@effortless-aws/cli 0.8.0 → 0.9.1

package/dist/cli/index.js

@@ -6,9 +6,9 @@ var __export = (target, all) => {
 };
 
 // src/cli/index.ts
-import { CliConfig, Command as Command7 } from "@effect/cli";
+import { CliConfig, Command as Command8 } from "@effect/cli";
 import { NodeContext, NodeRuntime } from "@effect/platform-node";
-import { Effect as Effect45 } from "effect";
+import { Effect as Effect46 } from "effect";
 import { createRequire as createRequire2 } from "module";
 
 // src/cli/commands/deploy.ts
@@ -1933,6 +1933,18 @@ var publishVersion = (functionName) => Effect13.gen(function* () {
     version: result.Version
   };
 });
+var ensureEdgePermission = (functionName) => lambda_exports.make("add_permission", {
+  FunctionName: functionName,
+  StatementId: "replicator",
+  Action: "lambda:GetFunction",
+  Principal: "replicator.lambda.amazonaws.com"
+}).pipe(
+  Effect13.catchIf(
+    (e) => e._tag === "LambdaError" && e.is("ResourceConflictException"),
+    () => Effect13.logDebug(`Replicator permission already exists for ${functionName}`)
+  ),
+  Effect13.asVoid
+);
 var DEFAULT_CORS = {
   AllowOrigins: ["*"],
   AllowMethods: ["*"],
@@ -2459,15 +2471,24 @@ var getPackageVersion = (pkgPath) => {
     return null;
   }
 };
-var computeLockfileHash = (projectDir) => Effect18.gen(function* () {
+var computeLockfileHash = (projectDir, extraNodeModules) => Effect18.gen(function* () {
   const prodDeps = yield* readProductionDependencies(projectDir);
   if (prodDeps.length === 0) {
     return yield* Effect18.fail(new Error("No production dependencies"));
   }
-  const { packages: allPackages, resolvedPaths } = collectTransitiveDeps(projectDir, prodDeps);
+  const { packages: allPackages, resolvedPaths } = collectTransitiveDeps(
+    projectDir,
+    prodDeps,
+    void 0,
+    void 0,
+    void 0,
+    void 0,
+    void 0,
+    extraNodeModules
+  );
   const packageVersions = [];
   for (const pkgName of Array.from(allPackages).filter((p) => !isAwsRuntime(p)).sort()) {
-    const pkgPath = resolvedPaths.get(pkgName) ?? findInPnpmStore(projectDir, pkgName) ?? getPackageRealPath(projectDir, pkgName);
+    const pkgPath = resolvedPaths.get(pkgName) ?? findInPnpmStore(projectDir, pkgName, extraNodeModules) ?? getPackageRealPath(projectDir, pkgName);
     if (pkgPath) {
       const version2 = getPackageVersion(pkgPath);
       if (version2) {
@@ -2522,10 +2543,13 @@ var DEV_ONLY_PREFIXES = [
   "@vitest/",
   "@jest/"
 ];
-var extractExportPaths = (value) => {
+var RUNTIME_CONDITIONS = /* @__PURE__ */ new Set(["import", "require", "default", "node"]);
+var isSubpath = (key) => key.startsWith(".");
+var extractExportPaths = (value, key) => {
+  if (key !== void 0 && !isSubpath(key) && !RUNTIME_CONDITIONS.has(key)) return [];
   if (typeof value === "string") return [value];
   if (typeof value === "object" && value !== null) {
-    return Object.values(value).flatMap(extractExportPaths);
+    return Object.entries(value).flatMap(([k, v]) => extractExportPaths(v, k));
   }
   return [];
 };
@@ -2568,7 +2592,7 @@ var checkDependencyWarnings = (projectDir) => Effect18.gen(function* () {
       const tsEntries = [...new Set(entryPoints.filter(isRawTypeScript))];
       if (tsEntries.length > 0) {
         warnings.push(
-          `Package "${dep}" has TypeScript entry points (${tsEntries.join(", ")}) that will fail at runtime in node_modules (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING). Move it to "devDependencies" so esbuild can bundle and transpile it.`
+          `Package "${dep}" has TypeScript entry points (${tsEntries.join(", ")}) \u2014 it will be bundled by esbuild instead of included in the layer.`
         );
       }
     } catch {
@@ -2601,8 +2625,7 @@ var getPackageDeps = (pkgPath) => {
     return EMPTY_DEPS;
   }
 };
-var findInPnpmStore = (projectDir, pkgName) => {
-  const pnpmDir = path.join(projectDir, "node_modules", ".pnpm");
+var searchPnpmDir = (pnpmDir, pkgName) => {
   if (!fsSync.existsSync(pnpmDir)) return null;
   const pnpmPkgName = pkgName.replace("/", "+");
   try {
@@ -2622,7 +2645,18 @@ var findInPnpmStore = (projectDir, pkgName) => {
   }
   return null;
 };
-var collectTransitiveDeps = (projectDir, rootDeps, searchPath = path.join(projectDir, "node_modules"), visited = /* @__PURE__ */ new Set(), resolvedPaths = /* @__PURE__ */ new Map(), warnings = [], optionalNames = /* @__PURE__ */ new Set()) => {
+var findInPnpmStore = (projectDir, pkgName, extraNodeModules) => {
+  const result = searchPnpmDir(path.join(projectDir, "node_modules", ".pnpm"), pkgName);
+  if (result) return result;
+  if (extraNodeModules) {
+    for (const dir of extraNodeModules) {
+      const found = searchPnpmDir(path.join(dir, ".pnpm"), pkgName);
+      if (found) return found;
+    }
+  }
+  return null;
+};
+var collectTransitiveDeps = (projectDir, rootDeps, searchPath = path.join(projectDir, "node_modules"), visited = /* @__PURE__ */ new Set(), resolvedPaths = /* @__PURE__ */ new Map(), warnings = [], optionalNames = /* @__PURE__ */ new Set(), extraNodeModules) => {
   const rootNodeModules = path.join(projectDir, "node_modules");
   for (const dep of rootDeps) {
     if (visited.has(dep)) continue;
@@ -2645,8 +2679,20 @@ var collectTransitiveDeps = (projectDir, rootDeps, searchPath = path.join(projec
         }
       }
     }
+    if (!realPath && extraNodeModules) {
+      for (const dir of extraNodeModules) {
+        pkgPath = path.join(dir, dep);
+        if (fsSync.existsSync(pkgPath)) {
+          try {
+            realPath = fsSync.realpathSync(pkgPath);
+            break;
+          } catch {
+          }
+        }
+      }
+    }
     if (!realPath) {
-      realPath = findInPnpmStore(projectDir, dep);
+      realPath = findInPnpmStore(projectDir, dep, extraNodeModules);
     }
     if (!realPath) {
       if (!optionalNames.has(dep)) {
@@ -2662,15 +2708,38 @@ var collectTransitiveDeps = (projectDir, rootDeps, searchPath = path.join(projec
       const pkgNodeModules = isScoped ? path.dirname(path.dirname(realPath)) : path.dirname(realPath);
       const nextOptional = new Set(optionalNames);
       for (const name of pkgDeps.optional) nextOptional.add(name);
-      collectTransitiveDeps(projectDir, pkgDeps.all, pkgNodeModules, visited, resolvedPaths, warnings, nextOptional);
+      collectTransitiveDeps(projectDir, pkgDeps.all, pkgNodeModules, visited, resolvedPaths, warnings, nextOptional, extraNodeModules);
     }
   }
   return { packages: visited, resolvedPaths, warnings };
 };
 var isAwsRuntime = (pkg) => pkg.startsWith("@aws-sdk/") || pkg.startsWith("@smithy/") || pkg.startsWith("@aws-crypto/") || pkg.startsWith("@aws/");
-var collectLayerPackages = (projectDir, dependencies) => {
+var hasTypeScriptEntryPoints = (pkgPath) => {
+  const pkgJsonPath = path.join(pkgPath, "package.json");
+  if (!fsSync.existsSync(pkgJsonPath)) return false;
+  try {
+    const pkgJson = JSON.parse(fsSync.readFileSync(pkgJsonPath, "utf-8"));
+    const entryPoints = [];
+    if (typeof pkgJson.main === "string") entryPoints.push(pkgJson.main);
+    if (typeof pkgJson.module === "string") entryPoints.push(pkgJson.module);
+    entryPoints.push(...extractExportPaths(pkgJson.exports));
+    return entryPoints.some(isRawTypeScript);
+  } catch {
+    return false;
+  }
+};
+var collectLayerPackages = (projectDir, dependencies, extraNodeModules) => {
   if (dependencies.length === 0) return { packages: [], resolvedPaths: /* @__PURE__ */ new Map(), warnings: [] };
-  const { packages, resolvedPaths, warnings } = collectTransitiveDeps(projectDir, dependencies);
+  const { packages, resolvedPaths, warnings } = collectTransitiveDeps(
+    projectDir,
+    dependencies,
+    void 0,
+    void 0,
+    void 0,
+    void 0,
+    void 0,
+    extraNodeModules
+  );
   let changed = true;
   while (changed) {
     changed = false;
@@ -2679,7 +2748,7 @@ var collectLayerPackages = (projectDir, dependencies) => {
       const pkgPaths = /* @__PURE__ */ new Set();
       const resolved = resolvedPaths.get(pkg);
       if (resolved) pkgPaths.add(resolved);
-      const found = findPackagePath(projectDir, pkg);
+      const found = findPackagePath(projectDir, pkg, extraNodeModules);
       if (found) pkgPaths.add(found);
       if (pkgPaths.size === 0) continue;
       for (const pkgPath of pkgPaths) {
@@ -2687,7 +2756,7 @@ var collectLayerPackages = (projectDir, dependencies) => {
         const optionalSet = new Set(pkgDeps.optional);
         for (const dep of pkgDeps.all) {
           if (!packages.has(dep) && !isAwsRuntime(dep)) {
-            let depPath = findPackagePath(projectDir, dep);
+            let depPath = findPackagePath(projectDir, dep, extraNodeModules);
             if (!depPath) {
               const isScoped = pkg.startsWith("@");
               const parentNodeModules = isScoped ? path.dirname(path.dirname(pkgPath)) : path.dirname(pkgPath);
@@ -2708,13 +2777,33 @@ var collectLayerPackages = (projectDir, dependencies) => {
       }
     }
   }
-  const filtered = Array.from(packages).filter((pkg) => !isAwsRuntime(pkg));
+  const filtered = Array.from(packages).filter((pkg) => {
+    if (isAwsRuntime(pkg)) return false;
+    const pkgPath = resolvedPaths.get(pkg) ?? findPackagePath(projectDir, pkg, extraNodeModules);
+    if (!pkgPath) return false;
+    if (hasTypeScriptEntryPoints(pkgPath)) {
+      warnings.push(`Package "${pkg}" has TypeScript entry points \u2014 it will be bundled by esbuild instead of included in the layer`);
+      return false;
+    }
+    return true;
+  });
   return { packages: filtered, resolvedPaths, warnings };
 };
-var findPackagePath = (projectDir, pkgName) => {
+var findPackagePath = (projectDir, pkgName, extraNodeModules) => {
   const rootPath = getPackageRealPath(projectDir, pkgName);
   if (rootPath) return rootPath;
-  return findInPnpmStore(projectDir, pkgName);
+  if (extraNodeModules) {
+    for (const dir of extraNodeModules) {
+      const pkgPath = path.join(dir, pkgName);
+      if (fsSync.existsSync(pkgPath)) {
+        try {
+          return fsSync.realpathSync(pkgPath);
+        } catch {
+        }
+      }
+    }
+  }
+  return findInPnpmStore(projectDir, pkgName, extraNodeModules);
 };
 var createLayerZip = (projectDir, packages, resolvedPaths) => Effect18.async((resume) => {
   const chunks = [];
@@ -2778,7 +2867,7 @@ var ensureLayer = (config) => Effect18.gen(function* () {
     yield* Effect18.logDebug("No production dependencies, skipping layer creation");
     return null;
   }
-  const hash = yield* computeLockfileHash(config.projectDir).pipe(
+  const hash = yield* computeLockfileHash(config.projectDir, config.extraNodeModules).pipe(
     Effect18.catchAll((e) => {
       const message = e instanceof Error ? e.message : String(e);
       return Effect18.logWarning(`Cannot compute lockfile hash: ${message}, skipping layer`).pipe(
@@ -2795,7 +2884,7 @@ var ensureLayer = (config) => Effect18.gen(function* () {
     yield* Effect18.logDebug(`Layer ${layerName} with hash ${hash} already exists (version ${existing.version})`);
     return existing;
   }
-  const { packages: allPackages, resolvedPaths, warnings: layerWarnings } = yield* Effect18.sync(() => collectLayerPackages(config.projectDir, dependencies));
+  const { packages: allPackages, resolvedPaths, warnings: layerWarnings } = yield* Effect18.sync(() => collectLayerPackages(config.projectDir, dependencies, config.extraNodeModules));
   for (const warning of layerWarnings) {
     yield* Effect18.logWarning(`[layer] ${warning}`);
   }
@@ -2805,11 +2894,46 @@ var ensureLayer = (config) => Effect18.gen(function* () {
   if (skippedPackages.length > 0) {
     yield* Effect18.logWarning(`Skipped ${skippedPackages.length} packages (not found): ${skippedPackages.slice(0, 10).join(", ")}${skippedPackages.length > 10 ? "..." : ""}`);
   }
-  yield* Effect18.logDebug(`Layer zip size: ${(layerZip.length / 1024 / 1024).toFixed(2)} MB (${includedPackages.length} packages)`);
+  const zipSizeMB = layerZip.length / 1024 / 1024;
+  yield* Effect18.logDebug(`Layer zip size: ${zipSizeMB.toFixed(2)} MB (${includedPackages.length} packages)`);
+  const MAX_DIRECT_UPLOAD = 50 * 1024 * 1024;
+  let content;
+  if (layerZip.length > MAX_DIRECT_UPLOAD) {
+    const bucketName = `${config.project}-${config.stage}-deploy-artifacts`;
+    const s3Key = `layers/${layerName}-${hash}.zip`;
+    yield* Effect18.logDebug(`Layer zip too large for direct upload (${zipSizeMB.toFixed(1)} MB), uploading to S3: s3://${bucketName}/${s3Key}`);
+    const bucketExists = yield* s3_exports.make("head_bucket", { Bucket: bucketName }).pipe(
+      Effect18.map(() => true),
+      Effect18.catchIf((e) => e._tag === "S3Error", () => Effect18.succeed(false))
+    );
+    if (!bucketExists) {
+      yield* s3_exports.make("create_bucket", {
+        Bucket: bucketName,
+        ...config.region !== "us-east-1" ? { CreateBucketConfiguration: { LocationConstraint: config.region } } : {}
+      });
+      yield* s3_exports.make("put_public_access_block", {
+        Bucket: bucketName,
+        PublicAccessBlockConfiguration: {
+          BlockPublicAcls: true,
+          IgnorePublicAcls: true,
+          BlockPublicPolicy: true,
+          RestrictPublicBuckets: true
+        }
+      });
+    }
+    yield* s3_exports.make("put_object", {
+      Bucket: bucketName,
+      Key: s3Key,
+      Body: layerZip
+    });
+    content = { S3Bucket: bucketName, S3Key: s3Key };
+  } else {
+    content = { ZipFile: layerZip };
+  }
   const result = yield* lambda_exports.make("publish_layer_version", {
     LayerName: layerName,
     Description: `effortless deps layer hash:${hash}`,
-    Content: { ZipFile: layerZip },
+    Content: content,
     CompatibleRuntimes: [Runtime2.nodejs24x],
     CompatibleArchitectures: [Architecture2.arm64]
   });
@@ -4002,6 +4126,7 @@ import { Effect as Effect24 } from "effect";
 import * as esbuild from "esbuild";
 import * as fsSync2 from "fs";
 import * as path3 from "path";
+import { builtinModules } from "module";
 import { createRequire } from "module";
 import archiver2 from "archiver";
 import { globSync } from "glob";
@@ -4012,7 +4137,36 @@ var parseSource = (source) => {
   const project = new Project({ useInMemoryFileSystem: true });
   return project.createSourceFile("input.ts", source);
 };
-var RUNTIME_PROPS = ["onRecord", "onBatchComplete", "onBatch", "onMessage", "onObjectCreated", "onObjectRemoved", "setup", "schema", "onError", "deps", "config", "static", "middleware", "routes", "get", "post"];
+var bareName = (expr) => {
+  const dot = expr.lastIndexOf(".");
+  return dot === -1 ? expr : expr.slice(dot + 1);
+};
+var getProp = (obj, name) => obj.getProperties().find((p) => p.getKind() === SyntaxKind.PropertyAssignment && p.getName() === name)?.asKindOrThrow(SyntaxKind.PropertyAssignment).getInitializer();
+var findDefineCalls = (sourceFile, defineFn) => {
+  const results = [];
+  const tryAdd = (callExpr, exportName) => {
+    if (bareName(callExpr.getExpression().getText()) !== defineFn) return;
+    const firstArg = callExpr.getArguments()[0];
+    if (firstArg?.getKind() === SyntaxKind.ObjectLiteralExpression) {
+      results.push({ exportName, args: firstArg });
+    }
+  };
+  const def = sourceFile.getExportAssignment((e) => !e.isExportEquals());
+  if (def?.getExpression().getKind() === SyntaxKind.CallExpression) {
+    tryAdd(def.getExpression().asKindOrThrow(SyntaxKind.CallExpression), "default");
+  }
+  for (const stmt of sourceFile.getVariableStatements()) {
+    if (!stmt.isExported()) continue;
+    for (const decl of stmt.getDeclarations()) {
+      const init = decl.getInitializer();
+      if (init?.getKind() === SyntaxKind.CallExpression) {
+        tryAdd(init.asKindOrThrow(SyntaxKind.CallExpression), decl.getName());
+      }
+    }
+  }
+  return results;
+};
+var RUNTIME_PROPS = ["onRecord", "onBatchComplete", "onBatch", "onMessage", "onObjectCreated", "onObjectRemoved", "setup", "schema", "onError", "deps", "config", "static", "middleware", "auth", "routes", "get", "post"];
 var evalConfig = (configText, exportName) => {
   try {
     return new Function(`return ${configText}`)();
@@ -4027,35 +4181,18 @@ Handler config must use only literal values (no variables, imports, or expressio
 var buildConfigWithoutRuntime = (obj) => {
   const props = obj.getProperties().filter((p) => {
     if (p.getKind() === SyntaxKind.PropertyAssignment) {
-      const propAssign = p;
-      return !RUNTIME_PROPS.includes(propAssign.getName());
+      return !RUNTIME_PROPS.includes(p.getName());
+    }
+    if (p.getKind() === SyntaxKind.ShorthandPropertyAssignment) {
+      return !RUNTIME_PROPS.includes(p.asKindOrThrow(SyntaxKind.ShorthandPropertyAssignment).getName());
     }
     return true;
   }).map((p) => p.getText()).join(", ");
   return `{ ${props} }`;
 };
-var extractPropertyFromObject = (obj, propName) => {
-  const prop = obj.getProperties().find((p) => {
-    if (p.getKind() === SyntaxKind.PropertyAssignment) {
-      return p.getName() === propName;
-    }
-    return false;
-  });
-  if (prop && prop.getKind() === SyntaxKind.PropertyAssignment) {
-    const propAssign = prop;
-    return propAssign.getInitializer()?.getText();
-  }
-  return void 0;
-};
+var toKebabCase = (str) => str.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
 var extractDepsKeys = (obj) => {
-  const depsProp = obj.getProperties().find((p) => {
-    if (p.getKind() === SyntaxKind.PropertyAssignment) {
-      return p.getName() === "deps";
-    }
-    return false;
-  });
-  if (!depsProp || depsProp.getKind() !== SyntaxKind.PropertyAssignment) return [];
-  let init = depsProp.getInitializer();
+  let init = getProp(obj, "deps");
   if (!init) return [];
   if (init.getKind() === SyntaxKind.ArrowFunction) {
     const body = init.getBody();
@@ -4063,9 +4200,8 @@ var extractDepsKeys = (obj) => {
       init = body.getExpression();
     }
   }
-  if (!init || init.getKind() !== SyntaxKind.ObjectLiteralExpression) return [];
-  const depsObj = init;
-  return depsObj.getProperties().map((p) => {
+  if (init.getKind() !== SyntaxKind.ObjectLiteralExpression) return [];
+  return init.getProperties().map((p) => {
     if (p.getKind() === SyntaxKind.ShorthandPropertyAssignment) {
       return p.asKindOrThrow(SyntaxKind.ShorthandPropertyAssignment).getName();
     }
@@ -4075,15 +4211,17 @@ var extractDepsKeys = (obj) => {
     return "";
   }).filter(Boolean);
 };
-var extractParamEntries = (obj) => {
-  const configProp = obj.getProperties().find((p) => {
-    if (p.getKind() === SyntaxKind.PropertyAssignment) {
-      return p.getName() === "config";
-    }
-    return false;
-  });
-  if (!configProp || configProp.getKind() !== SyntaxKind.PropertyAssignment) return [];
-  const init = configProp.getInitializer();
+var parseGenerateSpec = (text) => {
+  if (!text) return void 0;
+  const hexMatch = text.match(/generateHex\((\d+)\)/);
+  if (hexMatch) return { type: "hex", bytes: Number(hexMatch[1]) };
+  const base64Match = text.match(/generateBase64\((\d+)\)/);
+  if (base64Match) return { type: "base64", bytes: Number(base64Match[1]) };
+  if (text.includes("generateUuid")) return { type: "uuid" };
+  return void 0;
+};
+var extractSecretEntries = (obj) => {
+  const init = getProp(obj, "config");
   if (!init || init.getKind() !== SyntaxKind.ObjectLiteralExpression) return [];
   const configObj = init;
   const entries = [];
@@ -4094,47 +4232,46 @@ var extractParamEntries = (obj) => {
     const propInit = propAssign.getInitializer();
     if (!propInit) continue;
     if (propInit.getKind() === SyntaxKind.StringLiteral) {
-      const ssmKey = propInit.asKindOrThrow(SyntaxKind.StringLiteral).getLiteralValue();
-      entries.push({ propName, ssmKey });
+      entries.push({ propName, ssmKey: propInit.asKindOrThrow(SyntaxKind.StringLiteral).getLiteralValue() });
       continue;
     }
     if (propInit.getKind() !== SyntaxKind.CallExpression) continue;
     const callExpr = propInit;
-    const callArgs = callExpr.getArguments();
-    if (callArgs.length === 0) continue;
-    const firstArg = callArgs[0];
-    if (firstArg.getKind() === SyntaxKind.StringLiteral) {
-      const ssmKey = firstArg.asKindOrThrow(SyntaxKind.StringLiteral).getLiteralValue();
-      entries.push({ propName, ssmKey });
+    const fnName = bareName(callExpr.getExpression().getText());
+    if (fnName === "secret") {
+      const callArgs = callExpr.getArguments();
+      if (callArgs.length === 0) {
+        entries.push({ propName, ssmKey: toKebabCase(propName) });
+        continue;
+      }
+      const firstArg = callArgs[0];
+      if (firstArg.getKind() === SyntaxKind.ObjectLiteralExpression) {
+        const optObj = firstArg;
+        const keyText = getProp(optObj, "key")?.getText();
+        const ssmKey = keyText ? keyText.replace(/^["']|["']$/g, "") : toKebabCase(propName);
+        const generate = parseGenerateSpec(getProp(optObj, "generate")?.getText());
+        entries.push({ propName, ssmKey, ...generate ? { generate } : {} });
+      }
+      continue;
+    }
+    if (fnName === "param") {
+      const firstArg = callExpr.getArguments()[0];
+      if (firstArg?.getKind() === SyntaxKind.StringLiteral) {
+        entries.push({ propName, ssmKey: firstArg.asKindOrThrow(SyntaxKind.StringLiteral).getLiteralValue() });
+      }
     }
   }
   return entries;
 };
 var extractStaticGlobs = (obj) => {
-  const staticProp = obj.getProperties().find((p) => {
-    if (p.getKind() === SyntaxKind.PropertyAssignment) {
-      return p.getName() === "static";
-    }
-    return false;
-  });
-  if (!staticProp || staticProp.getKind() !== SyntaxKind.PropertyAssignment) return [];
-  const init = staticProp.getInitializer();
+  const init = getProp(obj, "static");
   if (!init || init.getKind() !== SyntaxKind.ArrayLiteralExpression) return [];
-  const arrayLiteral = init;
-  return arrayLiteral.getElements().filter((e) => e.getKind() === SyntaxKind.StringLiteral).map((e) => e.asKindOrThrow(SyntaxKind.StringLiteral).getLiteralValue());
+  return init.asKindOrThrow(SyntaxKind.ArrayLiteralExpression).getElements().filter((e) => e.getKind() === SyntaxKind.StringLiteral).map((e) => e.asKindOrThrow(SyntaxKind.StringLiteral).getLiteralValue());
 };
 var extractRoutePatterns = (obj) => {
-  const routesProp = obj.getProperties().find((p) => {
-    if (p.getKind() === SyntaxKind.PropertyAssignment) {
-      return p.getName() === "routes";
-    }
-    return false;
-  });
-  if (!routesProp || routesProp.getKind() !== SyntaxKind.PropertyAssignment) return [];
-  const init = routesProp.getInitializer();
+  const init = getProp(obj, "routes");
   if (!init || init.getKind() !== SyntaxKind.ObjectLiteralExpression) return [];
-  const routesObj = init;
-  return routesObj.getProperties().map((p) => {
+  return init.getProperties().map((p) => {
     if (p.getKind() !== SyntaxKind.PropertyAssignment) return "";
     const nameNode = p.getNameNode();
     if (nameNode.getKind() === SyntaxKind.StringLiteral) {
@@ -4143,6 +4280,30 @@ var extractRoutePatterns = (obj) => {
     return nameNode.getText();
   }).filter(Boolean);
 };
+var extractAuthConfigFromCall = (callExpr) => {
+  if (bareName(callExpr.getExpression().getText()) !== "defineAuth") return void 0;
+  const firstArg = callExpr.getArguments()[0];
+  if (!firstArg || firstArg.getKind() !== SyntaxKind.ObjectLiteralExpression) return void 0;
+  try {
+    return new Function(`return ${firstArg.getText()}`)();
+  } catch {
+    return void 0;
+  }
+};
+var extractAuthConfig = (obj, sourceFile) => {
+  const init = getProp(obj, "auth");
+  if (!init) return void 0;
+  if (init.getKind() === SyntaxKind.CallExpression) {
+    return extractAuthConfigFromCall(init);
+  }
+  if (init.getKind() === SyntaxKind.Identifier) {
+    const varInit = sourceFile.getVariableDeclaration(init.getText())?.getInitializer();
+    if (varInit?.getKind() === SyntaxKind.CallExpression) {
+      return extractAuthConfigFromCall(varInit);
+    }
+  }
+  return void 0;
+};
 var handlerRegistry = {
   table: {
     defineFn: "defineTable",
@@ -4190,96 +4351,49 @@ var handlerRegistry = {
 var extractHandlerConfigs = (source, type) => {
   const { defineFn, handlerProps } = handlerRegistry[type];
   const sourceFile = parseSource(source);
-  const results = [];
-  const exportDefault = sourceFile.getExportAssignment((e) => !e.isExportEquals());
-  if (exportDefault) {
-    const expr = exportDefault.getExpression();
-    if (expr.getKind() === SyntaxKind.CallExpression) {
-      const callExpr = expr.asKindOrThrow(SyntaxKind.CallExpression);
-      if (callExpr.getExpression().getText() === defineFn) {
-        const args = callExpr.getArguments();
-        const firstArg = args[0];
-        if (firstArg && firstArg.getKind() === SyntaxKind.ObjectLiteralExpression) {
-          const objLiteral = firstArg;
-          const configText = buildConfigWithoutRuntime(objLiteral);
-          const config = evalConfig(configText, "default");
-          const hasHandler = handlerProps.some((p) => extractPropertyFromObject(objLiteral, p) !== void 0);
-          const depsKeys = extractDepsKeys(objLiteral);
-          const paramEntries = extractParamEntries(objLiteral);
-          const staticGlobs = extractStaticGlobs(objLiteral);
-          const routePatterns = extractRoutePatterns(objLiteral);
-          results.push({ exportName: "default", config, hasHandler, depsKeys, paramEntries, staticGlobs, routePatterns });
-        }
-      }
-    }
-  }
-  sourceFile.getVariableStatements().forEach((stmt) => {
-    if (!stmt.isExported()) return;
-    stmt.getDeclarations().forEach((decl) => {
-      const initializer = decl.getInitializer();
-      if (!initializer || initializer.getKind() !== SyntaxKind.CallExpression) return;
-      const callExpr = initializer.asKindOrThrow(SyntaxKind.CallExpression);
-      if (callExpr.getExpression().getText() !== defineFn) return;
-      const args = callExpr.getArguments();
-      const firstArg = args[0];
-      if (firstArg && firstArg.getKind() === SyntaxKind.ObjectLiteralExpression) {
-        const objLiteral = firstArg;
-        const configText = buildConfigWithoutRuntime(objLiteral);
-        const exportName = decl.getName();
-        const config = evalConfig(configText, exportName);
-        const hasHandler = handlerProps.some((p) => extractPropertyFromObject(objLiteral, p) !== void 0);
-        const depsKeys = extractDepsKeys(objLiteral);
-        const paramEntries = extractParamEntries(objLiteral);
-        const staticGlobs = extractStaticGlobs(objLiteral);
-        const routePatterns = extractRoutePatterns(objLiteral);
-        results.push({ exportName, config, hasHandler, depsKeys, paramEntries, staticGlobs, routePatterns });
-      }
-    });
+  return findDefineCalls(sourceFile, defineFn).map(({ exportName, args }) => {
+    const config = evalConfig(buildConfigWithoutRuntime(args), exportName);
+    const hasHandler = handlerProps.some((p) => getProp(args, p) !== void 0);
+    const authCfg = extractAuthConfig(args, sourceFile);
+    return {
+      exportName,
+      config,
+      hasHandler,
+      depsKeys: extractDepsKeys(args),
+      secretEntries: extractSecretEntries(args),
+      staticGlobs: extractStaticGlobs(args),
+      routePatterns: extractRoutePatterns(args),
+      ...authCfg ? { authConfig: authCfg } : {}
+    };
   });
-  return results;
 };
 var generateMiddlewareEntryPoint = (source, runtimeDir2) => {
   const sourceFile = parseSource(source);
-  const imports = sourceFile.getImportDeclarations().map((d) => d.getText()).join("\n");
-  const defineFn = handlerRegistry.staticSite.defineFn;
+  const calls = findDefineCalls(sourceFile, handlerRegistry.staticSite.defineFn);
   let middlewareFnText;
   let exportName;
-  const exportDefault = sourceFile.getExportAssignment((e) => !e.isExportEquals());
-  if (exportDefault) {
-    const expr = exportDefault.getExpression();
-    if (expr.getKind() === SyntaxKind.CallExpression) {
-      const callExpr = expr.asKindOrThrow(SyntaxKind.CallExpression);
-      if (callExpr.getExpression().getText() === defineFn) {
-        const args = callExpr.getArguments();
-        const firstArg = args[0];
-        if (firstArg?.getKind() === SyntaxKind.ObjectLiteralExpression) {
-          middlewareFnText = extractPropertyFromObject(firstArg, "middleware");
-          exportName = "default";
-        }
-      }
+  for (const call of calls) {
+    const mw = getProp(call.args, "middleware")?.getText();
+    if (mw) {
+      middlewareFnText = mw;
+      exportName = call.exportName;
+      break;
     }
   }
-  if (!middlewareFnText) {
-    sourceFile.getVariableStatements().forEach((stmt) => {
-      if (middlewareFnText || !stmt.isExported()) return;
-      stmt.getDeclarations().forEach((decl) => {
-        if (middlewareFnText) return;
-        const init = decl.getInitializer();
-        if (!init || init.getKind() !== SyntaxKind.CallExpression) return;
-        const callExpr = init.asKindOrThrow(SyntaxKind.CallExpression);
-        if (callExpr.getExpression().getText() !== defineFn) return;
-        const args = callExpr.getArguments();
-        const firstArg = args[0];
-        if (firstArg?.getKind() === SyntaxKind.ObjectLiteralExpression) {
-          middlewareFnText = extractPropertyFromObject(firstArg, "middleware");
-          exportName = decl.getName();
-        }
-      });
-    });
-  }
   if (!middlewareFnText || !exportName) {
     throw new Error("Could not extract middleware function from source");
   }
+  const imports = sourceFile.getImportDeclarations().filter((d) => {
+    const defaultImport = d.getDefaultImport()?.getText();
+    if (defaultImport && middlewareFnText.includes(defaultImport)) return true;
+    for (const spec of d.getNamedImports()) {
+      const alias = spec.getAliasNode()?.getText() ?? spec.getName();
+      if (middlewareFnText.includes(alias)) return true;
+    }
+    const ns = d.getNamespaceImport()?.getText();
+    if (ns && middlewareFnText.includes(ns)) return true;
+    return false;
+  }).map((d) => d.getText()).join("\n");
   const wrapperPath = runtimeDir2 ? handlerRegistry.staticSite.wrapperPath.replace("~/runtime", runtimeDir2) : handlerRegistry.staticSite.wrapperPath;
   const entryPoint = `${imports}
 import { wrapMiddlewareFn } from "${wrapperPath}";
@@ -4300,6 +4414,7 @@ export const handler = ${wrapperFn}(${importName});
 };
 
 // src/build/bundle.ts
+var AUTH_COOKIE_NAME = "__eff_session";
 var extractTableConfigs = (source) => extractHandlerConfigs(source, "table");
 var extractAppConfigs = (source) => extractHandlerConfigs(source, "app");
 var extractStaticSiteConfigs = (source) => extractHandlerConfigs(source, "staticSite");
@@ -4316,7 +4431,9 @@ var bundle = (input) => Effect24.gen(function* () {
   const sourcePath = path3.isAbsolute(input.file) ? input.file : `./${input.file}`;
   const entryPoint = generateEntryPoint(sourcePath, exportName, type, runtimeDir);
   const awsExternals = ["@aws-sdk/*", "@smithy/*"];
-  const allExternals = [.../* @__PURE__ */ new Set([...awsExternals, ...externals])];
+  const nodeExternals = builtinModules.flatMap((m) => [m, `node:${m}`]);
+  const allExternals = [.../* @__PURE__ */ new Set([...awsExternals, ...nodeExternals, ...externals])];
+  const format = input.format ?? "esm";
   const result = yield* Effect24.tryPromise({
     try: () => esbuild.build({
       stdin: {
@@ -4330,8 +4447,11 @@ var bundle = (input) => Effect24.gen(function* () {
       write: false,
       minify: false,
       sourcemap: false,
-      format: input.format ?? "esm",
-      external: allExternals
+      format,
+      external: allExternals,
+      metafile: true,
+      // CJS packages bundled into ESM need a `require` function for Node.js builtins
+      ...format === "esm" ? { banner: { js: "import { createRequire } from 'module'; const require = createRequire(import.meta.url);" } } : {}
     }),
     catch: (error) => new Error(`esbuild failed: ${error}`)
   });
@@ -4339,8 +4459,32 @@ var bundle = (input) => Effect24.gen(function* () {
   if (!output) {
     throw new Error("esbuild produced no output");
   }
-  return output.text;
+  const bundleResult = { code: output.text };
+  if (result.metafile) {
+    bundleResult.topModules = analyzeMetafile(result.metafile);
+  }
+  return bundleResult;
 });
+var analyzeMetafile = (metafile) => {
+  const packageSizes = /* @__PURE__ */ new Map();
+  for (const [filePath, info] of Object.entries(metafile.inputs)) {
+    const nodeModIdx = filePath.lastIndexOf("node_modules/");
+    let key;
+    if (nodeModIdx !== -1) {
+      const afterNm = filePath.slice(nodeModIdx + "node_modules/".length);
+      if (afterNm.startsWith("@")) {
+        const parts = afterNm.split("/");
+        key = `${parts[0]}/${parts[1]}`;
+      } else {
+        key = afterNm.split("/")[0];
+      }
+    } else {
+      key = "<project>";
+    }
+    packageSizes.set(key, (packageSizes.get(key) ?? 0) + info.bytes);
+  }
+  return Array.from(packageSizes.entries()).map(([p, bytes]) => ({ path: p, bytes })).sort((a, b) => b.bytes - a.bytes);
+};
 var bundleMiddleware = (input) => Effect24.gen(function* () {
   const absFile = path3.isAbsolute(input.file) ? input.file : path3.resolve(input.projectDir, input.file);
   const source = fsSync2.readFileSync(absFile, "utf-8");
@@ -4371,6 +4515,106 @@ var bundleMiddleware = (input) => Effect24.gen(function* () {
   }
   return output.text;
 });
+var bundleAuthMiddleware = (input) => Effect24.gen(function* () {
+  const { authConfig, secret } = input;
+  const loginPath = authConfig.loginPath;
+  const publicPatterns = authConfig.public ?? [];
+  const entryPoint = `
+import { createHmac } from "crypto";
+
+const SECRET = ${JSON.stringify(secret)};
+const LOGIN_PATH = ${JSON.stringify(loginPath)};
+const PUBLIC = ${JSON.stringify(publicPatterns)};
+const COOKIE = ${JSON.stringify(AUTH_COOKIE_NAME)};
+
+const isPublic = (uri) => {
+  for (const p of PUBLIC) {
+    if (p.endsWith("/*")) {
+      if (uri.startsWith(p.slice(0, -1))) return true;
+    } else if (p.endsWith("*")) {
+      if (uri.startsWith(p.slice(0, -1))) return true;
+    } else {
+      if (uri === p) return true;
+    }
+  }
+  return false;
+};
+
+const verify = (cookie) => {
+  if (!cookie) return false;
+  const dot = cookie.indexOf(".");
+  if (dot === -1) return false;
+  const payload = cookie.slice(0, dot);
+  const sig = cookie.slice(dot + 1);
+  const expected = createHmac("sha256", SECRET).update(payload).digest("base64url");
+  if (sig !== expected) return false;
+  try {
+    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf-8"));
+    return data.exp > Math.floor(Date.now() / 1000);
+  } catch { return false; }
+};
+
+const parseCookies = (headers) => {
+  const cookies = {};
+  const cookieHeaders = headers.cookie;
+  if (!cookieHeaders) return cookies;
+  for (const { value } of cookieHeaders) {
+    for (const pair of value.split(";")) {
+      const eq = pair.indexOf("=");
+      if (eq === -1) continue;
+      const name = pair.slice(0, eq).trim();
+      const val = pair.slice(eq + 1).trim();
+      if (name) cookies[name] = val;
+    }
+  }
+  return cookies;
+};
+
+const rewrite = (uri) => {
+  if (uri.endsWith("/")) return uri + "index.html";
+  if (!uri.includes(".")) return uri + "/index.html";
+  return uri;
+};
+
+export const handler = async (event) => {
+  const req = event.Records[0].cf.request;
+
+  if (isPublic(req.uri)) {
+    req.uri = rewrite(req.uri);
+    return req;
+  }
+
+  const cookies = parseCookies(req.headers);
+  if (verify(cookies[COOKIE])) {
+    req.uri = rewrite(req.uri);
+    return req;
+  }
+
+  return {
+    status: "302",
+    statusDescription: "Found",
+    headers: { location: [{ key: "Location", value: LOGIN_PATH }] },
+  };
+};
+`;
+  const result = yield* Effect24.tryPromise({
+    try: () => esbuild.build({
+      stdin: { contents: entryPoint, loader: "js", resolveDir: process.cwd() },
+      bundle: true,
+      platform: "node",
+      target: "node22",
+      write: false,
+      minify: true,
+      sourcemap: false,
+      format: "esm",
+      external: ["crypto"]
+    }),
+    catch: (error) => new Error(`esbuild failed (auth middleware): ${error}`)
+  });
+  const output = result.outputFiles?.[0];
+  if (!output) throw new Error("esbuild produced no output for auth middleware");
+  return output.text;
+});
 var FIXED_DATE2 = /* @__PURE__ */ new Date(0);
 var zip = (input) => Effect24.async((resume) => {
   const chunks = [];
@@ -4470,21 +4714,25 @@ var flattenHandlers = (discovered) => {
   ];
 };
 
+// src/deploy/deploy.ts
+import * as crypto5 from "crypto";
+
 // src/deploy/resolve-config.ts
 import { Effect as Effect25 } from "effect";
-var collectRequiredParams = (handlers, project, stage) => {
+var collectRequiredSecrets = (handlers, project, stage) => {
   const seen = /* @__PURE__ */ new Map();
   const collect = (handlerGroups) => {
     for (const { exports } of handlerGroups) {
       for (const fn13 of exports) {
-        for (const { propName, ssmKey } of fn13.paramEntries) {
+        for (const { propName, ssmKey, generate } of fn13.secretEntries) {
           const ssmPath = `/${project}/${stage}/${ssmKey}`;
           if (!seen.has(ssmPath)) {
             seen.set(ssmPath, {
               ssmPath,
               propName,
               ssmKey,
-              handlerName: fn13.exportName
+              handlerName: fn13.exportName,
+              ...generate ? { generate } : {}
             });
           }
         }
@@ -4497,11 +4745,34 @@ var collectRequiredParams = (handlers, project, stage) => {
   collect(handlers.apiHandlers);
   return Array.from(seen.values());
 };
-var checkMissingParams = (params) => Effect25.gen(function* () {
-  if (params.length === 0) return { existing: [], missing: [] };
+var AUTH_SSM_KEY = "_auth-secret";
+var collectAuthSecret = (handlers, project, stage) => {
+  const hasAuth = (groups) => groups.some((g) => g.exports.some((fn13) => fn13.authConfig));
+  if (hasAuth(handlers.apiHandlers) || hasAuth(handlers.staticSiteHandlers)) {
+    return {
+      ssmPath: `/${project}/${stage}/${AUTH_SSM_KEY}`,
+      propName: "_authSecret",
+      ssmKey: AUTH_SSM_KEY,
+      handlerName: "_auth",
+      generate: { type: "hex", bytes: 32 }
+    };
+  }
+  return void 0;
+};
+var fetchAuthSecretValue = (ssmPath) => Effect25.gen(function* () {
+  const result = yield* ssm_exports.make("get_parameters", {
+    Names: [ssmPath],
+    WithDecryption: true
+  });
+  const value = result.Parameters?.[0]?.Value;
+  if (!value) throw new Error(`Auth secret not found at ${ssmPath}`);
+  return value;
+});
+var checkMissingSecrets = (secrets) => Effect25.gen(function* () {
+  if (secrets.length === 0) return { existing: [], missing: [] };
   const existingNames = /* @__PURE__ */ new Set();
-  for (let i = 0; i < params.length; i += 10) {
-    const batch = params.slice(i, i + 10);
+  for (let i = 0; i < secrets.length; i += 10) {
+    const batch = secrets.slice(i, i + 10);
     const result = yield* ssm_exports.make("get_parameters", {
       Names: batch.map((p) => p.ssmPath),
       WithDecryption: false
@@ -4512,7 +4783,7 @@ var checkMissingParams = (params) => Effect25.gen(function* () {
   }
   const existing = [];
   const missing = [];
-  for (const p of params) {
+  for (const p of secrets) {
     if (existingNames.has(p.ssmPath)) {
       existing.push(p);
     } else {
@@ -4530,6 +4801,12 @@ import { toSeconds } from "effortless-aws";
 import { Effect as Effect26 } from "effect";
 import * as fs3 from "fs/promises";
 import * as path4 from "path";
+var formatBytes = (bytes) => {
+  if (bytes < 1024) return `${bytes}B`;
+  const kb = bytes / 1024;
+  if (kb < 1024) return `${kb.toFixed(1)}KB`;
+  return `${(kb / 1024).toFixed(2)}MB`;
+};
 var readSource = (input) => Effect26.gen(function* () {
   if ("code" in input && typeof input.code === "string") {
     return input.code;
@@ -4542,10 +4819,11 @@ var ensureLayerAndExternal = (input) => Effect26.gen(function* () {
     project: input.project,
     stage: input.stage,
     region: input.region,
-    projectDir: input.packageDir
+    projectDir: input.packageDir,
+    extraNodeModules: input.extraNodeModules
   });
   const prodDeps = layerResult ? yield* readProductionDependencies(input.packageDir) : [];
-  const { packages: external, warnings: layerWarnings } = prodDeps.length > 0 ? yield* Effect26.sync(() => collectLayerPackages(input.packageDir, prodDeps)) : { packages: [], warnings: [] };
+  const { packages: external, warnings: layerWarnings } = prodDeps.length > 0 ? yield* Effect26.sync(() => collectLayerPackages(input.packageDir, prodDeps, input.extraNodeModules)) : { packages: [], warnings: [] };
   for (const warning of layerWarnings) {
     yield* Effect26.logWarning(`[layer] ${warning}`);
   }
@@ -4590,14 +4868,21 @@ var deployCoreLambda = ({
     mergedPermissions.length > 0 ? mergedPermissions : void 0,
     makeTags(tagCtx, "iam-role")
   );
-  const bundled = yield* bundle({
+  const bundleResult = yield* bundle({
     ...input,
     exportName,
     ...bundleType ? { type: bundleType } : {},
     ...external && external.length > 0 ? { external } : {}
   });
   const staticFiles = staticGlobs && staticGlobs.length > 0 ? resolveStaticFiles(staticGlobs, input.projectDir) : void 0;
-  const code = yield* zip({ content: bundled, staticFiles });
+  const bundleSize = Buffer.byteLength(bundleResult.code, "utf-8");
+  if (bundleResult.topModules && bundleSize > 500 * 1024) {
+    const top = bundleResult.topModules.slice(0, 10);
+    const lines = top.map((m) => `  ${formatBytes(m.bytes).padStart(8)}  ${m.path}`).join("\n");
+    yield* Effect26.logWarning(`Bundle "${handlerName}" is ${formatBytes(bundleSize)} \u2014 top modules:
+${lines}`);
+  }
+  const code = yield* zip({ content: bundleResult.code, staticFiles });
   const environment = {
     EFF_PROJECT: input.project,
     EFF_STAGE: tagCtx.stage,
@@ -4617,7 +4902,7 @@ var deployCoreLambda = ({
     ...layerArn ? { layers: [layerArn] } : {},
     environment
   });
-  return { functionArn, status, tagCtx };
+  return { functionArn, status, tagCtx, bundleSize };
 });
 
 // src/deploy/deploy-table.ts
@@ -4639,7 +4924,7 @@ var deployTableFunction = ({ input, fn: fn13, layerArn, external, depsEnv, depsP
     tags: makeTags(tagCtx, "dynamodb")
   });
   const selfEnv = { EFF_DEP_SELF: `table:${tableName}`, ...depsEnv };
-  const { functionArn, status } = yield* deployCoreLambda({
+  const { functionArn, status, bundleSize } = yield* deployCoreLambda({
     input,
     exportName,
     handlerName,
@@ -4667,6 +4952,7 @@ var deployTableFunction = ({ input, fn: fn13, layerArn, external, depsEnv, depsP
     exportName,
     functionArn,
     status,
+    bundleSize,
     tableArn,
     streamArn
   };
@@ -4683,7 +4969,8 @@ var deployTable = (input) => Effect27.gen(function* () {
     project: input.project,
     stage: resolveStage(input.stage),
     region: input.region,
-    packageDir: input.packageDir ?? input.projectDir
+    packageDir: input.packageDir ?? input.projectDir,
+    extraNodeModules: input.extraNodeModules
   });
   const result = yield* deployTableFunction({
     input,
@@ -4712,7 +4999,8 @@ var deployAllTables = (input) => Effect27.gen(function* () {
     project: input.project,
     stage: resolveStage(input.stage),
     region: input.region,
-    packageDir: input.packageDir ?? input.projectDir
+    packageDir: input.packageDir ?? input.projectDir,
+    extraNodeModules: input.extraNodeModules
   });
   const results = yield* Effect27.forEach(
     functions,
@@ -4741,7 +5029,7 @@ import { toSeconds as toSeconds2 } from "effortless-aws";
 var deployApiFunction = ({ input, fn: fn13, layerArn, external, depsEnv, depsPermissions, staticGlobs }) => Effect28.gen(function* () {
   const { exportName, config } = fn13;
   const handlerName = exportName;
-  const { functionArn, status } = yield* deployCoreLambda({
+  const { functionArn, status, bundleSize } = yield* deployCoreLambda({
     input,
     exportName,
     handlerName,
@@ -4755,7 +5043,7 @@ var deployApiFunction = ({ input, fn: fn13, layerArn, external, depsEnv, depsPer
     ...depsPermissions ? { depsPermissions } : {},
     ...staticGlobs && staticGlobs.length > 0 ? { staticGlobs } : {}
   });
-  return { exportName, functionArn, status, config, handlerName };
+  return { exportName, functionArn, status, bundleSize, config, handlerName };
 });
 var deploy = (input) => Effect28.gen(function* () {
   const source = yield* readSource(input);
@@ -4776,7 +5064,8 @@ var deploy = (input) => Effect28.gen(function* () {
     project: input.project,
     stage: tagCtx.stage,
     region: input.region,
-    packageDir: input.packageDir ?? input.projectDir
+    packageDir: input.packageDir ?? input.projectDir,
+    extraNodeModules: input.extraNodeModules
   });
   const { functionArn } = yield* deployApiFunction({
     input,
@@ -5138,6 +5427,12 @@ var deployMiddlewareLambda = (input) => Effect31.gen(function* () {
     makeTags(tagCtx, "iam-role")
   );
   const bundled = yield* bundleMiddleware({ projectDir, file });
+  const bundleSizeKB = Math.round(bundled.length / 1024);
+  if (bundleSizeKB > 50) {
+    yield* Effect31.logWarning(
+      `[middleware] Bundle size is ${bundleSizeKB}KB (expected <50KB). Middleware may be pulling in unrelated dependencies via barrel imports. Use direct file imports instead (e.g. import { Auth } from "./core/auth" instead of "./core").`
+    );
+  }
   const code = yield* zip({ content: bundled });
   const { functionArn } = yield* ensureLambda({
     project,
@@ -5153,14 +5448,52 @@ var deployMiddlewareLambda = (input) => Effect31.gen(function* () {
   }).pipe(
     Effect31.provide(clients_exports.makeClients({ lambda: { region: "us-east-1" } }))
   );
-  const { versionArn } = yield* publishVersion(
-    `${project}-${stage}-${middlewareName}`
-  ).pipe(
+  const edgeFunctionName = `${project}-${stage}-${middlewareName}`;
+  yield* ensureEdgePermission(edgeFunctionName).pipe(
+    Effect31.provide(clients_exports.makeClients({ lambda: { region: "us-east-1" } }))
+  );
+  const { versionArn } = yield* publishVersion(edgeFunctionName).pipe(
     Effect31.provide(clients_exports.makeClients({ lambda: { region: "us-east-1" } }))
   );
   yield* Effect31.logDebug(`Middleware deployed: ${versionArn}`);
   return { versionArn };
 });
+var deployAuthMiddlewareLambda = (input) => Effect31.gen(function* () {
+  const { project, stage, handlerName, tagCtx, authConfig, authSecret } = input;
+  const middlewareName = `${handlerName}-middleware`;
+  yield* Effect31.logDebug(`Deploying auth middleware Lambda@Edge: ${middlewareName}`);
+  const roleArn = yield* ensureEdgeRole(
+    project,
+    stage,
+    middlewareName,
+    makeTags(tagCtx, "iam-role")
+  );
+  const bundled = yield* bundleAuthMiddleware({ authConfig, secret: authSecret });
+  const code = yield* zip({ content: bundled });
+  const edgeFunctionName = `${project}-${stage}-${middlewareName}`;
+  yield* ensureLambda({
+    project,
+    stage,
+    name: middlewareName,
+    region: "us-east-1",
+    roleArn,
+    code,
+    memory: 128,
+    timeout: 5,
+    architecture: Architecture3.x86_64,
+    tags: makeTags(tagCtx, "lambda")
+  }).pipe(
+    Effect31.provide(clients_exports.makeClients({ lambda: { region: "us-east-1" } }))
+  );
+  yield* ensureEdgePermission(edgeFunctionName).pipe(
+    Effect31.provide(clients_exports.makeClients({ lambda: { region: "us-east-1" } }))
+  );
+  const { versionArn } = yield* publishVersion(edgeFunctionName).pipe(
+    Effect31.provide(clients_exports.makeClients({ lambda: { region: "us-east-1" } }))
+  );
+  yield* Effect31.logDebug(`Auth middleware deployed: ${versionArn}`);
+  return { versionArn };
+});
 var ERROR_PAGE_KEY = "_effortless/404.html";
 var generateErrorPageHtml = () => `<!DOCTYPE html>
 <html lang="en">
@@ -5265,7 +5598,20 @@ var deployStaticSite = (input) => Effect31.gen(function* () {
   const isSpa = config.spa ?? false;
   let urlRewriteFunctionArn;
   let lambdaEdgeArn;
-  if (hasMiddleware && input.file) {
+  const hasAuth = !!(input.authSecret && input.authConfig);
+  if (hasAuth) {
+    const authResult = yield* deployAuthMiddlewareLambda({
+      project,
+      stage,
+      handlerName,
+      tagCtx,
+      authConfig: input.authConfig,
+      authSecret: input.authSecret
+    }).pipe(
+      Effect31.provide(clients_exports.makeClients({ iam: { region: "us-east-1" } }))
+    );
+    lambdaEdgeArn = authResult.versionArn;
+  } else if (hasMiddleware && input.file) {
     const result = yield* deployMiddlewareLambda({
       projectDir,
       project,
@@ -5395,7 +5741,7 @@ var deployFifoQueueFunction = ({ input, fn: fn13, layerArn, external, depsEnv, d
     EFF_QUEUE_ARN: queueArn,
     ...depsEnv
   };
-  const { functionArn, status } = yield* deployCoreLambda({
+  const { functionArn, status, bundleSize } = yield* deployCoreLambda({
     input,
     exportName,
     handlerName,
@@ -5422,6 +5768,7 @@ var deployFifoQueueFunction = ({ input, fn: fn13, layerArn, external, depsEnv, d
     exportName,
     functionArn,
     status,
+    bundleSize,
     queueUrl,
     queueArn
   };
@@ -5456,7 +5803,7 @@ var deployBucketFunction = ({ input, fn: fn13, layerArn, external, depsEnv, deps
     };
   }
   const selfEnv = { EFF_DEP_SELF: `bucket:${bucketName}`, ...depsEnv };
-  const { functionArn, status } = yield* deployCoreLambda({
+  const { functionArn, status, bundleSize } = yield* deployCoreLambda({
     input,
     exportName,
     handlerName,
@@ -5484,6 +5831,7 @@ var deployBucketFunction = ({ input, fn: fn13, layerArn, external, depsEnv, deps
     exportName,
     functionArn,
     status,
+    bundleSize,
     bucketName,
     bucketArn
   };
@@ -5564,10 +5912,17 @@ var createLiveProgress = (manifest) => {
     const sec = ((Date.now() - startTime) / 1e3).toFixed(1);
     return c.dim(`${sec}s`);
   };
-  return (name, type, status) => Effect35.sync(() => {
+  const formatSize = (bytes) => {
+    if (bytes < 1024) return `${bytes}B`;
+    const kb = bytes / 1024;
+    if (kb < 1024) return `${kb.toFixed(0)}KB`;
+    return `${(kb / 1024).toFixed(1)}MB`;
+  };
+  return (name, type, status, bundleSize) => Effect35.sync(() => {
     const key = `${name}:${type}`;
     results.set(key, status);
-    const line = `  ${name} ${c.dim(`(${type})`)} ${statusLabel(status)} ${formatDuration()}`;
+    const sizeInfo = bundleSize ? ` ${c.dim(formatSize(bundleSize))}` : "";
+    const line = `  ${name} ${c.dim(`(${type})`)} ${statusLabel(status)}${sizeInfo} ${formatDuration()}`;
     if (isTTY) {
       const idx = lineIndex.get(key) ?? 0;
       const up = manifest.length - idx;
@@ -5576,7 +5931,7 @@ var createLiveProgress = (manifest) => {
         clearInterval(timer);
       }
     } else {
-      process.stdout.write(`  ${c.dim(`[${results.size}/${manifest.length}]`)} ${name} ${c.dim(`(${type})`)} ${statusLabel(status)} ${formatDuration()}
+      process.stdout.write(`  ${c.dim(`[${results.size}/${manifest.length}]`)} ${name} ${c.dim(`(${type})`)} ${statusLabel(status)}${sizeInfo} ${formatDuration()}
 `);
     }
   });
@@ -5587,7 +5942,8 @@ var prepareLayer = (input) => Effect35.gen(function* () {
     project: input.project,
     stage: input.stage,
     region: input.region,
-    projectDir: input.packageDir
+    projectDir: input.packageDir,
+    extraNodeModules: input.extraNodeModules
   }).pipe(
     Effect35.provide(
       clients_exports.makeClients({
@@ -5596,7 +5952,7 @@ var prepareLayer = (input) => Effect35.gen(function* () {
     )
   );
   const prodDeps = layerResult ? yield* readProductionDependencies(input.packageDir) : [];
-  const { packages: external, warnings: layerWarnings } = prodDeps.length > 0 ? yield* Effect35.sync(() => collectLayerPackages(input.packageDir, prodDeps)) : { packages: [], warnings: [] };
+  const { packages: external, warnings: layerWarnings } = prodDeps.length > 0 ? yield* Effect35.sync(() => collectLayerPackages(input.packageDir, prodDeps, input.extraNodeModules)) : { packages: [], warnings: [] };
   for (const warning of layerWarnings) {
     yield* Effect35.logWarning(`[layer] ${warning}`);
   }
@@ -5742,10 +6098,20 @@ var SSM_PERMISSIONS = [
   "ssm:GetParameter",
   "ssm:GetParameters"
 ];
-var resolveParams = (paramEntries, project, stage) => {
-  if (paramEntries.length === 0) return void 0;
+var executeGenerateSpec = (spec) => {
+  switch (spec.type) {
+    case "hex":
+      return crypto5.randomBytes(spec.bytes).toString("hex");
+    case "base64":
+      return crypto5.randomBytes(spec.bytes).toString("base64url");
+    case "uuid":
+      return crypto5.randomUUID();
+  }
+};
+var resolveSecrets = (secretEntries, project, stage) => {
+  if (secretEntries.length === 0) return void 0;
   const paramsEnv = {};
-  for (const { propName, ssmKey } of paramEntries) {
+  for (const { propName, ssmKey } of secretEntries) {
     paramsEnv[`EFF_PARAM_${propName}`] = `/${project}/${stage}/${ssmKey}`;
   }
   return { paramsEnv, paramsPermissions: SSM_PERMISSIONS };
@@ -5764,10 +6130,10 @@ var makeDeployInput = (ctx, file) => ({
   region: ctx.input.region,
   ...ctx.input.stage ? { stage: ctx.input.stage } : {}
 });
-var resolveHandlerEnv = (depsKeys, paramEntries, ctx) => {
+var resolveHandlerEnv = (depsKeys, secretEntries, ctx) => {
   const resolved = mergeResolved(
     resolveDeps(depsKeys, ctx.tableNameMap, ctx.bucketNameMap, ctx.mailerDomainMap, ctx.queueNameMap),
-    resolveParams(paramEntries, ctx.input.project, ctx.stage)
+    resolveSecrets(secretEntries, ctx.input.project, ctx.stage)
   );
   return {
     depsEnv: resolved?.depsEnv ?? {},
@@ -5781,7 +6147,7 @@ var buildTableTasks = (ctx, handlers, results) => {
     for (const fn13 of exports) {
       tasks.push(
         Effect35.gen(function* () {
-          const env = resolveHandlerEnv(fn13.depsKeys, fn13.paramEntries, ctx);
+          const env = resolveHandlerEnv(fn13.depsKeys, fn13.secretEntries, ctx);
           const result = yield* deployTableFunction({
             input: makeDeployInput(ctx, file),
             fn: fn13,
@@ -5792,7 +6158,7 @@ var buildTableTasks = (ctx, handlers, results) => {
             ...fn13.staticGlobs.length > 0 ? { staticGlobs: fn13.staticGlobs } : {}
           }).pipe(Effect35.provide(clients_exports.makeClients({ lambda: { region }, iam: { region }, dynamodb: { region } })));
           results.push(result);
-          yield* ctx.logComplete(fn13.exportName, "table", result.status);
+          yield* ctx.logComplete(fn13.exportName, "table", result.status, result.bundleSize);
         })
       );
     }
@@ -5837,6 +6203,12 @@ var buildStaticSiteTasks = (ctx, handlers, results, apiOriginDomain) => {
     for (const fn13 of exports) {
       tasks.push(
         Effect35.gen(function* () {
+          let authSecretValue;
+          if (fn13.authConfig && ctx.authSecretPath) {
+            authSecretValue = yield* fetchAuthSecretValue(ctx.authSecretPath).pipe(
+              Effect35.provide(clients_exports.makeClients({ ssm: { region: ctx.input.region } }))
+            );
+          }
           const result = yield* deployStaticSite({
             projectDir: ctx.input.projectDir,
             project: ctx.input.project,
@@ -5845,7 +6217,8 @@ var buildStaticSiteTasks = (ctx, handlers, results, apiOriginDomain) => {
             fn: fn13,
             verbose: ctx.input.verbose,
             ...fn13.hasHandler ? { file } : {},
-            ...apiOriginDomain ? { apiOriginDomain } : {}
+            ...apiOriginDomain ? { apiOriginDomain } : {},
+            ...authSecretValue && fn13.authConfig ? { authSecret: authSecretValue, authConfig: fn13.authConfig } : {}
           }).pipe(Effect35.provide(clients_exports.makeClients({
             s3: { region },
             cloudfront: { region: "us-east-1" },
@@ -5867,7 +6240,7 @@ var buildFifoQueueTasks = (ctx, handlers, results) => {
     for (const fn13 of exports) {
       tasks.push(
         Effect35.gen(function* () {
-          const env = resolveHandlerEnv(fn13.depsKeys, fn13.paramEntries, ctx);
+          const env = resolveHandlerEnv(fn13.depsKeys, fn13.secretEntries, ctx);
           const result = yield* deployFifoQueueFunction({
             input: makeDeployInput(ctx, file),
             fn: fn13,
@@ -5878,7 +6251,7 @@ var buildFifoQueueTasks = (ctx, handlers, results) => {
             ...fn13.staticGlobs.length > 0 ? { staticGlobs: fn13.staticGlobs } : {}
           }).pipe(Effect35.provide(clients_exports.makeClients({ lambda: { region }, iam: { region }, sqs: { region } })));
           results.push(result);
-          yield* ctx.logComplete(fn13.exportName, "queue", result.status);
+          yield* ctx.logComplete(fn13.exportName, "queue", result.status, result.bundleSize);
         })
       );
     }
@@ -5892,7 +6265,7 @@ var buildBucketTasks = (ctx, handlers, results) => {
     for (const fn13 of exports) {
       tasks.push(
         Effect35.gen(function* () {
-          const env = resolveHandlerEnv(fn13.depsKeys, fn13.paramEntries, ctx);
+          const env = resolveHandlerEnv(fn13.depsKeys, fn13.secretEntries, ctx);
           const result = yield* deployBucketFunction({
             input: makeDeployInput(ctx, file),
             fn: fn13,
@@ -5904,7 +6277,7 @@ var buildBucketTasks = (ctx, handlers, results) => {
           }).pipe(Effect35.provide(clients_exports.makeClients({ lambda: { region }, iam: { region }, s3: { region } })));
           results.push(result);
           const status = result.status === "resource-only" ? "created" : result.status;
-          yield* ctx.logComplete(fn13.exportName, "bucket", status);
+          yield* ctx.logComplete(fn13.exportName, "bucket", status, result.bundleSize);
         })
       );
     }
@@ -5939,8 +6312,12 @@ var buildApiTasks = (ctx, handlers, results) => {
     for (const fn13 of exports) {
       tasks.push(
         Effect35.gen(function* () {
-          const env = resolveHandlerEnv(fn13.depsKeys, fn13.paramEntries, ctx);
-          const { exportName, functionArn, status, handlerName } = yield* deployApiFunction({
+          const env = resolveHandlerEnv(fn13.depsKeys, fn13.secretEntries, ctx);
+          if (fn13.authConfig && ctx.authSecretPath) {
+            env.depsEnv["EFF_AUTH_SECRET"] = ctx.authSecretPath;
+            env.depsPermissions = [...env.depsPermissions, "ssm:GetParameter", "ssm:GetParameters"];
+          }
+          const { exportName, functionArn, status, bundleSize, handlerName } = yield* deployApiFunction({
             input: makeDeployInput(ctx, file),
             fn: fn13,
             ...ctx.layerArn ? { layerArn: ctx.layerArn } : {},
@@ -5957,7 +6334,7 @@ var buildApiTasks = (ctx, handlers, results) => {
             Effect35.provide(clients_exports.makeClients({ lambda: { region } }))
           );
           results.push({ exportName, url: functionUrl, functionArn });
-          yield* ctx.logComplete(exportName, "api", status);
+          yield* ctx.logComplete(exportName, "api", status, bundleSize);
         })
       );
     }
@@ -5994,16 +6371,33 @@ var deployProject = (input) => Effect35.gen(function* () {
   yield* Console2.log(`
   ${c.dim("Handlers:")} ${parts.join(", ")}`);
   const discovered = { tableHandlers, appHandlers, staticSiteHandlers, fifoQueueHandlers, bucketHandlers, mailerHandlers, apiHandlers };
-  const requiredParams = collectRequiredParams(discovered, input.project, stage);
-  if (requiredParams.length > 0) {
-    const { missing } = yield* checkMissingParams(requiredParams).pipe(
+  const requiredSecrets = collectRequiredSecrets(discovered, input.project, stage);
+  const authSecret = collectAuthSecret(discovered, input.project, stage);
+  if (authSecret) requiredSecrets.push(authSecret);
+  if (requiredSecrets.length > 0) {
+    const { missing } = yield* checkMissingSecrets(requiredSecrets).pipe(
       Effect35.provide(clients_exports.makeClients({ ssm: { region: input.region } }))
     );
-    if (missing.length > 0) {
+    const withGenerators = missing.filter((m) => m.generate);
+    const manualOnly = missing.filter((m) => !m.generate);
+    if (withGenerators.length > 0) {
+      for (const entry of withGenerators) {
+        const value = executeGenerateSpec(entry.generate);
+        yield* ssm_exports.make("put_parameter", {
+          Name: entry.ssmPath,
+          Value: value,
+          Type: "SecureString"
+        }).pipe(Effect35.provide(clients_exports.makeClients({ ssm: { region: input.region } })));
+        yield* Effect35.logDebug(`Auto-created SSM parameter: ${entry.ssmPath}`);
+      }
       yield* Console2.log(`
-  ${c.yellow("\u26A0")} Missing ${missing.length} SSM parameter(s):
+  ${c.green("\u2713")} Auto-created ${withGenerators.length} secret(s)`);
+    }
+    if (manualOnly.length > 0) {
+      yield* Console2.log(`
+  ${c.yellow("\u26A0")} Missing ${manualOnly.length} SSM parameter(s):
 `);
-      for (const p of missing) {
+      for (const p of manualOnly) {
         yield* Console2.log(`    ${c.dim(p.handlerName)} \u2192 ${c.yellow(p.ssmPath)}`);
       }
       yield* Console2.log(`
@@ -6027,7 +6421,8 @@ var deployProject = (input) => Effect35.gen(function* () {
     project: input.project,
     stage,
     region: input.region,
-    packageDir: input.packageDir ?? input.projectDir
+    packageDir: input.packageDir ?? input.projectDir,
+    extraNodeModules: input.extraNodeModules
   }) : { layerArn: void 0, layerVersion: void 0, layerStatus: void 0, external: [] };
   if (layerArn && layerStatus) {
     const status = layerStatus === "cached" ? c.dim("cached") : c.green("created");
@@ -6062,7 +6457,8 @@ var deployProject = (input) => Effect35.gen(function* () {
     bucketNameMap,
     mailerDomainMap,
     queueNameMap,
-    logComplete
+    logComplete,
+    ...authSecret ? { authSecretPath: authSecret.ssmPath } : {}
   };
   const tableResults = [];
   const appResults = [];
@@ -6265,7 +6661,8 @@ var deployCommand = Command.make(
           stage: finalStage,
           region: finalRegion,
           noSites,
-          verbose
+          verbose,
+          extraNodeModules: projectDir !== cwd ? [path10.join(projectDir, "node_modules")] : void 0
         });
         const total = results.tableResults.length + results.appResults.length + results.staticSiteResults.length + results.apiResults.length;
         yield* Console3.log(`
@@ -6359,7 +6756,8 @@ Deployed ${tableResults.length} table handler(s):`));
             project,
             stage: finalStage,
             region: finalRegion,
-            exportName: foundExport
+            exportName: foundExport,
+            extraNodeModules: projectDir !== cwd ? [path10.join(projectDir, "node_modules")] : void 0
           };
           if (handlerType === "table") {
             const result = yield* deployTable(input);
@@ -6464,9 +6862,9 @@ var STATUS_COLORS = {
 var formatStatus = (status) => {
   return STATUS_COLORS[status](status.padEnd(10));
 };
-var formatRoute = (method, path12) => {
-  if (method && path12) return `${method.padEnd(5)} ${path12}`;
-  if (path12) return path12;
+var formatRoute = (method, path13) => {
+  if (method && path13) return `${method.padEnd(5)} ${path13}`;
+  if (path13) return path13;
   return "";
 };
 var formatEntry = (entry) => {
@@ -7112,15 +7510,16 @@ var layerCommand = Command5.make(
   "layer",
   { build: buildOption, output: outputOption, verbose: verboseOption },
   ({ build: build3, output, verbose }) => Effect43.gen(function* () {
-    const { config, cwd } = yield* ProjectConfig;
+    const { config, cwd, projectDir } = yield* ProjectConfig;
+    const extraNodeModules = projectDir !== cwd ? [path11.join(projectDir, "node_modules")] : void 0;
     if (build3) {
-      yield* buildLayer(cwd, output, verbose);
+      yield* buildLayer(cwd, output, verbose, extraNodeModules);
     } else {
-      yield* showLayerInfo(cwd, config?.name, verbose);
+      yield* showLayerInfo(cwd, config?.name, verbose, extraNodeModules);
     }
   }).pipe(Effect43.provide(ProjectConfig.Live))
 ).pipe(Command5.withDescription("Inspect or locally build the shared Lambda dependency layer from package.json"));
-var showLayerInfo = (projectDir, projectName, verbose) => Effect43.gen(function* () {
+var showLayerInfo = (projectDir, projectName, verbose, extraNodeModules) => Effect43.gen(function* () {
   yield* Console7.log(`
 ${c.bold("=== Layer Packages Preview ===")}
 `);
@@ -7143,7 +7542,7 @@ ${c.bold("=== Layer Packages Preview ===")}
   for (const dep of prodDeps) {
     yield* Console7.log(`  ${dep}`);
   }
-  const hash = yield* computeLockfileHash(projectDir).pipe(
+  const hash = yield* computeLockfileHash(projectDir, extraNodeModules).pipe(
     Effect43.catchAll(() => Effect43.succeed(null))
   );
   if (hash) {
@@ -7152,7 +7551,7 @@ Lockfile hash: ${hash}`);
   } else {
     yield* Console7.log("\nNo lockfile found (package-lock.json, pnpm-lock.yaml, or yarn.lock)");
   }
-  const { packages: allPackages, warnings: layerWarnings } = yield* Effect43.sync(() => collectLayerPackages(projectDir, prodDeps));
+  const { packages: allPackages, warnings: layerWarnings } = yield* Effect43.sync(() => collectLayerPackages(projectDir, prodDeps, extraNodeModules));
   if (layerWarnings.length > 0) {
     yield* Console7.log(c.yellow(`
 Warnings (${layerWarnings.length}):`));
@@ -7181,7 +7580,7 @@ Total packages for layer ${c.dim(`(${allPackages.length})`)}:`);
 Layer name: ${projectName}-deps`);
   }
 });
-var buildLayer = (projectDir, output, verbose) => Effect43.gen(function* () {
+var buildLayer = (projectDir, output, verbose, extraNodeModules) => Effect43.gen(function* () {
   const outputDir = path11.isAbsolute(output) ? output : path11.resolve(projectDir, output);
   const layerDir = path11.join(outputDir, "nodejs", "node_modules");
   const layerRoot = path11.join(outputDir, "nodejs");
@@ -7211,12 +7610,12 @@ ${c.bold("=== Building Layer Locally ===")}
   for (const dep of prodDeps) {
     yield* Console7.log(`  ${dep}`);
   }
-  const hash = yield* computeLockfileHash(projectDir).pipe(
+  const hash = yield* computeLockfileHash(projectDir, extraNodeModules).pipe(
     Effect43.catchAll(() => Effect43.succeed("unknown"))
   );
   yield* Console7.log(`
 Lockfile hash: ${hash}`);
-  const { packages: allPackages, resolvedPaths, warnings: layerWarnings } = yield* Effect43.sync(() => collectLayerPackages(projectDir, prodDeps));
+  const { packages: allPackages, resolvedPaths, warnings: layerWarnings } = yield* Effect43.sync(() => collectLayerPackages(projectDir, prodDeps, extraNodeModules));
   if (layerWarnings.length > 0) {
     yield* Console7.log(`
 Warnings (${layerWarnings.length}):`);
@@ -7283,7 +7682,7 @@ var loadRequiredParams = (projectOpt, stage, region) => Effect44.gen(function* (
   const handlers = discoverHandlers(files);
   const finalStage = config?.stage ?? stage;
   const finalRegion = config?.region ?? region;
-  const params = collectRequiredParams(handlers, project, finalStage);
+  const params = collectRequiredSecrets(handlers, project, finalStage);
   return { params, project, stage: finalStage, region: finalRegion };
 });
 var listCommand = Command6.make(
@@ -7296,7 +7695,7 @@ var listCommand = Command6.make(
       yield* Console8.log("No config parameters declared in handlers.");
       return;
     }
-    const { existing, missing } = yield* checkMissingParams(params).pipe(
+    const { existing, missing } = yield* checkMissingSecrets(params).pipe(
       Effect44.provide(clients_exports.makeClients({ ssm: { region: ctx.region } }))
     );
     yield* Console8.log(`
@@ -7367,7 +7766,7 @@ var configRootCommand = Command6.make(
       yield* Console8.log("No config parameters declared in handlers.");
       return;
     }
-    const { missing } = yield* checkMissingParams(params).pipe(
+    const { missing } = yield* checkMissingSecrets(params).pipe(
       Effect44.provide(clients_exports.makeClients({ ssm: { region: ctx.region } }))
     );
     if (missing.length === 0) {
@@ -7416,25 +7815,189 @@ ${c.bold("Missing parameters")} ${c.dim(`(${ctx.project} / ${ctx.stage})`)}
 );
 var configCommand = configRootCommand;
 
+// src/cli/commands/build.ts
+import { Args as Args4, Command as Command7, Options as Options5 } from "@effect/cli";
+import { Effect as Effect45, Console as Console9, Option as Option6 } from "effect";
+import * as path12 from "path";
+import * as fs8 from "fs";
+var buildFileArg = Args4.file({ name: "file", exists: "yes" }).pipe(
+  Args4.withDescription("Handler file to build"),
+  Args4.optional
+);
+var buildAllOption = Options5.boolean("all").pipe(
+  Options5.withDescription("Build all exports from file")
+);
+var buildTableOption = Options5.boolean("table").pipe(
+  Options5.withDescription("Build as table handler (defineTable)")
+);
+var buildCommand = Command7.make(
+  "build",
+  { file: buildFileArg, all: buildAllOption, table: buildTableOption, output: outputOption, verbose: verboseOption },
+  ({ file, all, table, output, verbose }) => Effect45.gen(function* () {
+    const { config, projectDir, cwd } = yield* ProjectConfig;
+    const outputDir = path12.isAbsolute(output) ? output : path12.resolve(projectDir, output);
+    const extraNodeModules = projectDir !== cwd ? [path12.join(projectDir, "node_modules")] : void 0;
+    if (!fs8.existsSync(outputDir)) {
+      fs8.mkdirSync(outputDir, { recursive: true });
+    }
+    const prodDeps = yield* readProductionDependencies(projectDir).pipe(
+      Effect45.catchAll(() => Effect45.succeed([]))
+    );
+    const { packages: external, warnings: layerWarnings } = prodDeps.length > 0 ? yield* Effect45.sync(() => collectLayerPackages(projectDir, prodDeps, extraNodeModules)) : { packages: [], warnings: [] };
+    for (const warning of layerWarnings) {
+      yield* Effect45.logWarning(`[layer] ${warning}`);
+    }
+    if (external.length > 0) {
+      yield* Console9.log(`Using ${external.length} external packages (from layer)
+`);
+    }
+    yield* Option6.match(file, {
+      onNone: () => Effect45.gen(function* () {
+        const patterns = getPatternsFromConfig(config);
+        if (!patterns) {
+          yield* Console9.error("Error: No file specified and no 'handlers' patterns in config");
+          return;
+        }
+        const files = findHandlerFiles(patterns, projectDir);
+        const discovered = discoverHandlers(files);
+        let builtCount = 0;
+        for (const { file: handlerFile, exports } of discovered.apiHandlers) {
+          const relativePath = path12.relative(projectDir, handlerFile);
+          const baseName = path12.basename(handlerFile, path12.extname(handlerFile));
+          for (const { exportName } of exports) {
+            const outputName = exportName === "default" ? baseName : `${baseName}-${exportName}`;
+            const outputPath = path12.join(outputDir, `${outputName}.mjs`);
+            yield* Console9.log(`Building ${c.cyan("[api]")} ${c.bold(relativePath)}:${exportName}...`);
+            const result = yield* bundle({
+              projectDir,
+              file: handlerFile,
+              exportName,
+              type: "api",
+              ...external.length > 0 ? { external } : {}
+            });
+            fs8.writeFileSync(outputPath, result.code);
+            const size = (Buffer.byteLength(result.code) / 1024).toFixed(1);
+            yield* Console9.log(`  -> ${outputPath} ${c.dim(`(${size} KB)`)}`);
+            if (result.topModules) {
+              for (const m of result.topModules.slice(0, 5)) {
+                yield* Console9.log(`     ${c.dim(`${(m.bytes / 1024).toFixed(1)} KB`)}  ${c.dim(m.path)}`);
+              }
+            }
+            builtCount++;
+          }
+        }
+        for (const { file: handlerFile, exports } of discovered.tableHandlers) {
+          const relativePath = path12.relative(projectDir, handlerFile);
+          const baseName = path12.basename(handlerFile, path12.extname(handlerFile));
+          for (const { exportName } of exports) {
+            const outputName = exportName === "default" ? baseName : `${baseName}-${exportName}`;
+            const outputPath = path12.join(outputDir, `${outputName}.mjs`);
+            yield* Console9.log(`Building ${c.cyan("[table]")} ${c.bold(relativePath)}:${exportName}...`);
+            const result = yield* bundle({
+              projectDir,
+              file: handlerFile,
+              exportName,
+              type: "table",
+              ...external.length > 0 ? { external } : {}
+            });
+            fs8.writeFileSync(outputPath, result.code);
+            const size = (Buffer.byteLength(result.code) / 1024).toFixed(1);
+            yield* Console9.log(`  -> ${outputPath} ${c.dim(`(${size} KB)`)}`);
+            if (result.topModules) {
+              for (const m of result.topModules.slice(0, 5)) {
+                yield* Console9.log(`     ${c.dim(`${(m.bytes / 1024).toFixed(1)} KB`)}  ${c.dim(m.path)}`);
+              }
+            }
+            builtCount++;
+          }
+        }
+        yield* Console9.log(c.green(`
+Built ${builtCount} handler(s) to ${outputDir}`));
+      }),
+      onSome: (filePath) => Effect45.gen(function* () {
+        const fullPath = path12.isAbsolute(filePath) ? filePath : path12.resolve(projectDir, filePath);
+        const source = fs8.readFileSync(fullPath, "utf-8");
+        const baseName = path12.basename(fullPath, path12.extname(fullPath));
+        if (table) {
+          const configs = extractTableConfigs(source);
+          if (configs.length === 0) {
+            yield* Console9.error("No defineTable handlers found in file");
+            return;
+          }
+          const toBundle = all ? configs : [configs[0]];
+          for (const { exportName } of toBundle) {
+            const outputName = exportName === "default" ? baseName : `${baseName}-${exportName}`;
+            const outputPath = path12.join(outputDir, `${outputName}.mjs`);
+            yield* Console9.log(`Building ${c.cyan("[table]")} ${c.bold(exportName)}...`);
+            const result = yield* bundle({
+              projectDir,
+              file: fullPath,
+              exportName,
+              type: "table",
+              ...external.length > 0 ? { external } : {}
+            });
+            fs8.writeFileSync(outputPath, result.code);
+            const size = (Buffer.byteLength(result.code) / 1024).toFixed(1);
+            yield* Console9.log(`  -> ${outputPath} ${c.dim(`(${size} KB)`)}`);
+            if (result.topModules) {
+              for (const m of result.topModules.slice(0, 5)) {
+                yield* Console9.log(`     ${c.dim(`${(m.bytes / 1024).toFixed(1)} KB`)}  ${c.dim(m.path)}`);
+              }
+            }
+          }
+        } else {
+          const configs = extractApiConfigs(source);
+          if (configs.length === 0) {
+            yield* Console9.error("No defineApi handlers found in file");
+            return;
+          }
+          const toBundle = all ? configs : [configs[0]];
+          for (const { exportName } of toBundle) {
+            const outputName = exportName === "default" ? baseName : `${baseName}-${exportName}`;
+            const outputPath = path12.join(outputDir, `${outputName}.mjs`);
+            yield* Console9.log(`Building ${c.cyan("[api]")} ${c.bold(exportName)}...`);
+            const result = yield* bundle({
+              projectDir,
+              file: fullPath,
+              exportName,
+              ...external.length > 0 ? { external } : {}
+            });
+            fs8.writeFileSync(outputPath, result.code);
+            const size = (Buffer.byteLength(result.code) / 1024).toFixed(1);
+            yield* Console9.log(`  -> ${outputPath} ${c.dim(`(${size} KB)`)}`);
+            if (result.topModules) {
+              for (const m of result.topModules.slice(0, 5)) {
+                yield* Console9.log(`     ${c.dim(`${(m.bytes / 1024).toFixed(1)} KB`)}  ${c.dim(m.path)}`);
+              }
+            }
+          }
+        }
+        yield* Console9.log(`
+Output directory: ${outputDir}`);
+      })
+    });
+  }).pipe(Effect45.provide(ProjectConfig.Live))
+).pipe(Command7.withDescription("Build handler bundles locally (for debugging)"));
+
 // src/cli/update-check.ts
 import { homedir as homedir2 } from "os";
-import { join as join9 } from "path";
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";
+import { join as join11 } from "path";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
 var PACKAGE_NAME = "@effortless-aws/cli";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
-var CACHE_DIR = join9(homedir2(), ".effortless-aws");
-var CACHE_FILE = join9(CACHE_DIR, "update-check.json");
+var CACHE_DIR = join11(homedir2(), ".effortless-aws");
+var CACHE_FILE = join11(CACHE_DIR, "update-check.json");
 function readCache() {
   try {
-    return JSON.parse(readFileSync5(CACHE_FILE, "utf-8"));
+    return JSON.parse(readFileSync6(CACHE_FILE, "utf-8"));
   } catch {
     return void 0;
   }
 }
 function writeCache(data) {
   try {
-    mkdirSync2(CACHE_DIR, { recursive: true });
-    writeFileSync2(CACHE_FILE, JSON.stringify(data));
+    mkdirSync3(CACHE_DIR, { recursive: true });
+    writeFileSync3(CACHE_FILE, JSON.stringify(data));
   } catch {
   }
 }
@@ -7496,18 +8059,18 @@ async function checkForUpdate(currentVersion) {
 // src/cli/index.ts
 var require2 = createRequire2(import.meta.url);
 var { version } = require2("../../package.json");
-var mainCommand = Command7.make("eff").pipe(
-  Command7.withSubcommands([deployCommand, statusCommand, logsCommand, cleanupCommand, layerCommand, configCommand]),
-  Command7.withDescription("Code-first AWS Lambda framework")
+var mainCommand = Command8.make("eff").pipe(
+  Command8.withSubcommands([deployCommand, statusCommand, logsCommand, cleanupCommand, layerCommand, configCommand, buildCommand]),
+  Command8.withDescription("Code-first AWS Lambda framework")
 );
-var cli = Command7.run(mainCommand, {
+var cli = Command8.run(mainCommand, {
   name: "effortless",
   version
 });
 var updateCheck = checkForUpdate(version);
 cli(process.argv).pipe(
-  Effect45.provide(NodeContext.layer),
-  Effect45.provide(CliConfig.layer({ showBuiltIns: false, showTypes: false })),
-  Effect45.tap(() => Effect45.promise(() => updateCheck)),
+  Effect46.provide(NodeContext.layer),
+  Effect46.provide(CliConfig.layer({ showBuiltIns: false, showTypes: false })),
+  Effect46.tap(() => Effect46.promise(() => updateCheck)),
   NodeRuntime.runMain
 );