@evident-ai/runner-cdk 3.5.2-dev.e67eb8b → 3.5.2-dev.f258bd6

package/dist/microvm/image/stage-context.d.ts

@@ -1,42 +1,17 @@
-export interface StageMicrovmImageContextOptions {
-    /**
-     * The repository baked into the image as the agent's workspace. This is the
-     * CONSUMER's repository, not Evident's — the image is a dev box for whatever
-     * codebase the agent works on. Must be a full (non-shallow) clone.
-     */
-    readonly repositoryPath: string;
-    /**
-     * `origin` of the baked repository, as the VM will see it. Must be a
-     * credential-free URL (typically `https://github.com/<owner>/<repo>.git`):
-     * this string ships inside the shared snapshot, so a token in it would be
-     * baked into every VM. The credential arrives per-VM instead.
-     */
-    readonly originUrl: string;
-    /** Directory to write the build context to. Removed and recreated. */
-    readonly destination: string;
-    /**
-     * Overlay scripts the image build runs as root and as `runner`. The overlay
-     * ships inside the shared snapshot, so it may install software but must carry
-     * no credential. When omitted, deterministic no-op scripts are written.
-     */
-    readonly overlayDir?: string;
-    /**
-     * The published template to copy from. Defaults to the one inside this
-     * package; named directly by the tests, which assert against a template they
-     * built themselves rather than whichever `dist/` happens to be present.
-     */
-    readonly templateDir?: string;
+/** The fixed directory that contains the workspace in a staged build context. */
+export declare const MICROVM_WORKSPACE_DIRECTORY = "workspace";
+export interface StageMicrovmBuildContextOptions {
+    /** The customer's directory containing their Dockerfile and COPY sources. */
+    readonly buildContextPath: string;
+    /** A full local checkout to bake into the image's `workspace/` directory. */
+    readonly workspaceRepositoryPath: string;
+    /** Credential-free origin URL carried by the baked checkout. */
+    readonly workspaceOriginUrl: string;
 }
 /**
- * Writes the build context AWS unpacks — the Dockerfile, the hook server, the
- * per-phase hook scripts, the deployment overlay and the repository — and
- * returns its path. The result is what `EvidentMicrovmConstruct`'s `imageSource`
- * takes.
+ * Stages customer-owned image inputs in a fresh temporary directory.
  *
- * The Dockerfile, hook server and phase hooks come from this package's
- * published `dist/`, so a consumer needs no checkout of the source repository and no
- * copy of those files. A caller may supply an overlay; the default is
- * deterministic no-op scripts. `repositoryPath` is the only required caller
- * input.
+ * Staging keeps the image asset hash a pure function of the workspace commit while
+ * leaving the customer in control of the Dockerfile and its build context.
  */
-export declare function stageMicrovmImageContext(options: StageMicrovmImageContextOptions): string;
+export declare function stageMicrovmBuildContext(options: StageMicrovmBuildContextOptions): string;

package/dist/microvm/image/stage-context.js

@@ -33,143 +33,53 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.stageMicrovmImageContext = stageMicrovmImageContext;
+exports.MICROVM_WORKSPACE_DIRECTORY = void 0;
+exports.stageMicrovmBuildContext = stageMicrovmBuildContext;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
 const path = __importStar(require("node:path"));
-/**
- * The image build context template published inside this package.
- *
- * Resolved from the PACKAGE ROOT, THREE directories above `__dirname` — either
- * compiled (`dist/microvm/image`) or via ts-node (`src/microvm/image`) — the
- * same way `microvm/construct.ts` resolves the controller Lambda asset, but one
- * `..` deeper because this file sits a directory below it. It is
- * written by `scripts/build.ts` at PACKAGE build time, not at stage time, so a
- * consumer needs no esbuild and no checkout of this repo (#1528).
- */
-const TEMPLATE_DIR = path.resolve(__dirname, '..', '..', '..', 'dist', 'microvm-image-context');
+/** The fixed directory that contains the workspace in a staged build context. */
+exports.MICROVM_WORKSPACE_DIRECTORY = 'workspace';
 function git(args, cwd) {
     return (0, node_child_process_1.execFileSync)('git', args, { cwd, encoding: 'utf8' }).trim();
 }
-/**
- * `git rev-parse --is-shallow-repository` throws an opaque `execFileSync`
- * error (e.g. "not a git repository") when `repositoryPath` isn't usable at
- * all, so that failure is rethrown naming the path.
- */
-function isShallowRepository(repositoryPath) {
+/** Names the path when git cannot determine whether the repository is shallow. */
+function isShallowRepository(sourcePath) {
     try {
-        return git(['rev-parse', '--is-shallow-repository'], repositoryPath) === 'true';
+        return git(['rev-parse', '--is-shallow-repository'], sourcePath) === 'true';
     }
     catch (err) {
-        throw new Error(`${repositoryPath} is not a usable git repository: ` +
+        throw new Error(`${sourcePath} is not a usable git repository: ` +
             `${err instanceof Error ? err.message : String(err)}`);
     }
 }
-/**
- * Clones the caller's repository into the build context for the Dockerfile to
- * bake as a checked-out but uninstalled workspace.
- *
- * `file://` rather than a plain path: a path triggers git's local-clone
- * optimisation, which copies the whole object store — every branch and worktree
- * ref on the staging machine (50 MB here). The file transport negotiates like a
- * network fetch and packs only what the checked-out branch reaches (9 MB), with
- * one branch and one remote-tracking ref. Ignored files, `node_modules` first
- * among them, are not part of a clone at all.
- */
-function stageRepository(repositoryPath, destination, originUrl) {
-    if (isShallowRepository(repositoryPath)) {
-        throw new Error(`refusing to stage a shallow checkout (${repositoryPath}): the agent branches, ` +
+/** Clones a full repository while normalising the bytes that affect the image asset hash. */
+function stageRepository(sourcePath, stagedWorkspacePath, workspaceOriginUrl) {
+    if (isShallowRepository(sourcePath)) {
+        throw new Error(`refusing to stage a shallow checkout (${sourcePath}): the agent branches, ` +
             'commits and opens PRs, so the image needs real history. Run `git fetch --unshallow`.');
     }
-    // Absolute on both sides: `file://` needs an absolute path to mean anything,
-    // and the clone's cwd is the destination's parent (the only directory both
-    // are guaranteed to resolve against).
-    git(['clone', '--quiet', '--single-branch', `file://${repositoryPath}`, destination], path.dirname(destination));
-    // The clone points `origin` at this machine's filesystem; the VM's origin is
-    // the caller's own remote over HTTPS, with no credential in it.
-    git(['remote', 'set-url', 'origin', originUrl], destination);
-    // The asset hash of the resulting image must be a pure function of the commit,
-    // or every deploy publishes a new `AWS::Lambda::MicrovmImage` version and wedges
-    // the stack at its per-image version ceiling. Two things break that purity:
-    // - `pack-objects`' delta search is multithreaded (`pack.threads` defaults to
-    //   the CPU count) and its output varies run to run; `-f`/`-F`
-    //   (`--no-reuse-delta`/`--no-reuse-object`) additionally stop it from reusing
-    //   whatever packing the source checkout happened to have. All three together
-    //   make the pack a pure function of the object set, independent of the source.
-    // - `.git/index` carries stat data (inode/mtime/size) and `.git/logs/**` carries
-    //   wall-clock reflog timestamps; neither is byte-stable for a fixed commit.
-    git(['-c', 'pack.threads=1', 'repack', '-adfqF'], destination);
-    (0, node_fs_1.rmSync)(path.join(destination, '.git', 'index'), { force: true });
-    (0, node_fs_1.rmSync)(path.join(destination, '.git', 'logs'), { recursive: true, force: true });
-    console.log(`[stage] repo ${git(['rev-parse', 'HEAD'], destination)}`);
-}
-function stageScriptDirectory(source, destination) {
-    (0, node_fs_1.mkdirSync)(destination);
-    for (const entry of (0, node_fs_1.readdirSync)(source, { withFileTypes: true })) {
-        const sourcePath = path.join(source, entry.name);
-        const staged = path.join(destination, entry.name);
-        if (entry.isDirectory()) {
-            stageScriptDirectory(sourcePath, staged);
-            continue;
-        }
-        (0, node_fs_1.copyFileSync)(sourcePath, staged);
-        // Set modes here rather than inheriting them from the template, so they stay
-        // correct after an npm pack, zip, CI-cache or hand-copy round trip. The image
-        // executes extensionless scripts and sources `.sh` files.
-        (0, node_fs_1.chmodSync)(staged, entry.name.endsWith('.sh') ? 0o644 : 0o755);
-    }
+    git(['clone', '--quiet', '--single-branch', `file://${sourcePath}`, stagedWorkspacePath], path.dirname(stagedWorkspacePath));
+    git(['remote', 'set-url', 'origin', workspaceOriginUrl], stagedWorkspacePath);
+    git(['-c', 'pack.threads=1', 'repack', '-adfqF'], stagedWorkspacePath);
+    (0, node_fs_1.rmSync)(path.join(stagedWorkspacePath, '.git', 'index'), { force: true });
+    (0, node_fs_1.rmSync)(path.join(stagedWorkspacePath, '.git', 'logs'), { recursive: true, force: true });
+    console.log(`[stage] repo ${git(['rev-parse', 'HEAD'], stagedWorkspacePath)}`);
 }
 /**
- * Writes the build context AWS unpacks — the Dockerfile, the hook server, the
- * per-phase hook scripts, the deployment overlay and the repository — and
- * returns its path. The result is what `EvidentMicrovmConstruct`'s `imageSource`
- * takes.
+ * Stages customer-owned image inputs in a fresh temporary directory.
  *
- * The Dockerfile, hook server and phase hooks come from this package's
- * published `dist/`, so a consumer needs no checkout of the source repository and no
- * copy of those files. A caller may supply an overlay; the default is
- * deterministic no-op scripts. `repositoryPath` is the only required caller
- * input.
+ * Staging keeps the image asset hash a pure function of the workspace commit while
+ * leaving the customer in control of the Dockerfile and its build context.
  */
-function stageMicrovmImageContext(options) {
-    const { originUrl, overlayDir, templateDir = TEMPLATE_DIR } = options;
-    // `file://` and the clone below only mean anything against absolute paths,
-    // and a caller may reasonably pass either.
-    const repositoryPath = path.resolve(options.repositoryPath);
-    const destination = path.resolve(options.destination);
-    if (!(0, node_fs_1.existsSync)(templateDir)) {
-        throw new Error(`the MicroVM image context template is missing from ${templateDir}. It is written by ` +
-            "this package's build (`pnpm --filter @evident-ai/runner-cdk build`) and ships in the " +
-            'published tarball, so an installed copy should always have it.');
-    }
-    (0, node_fs_1.rmSync)(destination, { recursive: true, force: true });
-    (0, node_fs_1.mkdirSync)(destination, { recursive: true });
-    (0, node_fs_1.copyFileSync)(path.join(templateDir, 'Dockerfile'), path.join(destination, 'Dockerfile'));
-    (0, node_fs_1.copyFileSync)(path.join(templateDir, 'hook-server.js'), path.join(destination, 'hook-server.js'));
-    const hooksSource = path.join(templateDir, 'hooks');
-    const hooksStage = path.join(destination, 'hooks');
-    stageScriptDirectory(hooksSource, hooksStage);
-    const overlayStage = path.join(destination, 'overlay');
-    if (overlayDir === undefined) {
-        (0, node_fs_1.mkdirSync)(overlayStage);
-        for (const name of ['setup-root', 'setup-workspace']) {
-            const staged = path.join(overlayStage, name);
-            (0, node_fs_1.writeFileSync)(staged, '#!/usr/bin/env bash\n# No overlay supplied.\n', { mode: 0o755 });
-            (0, node_fs_1.chmodSync)(staged, 0o755);
-        }
-    }
-    else {
-        const resolvedOverlayDir = path.resolve(overlayDir);
-        if (!(0, node_fs_1.existsSync)(resolvedOverlayDir)) {
-            throw new Error(`overlay directory does not exist: ${resolvedOverlayDir}`);
-        }
-        for (const required of ['setup-root', 'setup-workspace']) {
-            if (!(0, node_fs_1.existsSync)(path.join(resolvedOverlayDir, required))) {
-                throw new Error(`overlay directory ${resolvedOverlayDir} is missing required script ${required}`);
-            }
-        }
-        stageScriptDirectory(resolvedOverlayDir, overlayStage);
+function stageMicrovmBuildContext(options) {
+    const buildContextPath = path.resolve(options.buildContextPath);
+    if (!(0, node_fs_1.existsSync)(buildContextPath) || !(0, node_fs_1.existsSync)(path.join(buildContextPath, 'Dockerfile'))) {
+        throw new Error(`MicroVM build context ${buildContextPath} does not exist or has no Dockerfile`);
     }
-    stageRepository(repositoryPath, path.join(destination, 'repo'), originUrl);
-    return destination;
+    const stagedPath = (0, node_fs_1.mkdtempSync)(path.join((0, node_os_1.tmpdir)(), 'evident-microvm-'));
+    (0, node_fs_1.cpSync)(buildContextPath, stagedPath, { recursive: true });
+    stageRepository(path.resolve(options.workspaceRepositoryPath), path.join(stagedPath, exports.MICROVM_WORKSPACE_DIRECTORY), options.workspaceOriginUrl);
+    return stagedPath;
 }

package/dist/microvm/image-version-reporter/construct.d.ts

@@ -3,7 +3,7 @@ import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
 import type { MicrovmImageBuildInputs } from '@evident-ai/lambda-microvm-cdk';
 export type ImageVersionReporterProps = {
     /** The secret whose value is the same HMAC key the controller verifies every doorbell against. */
-    doorbellSecret: secretsmanager.ISecret;
+    controllerSigningSecret: secretsmanager.ISecret;
     /** Base URL of Evident's own API — non-secret. */
     evidentApiUrl: string;
     /** The pool runner id the report is filed against — non-secret, public UUID. */

package/dist/microvm/image-version-reporter/construct.js

@@ -64,13 +64,13 @@ class ImageVersionReporter extends constructs_1.Construct {
             timeout: cdk.Duration.seconds(30),
             environment: {
                 // ARN + field name only, never the value (mirrors the controller and waker).
-                DOORBELL_SECRET_ARN: props.doorbellSecret.secretArn,
-                DOORBELL_SECRET_KEY: constants_1.DOORBELL_SECRET_KEY,
+                CONTROLLER_SIGNING_SECRET_ARN: props.controllerSigningSecret.secretArn,
+                CONTROLLER_SIGNING_SECRET_KEY: constants_1.CONTROLLER_SIGNING_SECRET_KEY,
                 EVIDENT_API_URL: props.evidentApiUrl,
                 EVIDENT_RUNNER_ID: props.evidentRunnerId,
             },
         });
-        props.doorbellSecret.grantRead(handler);
+        props.controllerSigningSecret.grantRead(handler);
         const provider = new cr.Provider(this, 'Provider', {
             onEventHandler: handler,
         });

package/dist/microvm/image-version-reporter/handler.d.ts

@@ -9,8 +9,8 @@ export type ReporterEvent = {
     };
 };
 export type ReporterConfig = {
-    doorbellSecretArn: string;
-    doorbellSecretKey: string;
+    controllerSigningSecretArn: string;
+    controllerSigningSecretKey: string;
     evidentApiUrl: string;
     evidentRunnerId: string;
 };

package/dist/microvm/image-version-reporter/handler.js

@@ -7,17 +7,17 @@ const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
 const PHYSICAL_RESOURCE_ID = 'evident-image-version-report';
 const REPORT_TIMEOUT_MS = 5_000;
 const secrets = new client_secrets_manager_1.SecretsManagerClient({});
-async function fetchDoorbellSecret(secretArn, secretKey) {
+async function fetchControllerSigningSecret(secretArn, secretKey) {
     const { SecretString } = await secrets.send(new client_secrets_manager_1.GetSecretValueCommand({ SecretId: secretArn }));
     if (!SecretString) {
-        throw new Error(`doorbell secret ${secretArn} has no SecretString`);
+        throw new Error(`controller signing secret ${secretArn} has no SecretString`);
     }
     const parsed = JSON.parse(SecretString);
     const value = parsed !== null && typeof parsed === 'object'
         ? parsed[secretKey]
         : undefined;
     if (typeof value !== 'string' || value === '') {
-        throw new Error(`doorbell secret ${secretArn} is missing a non-empty '${secretKey}' field`);
+        throw new Error(`controller signing secret ${secretArn} is missing a non-empty '${secretKey}' field`);
     }
     return value;
 }
@@ -43,7 +43,7 @@ function response() {
     return { PhysicalResourceId: PHYSICAL_RESOURCE_ID };
 }
 const runtimeDependencies = {
-    getSecret: fetchDoorbellSecret,
+    getSecret: fetchControllerSigningSecret,
     fetch: globalThis.fetch,
 };
 async function handleImageVersionReport(event, getConfig, dependencies = runtimeDependencies) {
@@ -57,10 +57,12 @@ async function handleImageVersionReport(event, getConfig, dependencies = runtime
         versions = readImageVersions(event.ResourceProperties?.imageVersions);
         const config = getConfig();
         runnerId = config.evidentRunnerId;
-        const secret = await dependencies.getSecret(config.doorbellSecretArn, config.doorbellSecretKey);
+        const secret = await dependencies.getSecret(config.controllerSigningSecretArn, config.controllerSigningSecretKey);
         const body = JSON.stringify({
             type: 'runner.microvm_image_versions_reported',
             versions,
+            // The API orders reports by this value because replacing an image restarts its version counter.
+            reporter_clock_ms: Date.now(),
         });
         const signature = (0, node_crypto_1.createHmac)('sha256', secret).update(body).digest('hex');
         const url = `${config.evidentApiUrl.replace(/\/+$/, '')}/v1/runners/${encodeURIComponent(runnerId)}/microvm-image-versions`;
@@ -96,8 +98,8 @@ async function handleImageVersionReport(event, getConfig, dependencies = runtime
     return response();
 }
 const handler = (event) => handleImageVersionReport(event, () => ({
-    doorbellSecretArn: requireEnv('DOORBELL_SECRET_ARN'),
-    doorbellSecretKey: requireEnv('DOORBELL_SECRET_KEY'),
+    controllerSigningSecretArn: requireEnv('CONTROLLER_SIGNING_SECRET_ARN'),
+    controllerSigningSecretKey: requireEnv('CONTROLLER_SIGNING_SECRET_KEY'),
     evidentApiUrl: requireEnv('EVIDENT_API_URL'),
     evidentRunnerId: requireEnv('EVIDENT_RUNNER_ID'),
 }));

package/dist/microvm/shapes.d.ts

@@ -5,11 +5,8 @@ import { type MicrovmMemoryMiB } from '@evident-ai/lambda-microvm-cdk';
  * there is no launch-time resource dial — so "a bigger machine" means "a
  * different shape", each backed by its own `MicrovmImage`.
  *
- * `constructId` and `imageName` are carried **explicitly** rather than
- * derived from `name`, because for the default shape they are frozen
- * deployment identity (see the comment on `MICROVM_SHAPES` below): deriving
- * them would let an innocent rename of `name` silently rebuild the live
- * image. Every other shape is free to name these however is convenient.
+ * `name` is also the `MicrovmImage` child id, so it identifies both the
+ * controller-facing shape and the image resource built for it.
  */
 export interface MicrovmShape {
     /** The stable id a doorbell asks for; crosses the wire to Evident. */
@@ -27,8 +24,6 @@ export interface MicrovmShape {
      * it must be the first entry in `MICROVM_SHAPES`.
      */
     readonly isDefault: boolean;
-    /** The `MicrovmImage` construct id within the stack. */
-    readonly constructId: string;
     /** The account-unique `imageName` passed to `MicrovmImage`. */
     readonly imageName: string;
 }
@@ -45,28 +40,22 @@ export interface MicrovmShape {
  * making the construction-order contract enforceable rather than a
  * convention.
  *
- * The default entry's `constructId` ("Image") and `imageName`
- * ("evident-microvm") are FROZEN: they are today's live, hand-deployed
- * image's identity. Changing either destroys and rebuilds it (~4m45s,
- * measured) plus a window with no image. Its `description` is copied
- * verbatim from the image that is live today so the deploy changes nothing
- * about it.
+ * The default entry's `name` ("standard") and `imageName`
+ * ("evident-microvm-standard") are FROZEN: `name` crosses the wire and
+ * identifies the image child, while `imageName` is account-unique. Changing
+ * either replaces the image, so both values remain stable after deployment.
  *
  * "Frozen" means unchanged under OUR OWN synth (no `microvm:*` context set —
  * `main.ts` passes none). `imageName` MAY carry a customer's
  * `microvm:namePrefix` (`deployment.ts`'s `resolveShapeCatalogue`) — that is
- * account-scoped naming, not a change to this module. `constructId` stays
- * frozen unconditionally, with no override anywhere: it is the
- * CloudFormation logical-id path, and prefixing it is the resource
- * replacement this whole file's FROZEN warning exists to prevent.
+ * account-scoped naming, not a change to this module.
  */
 export declare const MICROVM_SHAPES: readonly MicrovmShape[];
 /**
  * Validates a shape list at synth time. Deliberately lean
  * (`code-simplicity.mdc`): this is a hand-edited constant list in a typed
- * file, so it only checks what `tsc` cannot already catch — CDK itself
- * rejects a duplicate `constructId`, so that one needs no check here, and no
- * byte-budget cap is applied (the image ARNs are unresolved tokens at synth,
- * so a rendered size is not measurable anyway).
+ * file, so it only checks what `tsc` cannot already catch. No byte-budget cap
+ * is applied because the image ARNs are unresolved tokens at synth, so a
+ * rendered size is not measurable anyway.
  */
 export declare function validateShapes(shapes: readonly MicrovmShape[]): readonly MicrovmShape[];

package/dist/microvm/shapes.js

@@ -16,20 +16,15 @@ const lambda_microvm_cdk_1 = require("@evident-ai/lambda-microvm-cdk");
  * making the construction-order contract enforceable rather than a
  * convention.
  *
- * The default entry's `constructId` ("Image") and `imageName`
- * ("evident-microvm") are FROZEN: they are today's live, hand-deployed
- * image's identity. Changing either destroys and rebuilds it (~4m45s,
- * measured) plus a window with no image. Its `description` is copied
- * verbatim from the image that is live today so the deploy changes nothing
- * about it.
+ * The default entry's `name` ("standard") and `imageName`
+ * ("evident-microvm-standard") are FROZEN: `name` crosses the wire and
+ * identifies the image child, while `imageName` is account-unique. Changing
+ * either replaces the image, so both values remain stable after deployment.
  *
  * "Frozen" means unchanged under OUR OWN synth (no `microvm:*` context set —
  * `main.ts` passes none). `imageName` MAY carry a customer's
  * `microvm:namePrefix` (`deployment.ts`'s `resolveShapeCatalogue`) — that is
- * account-scoped naming, not a change to this module. `constructId` stays
- * frozen unconditionally, with no override anywhere: it is the
- * CloudFormation logical-id path, and prefixing it is the resource
- * replacement this whole file's FROZEN warning exists to prevent.
+ * account-scoped naming, not a change to this module.
  */
 exports.MICROVM_SHAPES = [
     {
@@ -38,18 +33,16 @@ exports.MICROVM_SHAPES = [
         description: 'Evident per-session runner: an arm64 image that boots with no identity and acquires one at /run.',
         memoryMiB: 4096,
         isDefault: true,
-        // FROZEN — see the file-level comment. Do not rename either string.
-        constructId: 'Image',
-        imageName: 'evident-microvm',
+        // FROZEN — name crosses the wire and imageName is account-unique.
+        imageName: 'evident-microvm-standard',
     },
 ];
 /**
  * Validates a shape list at synth time. Deliberately lean
  * (`code-simplicity.mdc`): this is a hand-edited constant list in a typed
- * file, so it only checks what `tsc` cannot already catch — CDK itself
- * rejects a duplicate `constructId`, so that one needs no check here, and no
- * byte-budget cap is applied (the image ARNs are unresolved tokens at synth,
- * so a rendered size is not measurable anyway).
+ * file, so it only checks what `tsc` cannot already catch. No byte-budget cap
+ * is applied because the image ARNs are unresolved tokens at synth, so a
+ * rendered size is not measurable anyway.
  */
 function validateShapes(shapes) {
     if (shapes.length === 0) {

package/dist/waker-lambda/handler.js

@@ -27,9 +27,9 @@ module.exports = __toCommonJS(handler_exports);
 var import_client_ecs = require("@aws-sdk/client-ecs");
 var import_client_secrets_manager = require("@aws-sdk/client-secrets-manager");
 
-// ../webhook-signature/src/verify-wake-signature.ts
+// ../../sdk/src/signature.ts
 var import_node_crypto = require("node:crypto");
-function verifyWakeSignature(rawBody, signatureHeader, secret) {
+function verifyEvidentSignature(rawBody, signatureHeader, secret) {
   if (!signatureHeader || !secret) {
     return false;
   }
@@ -64,7 +64,7 @@ async function handleWake({
   service,
   ecs
 }) {
-  if (!verifyWakeSignature(rawBody, signatureHeader, wakeSecret)) {
+  if (!verifyEvidentSignature(rawBody, signatureHeader, wakeSecret)) {
     const { statusCode: statusCode2, body: body2 } = jsonResponse(401, "invalid signature");
     return { statusCode: statusCode2, body: body2, calledUpdateService: false };
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evident-ai/runner-cdk",
-  "version": "3.5.2-dev.e67eb8b",
+  "version": "3.5.2-dev.f258bd6",
   "description": "Reusable CDK constructs for an Evident agent runner: a single scale-to-zero Fargate runner (task + service + per-agent self-stop role + waker Lambda), or a per-session AWS Lambda MicroVM that boots on demand and suspends between messages. Instantiate once per agent from your own stack.",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -15,8 +15,8 @@
   ],
   "scripts": {
     "build": "pnpm run build-bundled-deps && ts-node scripts/build.ts && node -e 'const m=require(\"./package.json\").main; if (!require(\"node:fs\").existsSync(m)) { console.error(`build produced no ${m}`); process.exit(1); }'",
-    "//build-bundled-deps": "scripts/build.ts esbuild-bundles runner/docker-images/microvm/hook-server.ts, which imports @evident-ai/lambda-microvm-runtime by its built `main`. @evident-ai/lambda-microvm-cdk is a workspace:* devDependency whose types resolve through its own dist/, so tsc --project tsconfig.build.json cannot compile src/microvm/{shapes,construct}.ts without it. Chained into `build` rather than left to turbo's `^build` because callers outside turbo invoke `pnpm --filter @evident-ai/runner-cdk build` directly, which bypasses turbo entirely.",
-    "build-bundled-deps": "pnpm --filter @evident-ai/lambda-microvm-cdk build && pnpm --filter @evident-ai/lambda-microvm-runtime build",
+    "//build-bundled-deps": "Builds the workspace dependencies whose dist/ output the direct runner-cdk build chain consumes: lambda-microvm-cdk for the public construct types, lambda-microvm-runtime for runner-microvm-image's hook-server bundle, and runner-microvm-image for that bundle itself. Chained into `build` rather than left to turbo's `^build` because callers outside turbo invoke `pnpm --filter @evident-ai/runner-cdk build` directly, which bypasses turbo entirely.",
+    "build-bundled-deps": "pnpm --filter @evident-ai/lambda-microvm-cdk build && pnpm --filter @evident-ai/lambda-microvm-runtime build && pnpm --filter runner-microvm-image build",
     "typecheck": "tsc --noEmit",
     "test": "node --test --require ts-node/register 'src/**/*.test.ts'",
     "format": "prettier --write 'src/**/*.ts'",