@evident-ai/runner-cdk 3.5.2-dev.f258bd6 → 3.5.2-dev.f80111b

package/dist/microvm/construct.d.ts

@@ -91,6 +91,12 @@ export interface EvidentMicrovmConstructProps {
      * throws at construction rather than silently disabling the reporter.
      */
     readonly evidentRunnerId?: string;
+    /**
+     * Opts into bounding the per-image MicroVM version quota (L-F8BECE9C) for
+     * this deployment's images only, using the upstream engine defaults. Omitting
+     * this leaves the synthesised template byte-for-byte identical.
+     */
+    readonly imageVersionPruning?: boolean;
 }
 /**
  * The customer-account half of the per-session runner (#558): the MicroVM

package/dist/microvm/construct.js

@@ -44,6 +44,7 @@ const lambda_microvm_cdk_1 = require("@evident-ai/lambda-microvm-cdk");
 const constants_1 = require("./constants");
 const shapes_1 = require("./shapes");
 const construct_1 = require("./image-version-reporter/construct");
+const construct_2 = require("./image-version-pruner/construct");
 // Image hooks build the snapshot, so they get minutes where the runtime hooks
 // get AWS's 60 s.
 const IMAGE_HOOK_TIMEOUT_SECONDS = 600;
@@ -263,6 +264,23 @@ class EvidentMicrovmConstruct extends constructs_1.Construct {
                 buildTriggers: Object.fromEntries(shapes.map((shape) => [shape.name, images.get(shape.name).buildInputs])),
             });
         }
+        if (props.imageVersionPruning) {
+            const pruner = new construct_2.ImageVersionPruner(this, 'ImageVersionPruner', {
+                imageArns: shapes.map((shape) => (0, lambda_microvm_cdk_1.microvmImageArn)({
+                    region: cdk.Stack.of(this).region,
+                    accountId: cdk.Stack.of(this).account,
+                    imageName: shape.imageName,
+                })),
+                buildTriggers: Object.fromEntries(shapes.map((shape) => {
+                    const { buildRoleArn: _buildRoleArn, ...buildInputs } = images.get(shape.name).buildInputs;
+                    return [shape.name, buildInputs];
+                })),
+            });
+            // Free a quota slot before the publish that consumes it.
+            for (const shape of shapes) {
+                images.get(shape.name).node.addDependency(pruner);
+            }
+        }
         this.functionUrl = functionUrl.url;
         this.shapeCatalogueJson = shapeCatalogueJson;
         this.durableStateBucket = durableState;

package/dist/microvm/image-version-pruner/construct.d.ts

@@ -0,0 +1,13 @@
+import { Construct } from 'constructs';
+import type { MicrovmImageBuildInputs } from '@evident-ai/lambda-microvm-cdk';
+export type ImageVersionPrunerProps = {
+    readonly imageArns: readonly string[];
+    /**
+     * Build inputs are a CloudFormation-visible invocation trigger. The build role
+     * ARN is excluded because it belongs to the image subtree and would create a cycle.
+     */
+    readonly buildTriggers: Record<string, Omit<MicrovmImageBuildInputs, 'buildRoleArn'>>;
+};
+export declare class ImageVersionPruner extends Construct {
+    constructor(scope: Construct, id: string, props: ImageVersionPrunerProps);
+}

package/dist/microvm/image-version-pruner/construct.js

@@ -0,0 +1,79 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ImageVersionPruner = void 0;
+const path = __importStar(require("path"));
+const cdk = __importStar(require("aws-cdk-lib"));
+const iam = __importStar(require("aws-cdk-lib/aws-iam"));
+const lambda = __importStar(require("aws-cdk-lib/aws-lambda"));
+const cr = __importStar(require("aws-cdk-lib/custom-resources"));
+const constructs_1 = require("constructs");
+class ImageVersionPruner extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const handler = new lambda.Function(this, 'Function', {
+            runtime: lambda.Runtime.NODEJS_22_X,
+            code: lambda.Code.fromAsset(path.join(__dirname, '..', '..', '..', 'dist', 'image-version-pruner-lambda')),
+            handler: 'handler.handler',
+            memorySize: 256,
+            timeout: cdk.Duration.minutes(5),
+        });
+        handler.addToRolePolicy(new iam.PolicyStatement({
+            actions: [
+                'lambda:GetMicrovmImage',
+                'lambda:ListMicrovmImageVersions',
+                'lambda:UpdateMicrovmImageVersion',
+                'lambda:DeleteMicrovmImageVersion',
+            ],
+            resources: [...props.imageArns],
+        }));
+        handler.addToRolePolicy(new iam.PolicyStatement({
+            // Evidence-only read: this account-wide permission cannot authorize a mutation.
+            actions: ['lambda:ListMicrovms'],
+            resources: ['*'],
+        }));
+        const provider = new cr.Provider(this, 'Provider', {
+            onEventHandler: handler,
+        });
+        new cdk.CustomResource(this, 'Resource', {
+            serviceToken: provider.serviceToken,
+            properties: {
+                imageArns: props.imageArns,
+                buildTriggers: props.buildTriggers,
+            },
+        });
+    }
+}
+exports.ImageVersionPruner = ImageVersionPruner;

package/dist/microvm/image-version-pruner/handler.d.ts

@@ -0,0 +1,20 @@
+import { LambdaMicrovmsClient } from '@aws-sdk/client-lambda-microvms';
+import { type PruneImageVersionsOptions, type PruneSummary } from '@evident-ai/lambda-microvm-cdk/prune';
+export declare const PRUNE_DEADLINE_MS: number;
+export type ImageVersionPrunerEvent = {
+    RequestType: 'Create' | 'Update' | 'Delete';
+    ResourceProperties?: {
+        imageArns?: unknown;
+    };
+};
+export type ImageVersionPrunerDependencies = {
+    pruneImageVersions: (options: PruneImageVersionsOptions) => Promise<PruneSummary>;
+    createClient: () => LambdaMicrovmsClient;
+    now: () => number;
+};
+type ImageVersionPrunerResponse = {
+    PhysicalResourceId: string;
+};
+export declare function handleImageVersionPrune(event: ImageVersionPrunerEvent, dependencies?: ImageVersionPrunerDependencies): Promise<ImageVersionPrunerResponse>;
+export declare const handler: (event: ImageVersionPrunerEvent) => Promise<ImageVersionPrunerResponse>;
+export {};

package/dist/microvm/image-version-pruner/handler.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = exports.PRUNE_DEADLINE_MS = void 0;
+exports.handleImageVersionPrune = handleImageVersionPrune;
+const client_lambda_microvms_1 = require("@aws-sdk/client-lambda-microvms");
+const prune_1 = require("@evident-ai/lambda-microvm-cdk/prune");
+const PHYSICAL_RESOURCE_ID = 'evident-image-version-pruner';
+exports.PRUNE_DEADLINE_MS = 4 * 60 * 1_000;
+const runtimeDependencies = {
+    pruneImageVersions: prune_1.pruneImageVersions,
+    createClient: () => new client_lambda_microvms_1.LambdaMicrovmsClient({}),
+    now: Date.now,
+};
+function response() {
+    return { PhysicalResourceId: PHYSICAL_RESOURCE_ID };
+}
+function log(message) {
+    console.log(`[image-version-pruner] ${message}`);
+}
+function logError(message) {
+    console.error(`[image-version-pruner] ${message}`);
+}
+function readImageArns(value) {
+    if (!Array.isArray(value) || !value.every((imageArn) => typeof imageArn === 'string')) {
+        return undefined;
+    }
+    return value;
+}
+async function raceWithDeadline(operation, controller) {
+    let timer;
+    const deadline = new Promise((resolve) => {
+        timer = setTimeout(() => resolve({ timedOut: true }), exports.PRUNE_DEADLINE_MS);
+    });
+    try {
+        const result = await Promise.race([
+            operation.then((summary) => ({ timedOut: false, summary })),
+            deadline,
+        ]);
+        if (result.timedOut) {
+            controller.abort();
+            try {
+                await operation;
+            }
+            catch (error) {
+                console.warn('MicroVM image version pruning cancellation observed', {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        return result;
+    }
+    finally {
+        if (timer !== undefined) {
+            clearTimeout(timer);
+        }
+    }
+}
+async function handleImageVersionPrune(event, dependencies = runtimeDependencies) {
+    if (event.RequestType === 'Delete') {
+        return response();
+    }
+    const imageArns = readImageArns(event.ResourceProperties?.imageArns);
+    if (imageArns === undefined) {
+        console.warn('MicroVM image version pruning skipped', {
+            operation: event.RequestType,
+            reason: 'imageArns must be an array of strings',
+        });
+        return response();
+    }
+    if (imageArns.length === 0) {
+        console.warn('MicroVM image version pruning skipped', {
+            operation: event.RequestType,
+            reason: 'imageArns is empty',
+        });
+        return response();
+    }
+    try {
+        const startedAt = dependencies.now();
+        const controller = new AbortController();
+        const operation = dependencies.pruneImageVersions({
+            client: dependencies.createClient(),
+            imageArns,
+            abortSignal: controller.signal,
+            log,
+            logError,
+        });
+        const result = await raceWithDeadline(operation, controller);
+        if (result.timedOut) {
+            console.warn('MicroVM image version pruning deadline reached', {
+                operation: event.RequestType,
+                imageArns,
+                deadlineMs: exports.PRUNE_DEADLINE_MS,
+                elapsedMs: dependencies.now() - startedAt,
+            });
+            return response();
+        }
+        console.log('MicroVM image version pruning complete', {
+            operation: event.RequestType,
+            imageArns,
+            deactivated: result.summary.deactivated.length,
+            deleted: result.summary.deleted.length,
+            skipped: result.summary.skipped.length,
+            stoppedOnQuota: result.summary.stoppedOnQuota,
+        });
+    }
+    catch (error) {
+        console.warn('MicroVM image version pruning failed', {
+            operation: event.RequestType,
+            imageArns,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+    return response();
+}
+const handler = (event) => handleImageVersionPrune(event);
+exports.handler = handler;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evident-ai/runner-cdk",
-  "version": "3.5.2-dev.f258bd6",
+  "version": "3.5.2-dev.f80111b",
   "description": "Reusable CDK constructs for an Evident agent runner: a single scale-to-zero Fargate runner (task + service + per-agent self-stop role + waker Lambda), or a per-session AWS Lambda MicroVM that boots on demand and suspends between messages. Instantiate once per agent from your own stack.",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",