@evident-ai/runner-cdk 3.5.2-dev.43244a2 → 3.5.2-dev.bcf1140

package/dist/evident-scale-to-zero-construct.js

@@ -39,6 +39,7 @@ const constructs_1 = require("constructs");
 const ec2 = __importStar(require("aws-cdk-lib/aws-ec2"));
 const ecs = __importStar(require("aws-cdk-lib/aws-ecs"));
 const iam = __importStar(require("aws-cdk-lib/aws-iam"));
+const constants_1 = require("./microvm/constants");
 const construct_1 = require("./waker/construct");
 /** Current fixed value of `resourcePrefix`, kept as the default so an adopter
  *  omitting the prop reproduces today's physical names exactly. */
@@ -111,15 +112,7 @@ class EvidentScaleToZeroConstruct extends constructs_1.Construct {
             GIT_BRANCH: gitBranch ?? 'main',
             // Scale-to-zero self-stop inputs (the entrypoint uses these to scale to 0).
             EVIDENT_IDLE_TIMEOUT_SECONDS: String(idleTimeoutSeconds),
-            // Auto-cleanup (issue #190): `evident run` reads this directly and, once a
-            // retention rule is set, sweeps OpenCode sessions idle longer than the
-            // window (protected/active sessions are never touched). Tightened from 7d
-            // to 24h per #537: at 7d, opencode.db was observed growing ~11x (77 MB ->
-            // 849 MB) in ~24h, so 7d was far too permissive at the observed growth
-            // rate. 24h is the tighter mitigation that came out of that (see also the
-            // OPENCODE_VERSION pin above). Sweep runs on the default 1h interval and
-            // never touches a protected/active session.
-            EVIDENT_SESSION_CLEANUP_MAX_AGE: '24h',
+            EVIDENT_SESSION_CLEANUP_MAX_AGE: constants_1.SESSION_CLEANUP_MAX_AGE,
             CLUSTER: cluster.clusterName,
             SERVICE: serviceName,
             EVIDENT_SELFSTOP_ROLE_ARN: selfStopRole.roleArn,

package/dist/microvm/constants.d.ts

@@ -5,3 +5,5 @@ export declare const RUN_HOOK_PAYLOAD_MAX_BYTES = 16384;
 export declare const SUSPENDING_POLL_ATTEMPTS = 4;
 export declare const SUSPENDING_POLL_INTERVAL_MS = 500;
 export declare const MICROVM_MAX_RUN_SECONDS = 28800;
+export declare const SESSION_CLEANUP_MAX_AGE = "24h";
+export declare const DOORBELL_SECRET_KEY = "DOORBELL_SECRET";

package/dist/microvm/constants.js

@@ -1,10 +1,10 @@
 "use strict";
-// Shared literals for the MicroVM controller and for the image it launches.
+// Shared literals for the MicroVM controller, its image, and the Fargate runner.
 // Every module imports from here rather than restating a value that must match
 // across them. The image template pins matching copies, guarded by
 // `microvm/image/dockerfile.test.ts`.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MICROVM_MAX_RUN_SECONDS = exports.SUSPENDING_POLL_INTERVAL_MS = exports.SUSPENDING_POLL_ATTEMPTS = exports.RUN_HOOK_PAYLOAD_MAX_BYTES = exports.HOOK_TIMEOUT_SECONDS = exports.HOOKS_DIR = exports.HOOKS_PORT = void 0;
+exports.DOORBELL_SECRET_KEY = exports.SESSION_CLEANUP_MAX_AGE = exports.MICROVM_MAX_RUN_SECONDS = exports.SUSPENDING_POLL_INTERVAL_MS = exports.SUSPENDING_POLL_ATTEMPTS = exports.RUN_HOOK_PAYLOAD_MAX_BYTES = exports.HOOK_TIMEOUT_SECONDS = exports.HOOKS_DIR = exports.HOOKS_PORT = void 0;
 // The port the image's hook server binds, baked into the published Dockerfile
 // (`ENV HOOKS_PORT`) and passed to the construct as `hooksPort`. Exported from
 // the package index because a consumer building the published image context
@@ -32,3 +32,12 @@ exports.SUSPENDING_POLL_INTERVAL_MS = 500;
 // longer than any VM can possibly still be running, no VM started before the
 // deactivation can outlive it. The two MUST move together.
 exports.MICROVM_MAX_RUN_SECONDS = 28800;
+// Auto-cleanup (issue #190): `evident run` reads this directly from the Fargate
+// task and MicroVM image. Setting a retention rule makes it sweep OpenCode
+// sessions idle longer than 24h; protected/active sessions are never touched.
+// The 24h window rather than 7d keeps the session database bounded at the growth
+// rate observed in #537. The sweep runs on the default 1h interval.
+exports.SESSION_CLEANUP_MAX_AGE = '24h';
+// The JSON field inside the doorbell secret is shared by the Lambdas that name
+// it and by whatever produces the secret; this is never the secret value.
+exports.DOORBELL_SECRET_KEY = 'DOORBELL_SECRET';

package/dist/microvm/construct.js

@@ -40,14 +40,12 @@ const constructs_1 = require("constructs");
 const lambda = __importStar(require("aws-cdk-lib/aws-lambda"));
 const s3 = __importStar(require("aws-cdk-lib/aws-s3"));
 const lambda_microvm_cdk_1 = require("@evident-ai/lambda-microvm-cdk");
+const constants_1 = require("./constants");
 const shapes_1 = require("./shapes");
 const construct_1 = require("./image-version-reporter/construct");
 // Image hooks build the snapshot, so they get minutes where the runtime hooks
 // get AWS's 60 s.
 const IMAGE_HOOK_TIMEOUT_SECONDS = 600;
-// The field inside the doorbell secret, shared by this construct (which
-// names it for the controller) and whatever produced `props.doorbellSecret`.
-const DOORBELL_SECRET_KEY = 'DOORBELL_SECRET';
 /**
  * The customer-account half of the per-session runner (#558): the MicroVM
  * image and the roles it builds and runs as, plus the stateless controller
@@ -127,10 +125,8 @@ class EvidentMicrovmConstruct extends constructs_1.Construct {
             // ("Environment variable key 'AWS_REGION' is reserved", 400), which is
             // also why the synchroniser's S3 client does not need it set — the
             // MicroVM runtime supplies the region itself.
-            // Read by `evident run` itself (not the hooks), the same 24h window ECS
-            // already bakes in for its own runners (evident-scale-to-zero-construct.ts:191).
             // Safe to bake: identical for every VM from this image version.
-            EVIDENT_SESSION_CLEANUP_MAX_AGE: '24h',
+            EVIDENT_SESSION_CLEANUP_MAX_AGE: constants_1.SESSION_CLEANUP_MAX_AGE,
             ...(props.runnerOpencodeConfigPath
                 ? { RUNNER_OPENCODE_CONFIG: props.runnerOpencodeConfigPath }
                 : {}),
@@ -240,7 +236,7 @@ class EvidentMicrovmConstruct extends constructs_1.Construct {
                 // Secrets Manager at runtime, so the key is not exposed to anyone with
                 // lambda:GetFunctionConfiguration.
                 DOORBELL_SECRET_ARN: props.doorbellSecret.secretArn,
-                DOORBELL_SECRET_KEY: DOORBELL_SECRET_KEY,
+                DOORBELL_SECRET_KEY: constants_1.DOORBELL_SECRET_KEY,
                 MICROVM_SHAPES: shapeCatalogueJson,
                 // The role every shape's MicroVM shares (D3) — still one role, still
                 // this same expression, now documented as shared rather than singular.

package/dist/microvm/image-version-reporter/construct.js

@@ -39,8 +39,7 @@ const cdk = __importStar(require("aws-cdk-lib"));
 const constructs_1 = require("constructs");
 const lambda = __importStar(require("aws-cdk-lib/aws-lambda"));
 const cr = __importStar(require("aws-cdk-lib/custom-resources"));
-/** The JSON field name inside the doorbell secret, same key the controller reads. */
-const DOORBELL_SECRET_KEY = 'DOORBELL_SECRET';
+const constants_1 = require("../constants");
 /**
  * Deploy-time push: reports each shape's just-published MicroVM image version to
  * Evident, once per deploy that actually changes it. `imageVersions` is the
@@ -66,7 +65,7 @@ class ImageVersionReporter extends constructs_1.Construct {
             environment: {
                 // ARN + field name only, never the value (mirrors the controller and waker).
                 DOORBELL_SECRET_ARN: props.doorbellSecret.secretArn,
-                DOORBELL_SECRET_KEY: DOORBELL_SECRET_KEY,
+                DOORBELL_SECRET_KEY: constants_1.DOORBELL_SECRET_KEY,
                 EVIDENT_API_URL: props.evidentApiUrl,
                 EVIDENT_RUNNER_ID: props.evidentRunnerId,
             },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evident-ai/runner-cdk",
-  "version": "3.5.2-dev.43244a2",
+  "version": "3.5.2-dev.bcf1140",
   "description": "Reusable CDK constructs for an Evident agent runner: a single scale-to-zero Fargate runner (task + service + per-agent self-stop role + waker Lambda), or a per-session AWS Lambda MicroVM that boots on demand and suspends between messages. Instantiate once per agent from your own stack.",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",