@evident-ai/runner-cdk 0.1.1-dev.da88f8e → 3.4.1-dev.0ef5061

package/dist/microvm/controller/shape-catalogue.d.ts

@@ -1,6 +1,6 @@
 /**
  * Parses the `MICROVM_SHAPES` environment variable (a JSON array, written by
- * CloudFormation from `infrastructure/evident-microvm/src/shapes.ts` at
+ * CloudFormation from `aws/runner-cdk/src/microvm/shapes.ts` at
  * deploy time — see D6/D7 in the plan) into a `ShapeCatalogue` the pure
  * decision core can query, without that core ever touching `process.env`
  * itself.

package/dist/microvm/controller/shape-catalogue.js

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Parses the `MICROVM_SHAPES` environment variable (a JSON array, written by
- * CloudFormation from `infrastructure/evident-microvm/src/shapes.ts` at
+ * CloudFormation from `aws/runner-cdk/src/microvm/shapes.ts` at
  * deploy time — see D6/D7 in the plan) into a `ShapeCatalogue` the pure
  * decision core can query, without that core ever touching `process.env`
  * itself.

package/dist/microvm/image-version-reporter/construct.d.ts

@@ -0,0 +1,35 @@
+import { Construct } from 'constructs';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import type { MicrovmImageBuildInputs } from '@evident-ai/lambda-microvm-cdk';
+export type ImageVersionReporterProps = {
+    /** The secret whose value is the same HMAC key the controller verifies every doorbell against. */
+    doorbellSecret: secretsmanager.ISecret;
+    /** Base URL of Evident's own API — non-secret. */
+    evidentApiUrl: string;
+    /** The pool runner id the report is filed against — non-secret, public UUID. */
+    evidentRunnerId: string;
+    /** Shape name -> the `Fn::GetAtt LatestActiveImageVersion` published this deploy. */
+    imageVersions: Record<string, string>;
+    /**
+     * Shape name -> {@link MicrovmImageBuildInputs}, a STRUCTURED object (never
+     * a delimiter-joined string — see its docstring for why flattening is
+     * unsafe) that changes whenever THIS deploy's build inputs change. Unlike
+     * `imageVersions`' `Fn::GetAtt` (a runtime attribute of the MicroVM image
+     * service, whose deploy-time propagation to a dependent resource this
+     * construct cannot itself guarantee), every field here is either a
+     * synth-time-computed literal or a plain `Ref`/`Fn::GetAtt` to a resource
+     * IN THIS STACK — CloudFormation diffs the full resolved property tree, so
+     * a change anywhere in this object is a certain, not merely likely,
+     * re-invocation trigger.
+     */
+    buildTriggers: Record<string, MicrovmImageBuildInputs>;
+};
+/**
+ * Deploy-time push: reports each shape's just-published MicroVM image version to
+ * Evident, once per deploy that actually changes it. `imageVersions` is the
+ * payload; `buildTriggers` is what guarantees re-invocation on exactly the
+ * deploy that matters, independent of `imageVersions`' own resolution timing.
+ */
+export declare class ImageVersionReporter extends Construct {
+    constructor(scope: Construct, id: string, props: ImageVersionReporterProps);
+}

package/dist/microvm/image-version-reporter/construct.js

@@ -0,0 +1,91 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ImageVersionReporter = void 0;
+const path = __importStar(require("path"));
+const cdk = __importStar(require("aws-cdk-lib"));
+const constructs_1 = require("constructs");
+const lambda = __importStar(require("aws-cdk-lib/aws-lambda"));
+const cr = __importStar(require("aws-cdk-lib/custom-resources"));
+/** The JSON field name inside the doorbell secret, same key the controller reads. */
+const DOORBELL_SECRET_KEY = 'DOORBELL_SECRET';
+/**
+ * Deploy-time push: reports each shape's just-published MicroVM image version to
+ * Evident, once per deploy that actually changes it. `imageVersions` is the
+ * payload; `buildTriggers` is what guarantees re-invocation on exactly the
+ * deploy that matters, independent of `imageVersions`' own resolution timing.
+ */
+class ImageVersionReporter extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const handler = new lambda.Function(this, 'Function', {
+            runtime: lambda.Runtime.NODEJS_22_X,
+            // Pre-bundled at PACKAGE build time, same reasoning as the waker's and the
+            // controller's own `Code.fromAsset` (see their comments) — resolved from
+            // the PACKAGE ROOT, two directories below this file either compiled
+            // (`dist/microvm/image-version-reporter`) or via ts-node
+            // (`src/microvm/image-version-reporter`).
+            code: lambda.Code.fromAsset(path.join(__dirname, '..', '..', '..', 'dist', 'image-version-reporter-lambda')),
+            handler: 'handler.handler',
+            memorySize: 128,
+            // A deploy hook must not hold CloudFormation for its default 1 h — this is
+            // the hard stop; the handler's own internal REPORT_TIMEOUT_MS is well under it.
+            timeout: cdk.Duration.seconds(30),
+            environment: {
+                // ARN + field name only, never the value (mirrors the controller and waker).
+                DOORBELL_SECRET_ARN: props.doorbellSecret.secretArn,
+                DOORBELL_SECRET_KEY: DOORBELL_SECRET_KEY,
+                EVIDENT_API_URL: props.evidentApiUrl,
+                EVIDENT_RUNNER_ID: props.evidentRunnerId,
+            },
+        });
+        props.doorbellSecret.grantRead(handler);
+        const provider = new cr.Provider(this, 'Provider', {
+            onEventHandler: handler,
+        });
+        new cdk.CustomResource(this, 'Resource', {
+            serviceToken: provider.serviceToken,
+            properties: {
+                imageVersions: props.imageVersions,
+                // Not read by the handler — its only job is to be a property value
+                // CloudFormation can see change (a structured object, so any field
+                // changing anywhere is a real property diff), so the resource is
+                // invoked on exactly the deploy that changes a build input.
+                buildTriggers: props.buildTriggers,
+            },
+        });
+    }
+}
+exports.ImageVersionReporter = ImageVersionReporter;

package/dist/microvm/image-version-reporter/handler.d.ts

@@ -0,0 +1,26 @@
+export type ImageVersionPair = {
+    shape: string;
+    image_version: string;
+};
+export type ReporterEvent = {
+    RequestType: 'Create' | 'Update' | 'Delete';
+    ResourceProperties?: {
+        imageVersions?: unknown;
+    };
+};
+export type ReporterConfig = {
+    doorbellSecretArn: string;
+    doorbellSecretKey: string;
+    evidentApiUrl: string;
+    evidentRunnerId: string;
+};
+type ReporterDependencies = {
+    getSecret: (secretArn: string, secretKey: string) => Promise<string>;
+    fetch: typeof fetch;
+};
+type ReporterResponse = {
+    PhysicalResourceId: string;
+};
+export declare function handleImageVersionReport(event: ReporterEvent, getConfig: () => ReporterConfig, dependencies?: ReporterDependencies): Promise<ReporterResponse>;
+export declare const handler: (event: ReporterEvent) => Promise<ReporterResponse>;
+export {};

package/dist/microvm/image-version-reporter/handler.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = void 0;
+exports.handleImageVersionReport = handleImageVersionReport;
+const node_crypto_1 = require("node:crypto");
+const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
+const PHYSICAL_RESOURCE_ID = 'evident-image-version-report';
+const REPORT_TIMEOUT_MS = 5_000;
+const secrets = new client_secrets_manager_1.SecretsManagerClient({});
+async function fetchDoorbellSecret(secretArn, secretKey) {
+    const { SecretString } = await secrets.send(new client_secrets_manager_1.GetSecretValueCommand({ SecretId: secretArn }));
+    if (!SecretString) {
+        throw new Error(`doorbell secret ${secretArn} has no SecretString`);
+    }
+    const parsed = JSON.parse(SecretString);
+    const value = parsed !== null && typeof parsed === 'object'
+        ? parsed[secretKey]
+        : undefined;
+    if (typeof value !== 'string' || value === '') {
+        throw new Error(`doorbell secret ${secretArn} is missing a non-empty '${secretKey}' field`);
+    }
+    return value;
+}
+function requireEnv(name) {
+    const value = process.env[name];
+    if (!value) {
+        throw new Error(`missing required env var ${name}`);
+    }
+    return value;
+}
+function readImageVersions(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('imageVersions must be an object');
+    }
+    return Object.entries(value).map(([shape, imageVersion]) => {
+        if (typeof imageVersion !== 'string') {
+            throw new Error(`imageVersions.${shape} must be a string`);
+        }
+        return { shape, image_version: imageVersion };
+    });
+}
+function response() {
+    return { PhysicalResourceId: PHYSICAL_RESOURCE_ID };
+}
+const runtimeDependencies = {
+    getSecret: fetchDoorbellSecret,
+    fetch: globalThis.fetch,
+};
+async function handleImageVersionReport(event, getConfig, dependencies = runtimeDependencies) {
+    if (event.RequestType === 'Delete') {
+        return response();
+    }
+    let runnerId = 'unknown';
+    let versions = [];
+    let responseStatus;
+    try {
+        versions = readImageVersions(event.ResourceProperties?.imageVersions);
+        const config = getConfig();
+        runnerId = config.evidentRunnerId;
+        const secret = await dependencies.getSecret(config.doorbellSecretArn, config.doorbellSecretKey);
+        const body = JSON.stringify({
+            type: 'runner.microvm_image_versions_reported',
+            versions,
+        });
+        const signature = (0, node_crypto_1.createHmac)('sha256', secret).update(body).digest('hex');
+        const url = `${config.evidentApiUrl.replace(/\/+$/, '')}/v1/runners/${encodeURIComponent(runnerId)}/microvm-image-versions`;
+        const result = await dependencies.fetch(url, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                'x-evident-signature': signature,
+            },
+            body,
+            signal: AbortSignal.timeout(REPORT_TIMEOUT_MS),
+        });
+        responseStatus = result.status;
+        console.log('runner.microvm_image_versions_reported', {
+            runnerId,
+            versions,
+            status: result.status,
+        });
+        if (!result.ok) {
+            throw new Error(`Evident returned HTTP ${result.status}`);
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.warn('MicroVM image version report failed', {
+            operation: event.RequestType,
+            runnerId,
+            versions,
+            ...(responseStatus === undefined ? {} : { status: responseStatus }),
+            error: message,
+        });
+    }
+    return response();
+}
+const handler = (event) => handleImageVersionReport(event, () => ({
+    doorbellSecretArn: requireEnv('DOORBELL_SECRET_ARN'),
+    doorbellSecretKey: requireEnv('DOORBELL_SECRET_KEY'),
+    evidentApiUrl: requireEnv('EVIDENT_API_URL'),
+    evidentRunnerId: requireEnv('EVIDENT_RUNNER_ID'),
+}));
+exports.handler = handler;

package/dist/microvm-image-context/Dockerfile

@@ -37,7 +37,7 @@ RUN corepack enable && corepack prepare pnpm@9.15.0 --activate
 # binary assertion further down fails the build if any required binary is gone.
 RUN apt-get update \
   && apt-get install -y --no-install-recommends \
-    ca-certificates curl git jq less procps ripgrep \
+    ca-certificates curl git jq less procps psmisc ripgrep \
     postgresql postgresql-contrib direnv \
     gnupg unzip \
   # --- GitHub CLI (`gh`) from the official apt repo ---
@@ -71,8 +71,8 @@ RUN apt-get update \
 # restore` attempt — then starts a backgrounded `litestream replicate` once
 # opencode has opened the DB (WI-3); `/suspend`/`/resume`/`/terminate` flush,
 # restart and stop it in turn (WI-4). Do not remove as dead code.
-ARG LITESTREAM_VERSION=0.5.13
-ARG LITESTREAM_SHA256=ef47997794ce8dd87a64b44622d556b3a693b135fd72e0cf47cc42ac2e979051
+ARG LITESTREAM_VERSION=0.5.16
+ARG LITESTREAM_SHA256=678022e4103145302598e35d37f8718392d42e153feeb1e2d4a64dd0cd3aaf10
 RUN curl -fsSL -o /tmp/litestream.tar.gz \
       "https://github.com/benbjohnson/litestream/releases/download/v${LITESTREAM_VERSION}/litestream-${LITESTREAM_VERSION}-linux-arm64.tar.gz" \
   && echo "${LITESTREAM_SHA256}  /tmp/litestream.tar.gz" | sha256sum -c - \
@@ -171,10 +171,10 @@ ENV HOME=/home/runner
 # permanent no-op and every VM from this snapshot shares one machine id. Empty
 # is the correct unset state — it is the absence of an identity, so nothing
 # per-VM-unique enters the shared snapshot.
-RUN mkdir -p /var/lib/runner-pg /var/lib/dbus \
+RUN mkdir -p /var/lib/runner-pg /var/lib/dbus /home/runner/.local/state/evident \
   && install -o runner -g runner -m 0644 /dev/null /etc/machine-id \
   && install -o runner -g runner -m 0644 /dev/null /var/lib/dbus/machine-id \
-  && chown -R runner:runner /var/lib/runner-pg /home/runner
+   && chown -R runner:runner /var/lib/runner-pg /home/runner
 COPY --chown=10001:10001 repo ${WORKSPACE}
 WORKDIR ${WORKSPACE}
 USER runner
@@ -204,9 +204,12 @@ RUN git reset --quiet
 # database stay per-VM (see entrypoint.sh's pre-warm in evident-runner).
 RUN if [ -f pnpm-lock.yaml ]; then \
       pnpm install --frozen-lockfile \
-      && pnpm run build --filter='./packages/*'; \
+      && pnpm run build --filter='./packages/*' \
+        --filter='./aws/runner-cdk' \
+        --filter='./aws/lambda-microvm-cdk' \
+        --filter='./aws/lambda-microvm-runtime'; \
     else \
-      echo "[workspace-prep] no pnpm-lock.yaml in the baked repository — skipping the dependency install and the packages build; the agent installs on first use."; \
+      echo "[workspace-prep] no pnpm-lock.yaml in the baked repository — skipping the dependency install and the workspace build; the agent installs on first use."; \
     fi
 
 # Data dir for the local dev Postgres cluster; listens on 5433 to match this

package/dist/microvm-image-context/hook-server.js

@@ -275,14 +275,10 @@ var require_dist = __commonJS({
   }
 });
 
-// src/microvm/image/hook-server.ts
+// ../../runner/docker-images/microvm/hook-server.ts
 var import_lambda_microvm_runtime = __toESM(require_dist());
-
-// src/microvm/constants.ts
-var HOOKS_PORT = 8080;
 var HOOKS_DIR = "/etc/evident/hooks";
-
-// src/microvm/image/hook-server.ts
+var HOOKS_PORT = 8080;
 var server = (0, import_lambda_microvm_runtime.createNodeRuntime)({ hooksDir: HOOKS_DIR });
 var port = Number(process.env.HOOKS_PORT ?? HOOKS_PORT);
 server.listen(port, "0.0.0.0", () => {