@evident-ai/runner-cdk 3.5.2-dev.8d3aa06 → 3.5.2-dev.bbd799b

package/dist/microvm/image-version-pruner/construct.js

@@ -0,0 +1,79 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ImageVersionPruner = void 0;
+const path = __importStar(require("path"));
+const cdk = __importStar(require("aws-cdk-lib"));
+const iam = __importStar(require("aws-cdk-lib/aws-iam"));
+const lambda = __importStar(require("aws-cdk-lib/aws-lambda"));
+const cr = __importStar(require("aws-cdk-lib/custom-resources"));
+const constructs_1 = require("constructs");
+class ImageVersionPruner extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const handler = new lambda.Function(this, 'Function', {
+            runtime: lambda.Runtime.NODEJS_22_X,
+            code: lambda.Code.fromAsset(path.join(__dirname, '..', '..', '..', 'dist', 'image-version-pruner-lambda')),
+            handler: 'handler.handler',
+            memorySize: 256,
+            timeout: cdk.Duration.minutes(5),
+        });
+        handler.addToRolePolicy(new iam.PolicyStatement({
+            actions: [
+                'lambda:GetMicrovmImage',
+                'lambda:ListMicrovmImageVersions',
+                'lambda:UpdateMicrovmImageVersion',
+                'lambda:DeleteMicrovmImageVersion',
+            ],
+            resources: [...props.imageArns],
+        }));
+        handler.addToRolePolicy(new iam.PolicyStatement({
+            // Evidence-only read: this account-wide permission cannot authorize a mutation.
+            actions: ['lambda:ListMicrovms'],
+            resources: ['*'],
+        }));
+        const provider = new cr.Provider(this, 'Provider', {
+            onEventHandler: handler,
+        });
+        new cdk.CustomResource(this, 'Resource', {
+            serviceToken: provider.serviceToken,
+            properties: {
+                imageArns: props.imageArns,
+                buildTriggers: props.buildTriggers,
+            },
+        });
+    }
+}
+exports.ImageVersionPruner = ImageVersionPruner;

package/dist/microvm/image-version-pruner/handler.d.ts

@@ -0,0 +1,20 @@
+import { LambdaMicrovmsClient } from '@aws-sdk/client-lambda-microvms';
+import { type PruneImageVersionsOptions, type PruneSummary } from '@evident-ai/lambda-microvm-cdk/prune';
+export declare const PRUNE_DEADLINE_MS: number;
+export type ImageVersionPrunerEvent = {
+    RequestType: 'Create' | 'Update' | 'Delete';
+    ResourceProperties?: {
+        imageArns?: unknown;
+    };
+};
+export type ImageVersionPrunerDependencies = {
+    pruneImageVersions: (options: PruneImageVersionsOptions) => Promise<PruneSummary>;
+    createClient: () => LambdaMicrovmsClient;
+    now: () => number;
+};
+type ImageVersionPrunerResponse = {
+    PhysicalResourceId: string;
+};
+export declare function handleImageVersionPrune(event: ImageVersionPrunerEvent, dependencies?: ImageVersionPrunerDependencies): Promise<ImageVersionPrunerResponse>;
+export declare const handler: (event: ImageVersionPrunerEvent) => Promise<ImageVersionPrunerResponse>;
+export {};

package/dist/microvm/image-version-pruner/handler.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = exports.PRUNE_DEADLINE_MS = void 0;
+exports.handleImageVersionPrune = handleImageVersionPrune;
+const client_lambda_microvms_1 = require("@aws-sdk/client-lambda-microvms");
+const prune_1 = require("@evident-ai/lambda-microvm-cdk/prune");
+const PHYSICAL_RESOURCE_ID = 'evident-image-version-pruner';
+exports.PRUNE_DEADLINE_MS = 4 * 60 * 1_000;
+const runtimeDependencies = {
+    pruneImageVersions: prune_1.pruneImageVersions,
+    createClient: () => new client_lambda_microvms_1.LambdaMicrovmsClient({}),
+    now: Date.now,
+};
+function response() {
+    return { PhysicalResourceId: PHYSICAL_RESOURCE_ID };
+}
+function log(message) {
+    console.log(`[image-version-pruner] ${message}`);
+}
+function logError(message) {
+    console.error(`[image-version-pruner] ${message}`);
+}
+function readImageArns(value) {
+    if (!Array.isArray(value) || !value.every((imageArn) => typeof imageArn === 'string')) {
+        return undefined;
+    }
+    return value;
+}
+async function raceWithDeadline(operation, controller) {
+    let timer;
+    const deadline = new Promise((resolve) => {
+        timer = setTimeout(() => resolve({ timedOut: true }), exports.PRUNE_DEADLINE_MS);
+    });
+    try {
+        const result = await Promise.race([
+            operation.then((summary) => ({ timedOut: false, summary })),
+            deadline,
+        ]);
+        if (result.timedOut) {
+            controller.abort();
+            try {
+                await operation;
+            }
+            catch (error) {
+                console.warn('MicroVM image version pruning cancellation observed', {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        return result;
+    }
+    finally {
+        if (timer !== undefined) {
+            clearTimeout(timer);
+        }
+    }
+}
+async function handleImageVersionPrune(event, dependencies = runtimeDependencies) {
+    if (event.RequestType === 'Delete') {
+        return response();
+    }
+    const imageArns = readImageArns(event.ResourceProperties?.imageArns);
+    if (imageArns === undefined) {
+        console.warn('MicroVM image version pruning skipped', {
+            operation: event.RequestType,
+            reason: 'imageArns must be an array of strings',
+        });
+        return response();
+    }
+    if (imageArns.length === 0) {
+        console.warn('MicroVM image version pruning skipped', {
+            operation: event.RequestType,
+            reason: 'imageArns is empty',
+        });
+        return response();
+    }
+    try {
+        const startedAt = dependencies.now();
+        const controller = new AbortController();
+        const operation = dependencies.pruneImageVersions({
+            client: dependencies.createClient(),
+            imageArns,
+            abortSignal: controller.signal,
+            log,
+            logError,
+        });
+        const result = await raceWithDeadline(operation, controller);
+        if (result.timedOut) {
+            console.warn('MicroVM image version pruning deadline reached', {
+                operation: event.RequestType,
+                imageArns,
+                deadlineMs: exports.PRUNE_DEADLINE_MS,
+                elapsedMs: dependencies.now() - startedAt,
+            });
+            return response();
+        }
+        console.log('MicroVM image version pruning complete', {
+            operation: event.RequestType,
+            imageArns,
+            deactivated: result.summary.deactivated.length,
+            deleted: result.summary.deleted.length,
+            skipped: result.summary.skipped.length,
+            stoppedOnQuota: result.summary.stoppedOnQuota,
+        });
+    }
+    catch (error) {
+        console.warn('MicroVM image version pruning failed', {
+            operation: event.RequestType,
+            imageArns,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+    return response();
+}
+const handler = (event) => handleImageVersionPrune(event);
+exports.handler = handler;

package/dist/microvm/image-version-reporter/construct.d.ts

@@ -3,7 +3,7 @@ import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
 import type { MicrovmImageBuildInputs } from '@evident-ai/lambda-microvm-cdk';
 export type ImageVersionReporterProps = {
     /** The secret whose value is the same HMAC key the controller verifies every doorbell against. */
-    doorbellSecret: secretsmanager.ISecret;
+    controllerSigningSecret: secretsmanager.ISecret;
     /** Base URL of Evident's own API — non-secret. */
     evidentApiUrl: string;
     /** The pool runner id the report is filed against — non-secret, public UUID. */

package/dist/microvm/image-version-reporter/construct.js

@@ -64,13 +64,13 @@ class ImageVersionReporter extends constructs_1.Construct {
             timeout: cdk.Duration.seconds(30),
             environment: {
                 // ARN + field name only, never the value (mirrors the controller and waker).
-                DOORBELL_SECRET_ARN: props.doorbellSecret.secretArn,
-                DOORBELL_SECRET_KEY: constants_1.DOORBELL_SECRET_KEY,
+                CONTROLLER_SIGNING_SECRET_ARN: props.controllerSigningSecret.secretArn,
+                CONTROLLER_SIGNING_SECRET_KEY: constants_1.CONTROLLER_SIGNING_SECRET_KEY,
                 EVIDENT_API_URL: props.evidentApiUrl,
                 EVIDENT_RUNNER_ID: props.evidentRunnerId,
             },
         });
-        props.doorbellSecret.grantRead(handler);
+        props.controllerSigningSecret.grantRead(handler);
         const provider = new cr.Provider(this, 'Provider', {
             onEventHandler: handler,
         });

package/dist/microvm/image-version-reporter/handler.d.ts

@@ -9,8 +9,8 @@ export type ReporterEvent = {
     };
 };
 export type ReporterConfig = {
-    doorbellSecretArn: string;
-    doorbellSecretKey: string;
+    controllerSigningSecretArn: string;
+    controllerSigningSecretKey: string;
     evidentApiUrl: string;
     evidentRunnerId: string;
 };

package/dist/microvm/image-version-reporter/handler.js

@@ -7,17 +7,17 @@ const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
 const PHYSICAL_RESOURCE_ID = 'evident-image-version-report';
 const REPORT_TIMEOUT_MS = 5_000;
 const secrets = new client_secrets_manager_1.SecretsManagerClient({});
-async function fetchDoorbellSecret(secretArn, secretKey) {
+async function fetchControllerSigningSecret(secretArn, secretKey) {
     const { SecretString } = await secrets.send(new client_secrets_manager_1.GetSecretValueCommand({ SecretId: secretArn }));
     if (!SecretString) {
-        throw new Error(`doorbell secret ${secretArn} has no SecretString`);
+        throw new Error(`controller signing secret ${secretArn} has no SecretString`);
     }
     const parsed = JSON.parse(SecretString);
     const value = parsed !== null && typeof parsed === 'object'
         ? parsed[secretKey]
         : undefined;
     if (typeof value !== 'string' || value === '') {
-        throw new Error(`doorbell secret ${secretArn} is missing a non-empty '${secretKey}' field`);
+        throw new Error(`controller signing secret ${secretArn} is missing a non-empty '${secretKey}' field`);
     }
     return value;
 }
@@ -43,7 +43,7 @@ function response() {
     return { PhysicalResourceId: PHYSICAL_RESOURCE_ID };
 }
 const runtimeDependencies = {
-    getSecret: fetchDoorbellSecret,
+    getSecret: fetchControllerSigningSecret,
     fetch: globalThis.fetch,
 };
 async function handleImageVersionReport(event, getConfig, dependencies = runtimeDependencies) {
@@ -57,10 +57,12 @@ async function handleImageVersionReport(event, getConfig, dependencies = runtime
         versions = readImageVersions(event.ResourceProperties?.imageVersions);
         const config = getConfig();
         runnerId = config.evidentRunnerId;
-        const secret = await dependencies.getSecret(config.doorbellSecretArn, config.doorbellSecretKey);
+        const secret = await dependencies.getSecret(config.controllerSigningSecretArn, config.controllerSigningSecretKey);
         const body = JSON.stringify({
             type: 'runner.microvm_image_versions_reported',
             versions,
+            // The API orders reports by this value because replacing an image restarts its version counter.
+            reporter_clock_ms: Date.now(),
         });
         const signature = (0, node_crypto_1.createHmac)('sha256', secret).update(body).digest('hex');
         const url = `${config.evidentApiUrl.replace(/\/+$/, '')}/v1/runners/${encodeURIComponent(runnerId)}/microvm-image-versions`;
@@ -96,8 +98,8 @@ async function handleImageVersionReport(event, getConfig, dependencies = runtime
     return response();
 }
 const handler = (event) => handleImageVersionReport(event, () => ({
-    doorbellSecretArn: requireEnv('DOORBELL_SECRET_ARN'),
-    doorbellSecretKey: requireEnv('DOORBELL_SECRET_KEY'),
+    controllerSigningSecretArn: requireEnv('CONTROLLER_SIGNING_SECRET_ARN'),
+    controllerSigningSecretKey: requireEnv('CONTROLLER_SIGNING_SECRET_KEY'),
     evidentApiUrl: requireEnv('EVIDENT_API_URL'),
     evidentRunnerId: requireEnv('EVIDENT_RUNNER_ID'),
 }));

package/dist/microvm/shapes.d.ts

@@ -5,11 +5,8 @@ import { type MicrovmMemoryMiB } from '@evident-ai/lambda-microvm-cdk';
  * there is no launch-time resource dial — so "a bigger machine" means "a
  * different shape", each backed by its own `MicrovmImage`.
  *
- * `constructId` and `imageName` are carried **explicitly** rather than
- * derived from `name`, because for the default shape they are frozen
- * deployment identity (see the comment on `MICROVM_SHAPES` below): deriving
- * them would let an innocent rename of `name` silently rebuild the live
- * image. Every other shape is free to name these however is convenient.
+ * `name` is also the `MicrovmImage` child id, so it identifies both the
+ * controller-facing shape and the image resource built for it.
  */
 export interface MicrovmShape {
     /** The stable id a doorbell asks for; crosses the wire to Evident. */
@@ -27,8 +24,6 @@ export interface MicrovmShape {
      * it must be the first entry in `MICROVM_SHAPES`.
      */
     readonly isDefault: boolean;
-    /** The `MicrovmImage` construct id within the stack. */
-    readonly constructId: string;
     /** The account-unique `imageName` passed to `MicrovmImage`. */
     readonly imageName: string;
 }
@@ -45,28 +40,22 @@ export interface MicrovmShape {
  * making the construction-order contract enforceable rather than a
  * convention.
  *
- * The default entry's `constructId` ("Image") and `imageName`
- * ("evident-microvm") are FROZEN: they are today's live, hand-deployed
- * image's identity. Changing either destroys and rebuilds it (~4m45s,
- * measured) plus a window with no image. Its `description` is copied
- * verbatim from the image that is live today so the deploy changes nothing
- * about it.
+ * The default entry's `name` ("standard") and `imageName`
+ * ("evident-microvm-standard") are FROZEN: `name` crosses the wire and
+ * identifies the image child, while `imageName` is account-unique. Changing
+ * either replaces the image, so both values remain stable after deployment.
  *
  * "Frozen" means unchanged under OUR OWN synth (no `microvm:*` context set —
  * `main.ts` passes none). `imageName` MAY carry a customer's
  * `microvm:namePrefix` (`deployment.ts`'s `resolveShapeCatalogue`) — that is
- * account-scoped naming, not a change to this module. `constructId` stays
- * frozen unconditionally, with no override anywhere: it is the
- * CloudFormation logical-id path, and prefixing it is the resource
- * replacement this whole file's FROZEN warning exists to prevent.
+ * account-scoped naming, not a change to this module.
  */
 export declare const MICROVM_SHAPES: readonly MicrovmShape[];
 /**
  * Validates a shape list at synth time. Deliberately lean
  * (`code-simplicity.mdc`): this is a hand-edited constant list in a typed
- * file, so it only checks what `tsc` cannot already catch — CDK itself
- * rejects a duplicate `constructId`, so that one needs no check here, and no
- * byte-budget cap is applied (the image ARNs are unresolved tokens at synth,
- * so a rendered size is not measurable anyway).
+ * file, so it only checks what `tsc` cannot already catch. No byte-budget cap
+ * is applied because the image ARNs are unresolved tokens at synth, so a
+ * rendered size is not measurable anyway.
  */
 export declare function validateShapes(shapes: readonly MicrovmShape[]): readonly MicrovmShape[];

package/dist/microvm/shapes.js

@@ -16,20 +16,15 @@ const lambda_microvm_cdk_1 = require("@evident-ai/lambda-microvm-cdk");
  * making the construction-order contract enforceable rather than a
  * convention.
  *
- * The default entry's `constructId` ("Image") and `imageName`
- * ("evident-microvm") are FROZEN: they are today's live, hand-deployed
- * image's identity. Changing either destroys and rebuilds it (~4m45s,
- * measured) plus a window with no image. Its `description` is copied
- * verbatim from the image that is live today so the deploy changes nothing
- * about it.
+ * The default entry's `name` ("standard") and `imageName`
+ * ("evident-microvm-standard") are FROZEN: `name` crosses the wire and
+ * identifies the image child, while `imageName` is account-unique. Changing
+ * either replaces the image, so both values remain stable after deployment.
  *
  * "Frozen" means unchanged under OUR OWN synth (no `microvm:*` context set —
  * `main.ts` passes none). `imageName` MAY carry a customer's
  * `microvm:namePrefix` (`deployment.ts`'s `resolveShapeCatalogue`) — that is
- * account-scoped naming, not a change to this module. `constructId` stays
- * frozen unconditionally, with no override anywhere: it is the
- * CloudFormation logical-id path, and prefixing it is the resource
- * replacement this whole file's FROZEN warning exists to prevent.
+ * account-scoped naming, not a change to this module.
  */
 exports.MICROVM_SHAPES = [
     {
@@ -38,18 +33,16 @@ exports.MICROVM_SHAPES = [
         description: 'Evident per-session runner: an arm64 image that boots with no identity and acquires one at /run.',
         memoryMiB: 4096,
         isDefault: true,
-        // FROZEN — see the file-level comment. Do not rename either string.
-        constructId: 'Image',
-        imageName: 'evident-microvm',
+        // FROZEN — name crosses the wire and imageName is account-unique.
+        imageName: 'evident-microvm-standard',
     },
 ];
 /**
  * Validates a shape list at synth time. Deliberately lean
  * (`code-simplicity.mdc`): this is a hand-edited constant list in a typed
- * file, so it only checks what `tsc` cannot already catch — CDK itself
- * rejects a duplicate `constructId`, so that one needs no check here, and no
- * byte-budget cap is applied (the image ARNs are unresolved tokens at synth,
- * so a rendered size is not measurable anyway).
+ * file, so it only checks what `tsc` cannot already catch. No byte-budget cap
+ * is applied because the image ARNs are unresolved tokens at synth, so a
+ * rendered size is not measurable anyway.
  */
 function validateShapes(shapes) {
     if (shapes.length === 0) {

package/dist/waker-lambda/handler.js

@@ -27,9 +27,9 @@ module.exports = __toCommonJS(handler_exports);
 var import_client_ecs = require("@aws-sdk/client-ecs");
 var import_client_secrets_manager = require("@aws-sdk/client-secrets-manager");
 
-// ../webhook-signature/src/verify-wake-signature.ts
+// ../../sdk/src/signature.ts
 var import_node_crypto = require("node:crypto");
-function verifyWakeSignature(rawBody, signatureHeader, secret) {
+function verifyEvidentSignature(rawBody, signatureHeader, secret) {
   if (!signatureHeader || !secret) {
     return false;
   }
@@ -64,7 +64,7 @@ async function handleWake({
   service,
   ecs
 }) {
-  if (!verifyWakeSignature(rawBody, signatureHeader, wakeSecret)) {
+  if (!verifyEvidentSignature(rawBody, signatureHeader, wakeSecret)) {
     const { statusCode: statusCode2, body: body2 } = jsonResponse(401, "invalid signature");
     return { statusCode: statusCode2, body: body2, calledUpdateService: false };
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evident-ai/runner-cdk",
-  "version": "3.5.2-dev.8d3aa06",
+  "version": "3.5.2-dev.bbd799b",
   "description": "Reusable CDK constructs for an Evident agent runner: a single scale-to-zero Fargate runner (task + service + per-agent self-stop role + waker Lambda), or a per-session AWS Lambda MicroVM that boots on demand and suspends between messages. Instantiate once per agent from your own stack.",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -15,8 +15,8 @@
   ],
   "scripts": {
     "build": "pnpm run build-bundled-deps && ts-node scripts/build.ts && node -e 'const m=require(\"./package.json\").main; if (!require(\"node:fs\").existsSync(m)) { console.error(`build produced no ${m}`); process.exit(1); }'",
-    "//build-bundled-deps": "scripts/build.ts esbuild-bundles runner/docker-images/microvm/hook-server.ts, which imports @evident-ai/lambda-microvm-runtime by its built `main`. @evident-ai/lambda-microvm-cdk is a workspace:* devDependency whose types resolve through its own dist/, so tsc --project tsconfig.build.json cannot compile src/microvm/{shapes,construct}.ts without it. Chained into `build` rather than left to turbo's `^build` because callers outside turbo invoke `pnpm --filter @evident-ai/runner-cdk build` directly, which bypasses turbo entirely.",
-    "build-bundled-deps": "pnpm --filter @evident-ai/lambda-microvm-cdk build && pnpm --filter @evident-ai/lambda-microvm-runtime build",
+    "//build-bundled-deps": "Builds the workspace dependencies whose dist/ output the direct runner-cdk build chain consumes: lambda-microvm-cdk for the public construct types, lambda-microvm-runtime for runner-microvm-image's hook-server bundle, and runner-microvm-image for that bundle itself. Chained into `build` rather than left to turbo's `^build` because callers outside turbo invoke `pnpm --filter @evident-ai/runner-cdk build` directly, which bypasses turbo entirely.",
+    "build-bundled-deps": "pnpm --filter @evident-ai/lambda-microvm-cdk build && pnpm --filter @evident-ai/lambda-microvm-runtime build && pnpm --filter runner-microvm-image build",
     "typecheck": "tsc --noEmit",
     "test": "node --test --require ts-node/register 'src/**/*.test.ts'",
     "format": "prettier --write 'src/**/*.ts'",