@evident-ai/runner-cdk 3.5.2-dev.a72611d → 3.5.2-dev.bbd799b

package/dist/microvm/controller/handle-doorbell.js

@@ -4,7 +4,7 @@ exports.handleDoorbell = handleDoorbell;
 const node_crypto_1 = require("node:crypto");
 const sdk_1 = require("@evident/sdk");
 const constants_1 = require("../constants");
-const doorbell_1 = require("./doorbell");
+const doorbell_request_1 = require("./doorbell-request");
 const throttle_retry_1 = require("./throttle-retry");
 const REASON = {
     invalidSignature: 'invalid_signature',
@@ -65,7 +65,7 @@ function decide({ statusCode, action, reason, state, runnerId, microvmId, starte
 }
 /**
  * `RunMicrovm`'s idempotency key. Keyed on `runner_id` plus a "generation"
- * marker: the dead VM's `microvm_id` on the recovery arms (`doorbell.microvmId`
+ * marker: the dead VM's `microvm_id` on the recovery arms (`doorbellRequest.microvmId`
  * is defined — TERMINATED/TERMINATING/not_found and the resume-failed
  * fallback), else `occurred_at` on the cold arm (no `microvm_id` yet). The id
  * advances every VM generation — `mvm-A` dies, the token keyed on it starts
@@ -92,9 +92,9 @@ function decide({ statusCode, action, reason, state, runnerId, microvmId, starte
  * that retried the same event with a different shape starts TWO concurrent
  * 8-hour VMs instead of deduping to one.
  */
-function clientTokenFor(doorbell) {
-    const generation = doorbell.microvmId ?? doorbell.occurredAt;
-    return (0, node_crypto_1.createHash)('sha256').update(`${doorbell.runnerId}:${generation}`).digest('hex');
+function clientTokenFor(doorbellRequest) {
+    const generation = doorbellRequest.microvmId ?? doorbellRequest.occurredAt;
+    return (0, node_crypto_1.createHash)('sha256').update(`${doorbellRequest.runnerId}:${generation}`).digest('hex');
 }
 /**
  * MicroVM image versions are dotted decimals (`48.0`, `50.0`), so they must NOT
@@ -140,15 +140,15 @@ function compareImageVersions(a, b) {
  * unparseable all warn and return false, i.e. resume exactly as before
  * (`development-workflow.mdc`: never fail a gate on absent evidence).
  */
-async function shouldRecreateForNewerImage(doorbell, shape, runningVersion, microvm) {
+async function shouldRecreateForNewerImage(doorbellRequest, shape, runningVersion, microvm) {
     if (runningVersion === undefined) {
-        console.warn(`[doorbell] GetMicrovm reported no imageVersion for runner ${doorbell.runnerId}; resuming`);
+        console.warn(`[doorbell] GetMicrovm reported no imageVersion for runner ${doorbellRequest.runnerId}; resuming`);
         return false;
     }
     const running = parseImageVersion(runningVersion);
     if (running === undefined) {
         console.warn(`[doorbell] unparseable running imageVersion "${runningVersion}" for runner ` +
-            `${doorbell.runnerId}; resuming`);
+            `${doorbellRequest.runnerId}; resuming`);
         return false;
     }
     let latestVersion;
@@ -159,14 +159,14 @@ async function shouldRecreateForNewerImage(doorbell, shape, runningVersion, micr
         latestVersion = await microvm.latestImageVersion(shape.imageArn);
     }
     catch (error) {
-        console.warn(`[doorbell] GetMicrovmImage failed for runner ${doorbell.runnerId}; resuming on the ` +
+        console.warn(`[doorbell] GetMicrovmImage failed for runner ${doorbellRequest.runnerId}; resuming on the ` +
             `running image ${runningVersion}: ${error instanceof Error ? error.message : String(error)}`);
         return false;
     }
     const latest = latestVersion === undefined ? undefined : parseImageVersion(latestVersion);
     if (latest === undefined) {
         console.warn(`[doorbell] no comparable latest image version (${latestVersion ?? 'none'}) for runner ` +
-            `${doorbell.runnerId}; resuming on the running image ${runningVersion}`);
+            `${doorbellRequest.runnerId}; resuming on the running image ${runningVersion}`);
         return false;
     }
     // Strictly below, not merely different: a running version ABOVE the latest
@@ -174,15 +174,15 @@ async function shouldRecreateForNewerImage(doorbell, shape, runningVersion, micr
     // been deactivated, and recreating would not roll it forward. Resume.
     return compareImageVersions(running, latest) < 0;
 }
-async function handleDoorbell({ rawBody, signatureHeader, doorbellSecret, shapes, microvm, sleep, random, }) {
-    if (!(0, sdk_1.verifyEvidentSignature)(rawBody, signatureHeader, doorbellSecret)) {
+async function handleDoorbell({ rawBody, signatureHeader, controllerSigningSecret, shapes, microvm, sleep, random, }) {
+    if (!(0, sdk_1.verifyEvidentSignature)(rawBody, signatureHeader, controllerSigningSecret)) {
         return decide({
             statusCode: 401,
             action: 'rejected',
             reason: REASON.invalidSignature,
         });
     }
-    const parsed = (0, doorbell_1.parseDoorbell)(rawBody);
+    const parsed = (0, doorbell_request_1.parseDoorbellRequest)(rawBody);
     if (!parsed.ok) {
         return decide({
             statusCode: 400,
@@ -190,10 +190,10 @@ async function handleDoorbell({ rawBody, signatureHeader, doorbellSecret, shapes
             reason: parsed.reason,
         });
     }
-    const doorbell = parsed.doorbell;
+    const doorbellRequest = parsed.doorbell;
     const timing = { sleep, random };
-    if (doorbell.type === doorbell_1.SHAPES_EVENT_TYPE) {
-        // A pure read of deploy-time metadata — see doorbell.ts's header comment
+    if (doorbellRequest.type === doorbell_request_1.SHAPES_EVENT_TYPE) {
+        // A pure read of deploy-time metadata — see doorbell-request.ts's header comment
         // (D2) for why replay is deliberately undefended here.
         return decide({
             statusCode: 200,
@@ -202,46 +202,46 @@ async function handleDoorbell({ rawBody, signatureHeader, doorbellSecret, shapes
             shapes: shapes.advertise(),
         });
     }
-    // Resolve the requested shape immediately after parseDoorbell/the describe
+    // Resolve the requested shape immediately after parseDoorbellRequest/the describe
     // arm — BEFORE the suspend_requested branch and the whole state machine
     // (D5). Resolving lazily inside runMicrovm would return 200 and silently
     // ignore a removed shape on the RUNNING/PENDING no-op path and the
     // successful-resume path, since runMicrovm is never reached on either. A
     // suspend doorbell has no `shape` field, so nothing here runs for it.
-    if (doorbell.type !== 'runner.suspend_requested') {
-        const resolvedShape = shapes.resolve(doorbell.shape);
+    if (doorbellRequest.type !== 'runner.suspend_requested') {
+        const resolvedShape = shapes.resolve(doorbellRequest.shape);
         if (resolvedShape === undefined) {
             // 400, not 404/409: a redelivery of the identical body cannot fix this.
             // Never echo the requested shape name — the closed-constant rule
-            // (doorbell.ts's DOORBELL_REJECTION) applies to every reason here too,
+            // (doorbell-request.ts's DOORBELL_REJECTION) applies to every reason here too,
             // and Evident persists response_body.
             return decide({
                 statusCode: 400,
                 action: 'rejected',
                 reason: REASON.unknownShape,
-                runnerId: doorbell.runnerId,
-                microvmId: doorbell.microvmId,
+                runnerId: doorbellRequest.runnerId,
+                microvmId: doorbellRequest.microvmId,
             });
         }
-        return handleWakeDoorbell(doorbell, resolvedShape, microvm, timing);
+        return handleWakeDoorbell(doorbellRequest, resolvedShape, microvm, timing);
     }
-    return suspendMicrovm(doorbell, microvm, timing);
+    return suspendMicrovm(doorbellRequest, microvm, timing);
 }
-async function handleWakeDoorbell(doorbell, shape, microvm, timing) {
-    if (doorbell.microvmId === undefined) {
-        return runMicrovm(doorbell, shape, microvm, timing, false, REASON.noMicrovmId);
+async function handleWakeDoorbell(doorbellRequest, shape, microvm, timing) {
+    if (doorbellRequest.microvmId === undefined) {
+        return runMicrovm(doorbellRequest, shape, microvm, timing, false, REASON.noMicrovmId);
     }
     let described;
     let polled = false;
     try {
-        described = await microvm.describe(doorbell.microvmId);
+        described = await microvm.describe(doorbellRequest.microvmId);
         if (described.state === 'SUSPENDING') {
-            described = await pollWhileSuspending(doorbell.microvmId, microvm, timing.sleep);
+            described = await pollWhileSuspending(doorbellRequest.microvmId, microvm, timing.sleep);
             polled = true;
         }
     }
     catch (error) {
-        console.error(`[doorbell] GetMicrovm failed for runner ${doorbell.runnerId}: ` +
+        console.error(`[doorbell] GetMicrovm failed for runner ${doorbellRequest.runnerId}: ` +
             `${error instanceof Error ? error.message : String(error)}`);
         // `polled` is omitted here, not passed as `false`: it is only assigned
         // `true` after `pollWhileSuspending` returns, so a throw mid-poll would
@@ -250,8 +250,8 @@ async function handleWakeDoorbell(doorbell, shape, microvm, timing) {
             statusCode: 500,
             action: 'none',
             reason: REASON.getStateFailed,
-            runnerId: doorbell.runnerId,
-            microvmId: doorbell.microvmId,
+            runnerId: doorbellRequest.runnerId,
+            microvmId: doorbellRequest.microvmId,
         });
     }
     const state = described.state;
@@ -264,8 +264,8 @@ async function handleWakeDoorbell(doorbell, shape, microvm, timing) {
             action: 'none',
             reason: REASON.suspendingPollExhausted,
             state,
-            runnerId: doorbell.runnerId,
-            microvmId: doorbell.microvmId,
+            runnerId: doorbellRequest.runnerId,
+            microvmId: doorbellRequest.microvmId,
             polled,
         });
     }
@@ -279,8 +279,8 @@ async function handleWakeDoorbell(doorbell, shape, microvm, timing) {
                 action: 'none',
                 reason: state === 'RUNNING' ? REASON.alreadyRunning : REASON.alreadyStarting,
                 state,
-                runnerId: doorbell.runnerId,
-                microvmId: doorbell.microvmId,
+                runnerId: doorbellRequest.runnerId,
+                microvmId: doorbellRequest.microvmId,
                 polled,
                 startedAt: described.startedAt,
                 imageVersion: described.imageVersion,
@@ -290,15 +290,15 @@ async function handleWakeDoorbell(doorbell, shape, microvm, timing) {
             // request (#1906) can still set the same wire flag. Recreate loses VM-local
             // filesystem state; durable provider credentials survive in object storage,
             // but a manual paste/upload not yet synced there may be lost (#2071).
-            if (doorbell.recreateOnOutdatedImage === true &&
-                (await shouldRecreateForNewerImage(doorbell, shape, described.imageVersion, microvm))) {
-                return runMicrovm(doorbell, shape, microvm, timing, polled, REASON.imageVersionOutdated, state);
+            if (doorbellRequest.recreateOnOutdatedImage === true &&
+                (await shouldRecreateForNewerImage(doorbellRequest, shape, described.imageVersion, microvm))) {
+                return runMicrovm(doorbellRequest, shape, microvm, timing, polled, REASON.imageVersionOutdated, state);
             }
-            return resumeMicrovm(doorbell, doorbell.microvmId, shape, microvm, timing, polled, described.startedAt, described.imageVersion);
+            return resumeMicrovm(doorbellRequest, doorbellRequest.microvmId, shape, microvm, timing, polled, described.startedAt, described.imageVersion);
         default:
             // TERMINATED, TERMINATING, not_found — gone or going, so a fresh VM either
             // way. This is what self-heals a stale `microvm_id`.
-            return runMicrovm(doorbell, shape, microvm, timing, polled, state === 'not_found' ? REASON.microvmNotFound : REASON.terminated, state);
+            return runMicrovm(doorbellRequest, shape, microvm, timing, polled, state === 'not_found' ? REASON.microvmNotFound : REASON.terminated, state);
     }
 }
 /**
@@ -333,13 +333,13 @@ function isClientTokenParameterMismatch(error) {
     const message = typeof e.message === 'string' ? e.message.toLowerCase() : '';
     return message.includes('clienttoken') && message.includes('different request parameters');
 }
-async function runMicrovm(doorbell, shape, microvm, timing, polled, reason, state) {
+async function runMicrovm(doorbellRequest, shape, microvm, timing, polled, reason, state) {
     let started;
     try {
         started = await (0, throttle_retry_1.withThrottleRetry)(() => microvm.run({
             imageIdentifier: shape.imageArn,
-            runHookPayload: doorbell.runHookPayload,
-            clientToken: clientTokenFor(doorbell),
+            runHookPayload: doorbellRequest.runHookPayload,
+            clientToken: clientTokenFor(doorbellRequest),
         }), timing);
     }
     catch (error) {
@@ -353,7 +353,7 @@ async function runMicrovm(doorbell, shape, microvm, timing, polled, reason, stat
             // wakes.
             const name = error instanceof Error ? error.name : 'unknown';
             const message = error instanceof Error ? error.message : String(error);
-            console.warn(`[doorbell] RunMicrovm clientToken already used for runner ${doorbell.runnerId}: ` +
+            console.warn(`[doorbell] RunMicrovm clientToken already used for runner ${doorbellRequest.runnerId}: ` +
                 `${name}: ${message}`);
             // No `microvmId` (see the comment above), and therefore deliberately no
             // `startedAt` either: `decide`'s invariant is that `microvm_started_at`
@@ -365,18 +365,18 @@ async function runMicrovm(doorbell, shape, microvm, timing, polled, reason, stat
                 action: 'run',
                 reason: REASON.runAlreadyStartedForToken,
                 state,
-                runnerId: doorbell.runnerId,
+                runnerId: doorbellRequest.runnerId,
                 polled,
             });
         }
-        console.error(`[doorbell] RunMicrovm failed for runner ${doorbell.runnerId}: ` +
+        console.error(`[doorbell] RunMicrovm failed for runner ${doorbellRequest.runnerId}: ` +
             `${error instanceof Error ? error.message : String(error)}`);
         return decide({
             statusCode: 500,
             action: 'run',
             reason: REASON.runFailed,
             state,
-            runnerId: doorbell.runnerId,
+            runnerId: doorbellRequest.runnerId,
             polled,
         });
     }
@@ -385,14 +385,14 @@ async function runMicrovm(doorbell, shape, microvm, timing, polled, reason, stat
         action: 'run',
         reason,
         state,
-        runnerId: doorbell.runnerId,
+        runnerId: doorbellRequest.runnerId,
         microvmId: started.microvmId,
         polled,
         startedAt: started.startedAt,
         imageVersion: started.imageVersion,
     });
 }
-async function resumeMicrovm(doorbell, microvmId, shape, microvm, timing, polled, 
+async function resumeMicrovm(doorbellRequest, microvmId, shape, microvm, timing, polled, 
 // Both values come from the `describe()` result that led here because
 // `ResumeMicrovm` returns no lifecycle metadata of its own.
 startedAt, imageVersion) {
@@ -400,24 +400,24 @@ startedAt, imageVersion) {
         await (0, throttle_retry_1.withThrottleRetry)(() => microvm.resume(microvmId), timing);
     }
     catch (error) {
-        console.error(`[doorbell] ResumeMicrovm failed for runner ${doorbell.runnerId}: ` +
+        console.error(`[doorbell] ResumeMicrovm failed for runner ${doorbellRequest.runnerId}: ` +
             `${error instanceof Error ? error.message : String(error)}`);
-        return runMicrovm(doorbell, shape, microvm, timing, polled, REASON.resumeFailedFallingBackToRun, 'SUSPENDED');
+        return runMicrovm(doorbellRequest, shape, microvm, timing, polled, REASON.resumeFailedFallingBackToRun, 'SUSPENDED');
     }
     return decide({
         statusCode: 200,
         action: 'resume',
         reason: REASON.resumed,
         state: 'SUSPENDED',
-        runnerId: doorbell.runnerId,
+        runnerId: doorbellRequest.runnerId,
         microvmId,
         polled,
         startedAt,
         imageVersion,
     });
 }
-async function suspendMicrovm(doorbell, microvm, timing) {
-    const microvmId = doorbell.microvmId;
+async function suspendMicrovm(doorbellRequest, microvm, timing) {
+    const microvmId = doorbellRequest.microvmId;
     if (microvmId === undefined) {
         // Nothing to suspend, and a redelivery would not change that — 200 so the
         // doorbell is not retried, but loudly enough to notice a mis-wired sender.
@@ -425,7 +425,7 @@ async function suspendMicrovm(doorbell, microvm, timing) {
             statusCode: 200,
             action: 'none',
             reason: REASON.suspendWithoutMicrovmId,
-            runnerId: doorbell.runnerId,
+            runnerId: doorbellRequest.runnerId,
         });
     }
     let state;
@@ -434,13 +434,13 @@ async function suspendMicrovm(doorbell, microvm, timing) {
         ({ state } = await microvm.describe(microvmId));
     }
     catch (error) {
-        console.error(`[doorbell] GetMicrovm failed for runner ${doorbell.runnerId}: ` +
+        console.error(`[doorbell] GetMicrovm failed for runner ${doorbellRequest.runnerId}: ` +
             `${error instanceof Error ? error.message : String(error)}`);
         return decide({
             statusCode: 500,
             action: 'none',
             reason: REASON.getStateFailed,
-            runnerId: doorbell.runnerId,
+            runnerId: doorbellRequest.runnerId,
             microvmId,
         });
     }
@@ -453,7 +453,7 @@ async function suspendMicrovm(doorbell, microvm, timing) {
             action: 'none',
             reason: REASON.suspendAlreadyGone,
             state,
-            runnerId: doorbell.runnerId,
+            runnerId: doorbellRequest.runnerId,
             microvmId,
         });
     }
@@ -461,14 +461,14 @@ async function suspendMicrovm(doorbell, microvm, timing) {
         await (0, throttle_retry_1.withThrottleRetry)(() => microvm.suspend(microvmId), timing);
     }
     catch (error) {
-        console.error(`[doorbell] SuspendMicrovm failed for runner ${doorbell.runnerId}: ` +
+        console.error(`[doorbell] SuspendMicrovm failed for runner ${doorbellRequest.runnerId}: ` +
             `${error instanceof Error ? error.message : String(error)}`);
         return decide({
             statusCode: 500,
             action: 'suspend',
             reason: REASON.suspendFailed,
             state,
-            runnerId: doorbell.runnerId,
+            runnerId: doorbellRequest.runnerId,
             microvmId,
         });
     }
@@ -477,7 +477,7 @@ async function suspendMicrovm(doorbell, microvm, timing) {
         action: 'suspend',
         reason: REASON.suspended,
         state,
-        runnerId: doorbell.runnerId,
+        runnerId: doorbellRequest.runnerId,
         microvmId,
     });
 }

package/dist/microvm/image/stage-context.d.ts

@@ -1,42 +1,17 @@
-export interface StageMicrovmImageContextOptions {
-    /**
-     * The repository baked into the image as the agent's workspace. This is the
-     * CONSUMER's repository, not Evident's — the image is a dev box for whatever
-     * codebase the agent works on. Must be a full (non-shallow) clone.
-     */
-    readonly repositoryPath: string;
-    /**
-     * `origin` of the baked repository, as the VM will see it. Must be a
-     * credential-free URL (typically `https://github.com/<owner>/<repo>.git`):
-     * this string ships inside the shared snapshot, so a token in it would be
-     * baked into every VM. The credential arrives per-VM instead.
-     */
-    readonly originUrl: string;
-    /** Directory to write the build context to. Removed and recreated. */
-    readonly destination: string;
-    /**
-     * Overlay scripts the image build runs as root and as `runner`. The overlay
-     * ships inside the shared snapshot, so it may install software but must carry
-     * no credential. When omitted, deterministic no-op scripts are written.
-     */
-    readonly overlayDir?: string;
-    /**
-     * The published template to copy from. Defaults to the one inside this
-     * package; named directly by the tests, which assert against a template they
-     * built themselves rather than whichever `dist/` happens to be present.
-     */
-    readonly templateDir?: string;
+/** The fixed directory that contains the workspace in a staged build context. */
+export declare const MICROVM_WORKSPACE_DIRECTORY = "workspace";
+export interface StageMicrovmBuildContextOptions {
+    /** The customer's directory containing their Dockerfile and COPY sources. */
+    readonly buildContextPath: string;
+    /** A full local checkout to bake into the image's `workspace/` directory. */
+    readonly workspaceRepositoryPath: string;
+    /** Credential-free origin URL carried by the baked checkout. */
+    readonly workspaceOriginUrl: string;
 }
 /**
- * Writes the build context AWS unpacks — the Dockerfile, the hook server, the
- * per-phase hook scripts, the deployment overlay and the repository — and
- * returns its path. The result is what `EvidentMicrovmConstruct`'s `imageSource`
- * takes.
+ * Stages customer-owned image inputs in a fresh temporary directory.
  *
- * The Dockerfile, hook server and phase hooks come from this package's
- * published `dist/`, so a consumer needs no checkout of the source repository and no
- * copy of those files (#1528). A caller may supply an overlay; the default is
- * deterministic no-op scripts. `repositoryPath` is the only required caller
- * input.
+ * Staging keeps the image asset hash a pure function of the workspace commit while
+ * leaving the customer in control of the Dockerfile and its build context.
  */
-export declare function stageMicrovmImageContext(options: StageMicrovmImageContextOptions): string;
+export declare function stageMicrovmBuildContext(options: StageMicrovmBuildContextOptions): string;

package/dist/microvm/image/stage-context.js

@@ -33,143 +33,56 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.stageMicrovmImageContext = stageMicrovmImageContext;
+exports.MICROVM_WORKSPACE_DIRECTORY = void 0;
+exports.stageMicrovmBuildContext = stageMicrovmBuildContext;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
 const path = __importStar(require("node:path"));
-/**
- * The image build context template published inside this package.
- *
- * Resolved from the PACKAGE ROOT, THREE directories above `__dirname` — either
- * compiled (`dist/microvm/image`) or via ts-node (`src/microvm/image`) — the
- * same way `microvm/construct.ts` resolves the controller Lambda asset, but one
- * `..` deeper because this file sits a directory below it. It is
- * written by `scripts/build.ts` at PACKAGE build time, not at stage time, so a
- * consumer needs no esbuild and no checkout of this repo (#1528).
- */
-const TEMPLATE_DIR = path.resolve(__dirname, '..', '..', '..', 'dist', 'microvm-image-context');
+/** The fixed directory that contains the workspace in a staged build context. */
+exports.MICROVM_WORKSPACE_DIRECTORY = 'workspace';
 function git(args, cwd) {
     return (0, node_child_process_1.execFileSync)('git', args, { cwd, encoding: 'utf8' }).trim();
 }
-/**
- * `git rev-parse --is-shallow-repository` throws an opaque `execFileSync`
- * error (e.g. "not a git repository") when `repositoryPath` isn't usable at
- * all, so that failure is rethrown naming the path.
- */
-function isShallowRepository(repositoryPath) {
+/** Names the path when git cannot determine whether the repository is shallow. */
+function isShallowRepository(sourcePath) {
     try {
-        return git(['rev-parse', '--is-shallow-repository'], repositoryPath) === 'true';
+        return git(['rev-parse', '--is-shallow-repository'], sourcePath) === 'true';
     }
     catch (err) {
-        throw new Error(`${repositoryPath} is not a usable git repository: ` +
+        throw new Error(`${sourcePath} is not a usable git repository: ` +
             `${err instanceof Error ? err.message : String(err)}`);
     }
 }
 /**
- * Clones the caller's repository into the build context for the Dockerfile to
- * bake as a checked-out but uninstalled workspace.
- *
- * `file://` rather than a plain path: a path triggers git's local-clone
- * optimisation, which copies the whole object store — every branch and worktree
- * ref on the staging machine (50 MB here). The file transport negotiates like a
- * network fetch and packs only what the checked-out branch reaches (9 MB), with
- * one branch and one remote-tracking ref. Ignored files, `node_modules` first
- * among them, are not part of a clone at all.
+ * Clones a single branch with full history while normalising bytes that affect the image asset hash.
+ * Its remote refspec covers only that branch, so other branches need an explicit refspec.
  */
-function stageRepository(repositoryPath, destination, originUrl) {
-    if (isShallowRepository(repositoryPath)) {
-        throw new Error(`refusing to stage a shallow checkout (${repositoryPath}): the agent branches, ` +
+function stageRepository(sourcePath, stagedWorkspacePath, workspaceOriginUrl) {
+    if (isShallowRepository(sourcePath)) {
+        throw new Error(`refusing to stage a shallow checkout (${sourcePath}): the agent branches, ` +
             'commits and opens PRs, so the image needs real history. Run `git fetch --unshallow`.');
     }
-    // Absolute on both sides: `file://` needs an absolute path to mean anything,
-    // and the clone's cwd is the destination's parent (the only directory both
-    // are guaranteed to resolve against).
-    git(['clone', '--quiet', '--single-branch', `file://${repositoryPath}`, destination], path.dirname(destination));
-    // The clone points `origin` at this machine's filesystem; the VM's origin is
-    // the caller's own remote over HTTPS, with no credential in it.
-    git(['remote', 'set-url', 'origin', originUrl], destination);
-    // The asset hash of the resulting image must be a pure function of the commit,
-    // or every deploy publishes a new `AWS::Lambda::MicrovmImage` version and wedges
-    // the stack at its per-image version ceiling. Two things break that purity:
-    // - `pack-objects`' delta search is multithreaded (`pack.threads` defaults to
-    //   the CPU count) and its output varies run to run; `-f`/`-F`
-    //   (`--no-reuse-delta`/`--no-reuse-object`) additionally stop it from reusing
-    //   whatever packing the source checkout happened to have. All three together
-    //   make the pack a pure function of the object set, independent of the source.
-    // - `.git/index` carries stat data (inode/mtime/size) and `.git/logs/**` carries
-    //   wall-clock reflog timestamps; neither is byte-stable for a fixed commit.
-    git(['-c', 'pack.threads=1', 'repack', '-adfqF'], destination);
-    (0, node_fs_1.rmSync)(path.join(destination, '.git', 'index'), { force: true });
-    (0, node_fs_1.rmSync)(path.join(destination, '.git', 'logs'), { recursive: true, force: true });
-    console.log(`[stage] repo ${git(['rev-parse', 'HEAD'], destination)}`);
-}
-function stageScriptDirectory(source, destination) {
-    (0, node_fs_1.mkdirSync)(destination);
-    for (const entry of (0, node_fs_1.readdirSync)(source, { withFileTypes: true })) {
-        const sourcePath = path.join(source, entry.name);
-        const staged = path.join(destination, entry.name);
-        if (entry.isDirectory()) {
-            stageScriptDirectory(sourcePath, staged);
-            continue;
-        }
-        (0, node_fs_1.copyFileSync)(sourcePath, staged);
-        // Set modes here rather than inheriting them from the template, so they stay
-        // correct after an npm pack, zip, CI-cache or hand-copy round trip. The image
-        // executes extensionless scripts and sources `.sh` files.
-        (0, node_fs_1.chmodSync)(staged, entry.name.endsWith('.sh') ? 0o644 : 0o755);
-    }
+    git(['clone', '--quiet', '--single-branch', `file://${sourcePath}`, stagedWorkspacePath], path.dirname(stagedWorkspacePath));
+    git(['remote', 'set-url', 'origin', workspaceOriginUrl], stagedWorkspacePath);
+    git(['-c', 'pack.threads=1', 'repack', '-adfqF'], stagedWorkspacePath);
+    (0, node_fs_1.rmSync)(path.join(stagedWorkspacePath, '.git', 'index'), { force: true });
+    (0, node_fs_1.rmSync)(path.join(stagedWorkspacePath, '.git', 'logs'), { recursive: true, force: true });
+    console.log(`[stage] repo ${git(['rev-parse', 'HEAD'], stagedWorkspacePath)}`);
 }
 /**
- * Writes the build context AWS unpacks — the Dockerfile, the hook server, the
- * per-phase hook scripts, the deployment overlay and the repository — and
- * returns its path. The result is what `EvidentMicrovmConstruct`'s `imageSource`
- * takes.
+ * Stages customer-owned image inputs in a fresh temporary directory.
  *
- * The Dockerfile, hook server and phase hooks come from this package's
- * published `dist/`, so a consumer needs no checkout of the source repository and no
- * copy of those files (#1528). A caller may supply an overlay; the default is
- * deterministic no-op scripts. `repositoryPath` is the only required caller
- * input.
+ * Staging keeps the image asset hash a pure function of the workspace commit while
+ * leaving the customer in control of the Dockerfile and its build context.
  */
-function stageMicrovmImageContext(options) {
-    const { originUrl, overlayDir, templateDir = TEMPLATE_DIR } = options;
-    // `file://` and the clone below only mean anything against absolute paths,
-    // and a caller may reasonably pass either.
-    const repositoryPath = path.resolve(options.repositoryPath);
-    const destination = path.resolve(options.destination);
-    if (!(0, node_fs_1.existsSync)(templateDir)) {
-        throw new Error(`the MicroVM image context template is missing from ${templateDir}. It is written by ` +
-            "this package's build (`pnpm --filter @evident-ai/runner-cdk build`) and ships in the " +
-            'published tarball, so an installed copy should always have it.');
-    }
-    (0, node_fs_1.rmSync)(destination, { recursive: true, force: true });
-    (0, node_fs_1.mkdirSync)(destination, { recursive: true });
-    (0, node_fs_1.copyFileSync)(path.join(templateDir, 'Dockerfile'), path.join(destination, 'Dockerfile'));
-    (0, node_fs_1.copyFileSync)(path.join(templateDir, 'hook-server.js'), path.join(destination, 'hook-server.js'));
-    const hooksSource = path.join(templateDir, 'hooks');
-    const hooksStage = path.join(destination, 'hooks');
-    stageScriptDirectory(hooksSource, hooksStage);
-    const overlayStage = path.join(destination, 'overlay');
-    if (overlayDir === undefined) {
-        (0, node_fs_1.mkdirSync)(overlayStage);
-        for (const name of ['setup-root', 'setup-workspace']) {
-            const staged = path.join(overlayStage, name);
-            (0, node_fs_1.writeFileSync)(staged, '#!/usr/bin/env bash\n# No overlay supplied.\n', { mode: 0o755 });
-            (0, node_fs_1.chmodSync)(staged, 0o755);
-        }
-    }
-    else {
-        const resolvedOverlayDir = path.resolve(overlayDir);
-        if (!(0, node_fs_1.existsSync)(resolvedOverlayDir)) {
-            throw new Error(`overlay directory does not exist: ${resolvedOverlayDir}`);
-        }
-        for (const required of ['setup-root', 'setup-workspace']) {
-            if (!(0, node_fs_1.existsSync)(path.join(resolvedOverlayDir, required))) {
-                throw new Error(`overlay directory ${resolvedOverlayDir} is missing required script ${required}`);
-            }
-        }
-        stageScriptDirectory(resolvedOverlayDir, overlayStage);
+function stageMicrovmBuildContext(options) {
+    const buildContextPath = path.resolve(options.buildContextPath);
+    if (!(0, node_fs_1.existsSync)(buildContextPath) || !(0, node_fs_1.existsSync)(path.join(buildContextPath, 'Dockerfile'))) {
+        throw new Error(`MicroVM build context ${buildContextPath} does not exist or has no Dockerfile`);
     }
-    stageRepository(repositoryPath, path.join(destination, 'repo'), originUrl);
-    return destination;
+    const stagedPath = (0, node_fs_1.mkdtempSync)(path.join((0, node_os_1.tmpdir)(), 'evident-microvm-'));
+    (0, node_fs_1.cpSync)(buildContextPath, stagedPath, { recursive: true });
+    stageRepository(path.resolve(options.workspaceRepositoryPath), path.join(stagedPath, exports.MICROVM_WORKSPACE_DIRECTORY), options.workspaceOriginUrl);
+    return stagedPath;
 }

package/dist/microvm/image-version-pruner/construct.d.ts

@@ -0,0 +1,13 @@
+import { Construct } from 'constructs';
+import type { MicrovmImageBuildInputs } from '@evident-ai/lambda-microvm-cdk';
+export type ImageVersionPrunerProps = {
+    readonly imageArns: readonly string[];
+    /**
+     * Build inputs are a CloudFormation-visible invocation trigger. The build role
+     * ARN is excluded because it belongs to the image subtree and would create a cycle.
+     */
+    readonly buildTriggers: Record<string, Omit<MicrovmImageBuildInputs, 'buildRoleArn'>>;
+};
+export declare class ImageVersionPruner extends Construct {
+    constructor(scope: Construct, id: string, props: ImageVersionPrunerProps);
+}