke session once it has answered. Its id is minted per invoke and
+ * never used again, so otherwise the microVM idles out its whole idle timeout
+ * billed for its memory (~2 GB-hours each; a deploy runs three). Best-effort:
+ * a deployer without the permission still deploys.
+ */
+async function stopSmokeSession(
+  runner: EndpointRunner,
+  opts: SmokeOptions,
+  log: (line: string) => void,
+): Promise<void> {
+  try {
+    await runner.capture([
+      "bedrock-agentcore",
+      "stop-runtime-session",
+      "--agent-runtime-arn",
+      opts.arn,
+      ...(opts.qualifier === undefined ? [] : ["--qualifier", opts.qualifier]),
+      "--runtime-session-id",
+      opts.sessionId,
+    ]);
+  } catch {
+    log("  (could not stop the smoke session; it ends at the idle timeout)");
+  }
+}
+
 /** Invoke the runtime and assert the response says what a healthy runtime says. */
 export async function smokeInvoke(runner: EndpointRunner, opts: SmokeOptions): Promise<void> {
   const log = opts.log ?? ((line: string) => console.log(line));
@@ -250,6 +276,7 @@ export async function smokeInvoke(runner: EndpointRunner, opts: SmokeOptions): P
   } finally {
     await rm(dir, { recursive: true, force: true });
   }
+  await stopSmokeSession(runner, opts, log);
   log(`  ${out.replaceAll("\n", "\n  ")}`);
   for (const needle of opts.expect ?? SMOKE_EXPECT)
     if (!out.includes(needle)) throw new Error(`smoke test: response does not contain ${needle}`);

package/src/deploy-permissions.ts

@@ -175,11 +175,13 @@ export function deployStatements(
     // `foundation-deploy post-deploy` (and `deploy`'s inline promotion): the
     // smoke test (`_smoke_test`, `_fs_probe`) against DEFAULT, then promotion
     // of the new version onto `live`, which CREATES `live` when an instance
-    // brought up by `deploy` alone has none yet (`promoteEndpoint`).
+    // brought up by `deploy` alone has none yet (`promoteEndpoint`). Each
+    // smoke session is stopped once it answers: nothing invokes it again.
     new iam.PolicyStatement({
       sid: "SmokeTestRuntime",
       actions: [
         "bedrock-agentcore:InvokeAgentRuntime",
+        "bedrock-agentcore:StopRuntimeSession",
         "bedrock-agentcore:GetAgentRuntime",
         "bedrock-agentcore:ListAgentRuntimeVersions",
         "bedrock-agentcore:GetAgentRuntimeEndpoint",

package/src/stacks/api-stack.ts

@@ -529,6 +529,19 @@ export class FoundationApi extends cdk.Stack {
         ],
       }),
     );
+    // A routine fire's session is single-use: the invoker ends it as soon as
+    // the fire answers instead of paying for its memory through the idle
+    // timeout (`isSingleUseSession` in gateway/src/invoker.ts).
+    invokerRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "StopSingleUseRuntimeSessions",
+        actions: ["bedrock-agentcore:StopRuntimeSession"],
+        resources: [
+          `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*`,
+          `arn:${this.partition}:bedrock-agentcore:${this.region}:${this.account}:runtime/${names.runtimeName}*/runtime-endpoint/*`,
+        ],
+      }),
+    );
     // Which version the endpoint serves: the invoker names it in the session
     // id so a thread moves off a pre-deploy microVM on its next turn.
     invokerRole.addToPolicy(