@evident-ai/runner-cdk 3.5.2-dev.7130f36 → 3.5.2-dev.81383cc

package/dist/image-version-reporter-lambda/handler.js

@@ -29,15 +29,17 @@ var import_client_secrets_manager = require("@aws-sdk/client-secrets-manager");
 var PHYSICAL_RESOURCE_ID = "evident-image-version-report";
 var REPORT_TIMEOUT_MS = 5e3;
 var secrets = new import_client_secrets_manager.SecretsManagerClient({});
-async function fetchDoorbellSecret(secretArn, secretKey) {
+async function fetchControllerSigningSecret(secretArn, secretKey) {
   const { SecretString } = await secrets.send(new import_client_secrets_manager.GetSecretValueCommand({ SecretId: secretArn }));
   if (!SecretString) {
-    throw new Error(`doorbell secret ${secretArn} has no SecretString`);
+    throw new Error(`controller signing secret ${secretArn} has no SecretString`);
   }
   const parsed = JSON.parse(SecretString);
   const value = parsed !== null && typeof parsed === "object" ? parsed[secretKey] : void 0;
   if (typeof value !== "string" || value === "") {
-    throw new Error(`doorbell secret ${secretArn} is missing a non-empty '${secretKey}' field`);
+    throw new Error(
+      `controller signing secret ${secretArn} is missing a non-empty '${secretKey}' field`
+    );
   }
   return value;
 }
@@ -63,7 +65,7 @@ function response() {
   return { PhysicalResourceId: PHYSICAL_RESOURCE_ID };
 }
 var runtimeDependencies = {
-  getSecret: fetchDoorbellSecret,
+  getSecret: fetchControllerSigningSecret,
   fetch: globalThis.fetch
 };
 async function handleImageVersionReport(event, getConfig, dependencies = runtimeDependencies) {
@@ -77,10 +79,15 @@ async function handleImageVersionReport(event, getConfig, dependencies = runtime
     versions = readImageVersions(event.ResourceProperties?.imageVersions);
     const config = getConfig();
     runnerId = config.evidentRunnerId;
-    const secret = await dependencies.getSecret(config.doorbellSecretArn, config.doorbellSecretKey);
+    const secret = await dependencies.getSecret(
+      config.controllerSigningSecretArn,
+      config.controllerSigningSecretKey
+    );
     const body = JSON.stringify({
       type: "runner.microvm_image_versions_reported",
-      versions
+      versions,
+      // The API orders reports by this value because replacing an image restarts its version counter.
+      reporter_clock_ms: Date.now()
     });
     const signature = (0, import_node_crypto.createHmac)("sha256", secret).update(body).digest("hex");
     const url = `${config.evidentApiUrl.replace(/\/+$/, "")}/v1/runners/${encodeURIComponent(
@@ -117,8 +124,8 @@ async function handleImageVersionReport(event, getConfig, dependencies = runtime
   return response();
 }
 var handler = (event) => handleImageVersionReport(event, () => ({
-  doorbellSecretArn: requireEnv("DOORBELL_SECRET_ARN"),
-  doorbellSecretKey: requireEnv("DOORBELL_SECRET_KEY"),
+  controllerSigningSecretArn: requireEnv("CONTROLLER_SIGNING_SECRET_ARN"),
+  controllerSigningSecretKey: requireEnv("CONTROLLER_SIGNING_SECRET_KEY"),
   evidentApiUrl: requireEnv("EVIDENT_API_URL"),
   evidentRunnerId: requireEnv("EVIDENT_RUNNER_ID")
 }));

package/dist/index.d.ts

@@ -3,4 +3,4 @@ export { EvidentWaker, type EvidentWakerProps } from './waker/construct';
 export { EvidentMicrovmConstruct, type EvidentMicrovmConstructProps } from './microvm/construct';
 export { MICROVM_SHAPES, validateShapes, type MicrovmShape } from './microvm/shapes';
 export { MICROVM_MAX_RUN_SECONDS, HOOKS_PORT, HOOK_TIMEOUT_SECONDS, } from './microvm/constants';
-export { stageMicrovmImageContext, type StageMicrovmImageContextOptions, } from './microvm/image/stage-context';
+export { MICROVM_WORKSPACE_DIRECTORY, stageMicrovmBuildContext, type StageMicrovmBuildContextOptions, } from './microvm/image/stage-context';

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.stageMicrovmImageContext = exports.HOOK_TIMEOUT_SECONDS = exports.HOOKS_PORT = exports.MICROVM_MAX_RUN_SECONDS = exports.validateShapes = exports.MICROVM_SHAPES = exports.EvidentMicrovmConstruct = exports.EvidentWaker = exports.EvidentScaleToZeroConstruct = void 0;
+exports.stageMicrovmBuildContext = exports.MICROVM_WORKSPACE_DIRECTORY = exports.HOOK_TIMEOUT_SECONDS = exports.HOOKS_PORT = exports.MICROVM_MAX_RUN_SECONDS = exports.validateShapes = exports.MICROVM_SHAPES = exports.EvidentMicrovmConstruct = exports.EvidentWaker = exports.EvidentScaleToZeroConstruct = void 0;
 var evident_scale_to_zero_construct_1 = require("./evident-scale-to-zero-construct");
 Object.defineProperty(exports, "EvidentScaleToZeroConstruct", { enumerable: true, get: function () { return evident_scale_to_zero_construct_1.EvidentScaleToZeroConstruct; } });
 var construct_1 = require("./waker/construct");
@@ -17,4 +17,5 @@ Object.defineProperty(exports, "MICROVM_MAX_RUN_SECONDS", { enumerable: true, ge
 Object.defineProperty(exports, "HOOKS_PORT", { enumerable: true, get: function () { return constants_1.HOOKS_PORT; } });
 Object.defineProperty(exports, "HOOK_TIMEOUT_SECONDS", { enumerable: true, get: function () { return constants_1.HOOK_TIMEOUT_SECONDS; } });
 var stage_context_1 = require("./microvm/image/stage-context");
-Object.defineProperty(exports, "stageMicrovmImageContext", { enumerable: true, get: function () { return stage_context_1.stageMicrovmImageContext; } });
+Object.defineProperty(exports, "MICROVM_WORKSPACE_DIRECTORY", { enumerable: true, get: function () { return stage_context_1.MICROVM_WORKSPACE_DIRECTORY; } });
+Object.defineProperty(exports, "stageMicrovmBuildContext", { enumerable: true, get: function () { return stage_context_1.stageMicrovmBuildContext; } });

package/dist/microvm/constants.d.ts

@@ -6,4 +6,4 @@ export declare const SUSPENDING_POLL_ATTEMPTS = 4;
 export declare const SUSPENDING_POLL_INTERVAL_MS = 500;
 export declare const MICROVM_MAX_RUN_SECONDS = 28800;
 export declare const SESSION_CLEANUP_MAX_AGE = "24h";
-export declare const DOORBELL_SECRET_KEY = "DOORBELL_SECRET";
+export declare const CONTROLLER_SIGNING_SECRET_KEY = "CONTROLLER_SIGNING_SECRET";

package/dist/microvm/constants.js

@@ -4,7 +4,7 @@
 // across them. The image template pins matching copies, guarded by
 // `microvm/image/dockerfile.test.ts`.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DOORBELL_SECRET_KEY = exports.SESSION_CLEANUP_MAX_AGE = exports.MICROVM_MAX_RUN_SECONDS = exports.SUSPENDING_POLL_INTERVAL_MS = exports.SUSPENDING_POLL_ATTEMPTS = exports.RUN_HOOK_PAYLOAD_MAX_BYTES = exports.HOOK_TIMEOUT_SECONDS = exports.HOOKS_DIR = exports.HOOKS_PORT = void 0;
+exports.CONTROLLER_SIGNING_SECRET_KEY = exports.SESSION_CLEANUP_MAX_AGE = exports.MICROVM_MAX_RUN_SECONDS = exports.SUSPENDING_POLL_INTERVAL_MS = exports.SUSPENDING_POLL_ATTEMPTS = exports.RUN_HOOK_PAYLOAD_MAX_BYTES = exports.HOOK_TIMEOUT_SECONDS = exports.HOOKS_DIR = exports.HOOKS_PORT = void 0;
 // The port the image's hook server binds, baked into the published Dockerfile
 // (`ENV HOOKS_PORT`) and passed to the construct as `hooksPort`. Exported from
 // the package index because a consumer building the published image context
@@ -38,6 +38,9 @@ exports.MICROVM_MAX_RUN_SECONDS = 28800;
 // The 24h window rather than 7d keeps the session database bounded at the growth
 // rate observed in #537. The sweep runs on the default 1h interval.
 exports.SESSION_CLEANUP_MAX_AGE = '24h';
-// The JSON field inside the doorbell secret is shared by the Lambdas that name
-// it and by whatever produces the secret; this is never the secret value.
-exports.DOORBELL_SECRET_KEY = 'DOORBELL_SECRET';
+// The JSON field inside the controller signing secret is shared by the Lambdas
+// that name it and by whatever produces the secret; this is never the secret
+// value. It is customer-facing and separate from persisted doorbell messages
+// and telemetry. Changing the value silently stops an existing adopter's
+// secret from being read.
+exports.CONTROLLER_SIGNING_SECRET_KEY = 'CONTROLLER_SIGNING_SECRET';

package/dist/microvm/construct.d.ts

@@ -4,12 +4,10 @@ import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
 import { type MicrovmShape } from './shapes';
 export interface EvidentMicrovmConstructProps {
     /**
-     * Build context for the image, already staged on disk. An argument rather
-     * than something this construct stages itself, so synthesising the stack
-     * stays a pure function of its inputs instead of depending on how the
-     * ambient checkout was cloned.
+     * Directory containing the consumer's Dockerfile and every file it copies,
+     * typically the return value of `stageMicrovmBuildContext()`.
      */
-    readonly imageSource: string;
+    readonly buildContextPath: string;
     /**
      * ARN of the Lambda-managed base MicroVM image, from
      * `aws lambda-microvms list-managed-microvm-images`. A string, not a `CfnParameter`
@@ -33,14 +31,14 @@ export interface EvidentMicrovmConstructProps {
     readonly shapes?: readonly MicrovmShape[];
     /**
      * The secret holding the shared HMAC key the controller verifies every
-     * doorbell against, under the field `DOORBELL_SECRET`. Any Secrets Manager
+     * doorbell against, under the field `CONTROLLER_SIGNING_SECRET`. Any Secrets Manager
      * secret, however the caller manages it — this construct has no opinion on
      * SOPS, KMS, or any other production mechanism. Required (not defaulted
      * here): a default would need a scope of its own, and a caller-owned
      * default keeps its own logical id — the caller builds one exactly once,
      * in its own scope, and passes the result in either case.
      */
-    readonly doorbellSecret: secretsmanager.ISecret;
+    readonly controllerSigningSecret: secretsmanager.ISecret;
     /**
      * Optional runner secret whose JSON values are exported by `/run`. Omitting it
      * leaves GitHub and MCP credentials unavailable to a generic consumer.
@@ -65,7 +63,7 @@ export interface EvidentMicrovmConstructProps {
      * TCP port the image's hook server listens on, baked into both the image
      * (`HOOKS_PORT` env var) and the `MicrovmImage`'s `hooks.port` — a mismatch
      * means AWS probes a port nothing binds. Caller-supplied because the hook
-     * server is part of `imageSource`, which this construct does not build.
+     * server is part of the base image, which this construct does not build.
      */
     readonly hooksPort: number;
     /**
@@ -93,6 +91,12 @@ export interface EvidentMicrovmConstructProps {
      * throws at construction rather than silently disabling the reporter.
      */
     readonly evidentRunnerId?: string;
+    /**
+     * Opts into bounding the per-image MicroVM version quota (L-F8BECE9C) for
+     * this deployment's images only, using the upstream engine defaults. Omitting
+     * this leaves the synthesised template byte-for-byte identical.
+     */
+    readonly imageVersionPruning?: boolean;
 }
 /**
  * The customer-account half of the per-session runner (#558): the MicroVM

package/dist/microvm/construct.js

@@ -44,6 +44,7 @@ const lambda_microvm_cdk_1 = require("@evident-ai/lambda-microvm-cdk");
 const constants_1 = require("./constants");
 const shapes_1 = require("./shapes");
 const construct_1 = require("./image-version-reporter/construct");
+const construct_2 = require("./image-version-pruner/construct");
 // Image hooks build the snapshot, so they get minutes where the runtime hooks
 // get AWS's 60 s.
 const IMAGE_HOOK_TIMEOUT_SECONDS = 600;
@@ -146,42 +147,31 @@ class EvidentMicrovmConstruct extends constructs_1.Construct {
             lifecycleTimeout: cdk.Duration.seconds(props.hookTimeoutSeconds),
             buildTimeout: cdk.Duration.seconds(IMAGE_HOOK_TIMEOUT_SECONDS),
         };
-        // Built first and with no `executionRole` prop, exactly as before this
-        // shape catalogue existed: same construct id (`Image`, frozen on the
-        // shape record — see shapes.ts), same `imageName`, same description. The
-        // construct therefore creates `Image/ExecutionRole` at its current path
-        // and current logical id — zero CloudFormation churn on the live,
-        // hand-deployed stack (D3/D9). Every additional shape below borrows this
-        // role rather than getting one of its own, which is why `validateShapes`
-        // requires the default shape to be `shapes[0]`: it must exist before any
-        // other shape can reference its execution role.
-        const defaultImage = new lambda_microvm_cdk_1.MicrovmImage(this, defaultShape.constructId, {
+        // Built first without an `executionRole` prop, so every additional shape
+        // can borrow this image's execution role. `validateShapes` requires the
+        // default shape to be `shapes[0]` because that role must exist first.
+        const defaultImage = new lambda_microvm_cdk_1.MicrovmImage(this, defaultShape.name, {
             imageName: defaultShape.imageName,
             description: defaultShape.description,
             // A local directory, so the zip is uploaded by `cdk deploy` itself and the
             // image ARN is a stack reference rather than a deploy-time input.
-            source: props.imageSource,
+            source: props.buildContextPath,
             baseImageArn: props.baseImageArn,
             baseImageVersion: props.baseImageVersion,
             memoryMiB: defaultShape.memoryMiB,
             environment: imageEnvironment,
             hooks: imageHooks,
         });
-        // WART, accepted deliberately: every additional shape's image is built
-        // with `defaultImage.executionRole`, so this role's construct path
-        // (`Image/ExecutionRole`) reads as if it belongs to just the default
-        // shape's image, when in fact it is shared by every shape. That is
-        // intentional — see D3 in the plan. Do NOT "fix" this with
-        // `overrideLogicalId`: renaming the logical id IS the CloudFormation
-        // churn this design exists to avoid (a delete-and-recreate of the role a
-        // running MicroVM has live session credentials from). The wart is one
-        // comment; the override would undo the point of D3.
+        // WART: every additional shape shares `defaultImage.executionRole`, so the
+        // role's path under the default image reads as if it belongs to one shape
+        // even though it serves all of them. Keeping one role avoids replacing a
+        // role that running MicroVMs may still have credentials from.
         const images = new Map([[defaultShape.name, defaultImage]]);
         for (const shape of additionalShapes) {
-            images.set(shape.name, new lambda_microvm_cdk_1.MicrovmImage(this, shape.constructId, {
+            images.set(shape.name, new lambda_microvm_cdk_1.MicrovmImage(this, shape.name, {
                 imageName: shape.imageName,
                 description: shape.description,
-                source: props.imageSource,
+                source: props.buildContextPath,
                 baseImageArn: props.baseImageArn,
                 baseImageVersion: props.baseImageVersion,
                 memoryMiB: shape.memoryMiB,
@@ -237,8 +227,8 @@ class EvidentMicrovmConstruct extends constructs_1.Construct {
                 // The ARN and field name, never the value: the controller reads it from
                 // Secrets Manager at runtime, so the key is not exposed to anyone with
                 // lambda:GetFunctionConfiguration.
-                DOORBELL_SECRET_ARN: props.doorbellSecret.secretArn,
-                DOORBELL_SECRET_KEY: constants_1.DOORBELL_SECRET_KEY,
+                CONTROLLER_SIGNING_SECRET_ARN: props.controllerSigningSecret.secretArn,
+                CONTROLLER_SIGNING_SECRET_KEY: constants_1.CONTROLLER_SIGNING_SECRET_KEY,
                 MICROVM_SHAPES: shapeCatalogueJson,
                 // The role every shape's MicroVM shares (D3) — still one role, still
                 // this same expression, now documented as shared rather than singular.
@@ -253,7 +243,7 @@ class EvidentMicrovmConstruct extends constructs_1.Construct {
         // emit N near-identical policy statements and break the "exactly one
         // statement granting X" guarantees this construct's test encodes.
         defaultImage.grantRun(controller);
-        props.doorbellSecret.grantRead(controller);
+        props.controllerSigningSecret.grantRead(controller);
         const functionUrl = controller.addFunctionUrl({
             // HMAC verification of the doorbell body IS the auth, as for the ECS waker.
             authType: lambda.FunctionUrlAuthType.NONE,
@@ -263,7 +253,7 @@ class EvidentMicrovmConstruct extends constructs_1.Construct {
         // no custom resource — this branch must not run for them.
         if (props.evidentApiUrl && props.evidentRunnerId) {
             new construct_1.ImageVersionReporter(this, 'ImageVersionReporter', {
-                doorbellSecret: props.doorbellSecret,
+                controllerSigningSecret: props.controllerSigningSecret,
                 evidentApiUrl: props.evidentApiUrl,
                 evidentRunnerId: props.evidentRunnerId,
                 imageVersions: Object.fromEntries(shapes.map((shape) => [shape.name, images.get(shape.name).latestActiveImageVersion])),
@@ -274,6 +264,23 @@ class EvidentMicrovmConstruct extends constructs_1.Construct {
                 buildTriggers: Object.fromEntries(shapes.map((shape) => [shape.name, images.get(shape.name).buildInputs])),
             });
         }
+        if (props.imageVersionPruning) {
+            const pruner = new construct_2.ImageVersionPruner(this, 'ImageVersionPruner', {
+                imageArns: shapes.map((shape) => (0, lambda_microvm_cdk_1.microvmImageArn)({
+                    region: cdk.Stack.of(this).region,
+                    accountId: cdk.Stack.of(this).account,
+                    imageName: shape.imageName,
+                })),
+                buildTriggers: Object.fromEntries(shapes.map((shape) => {
+                    const { buildRoleArn: _buildRoleArn, ...buildInputs } = images.get(shape.name).buildInputs;
+                    return [shape.name, buildInputs];
+                })),
+            });
+            // Free a quota slot before the publish that consumes it.
+            for (const shape of shapes) {
+                images.get(shape.name).node.addDependency(pruner);
+            }
+        }
         this.functionUrl = functionUrl.url;
         this.shapeCatalogueJson = shapeCatalogueJson;
         this.durableStateBucket = durableState;

package/dist/microvm/controller/handle-doorbell.d.ts

@@ -17,10 +17,10 @@ export type DoorbellResult = {
         kind: ActionKind;
     };
 };
-export declare function handleDoorbell({ rawBody, signatureHeader, doorbellSecret, shapes, microvm, sleep, random, }: {
+export declare function handleDoorbell({ rawBody, signatureHeader, controllerSigningSecret, shapes, microvm, sleep, random, }: {
     rawBody: string;
     signatureHeader: string | undefined;
-    doorbellSecret: string;
+    controllerSigningSecret: string;
     shapes: ShapeCatalogue;
     microvm: MicrovmClient;
 } & Timing): Promise<DoorbellResult>;

package/dist/microvm/controller/handle-doorbell.js

@@ -174,8 +174,8 @@ async function shouldRecreateForNewerImage(doorbellRequest, shape, runningVersio
     // been deactivated, and recreating would not roll it forward. Resume.
     return compareImageVersions(running, latest) < 0;
 }
-async function handleDoorbell({ rawBody, signatureHeader, doorbellSecret, shapes, microvm, sleep, random, }) {
-    if (!(0, sdk_1.verifyEvidentSignature)(rawBody, signatureHeader, doorbellSecret)) {
+async function handleDoorbell({ rawBody, signatureHeader, controllerSigningSecret, shapes, microvm, sleep, random, }) {
+    if (!(0, sdk_1.verifyEvidentSignature)(rawBody, signatureHeader, controllerSigningSecret)) {
         return decide({
             statusCode: 401,
             action: 'rejected',

package/dist/microvm/image/stage-context.d.ts

@@ -1,42 +1,17 @@
-export interface StageMicrovmImageContextOptions {
-    /**
-     * The repository baked into the image as the agent's workspace. This is the
-     * CONSUMER's repository, not Evident's — the image is a dev box for whatever
-     * codebase the agent works on. Must be a full (non-shallow) clone.
-     */
-    readonly repositoryPath: string;
-    /**
-     * `origin` of the baked repository, as the VM will see it. Must be a
-     * credential-free URL (typically `https://github.com/<owner>/<repo>.git`):
-     * this string ships inside the shared snapshot, so a token in it would be
-     * baked into every VM. The credential arrives per-VM instead.
-     */
-    readonly originUrl: string;
-    /** Directory to write the build context to. Removed and recreated. */
-    readonly destination: string;
-    /**
-     * Overlay scripts the image build runs as root and as `runner`. The overlay
-     * ships inside the shared snapshot, so it may install software but must carry
-     * no credential. When omitted, deterministic no-op scripts are written.
-     */
-    readonly overlayDir?: string;
-    /**
-     * The published template to copy from. Defaults to the one inside this
-     * package; named directly by the tests, which assert against a template they
-     * built themselves rather than whichever `dist/` happens to be present.
-     */
-    readonly templateDir?: string;
+/** The fixed directory that contains the workspace in a staged build context. */
+export declare const MICROVM_WORKSPACE_DIRECTORY = "workspace";
+export interface StageMicrovmBuildContextOptions {
+    /** The customer's directory containing their Dockerfile and COPY sources. */
+    readonly buildContextPath: string;
+    /** A full local checkout to bake into the image's `workspace/` directory. */
+    readonly workspaceRepositoryPath: string;
+    /** Credential-free origin URL carried by the baked checkout. */
+    readonly workspaceOriginUrl: string;
 }
 /**
- * Writes the build context AWS unpacks — the Dockerfile, the hook server, the
- * per-phase hook scripts, the deployment overlay and the repository — and
- * returns its path. The result is what `EvidentMicrovmConstruct`'s `imageSource`
- * takes.
+ * Stages customer-owned image inputs in a fresh temporary directory.
  *
- * The Dockerfile, hook server and phase hooks come from this package's
- * published `dist/`, so a consumer needs no checkout of the source repository and no
- * copy of those files. A caller may supply an overlay; the default is
- * deterministic no-op scripts. `repositoryPath` is the only required caller
- * input.
+ * Staging keeps the image asset hash a pure function of the workspace commit while
+ * leaving the customer in control of the Dockerfile and its build context.
  */
-export declare function stageMicrovmImageContext(options: StageMicrovmImageContextOptions): string;
+export declare function stageMicrovmBuildContext(options: StageMicrovmBuildContextOptions): string;

package/dist/microvm/image/stage-context.js

@@ -33,143 +33,53 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.stageMicrovmImageContext = stageMicrovmImageContext;
+exports.MICROVM_WORKSPACE_DIRECTORY = void 0;
+exports.stageMicrovmBuildContext = stageMicrovmBuildContext;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
 const path = __importStar(require("node:path"));
-/**
- * The image build context template published inside this package.
- *
- * Resolved from the PACKAGE ROOT, THREE directories above `__dirname` — either
- * compiled (`dist/microvm/image`) or via ts-node (`src/microvm/image`) — the
- * same way `microvm/construct.ts` resolves the controller Lambda asset, but one
- * `..` deeper because this file sits a directory below it. It is
- * written by `scripts/build.ts` at PACKAGE build time, not at stage time, so a
- * consumer needs no esbuild and no checkout of this repo (#1528).
- */
-const TEMPLATE_DIR = path.resolve(__dirname, '..', '..', '..', 'dist', 'microvm-image-context');
+/** The fixed directory that contains the workspace in a staged build context. */
+exports.MICROVM_WORKSPACE_DIRECTORY = 'workspace';
 function git(args, cwd) {
     return (0, node_child_process_1.execFileSync)('git', args, { cwd, encoding: 'utf8' }).trim();
 }
-/**
- * `git rev-parse --is-shallow-repository` throws an opaque `execFileSync`
- * error (e.g. "not a git repository") when `repositoryPath` isn't usable at
- * all, so that failure is rethrown naming the path.
- */
-function isShallowRepository(repositoryPath) {
+/** Names the path when git cannot determine whether the repository is shallow. */
+function isShallowRepository(sourcePath) {
     try {
-        return git(['rev-parse', '--is-shallow-repository'], repositoryPath) === 'true';
+        return git(['rev-parse', '--is-shallow-repository'], sourcePath) === 'true';
     }
     catch (err) {
-        throw new Error(`${repositoryPath} is not a usable git repository: ` +
+        throw new Error(`${sourcePath} is not a usable git repository: ` +
             `${err instanceof Error ? err.message : String(err)}`);
     }
 }
-/**
- * Clones the caller's repository into the build context for the Dockerfile to
- * bake as a checked-out but uninstalled workspace.
- *
- * `file://` rather than a plain path: a path triggers git's local-clone
- * optimisation, which copies the whole object store — every branch and worktree
- * ref on the staging machine (50 MB here). The file transport negotiates like a
- * network fetch and packs only what the checked-out branch reaches (9 MB), with
- * one branch and one remote-tracking ref. Ignored files, `node_modules` first
- * among them, are not part of a clone at all.
- */
-function stageRepository(repositoryPath, destination, originUrl) {
-    if (isShallowRepository(repositoryPath)) {
-        throw new Error(`refusing to stage a shallow checkout (${repositoryPath}): the agent branches, ` +
+/** Clones a full repository while normalising the bytes that affect the image asset hash. */
+function stageRepository(sourcePath, stagedWorkspacePath, workspaceOriginUrl) {
+    if (isShallowRepository(sourcePath)) {
+        throw new Error(`refusing to stage a shallow checkout (${sourcePath}): the agent branches, ` +
             'commits and opens PRs, so the image needs real history. Run `git fetch --unshallow`.');
     }
-    // Absolute on both sides: `file://` needs an absolute path to mean anything,
-    // and the clone's cwd is the destination's parent (the only directory both
-    // are guaranteed to resolve against).
-    git(['clone', '--quiet', '--single-branch', `file://${repositoryPath}`, destination], path.dirname(destination));
-    // The clone points `origin` at this machine's filesystem; the VM's origin is
-    // the caller's own remote over HTTPS, with no credential in it.
-    git(['remote', 'set-url', 'origin', originUrl], destination);
-    // The asset hash of the resulting image must be a pure function of the commit,
-    // or every deploy publishes a new `AWS::Lambda::MicrovmImage` version and wedges
-    // the stack at its per-image version ceiling. Two things break that purity:
-    // - `pack-objects`' delta search is multithreaded (`pack.threads` defaults to
-    //   the CPU count) and its output varies run to run; `-f`/`-F`
-    //   (`--no-reuse-delta`/`--no-reuse-object`) additionally stop it from reusing
-    //   whatever packing the source checkout happened to have. All three together
-    //   make the pack a pure function of the object set, independent of the source.
-    // - `.git/index` carries stat data (inode/mtime/size) and `.git/logs/**` carries
-    //   wall-clock reflog timestamps; neither is byte-stable for a fixed commit.
-    git(['-c', 'pack.threads=1', 'repack', '-adfqF'], destination);
-    (0, node_fs_1.rmSync)(path.join(destination, '.git', 'index'), { force: true });
-    (0, node_fs_1.rmSync)(path.join(destination, '.git', 'logs'), { recursive: true, force: true });
-    console.log(`[stage] repo ${git(['rev-parse', 'HEAD'], destination)}`);
-}
-function stageScriptDirectory(source, destination) {
-    (0, node_fs_1.mkdirSync)(destination);
-    for (const entry of (0, node_fs_1.readdirSync)(source, { withFileTypes: true })) {
-        const sourcePath = path.join(source, entry.name);
-        const staged = path.join(destination, entry.name);
-        if (entry.isDirectory()) {
-            stageScriptDirectory(sourcePath, staged);
-            continue;
-        }
-        (0, node_fs_1.copyFileSync)(sourcePath, staged);
-        // Set modes here rather than inheriting them from the template, so they stay
-        // correct after an npm pack, zip, CI-cache or hand-copy round trip. The image
-        // executes extensionless scripts and sources `.sh` files.
-        (0, node_fs_1.chmodSync)(staged, entry.name.endsWith('.sh') ? 0o644 : 0o755);
-    }
+    git(['clone', '--quiet', '--single-branch', `file://${sourcePath}`, stagedWorkspacePath], path.dirname(stagedWorkspacePath));
+    git(['remote', 'set-url', 'origin', workspaceOriginUrl], stagedWorkspacePath);
+    git(['-c', 'pack.threads=1', 'repack', '-adfqF'], stagedWorkspacePath);
+    (0, node_fs_1.rmSync)(path.join(stagedWorkspacePath, '.git', 'index'), { force: true });
+    (0, node_fs_1.rmSync)(path.join(stagedWorkspacePath, '.git', 'logs'), { recursive: true, force: true });
+    console.log(`[stage] repo ${git(['rev-parse', 'HEAD'], stagedWorkspacePath)}`);
 }
 /**
- * Writes the build context AWS unpacks — the Dockerfile, the hook server, the
- * per-phase hook scripts, the deployment overlay and the repository — and
- * returns its path. The result is what `EvidentMicrovmConstruct`'s `imageSource`
- * takes.
+ * Stages customer-owned image inputs in a fresh temporary directory.
  *
- * The Dockerfile, hook server and phase hooks come from this package's
- * published `dist/`, so a consumer needs no checkout of the source repository and no
- * copy of those files. A caller may supply an overlay; the default is
- * deterministic no-op scripts. `repositoryPath` is the only required caller
- * input.
+ * Staging keeps the image asset hash a pure function of the workspace commit while
+ * leaving the customer in control of the Dockerfile and its build context.
  */
-function stageMicrovmImageContext(options) {
-    const { originUrl, overlayDir, templateDir = TEMPLATE_DIR } = options;
-    // `file://` and the clone below only mean anything against absolute paths,
-    // and a caller may reasonably pass either.
-    const repositoryPath = path.resolve(options.repositoryPath);
-    const destination = path.resolve(options.destination);
-    if (!(0, node_fs_1.existsSync)(templateDir)) {
-        throw new Error(`the MicroVM image context template is missing from ${templateDir}. It is written by ` +
-            "this package's build (`pnpm --filter @evident-ai/runner-cdk build`) and ships in the " +
-            'published tarball, so an installed copy should always have it.');
-    }
-    (0, node_fs_1.rmSync)(destination, { recursive: true, force: true });
-    (0, node_fs_1.mkdirSync)(destination, { recursive: true });
-    (0, node_fs_1.copyFileSync)(path.join(templateDir, 'Dockerfile'), path.join(destination, 'Dockerfile'));
-    (0, node_fs_1.copyFileSync)(path.join(templateDir, 'hook-server.js'), path.join(destination, 'hook-server.js'));
-    const hooksSource = path.join(templateDir, 'hooks');
-    const hooksStage = path.join(destination, 'hooks');
-    stageScriptDirectory(hooksSource, hooksStage);
-    const overlayStage = path.join(destination, 'overlay');
-    if (overlayDir === undefined) {
-        (0, node_fs_1.mkdirSync)(overlayStage);
-        for (const name of ['setup-root', 'setup-workspace']) {
-            const staged = path.join(overlayStage, name);
-            (0, node_fs_1.writeFileSync)(staged, '#!/usr/bin/env bash\n# No overlay supplied.\n', { mode: 0o755 });
-            (0, node_fs_1.chmodSync)(staged, 0o755);
-        }
-    }
-    else {
-        const resolvedOverlayDir = path.resolve(overlayDir);
-        if (!(0, node_fs_1.existsSync)(resolvedOverlayDir)) {
-            throw new Error(`overlay directory does not exist: ${resolvedOverlayDir}`);
-        }
-        for (const required of ['setup-root', 'setup-workspace']) {
-            if (!(0, node_fs_1.existsSync)(path.join(resolvedOverlayDir, required))) {
-                throw new Error(`overlay directory ${resolvedOverlayDir} is missing required script ${required}`);
-            }
-        }
-        stageScriptDirectory(resolvedOverlayDir, overlayStage);
+function stageMicrovmBuildContext(options) {
+    const buildContextPath = path.resolve(options.buildContextPath);
+    if (!(0, node_fs_1.existsSync)(buildContextPath) || !(0, node_fs_1.existsSync)(path.join(buildContextPath, 'Dockerfile'))) {
+        throw new Error(`MicroVM build context ${buildContextPath} does not exist or has no Dockerfile`);
     }
-    stageRepository(repositoryPath, path.join(destination, 'repo'), originUrl);
-    return destination;
+    const stagedPath = (0, node_fs_1.mkdtempSync)(path.join((0, node_os_1.tmpdir)(), 'evident-microvm-'));
+    (0, node_fs_1.cpSync)(buildContextPath, stagedPath, { recursive: true });
+    stageRepository(path.resolve(options.workspaceRepositoryPath), path.join(stagedPath, exports.MICROVM_WORKSPACE_DIRECTORY), options.workspaceOriginUrl);
+    return stagedPath;
 }

package/dist/microvm/image-version-pruner/construct.d.ts

@@ -0,0 +1,13 @@
+import { Construct } from 'constructs';
+import type { MicrovmImageBuildInputs } from '@evident-ai/lambda-microvm-cdk';
+export type ImageVersionPrunerProps = {
+    readonly imageArns: readonly string[];
+    /**
+     * Build inputs are a CloudFormation-visible invocation trigger. The build role
+     * ARN is excluded because it belongs to the image subtree and would create a cycle.
+     */
+    readonly buildTriggers: Record<string, Omit<MicrovmImageBuildInputs, 'buildRoleArn'>>;
+};
+export declare class ImageVersionPruner extends Construct {
+    constructor(scope: Construct, id: string, props: ImageVersionPrunerProps);
+}