@evident-ai/runner-cdk 3.5.2-dev.a72611d → 3.5.2-dev.bbd799b

package/dist/image-version-reporter-lambda/handler.js

@@ -29,15 +29,17 @@ var import_client_secrets_manager = require("@aws-sdk/client-secrets-manager");
 var PHYSICAL_RESOURCE_ID = "evident-image-version-report";
 var REPORT_TIMEOUT_MS = 5e3;
 var secrets = new import_client_secrets_manager.SecretsManagerClient({});
-async function fetchDoorbellSecret(secretArn, secretKey) {
+async function fetchControllerSigningSecret(secretArn, secretKey) {
   const { SecretString } = await secrets.send(new import_client_secrets_manager.GetSecretValueCommand({ SecretId: secretArn }));
   if (!SecretString) {
-    throw new Error(`doorbell secret ${secretArn} has no SecretString`);
+    throw new Error(`controller signing secret ${secretArn} has no SecretString`);
   }
   const parsed = JSON.parse(SecretString);
   const value = parsed !== null && typeof parsed === "object" ? parsed[secretKey] : void 0;
   if (typeof value !== "string" || value === "") {
-    throw new Error(`doorbell secret ${secretArn} is missing a non-empty '${secretKey}' field`);
+    throw new Error(
+      `controller signing secret ${secretArn} is missing a non-empty '${secretKey}' field`
+    );
   }
   return value;
 }
@@ -63,7 +65,7 @@ function response() {
   return { PhysicalResourceId: PHYSICAL_RESOURCE_ID };
 }
 var runtimeDependencies = {
-  getSecret: fetchDoorbellSecret,
+  getSecret: fetchControllerSigningSecret,
   fetch: globalThis.fetch
 };
 async function handleImageVersionReport(event, getConfig, dependencies = runtimeDependencies) {
@@ -77,10 +79,15 @@ async function handleImageVersionReport(event, getConfig, dependencies = runtime
     versions = readImageVersions(event.ResourceProperties?.imageVersions);
     const config = getConfig();
     runnerId = config.evidentRunnerId;
-    const secret = await dependencies.getSecret(config.doorbellSecretArn, config.doorbellSecretKey);
+    const secret = await dependencies.getSecret(
+      config.controllerSigningSecretArn,
+      config.controllerSigningSecretKey
+    );
     const body = JSON.stringify({
       type: "runner.microvm_image_versions_reported",
-      versions
+      versions,
+      // The API orders reports by this value because replacing an image restarts its version counter.
+      reporter_clock_ms: Date.now()
     });
     const signature = (0, import_node_crypto.createHmac)("sha256", secret).update(body).digest("hex");
     const url = `${config.evidentApiUrl.replace(/\/+$/, "")}/v1/runners/${encodeURIComponent(
@@ -117,8 +124,8 @@ async function handleImageVersionReport(event, getConfig, dependencies = runtime
   return response();
 }
 var handler = (event) => handleImageVersionReport(event, () => ({
-  doorbellSecretArn: requireEnv("DOORBELL_SECRET_ARN"),
-  doorbellSecretKey: requireEnv("DOORBELL_SECRET_KEY"),
+  controllerSigningSecretArn: requireEnv("CONTROLLER_SIGNING_SECRET_ARN"),
+  controllerSigningSecretKey: requireEnv("CONTROLLER_SIGNING_SECRET_KEY"),
   evidentApiUrl: requireEnv("EVIDENT_API_URL"),
   evidentRunnerId: requireEnv("EVIDENT_RUNNER_ID")
 }));

package/dist/index.d.ts

@@ -3,4 +3,4 @@ export { EvidentWaker, type EvidentWakerProps } from './waker/construct';
 export { EvidentMicrovmConstruct, type EvidentMicrovmConstructProps } from './microvm/construct';
 export { MICROVM_SHAPES, validateShapes, type MicrovmShape } from './microvm/shapes';
 export { MICROVM_MAX_RUN_SECONDS, HOOKS_PORT, HOOK_TIMEOUT_SECONDS, } from './microvm/constants';
-export { stageMicrovmImageContext, type StageMicrovmImageContextOptions, } from './microvm/image/stage-context';
+export { MICROVM_WORKSPACE_DIRECTORY, stageMicrovmBuildContext, type StageMicrovmBuildContextOptions, } from './microvm/image/stage-context';

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.stageMicrovmImageContext = exports.HOOK_TIMEOUT_SECONDS = exports.HOOKS_PORT = exports.MICROVM_MAX_RUN_SECONDS = exports.validateShapes = exports.MICROVM_SHAPES = exports.EvidentMicrovmConstruct = exports.EvidentWaker = exports.EvidentScaleToZeroConstruct = void 0;
+exports.stageMicrovmBuildContext = exports.MICROVM_WORKSPACE_DIRECTORY = exports.HOOK_TIMEOUT_SECONDS = exports.HOOKS_PORT = exports.MICROVM_MAX_RUN_SECONDS = exports.validateShapes = exports.MICROVM_SHAPES = exports.EvidentMicrovmConstruct = exports.EvidentWaker = exports.EvidentScaleToZeroConstruct = void 0;
 var evident_scale_to_zero_construct_1 = require("./evident-scale-to-zero-construct");
 Object.defineProperty(exports, "EvidentScaleToZeroConstruct", { enumerable: true, get: function () { return evident_scale_to_zero_construct_1.EvidentScaleToZeroConstruct; } });
 var construct_1 = require("./waker/construct");
@@ -17,4 +17,5 @@ Object.defineProperty(exports, "MICROVM_MAX_RUN_SECONDS", { enumerable: true, ge
 Object.defineProperty(exports, "HOOKS_PORT", { enumerable: true, get: function () { return constants_1.HOOKS_PORT; } });
 Object.defineProperty(exports, "HOOK_TIMEOUT_SECONDS", { enumerable: true, get: function () { return constants_1.HOOK_TIMEOUT_SECONDS; } });
 var stage_context_1 = require("./microvm/image/stage-context");
-Object.defineProperty(exports, "stageMicrovmImageContext", { enumerable: true, get: function () { return stage_context_1.stageMicrovmImageContext; } });
+Object.defineProperty(exports, "MICROVM_WORKSPACE_DIRECTORY", { enumerable: true, get: function () { return stage_context_1.MICROVM_WORKSPACE_DIRECTORY; } });
+Object.defineProperty(exports, "stageMicrovmBuildContext", { enumerable: true, get: function () { return stage_context_1.stageMicrovmBuildContext; } });

package/dist/microvm/constants.d.ts

@@ -6,4 +6,4 @@ export declare const SUSPENDING_POLL_ATTEMPTS = 4;
 export declare const SUSPENDING_POLL_INTERVAL_MS = 500;
 export declare const MICROVM_MAX_RUN_SECONDS = 28800;
 export declare const SESSION_CLEANUP_MAX_AGE = "24h";
-export declare const DOORBELL_SECRET_KEY = "DOORBELL_SECRET";
+export declare const CONTROLLER_SIGNING_SECRET_KEY = "CONTROLLER_SIGNING_SECRET";

package/dist/microvm/constants.js

@@ -4,7 +4,7 @@
 // across them. The image template pins matching copies, guarded by
 // `microvm/image/dockerfile.test.ts`.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DOORBELL_SECRET_KEY = exports.SESSION_CLEANUP_MAX_AGE = exports.MICROVM_MAX_RUN_SECONDS = exports.SUSPENDING_POLL_INTERVAL_MS = exports.SUSPENDING_POLL_ATTEMPTS = exports.RUN_HOOK_PAYLOAD_MAX_BYTES = exports.HOOK_TIMEOUT_SECONDS = exports.HOOKS_DIR = exports.HOOKS_PORT = void 0;
+exports.CONTROLLER_SIGNING_SECRET_KEY = exports.SESSION_CLEANUP_MAX_AGE = exports.MICROVM_MAX_RUN_SECONDS = exports.SUSPENDING_POLL_INTERVAL_MS = exports.SUSPENDING_POLL_ATTEMPTS = exports.RUN_HOOK_PAYLOAD_MAX_BYTES = exports.HOOK_TIMEOUT_SECONDS = exports.HOOKS_DIR = exports.HOOKS_PORT = void 0;
 // The port the image's hook server binds, baked into the published Dockerfile
 // (`ENV HOOKS_PORT`) and passed to the construct as `hooksPort`. Exported from
 // the package index because a consumer building the published image context
@@ -38,6 +38,9 @@ exports.MICROVM_MAX_RUN_SECONDS = 28800;
 // The 24h window rather than 7d keeps the session database bounded at the growth
 // rate observed in #537. The sweep runs on the default 1h interval.
 exports.SESSION_CLEANUP_MAX_AGE = '24h';
-// The JSON field inside the doorbell secret is shared by the Lambdas that name
-// it and by whatever produces the secret; this is never the secret value.
-exports.DOORBELL_SECRET_KEY = 'DOORBELL_SECRET';
+// The JSON field inside the controller signing secret is shared by the Lambdas
+// that name it and by whatever produces the secret; this is never the secret
+// value. It is customer-facing and separate from persisted doorbell messages
+// and telemetry. Changing the value silently stops an existing adopter's
+// secret from being read.
+exports.CONTROLLER_SIGNING_SECRET_KEY = 'CONTROLLER_SIGNING_SECRET';

package/dist/microvm/construct.d.ts

@@ -4,12 +4,10 @@ import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
 import { type MicrovmShape } from './shapes';
 export interface EvidentMicrovmConstructProps {
     /**
-     * Build context for the image, already staged on disk. An argument rather
-     * than something this construct stages itself, so synthesising the stack
-     * stays a pure function of its inputs instead of depending on how the
-     * ambient checkout was cloned.
+     * Directory containing the consumer's Dockerfile and every file it copies,
+     * typically the return value of `stageMicrovmBuildContext()`.
      */
-    readonly imageSource: string;
+    readonly buildContextPath: string;
     /**
      * ARN of the Lambda-managed base MicroVM image, from
      * `aws lambda-microvms list-managed-microvm-images`. A string, not a `CfnParameter`
@@ -33,14 +31,14 @@ export interface EvidentMicrovmConstructProps {
     readonly shapes?: readonly MicrovmShape[];
     /**
      * The secret holding the shared HMAC key the controller verifies every
-     * doorbell against, under the field `DOORBELL_SECRET`. Any Secrets Manager
+     * doorbell against, under the field `CONTROLLER_SIGNING_SECRET`. Any Secrets Manager
      * secret, however the caller manages it — this construct has no opinion on
      * SOPS, KMS, or any other production mechanism. Required (not defaulted
      * here): a default would need a scope of its own, and a caller-owned
      * default keeps its own logical id — the caller builds one exactly once,
      * in its own scope, and passes the result in either case.
      */
-    readonly doorbellSecret: secretsmanager.ISecret;
+    readonly controllerSigningSecret: secretsmanager.ISecret;
     /**
      * Optional runner secret whose JSON values are exported by `/run`. Omitting it
      * leaves GitHub and MCP credentials unavailable to a generic consumer.
@@ -65,7 +63,7 @@ export interface EvidentMicrovmConstructProps {
      * TCP port the image's hook server listens on, baked into both the image
      * (`HOOKS_PORT` env var) and the `MicrovmImage`'s `hooks.port` — a mismatch
      * means AWS probes a port nothing binds. Caller-supplied because the hook
-     * server is part of `imageSource`, which this construct does not build.
+     * server is part of the base image, which this construct does not build.
      */
     readonly hooksPort: number;
     /**
@@ -93,6 +91,12 @@ export interface EvidentMicrovmConstructProps {
      * throws at construction rather than silently disabling the reporter.
      */
     readonly evidentRunnerId?: string;
+    /**
+     * Opts into bounding the per-image MicroVM version quota (L-F8BECE9C) for
+     * this deployment's images only, using the upstream engine defaults. Omitting
+     * this leaves the synthesised template byte-for-byte identical.
+     */
+    readonly imageVersionPruning?: boolean;
 }
 /**
  * The customer-account half of the per-session runner (#558): the MicroVM

package/dist/microvm/construct.js

@@ -37,12 +37,14 @@ exports.EvidentMicrovmConstruct = void 0;
 const path = __importStar(require("path"));
 const cdk = __importStar(require("aws-cdk-lib"));
 const constructs_1 = require("constructs");
+const iam = __importStar(require("aws-cdk-lib/aws-iam"));
 const lambda = __importStar(require("aws-cdk-lib/aws-lambda"));
 const s3 = __importStar(require("aws-cdk-lib/aws-s3"));
 const lambda_microvm_cdk_1 = require("@evident-ai/lambda-microvm-cdk");
 const constants_1 = require("./constants");
 const shapes_1 = require("./shapes");
 const construct_1 = require("./image-version-reporter/construct");
+const construct_2 = require("./image-version-pruner/construct");
 // Image hooks build the snapshot, so they get minutes where the runtime hooks
 // get AWS's 60 s.
 const IMAGE_HOOK_TIMEOUT_SECONDS = 600;
@@ -145,42 +147,31 @@ class EvidentMicrovmConstruct extends constructs_1.Construct {
             lifecycleTimeout: cdk.Duration.seconds(props.hookTimeoutSeconds),
             buildTimeout: cdk.Duration.seconds(IMAGE_HOOK_TIMEOUT_SECONDS),
         };
-        // Built first and with no `executionRole` prop, exactly as before this
-        // shape catalogue existed: same construct id (`Image`, frozen on the
-        // shape record — see shapes.ts), same `imageName`, same description. The
-        // construct therefore creates `Image/ExecutionRole` at its current path
-        // and current logical id — zero CloudFormation churn on the live,
-        // hand-deployed stack (D3/D9). Every additional shape below borrows this
-        // role rather than getting one of its own, which is why `validateShapes`
-        // requires the default shape to be `shapes[0]`: it must exist before any
-        // other shape can reference its execution role.
-        const defaultImage = new lambda_microvm_cdk_1.MicrovmImage(this, defaultShape.constructId, {
+        // Built first without an `executionRole` prop, so every additional shape
+        // can borrow this image's execution role. `validateShapes` requires the
+        // default shape to be `shapes[0]` because that role must exist first.
+        const defaultImage = new lambda_microvm_cdk_1.MicrovmImage(this, defaultShape.name, {
             imageName: defaultShape.imageName,
             description: defaultShape.description,
             // A local directory, so the zip is uploaded by `cdk deploy` itself and the
             // image ARN is a stack reference rather than a deploy-time input.
-            source: props.imageSource,
+            source: props.buildContextPath,
             baseImageArn: props.baseImageArn,
             baseImageVersion: props.baseImageVersion,
             memoryMiB: defaultShape.memoryMiB,
             environment: imageEnvironment,
             hooks: imageHooks,
         });
-        // WART, accepted deliberately: every additional shape's image is built
-        // with `defaultImage.executionRole`, so this role's construct path
-        // (`Image/ExecutionRole`) reads as if it belongs to just the default
-        // shape's image, when in fact it is shared by every shape. That is
-        // intentional — see D3 in the plan. Do NOT "fix" this with
-        // `overrideLogicalId`: renaming the logical id IS the CloudFormation
-        // churn this design exists to avoid (a delete-and-recreate of the role a
-        // running MicroVM has live session credentials from). The wart is one
-        // comment; the override would undo the point of D3.
+        // WART: every additional shape shares `defaultImage.executionRole`, so the
+        // role's path under the default image reads as if it belongs to one shape
+        // even though it serves all of them. Keeping one role avoids replacing a
+        // role that running MicroVMs may still have credentials from.
         const images = new Map([[defaultShape.name, defaultImage]]);
         for (const shape of additionalShapes) {
-            images.set(shape.name, new lambda_microvm_cdk_1.MicrovmImage(this, shape.constructId, {
+            images.set(shape.name, new lambda_microvm_cdk_1.MicrovmImage(this, shape.name, {
                 imageName: shape.imageName,
                 description: shape.description,
-                source: props.imageSource,
+                source: props.buildContextPath,
                 baseImageArn: props.baseImageArn,
                 baseImageVersion: props.baseImageVersion,
                 memoryMiB: shape.memoryMiB,
@@ -189,13 +180,14 @@ class EvidentMicrovmConstruct extends constructs_1.Construct {
                 hooks: imageHooks,
             }));
         }
-        // Bucket-wide rather than per-prefix (as the ECS runner's task role is):
-        // the prefix arrives at /run, so it cannot be named at synth, and one
-        // execution role is shared by every VM of every shape (D3). So a VM can
-        // read another session's credential store — acceptable within a single
-        // customer account, and what Phase 4 (#263) has to tighten when this goes
-        // multi-tenant.
-        durableState.grantReadWrite(defaultImage.executionRole);
+        // The execution role serves every image shape, so per-session state is scoped
+        // to the `runners/` root; vault credentials need only GetObject and PutObject.
+        durableState.grantReadWrite(defaultImage.executionRole, 'runners/*');
+        defaultImage.executionRole.addToPrincipalPolicy(new iam.PolicyStatement({
+            sid: 'ReadWriteCredentialVaultObjects',
+            actions: ['s3:GetObject', 's3:PutObject'],
+            resources: [durableState.arnForObjects('credential-vaults/*')],
+        }));
         // The image receives only an ARN; `/run` reads the secret value at runtime.
         props.runnerSecret?.grantRead(defaultImage.executionRole);
         // The shape catalogue the controller resolves a doorbell's `shape` field
@@ -235,8 +227,8 @@ class EvidentMicrovmConstruct extends constructs_1.Construct {
                 // The ARN and field name, never the value: the controller reads it from
                 // Secrets Manager at runtime, so the key is not exposed to anyone with
                 // lambda:GetFunctionConfiguration.
-                DOORBELL_SECRET_ARN: props.doorbellSecret.secretArn,
-                DOORBELL_SECRET_KEY: constants_1.DOORBELL_SECRET_KEY,
+                CONTROLLER_SIGNING_SECRET_ARN: props.controllerSigningSecret.secretArn,
+                CONTROLLER_SIGNING_SECRET_KEY: constants_1.CONTROLLER_SIGNING_SECRET_KEY,
                 MICROVM_SHAPES: shapeCatalogueJson,
                 // The role every shape's MicroVM shares (D3) — still one role, still
                 // this same expression, now documented as shared rather than singular.
@@ -251,7 +243,7 @@ class EvidentMicrovmConstruct extends constructs_1.Construct {
         // emit N near-identical policy statements and break the "exactly one
         // statement granting X" guarantees this construct's test encodes.
         defaultImage.grantRun(controller);
-        props.doorbellSecret.grantRead(controller);
+        props.controllerSigningSecret.grantRead(controller);
         const functionUrl = controller.addFunctionUrl({
             // HMAC verification of the doorbell body IS the auth, as for the ECS waker.
             authType: lambda.FunctionUrlAuthType.NONE,
@@ -261,7 +253,7 @@ class EvidentMicrovmConstruct extends constructs_1.Construct {
         // no custom resource — this branch must not run for them.
         if (props.evidentApiUrl && props.evidentRunnerId) {
             new construct_1.ImageVersionReporter(this, 'ImageVersionReporter', {
-                doorbellSecret: props.doorbellSecret,
+                controllerSigningSecret: props.controllerSigningSecret,
                 evidentApiUrl: props.evidentApiUrl,
                 evidentRunnerId: props.evidentRunnerId,
                 imageVersions: Object.fromEntries(shapes.map((shape) => [shape.name, images.get(shape.name).latestActiveImageVersion])),
@@ -272,6 +264,23 @@ class EvidentMicrovmConstruct extends constructs_1.Construct {
                 buildTriggers: Object.fromEntries(shapes.map((shape) => [shape.name, images.get(shape.name).buildInputs])),
             });
         }
+        if (props.imageVersionPruning) {
+            const pruner = new construct_2.ImageVersionPruner(this, 'ImageVersionPruner', {
+                imageArns: shapes.map((shape) => (0, lambda_microvm_cdk_1.microvmImageArn)({
+                    region: cdk.Stack.of(this).region,
+                    accountId: cdk.Stack.of(this).account,
+                    imageName: shape.imageName,
+                })),
+                buildTriggers: Object.fromEntries(shapes.map((shape) => {
+                    const { buildRoleArn: _buildRoleArn, ...buildInputs } = images.get(shape.name).buildInputs;
+                    return [shape.name, buildInputs];
+                })),
+            });
+            // Free a quota slot before the publish that consumes it.
+            for (const shape of shapes) {
+                images.get(shape.name).node.addDependency(pruner);
+            }
+        }
         this.functionUrl = functionUrl.url;
         this.shapeCatalogueJson = shapeCatalogueJson;
         this.durableStateBucket = durableState;

package/dist/microvm/controller/{doorbell.d.ts → doorbell-request.d.ts}

@@ -27,12 +27,12 @@ declare const WAKE_EVENT_TYPES: readonly ["agent.message_queued", "agent.wake_re
 declare const SUSPEND_EVENT_TYPE = "runner.suspend_requested";
 export declare const SHAPES_EVENT_TYPE = "runner.shapes_requested";
 type WakeEventType = (typeof WAKE_EVENT_TYPES)[number];
-type DoorbellFields = {
+type DoorbellRequestFields = {
     runnerId: string;
     occurredAt: string;
     microvmId?: string;
 };
-export type WakeDoorbell = DoorbellFields & {
+export type WakeDoorbellRequest = DoorbellRequestFields & {
     type: WakeEventType;
     runHookPayload: string;
     /**
@@ -46,7 +46,7 @@ export type WakeDoorbell = DoorbellFields & {
      */
     recreateOnOutdatedImage?: boolean;
 };
-export type Doorbell = WakeDoorbell | (DoorbellFields & {
+export type DoorbellRequest = WakeDoorbellRequest | (DoorbellRequestFields & {
     type: typeof SUSPEND_EVENT_TYPE;
 }) | {
     type: typeof SHAPES_EVENT_TYPE;
@@ -67,12 +67,12 @@ export declare const DOORBELL_REJECTION: {
     readonly runPayloadTooLarge: "run_payload_too_large";
 };
 export type DoorbellRejection = (typeof DOORBELL_REJECTION)[keyof typeof DOORBELL_REJECTION];
-export type ParsedDoorbell = {
+export type ParsedDoorbellRequest = {
     ok: true;
-    doorbell: Doorbell;
+    doorbell: DoorbellRequest;
 } | {
     ok: false;
     reason: DoorbellRejection;
 };
-export declare function parseDoorbell(rawBody: string): ParsedDoorbell;
+export declare function parseDoorbellRequest(rawBody: string): ParsedDoorbellRequest;
 export {};

package/dist/microvm/controller/{doorbell.js → doorbell-request.js}

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DOORBELL_REJECTION = exports.SHAPES_EVENT_TYPE = void 0;
-exports.parseDoorbell = parseDoorbell;
+exports.parseDoorbellRequest = parseDoorbellRequest;
 const constants_1 = require("../constants");
 /**
  * The doorbell Evident POSTs to the controller's Function URL. `run_payload` is
@@ -52,7 +52,7 @@ function nonBlankString(value) {
 function isWakeType(value) {
     return WAKE_EVENT_TYPES.includes(value);
 }
-function parseDoorbell(rawBody) {
+function parseDoorbellRequest(rawBody) {
     let body;
     try {
         body = JSON.parse(rawBody);

package/dist/microvm/controller/handle-doorbell.d.ts

@@ -17,10 +17,10 @@ export type DoorbellResult = {
         kind: ActionKind;
     };
 };
-export declare function handleDoorbell({ rawBody, signatureHeader, doorbellSecret, shapes, microvm, sleep, random, }: {
+export declare function handleDoorbell({ rawBody, signatureHeader, controllerSigningSecret, shapes, microvm, sleep, random, }: {
     rawBody: string;
     signatureHeader: string | undefined;
-    doorbellSecret: string;
+    controllerSigningSecret: string;
     shapes: ShapeCatalogue;
     microvm: MicrovmClient;
 } & Timing): Promise<DoorbellResult>;