@stacksjs/ts-cloud 0.2.27 → 0.3.0

package/dist/index.js

@@ -1194,9 +1194,9 @@ __export(exports_client, {
   AWSClient: () => AWSClient
 });
 import * as crypto2 from "node:crypto";
-import { existsSync as existsSync14, readFileSync as readFileSync4 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync7 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 function resolveS3Endpoint(options) {
   const base = options.endpoint || `s3.${options.region}.amazonaws.com`;
   if (!options.bucket) {
@@ -1254,12 +1254,12 @@ class AWSClient {
   }
   loadCredentialsFromFile() {
     const profile = process.env.AWS_PROFILE || "default";
-    const credentialsPath = process.env.AWS_SHARED_CREDENTIALS_FILE || join9(homedir6(), ".aws", "credentials");
+    const credentialsPath = process.env.AWS_SHARED_CREDENTIALS_FILE || join10(homedir6(), ".aws", "credentials");
     if (!existsSync14(credentialsPath)) {
       return null;
     }
     try {
-      const content = readFileSync4(credentialsPath, "utf-8");
+      const content = readFileSync7(credentialsPath, "utf-8");
       const credentials = this.parseCredentialsFile(content, profile);
       if (credentials.accessKeyId && credentials.secretAccessKey) {
         return credentials;
@@ -1688,7 +1688,7 @@ class AWSClient {
     return delay + jitter;
   }
   sleep(ms) {
-    return new Promise((resolve13) => setTimeout(resolve13, ms));
+    return new Promise((resolve14) => setTimeout(resolve14, ms));
   }
   getFromCache(key) {
     const entry = this.cache.get(key);
@@ -1753,7 +1753,7 @@ function detectCredentialSource() {
     };
   }
   const profile = process.env.AWS_PROFILE || "default";
-  const credentialsPath = process.env.AWS_SHARED_CREDENTIALS_FILE || join9(homedir6(), ".aws", "credentials");
+  const credentialsPath = process.env.AWS_SHARED_CREDENTIALS_FILE || join10(homedir6(), ".aws", "credentials");
   if (existsSync14(credentialsPath)) {
     return {
       source: "file",
@@ -1795,13 +1795,13 @@ function resolveCredentials2(profile) {
   return loadProfileFromFile(process.env.AWS_PROFILE || "default") ?? { accessKeyId: "", secretAccessKey: "" };
 }
 function loadProfileFromFile(profile) {
-  const { existsSync: existsSync15, readFileSync: readFileSync5 } = __require("node:fs");
+  const { existsSync: existsSync15, readFileSync: readFileSync8 } = __require("node:fs");
   const { homedir: homedir5 } = __require("node:os");
-  const { join: join8 } = __require("node:path");
-  const credentialsPath = process.env.AWS_SHARED_CREDENTIALS_FILE || join8(homedir5(), ".aws", "credentials");
+  const { join: join11 } = __require("node:path");
+  const credentialsPath = process.env.AWS_SHARED_CREDENTIALS_FILE || join11(homedir5(), ".aws", "credentials");
   if (!existsSync15(credentialsPath))
     return null;
-  const content = readFileSync5(credentialsPath, "utf-8");
+  const content = readFileSync8(credentialsPath, "utf-8");
   let currentProfile = null;
   let accessKeyId;
   let secretAccessKey;
@@ -1847,8 +1847,8 @@ function loadProfileFromFile(profile) {
 // src/aws/s3.ts
 import * as crypto3 from "node:crypto";
 import { readdir as readdir4 } from "node:fs/promises";
-import { join as join10 } from "node:path";
-import { readFileSync as readFileSync6 } from "node:fs";
+import { join as join12 } from "node:path";
+import { readFileSync as readFileSync9 } from "node:fs";
 function toFetchBody(data) {
   const { buffer, byteOffset, byteLength } = data;
   if (buffer instanceof ArrayBuffer) {
@@ -2250,7 +2250,7 @@ class S3Client2 {
     }
   }
   async copy(options) {
-    const fileContent = readFileSync6(options.source);
+    const fileContent = readFileSync9(options.source);
     await this.putObject({
       bucket: options.bucket,
       key: options.key,
@@ -2273,7 +2273,7 @@ class S3Client2 {
       const relativePath = file.substring(options.source.length + 1);
       const s3Key = options.prefix ? `${options.prefix}/${relativePath}` : relativePath;
       if (!options.dryRun) {
-        const fileContent = readFileSync6(file);
+        const fileContent = readFileSync9(file);
         await this.putObject({
           bucket: options.bucket,
           key: s3Key,
@@ -2304,7 +2304,7 @@ class S3Client2 {
     const files = [];
     const entries = await readdir4(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join10(dir, entry.name);
+      const fullPath = join12(dir, entry.name);
       if (entry.isDirectory()) {
         const subFiles = await this.listFilesRecursive(fullPath);
         files.push(...subFiles);
@@ -3722,7 +3722,7 @@ class CloudFormationClient {
           if (attempts % 10 === 0) {
             console.log(`[waitForStack] Attempt ${attempts}: Stack not visible yet`);
           }
-          await new Promise((resolve13) => setTimeout(resolve13, 2000));
+          await new Promise((resolve14) => setTimeout(resolve14, 2000));
           attempts++;
           continue;
         }
@@ -3761,7 +3761,7 @@ class CloudFormationClient {
         if (failureStatuses.includes(stack.StackStatus)) {
           throw new Error(`Stack reached failure status: ${stack.StackStatus}`);
         }
-        await new Promise((resolve13) => setTimeout(resolve13, 5000));
+        await new Promise((resolve14) => setTimeout(resolve14, 5000));
         attempts++;
       } catch (error) {
         if (waitType === "stack-delete-complete" && error.message?.includes("does not exist")) {
@@ -3771,7 +3771,7 @@ class CloudFormationClient {
           if (attempts % 10 === 0) {
             console.log(`[waitForStack] Attempt ${attempts}: Stack does not exist (error), retrying...`);
           }
-          await new Promise((resolve13) => setTimeout(resolve13, 2000));
+          await new Promise((resolve14) => setTimeout(resolve14, 2000));
           attempts++;
           continue;
         }
@@ -4042,7 +4042,7 @@ class CloudFormationClient {
           if (waitType === "stack-delete-complete") {
             return;
           }
-          await new Promise((resolve13) => setTimeout(resolve13, 2000));
+          await new Promise((resolve14) => setTimeout(resolve14, 2000));
           attempts++;
           continue;
         }
@@ -4060,14 +4060,14 @@ class CloudFormationClient {
         if (failureStatuses.includes(stack.StackStatus)) {
           throw new Error(`Stack reached failure status: ${stack.StackStatus}`);
         }
-        await new Promise((resolve13) => setTimeout(resolve13, 3000));
+        await new Promise((resolve14) => setTimeout(resolve14, 3000));
         attempts++;
       } catch (error) {
         if (waitType === "stack-delete-complete" && error.message?.includes("does not exist")) {
           return;
         }
         if (waitType === "stack-create-complete" && error.message?.includes("does not exist")) {
-          await new Promise((resolve13) => setTimeout(resolve13, 2000));
+          await new Promise((resolve14) => setTimeout(resolve14, 2000));
           attempts++;
           continue;
         }
@@ -4105,7 +4105,7 @@ class CloudFormationClient {
         if (failureStatuses.includes(status)) {
           return { success: false, status, reason: stack.StackStatusReason };
         }
-        await new Promise((resolve13) => setTimeout(resolve13, delayMs));
+        await new Promise((resolve14) => setTimeout(resolve14, delayMs));
       } catch (error) {
         if (error.message?.includes("does not exist")) {
           return { success: true, status: "DELETE_COMPLETE" };
@@ -4194,7 +4194,7 @@ class CloudFrontClient {
       if (invalidation.Status === "Completed") {
         return;
       }
-      await new Promise((resolve13) => setTimeout(resolve13, 5000));
+      await new Promise((resolve14) => setTimeout(resolve14, 5000));
       attempts++;
     }
     throw new Error(`Timeout waiting for invalidation ${invalidationId} to complete`);
@@ -5024,7 +5024,7 @@ ${Object.entries(config6).filter(([k]) => !k.startsWith("@_")).map(([key, val])
       if (dist.Status === "Deployed") {
         return true;
       }
-      await new Promise((resolve13) => setTimeout(resolve13, 30000));
+      await new Promise((resolve14) => setTimeout(resolve14, 30000));
     }
     return false;
   }
@@ -5085,7 +5085,7 @@ ${Object.entries(config6).filter(([k]) => !k.startsWith("@_")).map(([key, val])
       if (dist.Status === "Deployed" && !dist.Enabled) {
         return true;
       }
-      await new Promise((resolve13) => setTimeout(resolve13, 30000));
+      await new Promise((resolve14) => setTimeout(resolve14, 30000));
     }
     return false;
   }
@@ -5618,7 +5618,7 @@ var init_route53 = __esm(() => {
         if (status === "INSYNC") {
           return true;
         }
-        await new Promise((resolve13) => setTimeout(resolve13, delayMs));
+        await new Promise((resolve14) => setTimeout(resolve14, delayMs));
       }
       return false;
     }
@@ -6976,7 +6976,7 @@ class UnifiedDnsValidator {
       if (cert.DomainValidationOptions && cert.DomainValidationOptions.length > 0 && cert.DomainValidationOptions[0].ResourceRecord) {
         return;
       }
-      await new Promise((resolve13) => setTimeout(resolve13, 2000));
+      await new Promise((resolve14) => setTimeout(resolve14, 2000));
     }
     throw new Error("Timeout waiting for DNS validation options");
   }
@@ -7308,7 +7308,7 @@ class ACMClient {
       if (cert.Status === "FAILED" || cert.Status === "VALIDATION_TIMED_OUT") {
         return null;
       }
-      await new Promise((resolve13) => setTimeout(resolve13, delayMs));
+      await new Promise((resolve14) => setTimeout(resolve14, delayMs));
     }
     return null;
   }
@@ -7456,7 +7456,7 @@ class ACMDnsValidator {
       if (cert.DomainValidationOptions && cert.DomainValidationOptions.length > 0 && cert.DomainValidationOptions[0].ResourceRecord) {
         return;
       }
-      await new Promise((resolve13) => setTimeout(resolve13, 2000));
+      await new Promise((resolve14) => setTimeout(resolve14, 2000));
     }
     throw new Error("Timeout waiting for DNS validation options");
   }
@@ -7875,7 +7875,7 @@ class SESClient {
       if (isVerified) {
         return true;
       }
-      await new Promise((resolve13) => setTimeout(resolve13, delayMs));
+      await new Promise((resolve14) => setTimeout(resolve14, delayMs));
     }
     return false;
   }
@@ -10891,13 +10891,13 @@ async function uploadStaticFiles(options) {
   const { sourceDir, bucket, region, cacheControl = "max-age=31536000, public", onProgress } = options;
   const s32 = new S3Client2(region);
   const { readdir: readdir5 } = await import("node:fs/promises");
-  const { join: join8, relative: relative5 } = await import("node:path");
-  const { createHash: createHash5 } = await import("node:crypto");
+  const { join: join11, relative: relative5 } = await import("node:path");
+  const { createHash: createHash7 } = await import("node:crypto");
   async function listFiles(dir) {
     const files2 = [];
     const entries = await readdir5(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join8(dir, entry.name);
+      const fullPath = join11(dir, entry.name);
       if (entry.isDirectory()) {
         files2.push(...await listFiles(fullPath));
       } else {
@@ -10932,7 +10932,7 @@ async function uploadStaticFiles(options) {
     return types2[ext || ""] || "application/octet-stream";
   }
   function computeMD5(content) {
-    return createHash5("md5").update(content).digest("hex");
+    return createHash7("md5").update(content).digest("hex");
   }
   async function getExistingETags() {
     const etagMap = new Map;
@@ -19781,6 +19781,24 @@ import { join as join42 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
 import { createReadStream as createReadStream4, readdirSync as readdirSync42, statSync as statSync22 } from "node:fs";
 import { join as join52, relative as relative4 } from "node:path";
+import { deflateRawSync } from "node:zlib";
+import { execSync } from "node:child_process";
+import { createHash as createHash4 } from "node:crypto";
+import { cpSync, mkdtempSync, rmSync, writeFileSync as writeFileSync32 } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname as dirname22, isAbsolute as isAbsolute3, join as join62, resolve as resolve13 } from "node:path";
+import { fileURLToPath } from "node:url";
+import { readFileSync as readFileSync4 } from "node:fs";
+import { dirname as dirname32, join as join72 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { execFileSync } from "node:child_process";
+import { existsSync as existsSync52, mkdtempSync as mkdtempSync2, readdirSync as readdirSync52, readFileSync as readFileSync5, rmSync as rmSync2, statSync as statSync32, writeFileSync as writeFileSync42 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join8, relative as relative22 } from "node:path";
+import { execSync as execSync2 } from "node:child_process";
+import { createHash as createHash5 } from "node:crypto";
+import { readdirSync as readdirSync62, readFileSync as readFileSync6, statSync as statSync4 } from "node:fs";
+import { join as join9, relative as relative32, resolve as resolve22 } from "node:path";
 var __defProp3 = Object.defineProperty;
 var __returnValue3 = (v) => v;
 function __exportSetter3(name, newValue) {
@@ -20320,7 +20338,7 @@ function calculateBackoff(attempt, initialDelayMs, maxDelayMs) {
   return Math.min(exponentialDelay + jitter, maxDelayMs);
 }
 function sleep(ms) {
-  return new Promise((resolve13) => setTimeout(resolve13, ms));
+  return new Promise((resolve14) => setTimeout(resolve14, ms));
 }
 async function makeAWSRequest(options, retryOptions) {
   const {
@@ -21040,6 +21058,15 @@ function resolveStorageBucketName(slug, environment, bucketKey, explicitBucket)
 function resolveDeployBucketName(slug, environment) {
   return `${slug}-${environment}-deploy`;
 }
+function resolveServerlessAppStackName(config6, environment) {
+  return `${config6.project.slug}-${environment}-app`;
+}
+function resolveServerlessArtifactBucketName(slug, environment) {
+  return `${slug}-${environment}-deployments`;
+}
+function resolveServerlessAssetBucketName(slug, environment) {
+  return `${slug}-${environment}-assets`;
+}
 
 class DependencyGraph {
   nodes = new Map;
@@ -39955,6 +39982,44 @@ function createNodeJsServerlessPreset(options) {
     }
   };
 }
+function createServerlessNodePreset(options) {
+  const {
+    name,
+    slug,
+    entry,
+    domain,
+    runtime = "nodejs20.x",
+    memory = 1024,
+    build,
+    deploy,
+    assets,
+    queues = true,
+    scheduler = "on",
+    region = "us-east-1"
+  } = options;
+  return {
+    project: { name, slug, region },
+    mode: "serverless",
+    environments: {
+      production: {
+        type: "production",
+        domain,
+        app: {
+          kind: "node",
+          runtime,
+          entry,
+          memory,
+          build,
+          deploy,
+          assets,
+          queues,
+          scheduler,
+          domain
+        }
+      }
+    }
+  };
+}
 function createFullStackAppPreset(options) {
   const {
     name,
@@ -41515,6 +41580,47 @@ function createLaravelPreset(options) {
     }
   };
 }
+function createServerlessLaravelPreset(options) {
+  const {
+    name,
+    slug,
+    domain,
+    layers,
+    phpVersion = "8.3",
+    architecture = "x86_64",
+    memory = 1024,
+    build,
+    deploy = ["migrate --force"],
+    cache: cache2 = "dynamodb",
+    scheduler = "on",
+    region = "us-east-1"
+  } = options;
+  return {
+    project: { name, slug, region },
+    mode: "serverless",
+    environments: {
+      production: {
+        type: "production",
+        domain,
+        app: {
+          kind: "php",
+          runtime: "provided.al2023",
+          phpVersion,
+          architecture,
+          layers,
+          memory,
+          build,
+          deploy,
+          assets: "public",
+          queues: true,
+          scheduler,
+          cache: { driver: cache2 },
+          domain
+        }
+      }
+    }
+  };
+}
 function createDashboardSite(options) {
   return {
     root: options.root ?? "ui/dist",
@@ -43287,11 +43393,11 @@ var templateCache = new TemplateCache;
 async function hashFile(filePath, options = {}) {
   const algorithm = options.algorithm || "sha256";
   const chunkSize = options.chunkSize || 65536;
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const hash2 = createHash3(algorithm);
     const stream = createReadStream4(filePath, { highWaterMark: chunkSize });
     stream.on("data", (chunk) => hash2.update(chunk));
-    stream.on("end", () => resolve13(hash2.digest("hex")));
+    stream.on("end", () => resolve14(hash2.digest("hex")));
     stream.on("error", reject);
   });
 }
@@ -43493,7 +43599,7 @@ async function sequence(tasks) {
   return results;
 }
 function sleep2(ms) {
-  return new Promise((resolve13) => setTimeout(resolve13, ms));
+  return new Promise((resolve14) => setTimeout(resolve14, ms));
 }
 async function withTimeout(task, timeoutMs, timeoutMessage = "Operation timed out") {
   return Promise.race([
@@ -43531,12 +43637,12 @@ class RateLimiter {
       }
       return sleep2(this.minInterval - timeSinceLastExecution);
     }
-    return new Promise((resolve13) => this.queue.push(resolve13));
+    return new Promise((resolve14) => this.queue.push(resolve14));
   }
   processQueue() {
     if (this.queue.length > 0 && this.running < this.maxConcurrent) {
-      const resolve13 = this.queue.shift();
-      resolve13();
+      const resolve14 = this.queue.shift();
+      resolve14();
     }
   }
   stats() {
@@ -43847,6 +43953,27 @@ var cloud_config_schema_default = {
         region: {
           type: "string",
           description: "AWS region override for this environment"
+        },
+        app: {
+          type: "object",
+          description: "Serverless application manifest (Laravel-Vapor-equivalent). Defining this opts the environment into the serverless app deploy pipeline (http/queue/cli Lambda functions, assets, build/deploy hooks).",
+          properties: {
+            runtime: { type: "string", description: "Lambda runtime (e.g. nodejs20.x, provided.al2023)" },
+            kind: { type: "string", enum: ["node", "bun", "php"], description: "Application kind (drives packaging + runtime)" },
+            entry: { type: "string", description: "Entry file exporting the request handler" },
+            memory: { type: "number", description: "HTTP function memory in MB" },
+            timeout: { type: "number", description: "HTTP request timeout in seconds" },
+            gatewayVersion: { type: "number", enum: [1, 2], description: "API Gateway version (2 = HTTP API, 1 = REST)" },
+            warm: { type: "number", description: "Keep-warm / provisioned concurrency count" },
+            queues: { description: "Queue names (true = single default queue, false = disabled)" },
+            scheduler: { type: "string", enum: ["off", "on", "sub-minute"], description: "Task scheduler mode" },
+            build: { type: "array", items: { type: "string" }, description: "Commands run locally before packaging" },
+            deploy: { type: "array", items: { type: "string" }, description: "Commands run remotely after activation (e.g. migrations)" },
+            octane: { type: "boolean", description: "Persistent application mode (Laravel Octane)" },
+            packaging: { type: "string", enum: ["zip", "image"], description: "Deployment package format (zip or container image)" },
+            phpVersion: { type: "string", description: "PHP version for the runtime layer (kind: php)" },
+            architecture: { type: "string", enum: ["x86_64", "arm64"], description: "CPU architecture" }
+          }
         }
       }
     },
@@ -45920,9 +46047,9 @@ class REPL {
     this.running = false;
   }
   async readInput() {
-    return new Promise((resolve13) => {
+    return new Promise((resolve14) => {
       process.stdout.write(this.options.prompt || "> ");
-      resolve13("");
+      resolve14("");
     });
   }
   async executeCommand(input) {
@@ -50330,7 +50457,7 @@ class BlueGreenManager {
     console.log(`  Switching to: ${targetEnv}`);
     console.log(`\\n1. Deploying to ${targetEnv} environment`);
     if (!dryRun) {
-      await new Promise((resolve13) => setTimeout(resolve13, 100));
+      await new Promise((resolve14) => setTimeout(resolve14, 100));
     }
     console.log(`\\n2. Running health checks on ${targetEnv} environment`);
     if (deployment2.healthCheckConfig) {
@@ -50356,7 +50483,7 @@ class BlueGreenManager {
     }
     console.log(`\\n4. Monitoring ${targetEnv} environment`);
     if (!dryRun) {
-      await new Promise((resolve13) => setTimeout(resolve13, 100));
+      await new Promise((resolve14) => setTimeout(resolve14, 100));
     }
     result.success = true;
     result.endTime = new Date;
@@ -50398,7 +50525,7 @@ class BlueGreenManager {
     let consecutiveSuccesses = 0;
     const maxAttempts = config22.healthyThreshold + 2;
     for (let i = 0;i < maxAttempts; i++) {
-      await new Promise((resolve13) => setTimeout(resolve13, 50));
+      await new Promise((resolve14) => setTimeout(resolve14, 50));
       const healthy = Math.random() > 0.1;
       if (healthy) {
         consecutiveSuccesses++;
@@ -50646,7 +50773,7 @@ class CanaryManager {
       console.log(`  [SKIPPED - DRY RUN]`);
       return true;
     }
-    await new Promise((resolve13) => setTimeout(resolve13, 100));
+    await new Promise((resolve14) => setTimeout(resolve14, 100));
     const metrics = {
       baselineErrorRate: Math.random() * 0.5,
       canaryErrorRate: Math.random() * 0.8,
@@ -63219,7 +63346,7 @@ class DLQMonitoringManager {
     job.status = "processing";
     job.startedAt = new Date;
     job.attempts++;
-    await new Promise((resolve13) => setTimeout(resolve13, 100));
+    await new Promise((resolve14) => setTimeout(resolve14, 100));
     const success = Math.random() > 0.3;
     job.status = success ? "success" : "failed";
     job.completedAt = new Date;
@@ -63422,7 +63549,7 @@ class BatchProcessingManager {
   async processMessage(message, config22) {
     message.status = "processing";
     const startTime = Date.now();
-    await new Promise((resolve13) => setTimeout(resolve13, Math.random() * 100));
+    await new Promise((resolve14) => setTimeout(resolve14, Math.random() * 100));
     const processingTime = Date.now() - startTime;
     message.processingTime = processingTime;
     const success = Math.random() > 0.1;
@@ -63779,6 +63906,1115 @@ class QueueManagementManager {
   }
 }
 var queueManagementManager = new QueueManagementManager;
+var CRC_TABLE = (() => {
+  const table2 = [];
+  for (let i = 0;i < 256; i++) {
+    let c = i;
+    for (let j = 0;j < 8; j++)
+      c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+    table2[i] = c >>> 0;
+  }
+  return table2;
+})();
+function crc32(data) {
+  let crc = 4294967295;
+  for (let i = 0;i < data.length; i++)
+    crc = CRC_TABLE[(crc ^ data[i]) & 255] ^ crc >>> 8;
+  return (crc ^ 4294967295) >>> 0;
+}
+function toBuffer(data) {
+  if (typeof data === "string")
+    return Buffer.from(data, "utf-8");
+  if (Buffer.isBuffer(data))
+    return data;
+  return Buffer.from(data);
+}
+function dosTimeDate(date) {
+  const year = Math.max(1980, date.getFullYear());
+  const time = (date.getHours() << 11 | date.getMinutes() << 5 | date.getSeconds() >> 1) & 65535;
+  const d = (year - 1980 << 9 | date.getMonth() + 1 << 5 | date.getDate()) & 65535;
+  return { time, date: d };
+}
+function createZip(entries) {
+  const localParts = [];
+  const centralParts = [];
+  let offset = 0;
+  for (const entry of entries) {
+    const raw = toBuffer(entry.data);
+    const compressed = deflateRawSync(raw);
+    const crc = crc32(raw);
+    const nameBuf = Buffer.from(entry.name.replace(/\\/g, "/"), "utf-8");
+    const { time, date } = dosTimeDate(entry.date ?? new Date(0));
+    const mode = entry.mode ?? 420;
+    const local = Buffer.alloc(30 + nameBuf.length);
+    local.writeUInt32LE(67324752, 0);
+    local.writeUInt16LE(20, 4);
+    local.writeUInt16LE(0, 6);
+    local.writeUInt16LE(8, 8);
+    local.writeUInt16LE(time, 10);
+    local.writeUInt16LE(date, 12);
+    local.writeUInt32LE(crc, 14);
+    local.writeUInt32LE(compressed.length, 18);
+    local.writeUInt32LE(raw.length, 22);
+    local.writeUInt16LE(nameBuf.length, 26);
+    local.writeUInt16LE(0, 28);
+    nameBuf.copy(local, 30);
+    const central = Buffer.alloc(46 + nameBuf.length);
+    central.writeUInt32LE(33639248, 0);
+    central.writeUInt16LE(798, 4);
+    central.writeUInt16LE(20, 6);
+    central.writeUInt16LE(0, 8);
+    central.writeUInt16LE(8, 10);
+    central.writeUInt16LE(time, 12);
+    central.writeUInt16LE(date, 14);
+    central.writeUInt32LE(crc, 16);
+    central.writeUInt32LE(compressed.length, 20);
+    central.writeUInt32LE(raw.length, 24);
+    central.writeUInt16LE(nameBuf.length, 28);
+    central.writeUInt16LE(0, 30);
+    central.writeUInt16LE(0, 32);
+    central.writeUInt16LE(0, 34);
+    central.writeUInt16LE(0, 36);
+    central.writeUInt32LE((mode & 65535) << 16, 38);
+    central.writeUInt32LE(offset, 42);
+    nameBuf.copy(central, 46);
+    localParts.push(local, compressed);
+    centralParts.push(central);
+    offset += local.length + compressed.length;
+  }
+  const centralDir = Buffer.concat(centralParts);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(101010256, 0);
+  end.writeUInt16LE(0, 4);
+  end.writeUInt16LE(0, 6);
+  end.writeUInt16LE(entries.length, 8);
+  end.writeUInt16LE(entries.length, 10);
+  end.writeUInt32LE(centralDir.length, 12);
+  end.writeUInt32LE(offset, 16);
+  end.writeUInt16LE(0, 20);
+  return Buffer.concat([...localParts, centralDir, end]);
+}
+function generateBootstrap(opts) {
+  const adapter = opts.adapterImport ?? "./adapter";
+  const entry = opts.entryImport.replace(/\\/g, "/");
+  return `// Generated by ts-cloud — serverless app bootstrap. Do not edit.
+import * as __userModule from ${JSON.stringify(entry)}
+import { resolveApp, createHandlers } from ${JSON.stringify(adapter)}
+
+const __app = resolveApp(__userModule)
+const __handlers = createHandlers(__app)
+
+export const http = __handlers.http
+export const queue = __handlers.queue
+export const cli = __handlers.cli
+`;
+}
+function adapterSourcePath() {
+  return join62(dirname22(fileURLToPath(import.meta.url)), "runtime", "adapter.ts");
+}
+function runBuildHooks(hooks, cwd, onStep) {
+  for (const hook of hooks ?? []) {
+    onStep?.(`build: ${hook}`);
+    execSync(hook, { stdio: "inherit", cwd });
+  }
+}
+function sha256(data) {
+  return createHash4("sha256").update(data).digest("hex");
+}
+function artifactKey(slug, environment, hash2) {
+  return `deployments/${slug}/${environment}/${hash2}.zip`;
+}
+async function packageServerlessApp(opts) {
+  const projectRoot = resolve13(opts.projectRoot ?? process.cwd());
+  const { app } = opts;
+  if (!opts.skipBuild)
+    runBuildHooks(app.build, projectRoot, opts.onStep);
+  const entry = app.entry;
+  if (!entry)
+    throw new Error("serverless app: `entry` is required to package a Node/Bun application");
+  const entryPath = isAbsolute3(entry) ? entry : join62(projectRoot, entry);
+  const stage = mkdtempSync(join62(tmpdir(), "tscloud-pkg-"));
+  try {
+    cpSync(adapterSourcePath(), join62(stage, "adapter.ts"));
+    const bootstrapPath = join62(stage, "bootstrap.ts");
+    writeFileSync32(bootstrapPath, generateBootstrap({ entryImport: entryPath, adapterImport: "./adapter" }));
+    opts.onStep?.("bundling application");
+    const result = await Bun.build({
+      entrypoints: [bootstrapPath],
+      target: "node",
+      format: "esm",
+      minify: false,
+      sourcemap: "none"
+    });
+    if (!result.success) {
+      const logs = result.logs.map((l) => String(l)).join(`
+`);
+      throw new Error(`serverless app bundle failed:
+${logs}`);
+    }
+    const output = result.outputs[0];
+    const bundle = Buffer.from(await output.arrayBuffer());
+    const handlerFile = "index";
+    const zip = createZip([{ name: `${handlerFile}.mjs`, data: bundle }]);
+    return {
+      zip,
+      bundle,
+      sha256: sha256(zip),
+      handlerFile,
+      handlers: {
+        http: app.handlers?.http ?? `${handlerFile}.http`,
+        queue: app.handlers?.queue ?? `${handlerFile}.queue`,
+        cli: app.handlers?.cli ?? `${handlerFile}.cli`
+      },
+      bundleBytes: bundle.length
+    };
+  } finally {
+    rmSync(stage, { recursive: true, force: true });
+  }
+}
+function resolveQueueNames(app, slug, env) {
+  if (app.queues === false)
+    return [];
+  if (app.queues === undefined || app.queues === true)
+    return [`${slug}-${env}-default`];
+  return app.queues.map((q) => {
+    const name = typeof q === "string" ? q : Object.keys(q)[0];
+    return `${slug}-${env}-${name}`;
+  });
+}
+function composeServerlessAppTemplate(opts) {
+  const { app, environment, handlers } = opts;
+  const slug = opts.config.project.slug;
+  const runtime = app.runtime ?? "nodejs20.x";
+  const architecture = app.architecture ?? "x86_64";
+  const region = opts.config.project.region;
+  const functionNames = {
+    http: `${slug}-${environment}-http`,
+    queue: `${slug}-${environment}-queue`,
+    cli: `${slug}-${environment}-cli`
+  };
+  const queueNames = resolveQueueNames(app, slug, environment);
+  const hasQueue = queueNames.length > 0;
+  const imageMode = app.packaging === "image";
+  const schedulerEnabled = (app.scheduler ?? "on") !== "off";
+  const cacheEnabled = (app.cache?.driver ?? "dynamodb") === "dynamodb";
+  const assetsEnabled = Boolean(app.assets);
+  const assetsBucket = resolveServerlessAssetBucketName(slug, environment);
+  const tmpStorage = app.tmpStorage ?? 512;
+  const resources = {};
+  const outputs = {};
+  const inlinePolicies = [
+    {
+      PolicyName: "tscloud-serverless-app",
+      PolicyDocument: {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Effect: "Allow",
+            Action: ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
+            Resource: Fn2.sub("arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*")
+          },
+          {
+            Effect: "Allow",
+            Action: ["lambda:InvokeFunction"],
+            Resource: Fn2.sub(`arn:aws:lambda:\${AWS::Region}:\${AWS::AccountId}:function:${slug}-${environment}-*`)
+          },
+          {
+            Effect: "Allow",
+            Action: ["secretsmanager:GetSecretValue", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath"],
+            Resource: [
+              Fn2.sub(`arn:aws:secretsmanager:\${AWS::Region}:\${AWS::AccountId}:secret:${slug}/${environment}/*`),
+              Fn2.sub(`arn:aws:ssm:\${AWS::Region}:\${AWS::AccountId}:parameter/${slug}/${environment}/*`)
+            ]
+          },
+          {
+            Effect: "Allow",
+            Action: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket"],
+            Resource: [
+              Fn2.sub(`arn:aws:s3:::${assetsBucket}`),
+              Fn2.sub(`arn:aws:s3:::${assetsBucket}/*`),
+              ...app.storage?.bucket ? [Fn2.sub(`arn:aws:s3:::${app.storage.bucket}`), Fn2.sub(`arn:aws:s3:::${app.storage.bucket}/*`)] : []
+            ]
+          }
+        ]
+      }
+    }
+  ];
+  if (hasQueue) {
+    inlinePolicies[0].PolicyDocument.Statement.push({
+      Effect: "Allow",
+      Action: ["sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl"],
+      Resource: Fn2.sub(`arn:aws:sqs:\${AWS::Region}:\${AWS::AccountId}:${slug}-${environment}-*`)
+    });
+  }
+  if (cacheEnabled) {
+    inlinePolicies[0].PolicyDocument.Statement.push({
+      Effect: "Allow",
+      Action: ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem"],
+      Resource: Fn2.sub(`arn:aws:dynamodb:\${AWS::Region}:\${AWS::AccountId}:table/${slug}-${environment}-cache*`)
+    });
+  }
+  const managedPolicies = ["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"];
+  if (app.vpc?.subnets?.length)
+    managedPolicies.push("arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole");
+  resources.AppRole = {
+    Type: "AWS::IAM::Role",
+    Properties: {
+      RoleName: `${slug}-${environment}-app-role`,
+      AssumeRolePolicyDocument: {
+        Version: "2012-10-17",
+        Statement: [{ Effect: "Allow", Principal: { Service: "lambda.amazonaws.com" }, Action: "sts:AssumeRole" }]
+      },
+      ManagedPolicyArns: managedPolicies,
+      Policies: inlinePolicies
+    }
+  };
+  const baseEnv = (mode) => ({
+    TSCLOUD_LAMBDA_MODE: mode,
+    TSCLOUD_ENV: environment,
+    ...app.octane ? { TSCLOUD_OCTANE: "1" } : {},
+    ...cacheEnabled ? { TSCLOUD_CACHE_TABLE: `${slug}-${environment}-cache` } : {},
+    ...hasQueue ? { TSCLOUD_QUEUE: queueNames[0] } : {},
+    ...app.env ?? {}
+  });
+  const subnets = app.vpc?.subnets ?? [];
+  const hasVpc = subnets.length > 0;
+  const needsDataVpc = app.cache?.driver === "elasticache" || app.database?.connection === "aurora-serverless" || Boolean(app.rdsProxy);
+  if (needsDataVpc && !hasVpc) {
+    throw new Error("serverless app: elasticache / aurora-serverless / rdsProxy require app.vpc.subnets (private subnets) to be set.");
+  }
+  const vpcConfig = hasVpc ? {
+    VpcConfig: {
+      SubnetIds: subnets,
+      SecurityGroupIds: [
+        ...app.vpc?.securityGroups ?? [],
+        ...needsDataVpc ? [Fn2.getAtt("DataSecurityGroup", "GroupId")] : []
+      ]
+    }
+  } : {};
+  function addFunction(logicalId, name, handler8, mode, memory, timeout, reservedConcurrency) {
+    resources[`${logicalId}LogGroup`] = {
+      Type: "AWS::Logs::LogGroup",
+      Properties: { LogGroupName: `/aws/lambda/${name}`, RetentionInDays: 14 }
+    };
+    const codeProps = imageMode ? {
+      PackageType: "Image",
+      Code: { ImageUri: Fn2.ref("ImageUri") },
+      ...app.kind === "php" ? {} : { ImageConfig: { Command: [handler8] } }
+    } : {
+      Runtime: runtime,
+      Handler: handler8,
+      Code: { S3Bucket: Fn2.ref("ArtifactBucket"), S3Key: Fn2.ref("ArtifactKey") },
+      ...opts.runtimeLayers?.length ? { Layers: opts.runtimeLayers } : {}
+    };
+    resources[logicalId] = {
+      Type: "AWS::Lambda::Function",
+      DependsOn: [`${logicalId}LogGroup`],
+      Properties: {
+        FunctionName: name,
+        Architectures: [architecture],
+        MemorySize: memory,
+        Timeout: timeout,
+        Role: Fn2.getAtt("AppRole", "Arn"),
+        Environment: { Variables: baseEnv(mode) },
+        EphemeralStorage: { Size: tmpStorage },
+        ...codeProps,
+        ...reservedConcurrency !== undefined ? { ReservedConcurrentExecutions: reservedConcurrency } : {},
+        ...vpcConfig
+      }
+    };
+  }
+  addFunction("HttpFunction", functionNames.http, handlers.http, "http", app.memory ?? 1024, app.timeout ?? 28, app.concurrency);
+  addFunction("CliFunction", functionNames.cli, handlers.cli, "cli", app.cliMemory ?? 1024, app.cliTimeout ?? 900);
+  if (hasQueue)
+    addFunction("QueueFunction", functionNames.queue, handlers.queue, "queue", app.queueMemory ?? 1024, app.queueTimeout ?? 120);
+  resources.HttpApi = {
+    Type: "AWS::ApiGatewayV2::Api",
+    Properties: {
+      Name: `${slug}-${environment}`,
+      ProtocolType: "HTTP"
+    }
+  };
+  resources.HttpIntegration = {
+    Type: "AWS::ApiGatewayV2::Integration",
+    Properties: {
+      ApiId: Fn2.ref("HttpApi"),
+      IntegrationType: "AWS_PROXY",
+      IntegrationUri: Fn2.getAtt("HttpFunction", "Arn"),
+      PayloadFormatVersion: "2.0"
+    }
+  };
+  resources.HttpRoute = {
+    Type: "AWS::ApiGatewayV2::Route",
+    Properties: {
+      ApiId: Fn2.ref("HttpApi"),
+      RouteKey: "$default",
+      Target: Fn2.join("/", ["integrations", Fn2.ref("HttpIntegration")])
+    }
+  };
+  resources.HttpStage = {
+    Type: "AWS::ApiGatewayV2::Stage",
+    Properties: {
+      ApiId: Fn2.ref("HttpApi"),
+      StageName: "$default",
+      AutoDeploy: true
+    }
+  };
+  resources.HttpPermission = {
+    Type: "AWS::Lambda::Permission",
+    Properties: {
+      FunctionName: Fn2.ref("HttpFunction"),
+      Action: "lambda:InvokeFunction",
+      Principal: "apigateway.amazonaws.com",
+      SourceArn: Fn2.sub("arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${HttpApi}/*/*")
+    }
+  };
+  outputs.HttpApiEndpoint = {
+    Description: "HTTP API endpoint",
+    Value: Fn2.getAtt("HttpApi", "ApiEndpoint")
+  };
+  outputs.HttpApiId = { Description: "HTTP API id", Value: Fn2.ref("HttpApi") };
+  if (hasQueue) {
+    resources.AppQueueDlq = {
+      Type: "AWS::SQS::Queue",
+      Properties: {
+        QueueName: `${slug}-${environment}-dlq`,
+        MessageRetentionPeriod: 1209600
+      }
+    };
+    queueNames.forEach((qName, i) => {
+      const qId = `AppQueue${i}`;
+      resources[qId] = {
+        Type: "AWS::SQS::Queue",
+        Properties: {
+          QueueName: qName,
+          VisibilityTimeout: Math.max(app.queueTimeout ?? 120, app.queueTimeout ?? 120),
+          RedrivePolicy: {
+            deadLetterTargetArn: Fn2.getAtt("AppQueueDlq", "Arn"),
+            maxReceiveCount: app.queueTries ?? 3
+          }
+        }
+      };
+      resources[`${qId}Mapping`] = {
+        Type: "AWS::Lambda::EventSourceMapping",
+        Properties: {
+          EventSourceArn: Fn2.getAtt(qId, "Arn"),
+          FunctionName: Fn2.ref("QueueFunction"),
+          BatchSize: 1,
+          FunctionResponseTypes: ["ReportBatchItemFailures"],
+          ...app.queueConcurrency ? { ScalingConfig: { MaximumConcurrency: Math.max(2, app.queueConcurrency) } } : {}
+        }
+      };
+      outputs[`QueueUrl${i}`] = { Description: `Queue URL: ${qName}`, Value: Fn2.ref(qId) };
+    });
+  }
+  if (schedulerEnabled) {
+    resources.SchedulerRule = {
+      Type: "AWS::Events::Rule",
+      Properties: {
+        Name: `${slug}-${environment}-scheduler`,
+        ScheduleExpression: "rate(1 minute)",
+        State: "ENABLED",
+        Targets: [{
+          Id: "cli",
+          Arn: Fn2.getAtt("CliFunction", "Arn"),
+          Input: JSON.stringify({ command: "schedule:run" })
+        }]
+      }
+    };
+    resources.SchedulerPermission = {
+      Type: "AWS::Lambda::Permission",
+      Properties: {
+        FunctionName: Fn2.ref("CliFunction"),
+        Action: "lambda:InvokeFunction",
+        Principal: "events.amazonaws.com",
+        SourceArn: Fn2.getAtt("SchedulerRule", "Arn")
+      }
+    };
+  }
+  if (app.warm && app.warm > 0) {
+    const TARGETS_PER_RULE = 5;
+    const ruleCount = Math.ceil(app.warm / TARGETS_PER_RULE);
+    let warmed = 0;
+    for (let r = 0;r < ruleCount; r++) {
+      const targets = Math.min(TARGETS_PER_RULE, app.warm - warmed);
+      resources[`WarmerRule${r}`] = {
+        Type: "AWS::Events::Rule",
+        Properties: {
+          Name: `${slug}-${environment}-warmer-${r}`,
+          ScheduleExpression: "rate(5 minutes)",
+          State: "ENABLED",
+          Targets: Array.from({ length: targets }, (_, i) => ({
+            Id: `warm-${r}-${i}`,
+            Arn: Fn2.getAtt("HttpFunction", "Arn"),
+            Input: JSON.stringify({ warmer: true })
+          }))
+        }
+      };
+      warmed += targets;
+    }
+    resources.WarmerPermission = {
+      Type: "AWS::Lambda::Permission",
+      Properties: {
+        FunctionName: Fn2.ref("HttpFunction"),
+        Action: "lambda:InvokeFunction",
+        Principal: "events.amazonaws.com",
+        SourceArn: Fn2.sub(`arn:aws:events:\${AWS::Region}:\${AWS::AccountId}:rule/${slug}-${environment}-warmer-*`)
+      }
+    };
+  }
+  if (cacheEnabled) {
+    resources.CacheTable = {
+      Type: "AWS::DynamoDB::Table",
+      Properties: {
+        TableName: `${slug}-${environment}-cache`,
+        BillingMode: "PAY_PER_REQUEST",
+        AttributeDefinitions: [{ AttributeName: "key", AttributeType: "S" }],
+        KeySchema: [{ AttributeName: "key", KeyType: "HASH" }],
+        TimeToLiveSpecification: { AttributeName: "expires_at", Enabled: true }
+      }
+    };
+    outputs.CacheTableName = { Description: "DynamoDB cache table", Value: Fn2.ref("CacheTable") };
+  }
+  if (assetsEnabled) {
+    resources.AssetsBucket = {
+      Type: "AWS::S3::Bucket",
+      Properties: {
+        BucketName: assetsBucket,
+        PublicAccessBlockConfiguration: {
+          BlockPublicAcls: true,
+          BlockPublicPolicy: true,
+          IgnorePublicAcls: true,
+          RestrictPublicBuckets: true
+        }
+      }
+    };
+    resources.AssetsOAC = {
+      Type: "AWS::CloudFront::OriginAccessControl",
+      Properties: {
+        OriginAccessControlConfig: {
+          Name: `${slug}-${environment}-assets-oac`,
+          OriginAccessControlOriginType: "s3",
+          SigningBehavior: "always",
+          SigningProtocol: "sigv4"
+        }
+      }
+    };
+    resources.AssetsDistribution = {
+      Type: "AWS::CloudFront::Distribution",
+      Properties: {
+        DistributionConfig: {
+          Enabled: true,
+          DefaultCacheBehavior: {
+            TargetOriginId: "assets",
+            ViewerProtocolPolicy: "redirect-to-https",
+            Compress: true,
+            CachePolicyId: "658327ea-f89d-4fab-a63d-7e88639e58f6"
+          },
+          Origins: [{
+            Id: "assets",
+            DomainName: Fn2.getAtt("AssetsBucket", "RegionalDomainName"),
+            OriginAccessControlId: Fn2.ref("AssetsOAC"),
+            S3OriginConfig: { OriginAccessIdentity: "" }
+          }]
+        }
+      }
+    };
+    resources.AssetsBucketPolicy = {
+      Type: "AWS::S3::BucketPolicy",
+      Properties: {
+        Bucket: Fn2.ref("AssetsBucket"),
+        PolicyDocument: {
+          Version: "2012-10-17",
+          Statement: [{
+            Effect: "Allow",
+            Principal: { Service: "cloudfront.amazonaws.com" },
+            Action: "s3:GetObject",
+            Resource: Fn2.sub(`arn:aws:s3:::${assetsBucket}/*`),
+            Condition: { StringEquals: { "AWS:SourceArn": Fn2.sub("arn:aws:cloudfront::${AWS::AccountId}:distribution/${AssetsDistribution}") } }
+          }]
+        }
+      }
+    };
+    outputs.AssetsBucketName = { Description: "Assets bucket", Value: Fn2.ref("AssetsBucket") };
+    outputs.AssetsCdnDomain = { Description: "Assets CloudFront domain", Value: Fn2.getAtt("AssetsDistribution", "DomainName") };
+  }
+  if (app.firewall?.enabled) {
+    const wafRules = [];
+    let priority = 0;
+    if (app.firewall.rateLimit) {
+      wafRules.push({
+        Name: "rate-limit",
+        Priority: priority++,
+        Action: { Block: {} },
+        Statement: { RateBasedStatement: { Limit: app.firewall.rateLimit, AggregateKeyType: "IP" } },
+        VisibilityConfig: { SampledRequestsEnabled: true, CloudWatchMetricsEnabled: true, MetricName: `${slug}-${environment}-rate` }
+      });
+    }
+    const managed = {
+      sqlInjection: "AWSManagedRulesSQLiRuleSet",
+      xss: "AWSManagedRulesCommonRuleSet",
+      common: "AWSManagedRulesCommonRuleSet",
+      botControl: "AWSManagedRulesBotControlRuleSet",
+      ipReputation: "AWSManagedRulesAmazonIpReputationList"
+    };
+    for (const rule of app.firewall.rules ?? []) {
+      const name = managed[rule];
+      if (!name)
+        continue;
+      wafRules.push({
+        Name: `managed-${rule}`,
+        Priority: priority++,
+        OverrideAction: { None: {} },
+        Statement: { ManagedRuleGroupStatement: { VendorName: "AWS", Name: name } },
+        VisibilityConfig: { SampledRequestsEnabled: true, CloudWatchMetricsEnabled: true, MetricName: `${slug}-${environment}-${rule}` }
+      });
+    }
+    resources.WebAcl = {
+      Type: "AWS::WAFv2::WebACL",
+      Properties: {
+        Name: `${slug}-${environment}-waf`,
+        Scope: "REGIONAL",
+        DefaultAction: { Allow: {} },
+        Rules: wafRules,
+        VisibilityConfig: { SampledRequestsEnabled: true, CloudWatchMetricsEnabled: true, MetricName: `${slug}-${environment}-waf` }
+      }
+    };
+    resources.WebAclAssociation = {
+      Type: "AWS::WAFv2::WebACLAssociation",
+      DependsOn: ["HttpStage"],
+      Properties: {
+        ResourceArn: Fn2.sub("arn:aws:apigateway:${AWS::Region}::/apis/${HttpApi}/stages/$default"),
+        WebACLArn: Fn2.getAtt("WebAcl", "Arn")
+      }
+    };
+  }
+  if (hasVpc && needsDataVpc) {
+    resources.DataSecurityGroup = {
+      Type: "AWS::EC2::SecurityGroup",
+      Properties: {
+        GroupDescription: `${slug}-${environment} serverless data access`,
+        SecurityGroupIngress: [{ IpProtocol: "-1", CidrIp: "10.0.0.0/8" }]
+      }
+    };
+  }
+  if (app.cache?.driver === "elasticache") {
+    resources.CacheSubnetGroup = {
+      Type: "AWS::ElastiCache::SubnetGroup",
+      Properties: { Description: `${slug}-${environment} cache subnets`, SubnetIds: subnets }
+    };
+    resources.CacheCluster = {
+      Type: "AWS::ElastiCache::ReplicationGroup",
+      Properties: {
+        ReplicationGroupId: `${slug}-${environment}-cache`,
+        ReplicationGroupDescription: `${slug}-${environment} redis`,
+        Engine: "redis",
+        CacheNodeType: "cache.t4g.micro",
+        NumCacheClusters: 1,
+        AutomaticFailoverEnabled: false,
+        CacheSubnetGroupName: Fn2.ref("CacheSubnetGroup"),
+        SecurityGroupIds: [Fn2.getAtt("DataSecurityGroup", "GroupId")],
+        TransitEncryptionEnabled: false
+      }
+    };
+    outputs.CacheEndpoint = { Description: "Redis primary endpoint", Value: Fn2.getAtt("CacheCluster", "PrimaryEndPoint.Address") };
+  }
+  if (app.database?.connection === "aurora-serverless") {
+    resources.DbSubnetGroup = {
+      Type: "AWS::RDS::DBSubnetGroup",
+      Properties: { DBSubnetGroupDescription: `${slug}-${environment} db subnets`, SubnetIds: subnets }
+    };
+    resources.DbSecret = {
+      Type: "AWS::SecretsManager::Secret",
+      Properties: {
+        Name: `${slug}/${environment}/db`,
+        GenerateSecretString: {
+          SecretStringTemplate: JSON.stringify({ username: "app" }),
+          GenerateStringKey: "password",
+          PasswordLength: 32,
+          ExcludePunctuation: true
+        }
+      }
+    };
+    resources.DbCluster = {
+      Type: "AWS::RDS::DBCluster",
+      Properties: {
+        Engine: "aurora-mysql",
+        EngineMode: "provisioned",
+        DBClusterIdentifier: `${slug}-${environment}-db`,
+        MasterUsername: Fn2.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:username}}"),
+        MasterUserPassword: Fn2.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:password}}"),
+        ServerlessV2ScalingConfiguration: { MinCapacity: 0.5, MaxCapacity: 4 },
+        DBSubnetGroupName: Fn2.ref("DbSubnetGroup"),
+        VpcSecurityGroupIds: [Fn2.getAtt("DataSecurityGroup", "GroupId")]
+      }
+    };
+    resources.DbInstance = {
+      Type: "AWS::RDS::DBInstance",
+      Properties: {
+        Engine: "aurora-mysql",
+        DBInstanceClass: "db.serverless",
+        DBClusterIdentifier: Fn2.ref("DbCluster")
+      }
+    };
+    outputs.DbEndpoint = { Description: "Aurora cluster endpoint", Value: Fn2.getAtt("DbCluster", "Endpoint.Address") };
+  }
+  if (app.rdsProxy && app.database?.connection === "aurora-serverless") {
+    resources.DbProxyRole = {
+      Type: "AWS::IAM::Role",
+      Properties: {
+        AssumeRolePolicyDocument: {
+          Version: "2012-10-17",
+          Statement: [{ Effect: "Allow", Principal: { Service: "rds.amazonaws.com" }, Action: "sts:AssumeRole" }]
+        },
+        Policies: [{
+          PolicyName: "read-db-secret",
+          PolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [{ Effect: "Allow", Action: ["secretsmanager:GetSecretValue"], Resource: Fn2.ref("DbSecret") }]
+          }
+        }]
+      }
+    };
+    resources.DbProxy = {
+      Type: "AWS::RDS::DBProxy",
+      Properties: {
+        DBProxyName: typeof app.rdsProxy === "object" && app.rdsProxy.name ? app.rdsProxy.name : `${slug}-${environment}-proxy`,
+        EngineFamily: "MYSQL",
+        RoleArn: Fn2.getAtt("DbProxyRole", "Arn"),
+        Auth: [{ AuthScheme: "SECRETS", SecretArn: Fn2.ref("DbSecret"), IAMAuth: "DISABLED" }],
+        VpcSubnetIds: subnets,
+        VpcSecurityGroupIds: [Fn2.getAtt("DataSecurityGroup", "GroupId")],
+        RequireTLS: false
+      }
+    };
+    outputs.DbProxyEndpoint = { Description: "RDS Proxy endpoint", Value: Fn2.getAtt("DbProxy", "Endpoint") };
+  }
+  outputs.HttpFunctionName = { Description: "HTTP function name", Value: Fn2.ref("HttpFunction") };
+  outputs.CliFunctionName = { Description: "CLI function name", Value: Fn2.ref("CliFunction") };
+  if (hasQueue)
+    outputs.QueueFunctionName = { Description: "Queue function name", Value: Fn2.ref("QueueFunction") };
+  const template = {
+    AWSTemplateFormatVersion: "2010-09-09",
+    Description: `Serverless application for ${opts.config.project.name} (${slug}-${environment})`,
+    Parameters: imageMode ? {
+      ImageUri: { Type: "String", Description: "ECR image URI of the deployment artifact" }
+    } : {
+      ArtifactBucket: { Type: "String", Description: "S3 bucket holding the deployment artifact" },
+      ArtifactKey: { Type: "String", Description: "S3 key of the deployment artifact (zip)" }
+    },
+    Resources: resources,
+    Outputs: outputs
+  };
+  const resourceSummary = {};
+  for (const r of Object.values(resources)) {
+    resourceSummary[r.Type] = (resourceSummary[r.Type] ?? 0) + 1;
+  }
+  return { template, functionNames, queueNames, resourceSummary };
+}
+var PHP_LAYER_EXTENSIONS = [
+  "cli",
+  "fpm",
+  "mbstring",
+  "xml",
+  "pdo",
+  "mysqlnd",
+  "gd",
+  "bcmath",
+  "intl",
+  "opcache",
+  "sodium",
+  "process",
+  "pecl-redis6",
+  "pecl-apcu",
+  "pgsql"
+];
+function phpLayerPackages(phpVersion) {
+  const scl = `php${phpVersion.replace(".", "")}`;
+  return PHP_LAYER_EXTENSIONS.map((ext) => `${scl}-php-${ext}`);
+}
+function phpLayerBuildStage(phpVersion, asName) {
+  const scl = `php${phpVersion.replace(".", "")}`;
+  const packages = phpLayerPackages(phpVersion).join(" \\\n      ");
+  const sclRoot = `/opt/remi/${scl}/root`;
+  const from = asName ? `FROM amazonlinux:2023 AS ${asName}` : "FROM amazonlinux:2023";
+  return `${from}
+
+# Remi provides version-isolated PHP SCL packages for EL9 (AL2023 compatible).
+RUN dnf -y install dnf-plugins-core 'dnf-command(config-manager)' && \\
+    dnf -y install https://rpms.remirepo.net/enterprise/remi-release-9.rpm && \\
+    dnf -y update && \\
+    dnf -y install \\
+      ${packages} \\
+      findutils tar gzip && \\
+    dnf clean all
+
+# Relocate PHP + php-fpm + extensions and their shared libs under /opt.
+RUN set -eux; \\
+    mkdir -p /opt/php/bin /opt/php/sbin /opt/php/lib /opt/php/lib/php/modules /opt/php/etc/php.d /opt/tscloud; \\
+    cp ${sclRoot}/usr/bin/php /opt/php/bin/php; \\
+    cp ${sclRoot}/usr/sbin/php-fpm /opt/php/sbin/php-fpm; \\
+    EXT_DIR="$(${sclRoot}/usr/bin/php -r 'echo ini_get("extension_dir");')"; \\
+    cp -a "$EXT_DIR"/*.so /opt/php/lib/php/modules/ || true; \\
+    cp -a ${sclRoot}/etc/php.d/*.ini /opt/php/etc/php.d/ 2>/dev/null || true; \\
+    # Copy shared-library dependencies of php, php-fpm, and the extension modules.
+    for bin in /opt/php/bin/php /opt/php/sbin/php-fpm /opt/php/lib/php/modules/*.so; do \\
+      ldd "$bin" 2>/dev/null | awk '/=>/{print $3}/ld-linux/{print $1}' | sort -u | while read -r lib; do \\
+        [ -f "$lib" ] && cp -Ln "$lib" /opt/php/lib/ || true; \\
+      done; \\
+    done
+
+# Point PHP at the relocated config + extension dir.
+RUN printf 'extension_dir=/opt/php/lib/php/modules\\n' > /opt/php/etc/php.ini && \\
+    cat /opt/php/etc/php.d/*.ini >> /opt/php/etc/php.ini 2>/dev/null || true
+ENV PHP_INI_SCAN_DIR=/opt/php/etc/php.d
+
+# Runtime assets (bootstrap, runtime loops, fpm config) are added by the build
+# orchestrator after the image is produced. Export /opt as the layer payload.
+CMD ["true"]
+`;
+}
+function generatePhpLayerDockerfile(options = {}) {
+  const phpVersion = options.phpVersion ?? "8.3";
+  return `# ts-cloud PHP ${phpVersion} runtime layer (generated) — AWS Lambda provided.al2023.
+${phpLayerBuildStage(phpVersion)}`;
+}
+function generateAppImageDockerfile(options) {
+  if (options.kind === "php") {
+    const phpVersion = options.phpVersion ?? "8.3";
+    return `# ts-cloud serverless PHP app image (generated, multi-stage).
+${phpLayerBuildStage(phpVersion, "phpbuild")}
+
+FROM public.ecr.aws/lambda/provided:al2023
+# Bake the relocated PHP runtime from the build stage.
+COPY --from=phpbuild /opt/ /opt/
+# ts-cloud runtime assets (bootstrap, runtime loops, fpm config).
+COPY runtime/ /opt/
+# The application source tree.
+COPY app/ /var/task/
+# /opt/bootstrap is the runtime entrypoint; mode comes from TSCLOUD_LAMBDA_MODE.
+ENTRYPOINT [ "/opt/bootstrap" ]
+`;
+  }
+  const nodeMajor = options.nodeMajor ?? "20";
+  return `# ts-cloud serverless Node app image (generated).
+FROM public.ecr.aws/lambda/nodejs:${nodeMajor}
+
+# The bundled handler artifact (index.mjs) at the Lambda task root.
+COPY app/ \${LAMBDA_TASK_ROOT}/
+
+# Per-function CMD (e.g. index.http) is supplied via ImageConfig.Command.
+CMD [ "index.http" ]
+`;
+}
+function resolveApp(mod) {
+  const m = mod;
+  const def = m?.default ?? m;
+  if (typeof def === "function")
+    return { fetch: def };
+  return {
+    fetch: def?.fetch ?? m?.fetch,
+    queue: def?.queue ?? m?.queue,
+    cli: def?.cli ?? m?.cli
+  };
+}
+var TEXT_CONTENT = /^(?:text\/|application\/(?:json|xml|javascript|graphql|x-www-form-urlencoded|.*\+json|.*\+xml)|image\/svg)/i;
+function isTextContentType(contentType) {
+  if (!contentType)
+    return true;
+  return TEXT_CONTENT.test(contentType);
+}
+function readMaintenance(opts) {
+  if (opts?.maintenance)
+    return opts.maintenance;
+  const env = globalThis.process?.env ?? {};
+  return {
+    enabled: env.MAINTENANCE_MODE === "1" || env.MAINTENANCE_MODE === "true",
+    bypassSecret: env.MAINTENANCE_BYPASS_SECRET
+  };
+}
+function eventToRequest(event) {
+  const host = event.requestContext?.domainName ?? "localhost";
+  const query = event.rawQueryString ? `?${event.rawQueryString}` : "";
+  const url = `https://${host}${event.rawPath || "/"}${query}`;
+  const headers = new Headers;
+  for (const [key, value] of Object.entries(event.headers ?? {})) {
+    if (value !== undefined)
+      headers.set(key, value);
+  }
+  if (event.cookies?.length)
+    headers.set("cookie", event.cookies.join("; "));
+  const method = event.requestContext.http.method;
+  let body;
+  if (event.body !== undefined && method !== "GET" && method !== "HEAD") {
+    body = event.isBase64Encoded ? new Uint8Array(Buffer.from(event.body, "base64")) : new TextEncoder().encode(event.body);
+  }
+  return new Request(url, { method, headers, body });
+}
+async function responseToResult(response) {
+  const headers = {};
+  const cookies = [];
+  const setCookies = typeof response.headers.getSetCookie === "function" ? response.headers.getSetCookie() : [];
+  for (const c of setCookies)
+    cookies.push(c);
+  response.headers.forEach((value, key) => {
+    if (key.toLowerCase() === "set-cookie")
+      return;
+    headers[key] = value;
+  });
+  const buffer = Buffer.from(await response.arrayBuffer());
+  const textual = isTextContentType(response.headers.get("content-type"));
+  return {
+    statusCode: response.status,
+    headers,
+    ...cookies.length ? { cookies } : {},
+    body: textual ? buffer.toString("utf-8") : buffer.toString("base64"),
+    isBase64Encoded: !textual
+  };
+}
+function createHttpHandler(handler8, opts) {
+  return async (event) => {
+    if (event.warmer) {
+      return { statusCode: 200, headers: { "content-type": "text/plain" }, body: "warm", isBase64Encoded: false };
+    }
+    if (!handler8) {
+      return { statusCode: 501, headers: { "content-type": "text/plain" }, body: "No HTTP handler configured", isBase64Encoded: false };
+    }
+    const maintenance = readMaintenance(opts);
+    if (maintenance.enabled) {
+      const bypass = event.headers?.["x-maintenance-bypass"] ?? event.cookies?.find((c) => c.startsWith("tscloud_bypass="))?.split("=")[1];
+      if (!maintenance.bypassSecret || bypass !== maintenance.bypassSecret) {
+        return {
+          statusCode: 503,
+          headers: { "content-type": "text/plain", "retry-after": "120" },
+          body: "Service temporarily unavailable (maintenance mode)",
+          isBase64Encoded: false
+        };
+      }
+    }
+    const request = eventToRequest(event);
+    const response = await handler8(request);
+    return responseToResult(response);
+  };
+}
+function parseRecordBody(body) {
+  try {
+    return JSON.parse(body);
+  } catch {
+    return body;
+  }
+}
+function createQueueHandler(handler8) {
+  return async (event) => {
+    const batchItemFailures = [];
+    if (!handler8)
+      return { batchItemFailures };
+    for (const record of event.Records ?? []) {
+      try {
+        await handler8(parseRecordBody(record.body), record);
+      } catch {
+        batchItemFailures.push({ itemIdentifier: record.messageId });
+      }
+    }
+    return { batchItemFailures };
+  };
+}
+function createCliHandler(handler8) {
+  return async (event) => {
+    if (!handler8)
+      return { statusCode: 501, output: "No CLI handler configured" };
+    return handler8(event);
+  };
+}
+function createHandlers(app, opts) {
+  return {
+    http: createHttpHandler(app.fetch, opts),
+    queue: createQueueHandler(app.queue),
+    cli: createCliHandler(app.cli)
+  };
+}
+function generatePhpFpmConfig(options = {}) {
+  const socket = options.socketPath ?? "/tmp/.tscloud-fpm.sock";
+  const maxChildren = options.maxChildren ?? 1;
+  const errorLog = options.errorLog ?? "/tmp/storage/logs/php-fpm.log";
+  return `; ts-cloud php-fpm configuration (generated) — AWS Lambda custom runtime.
+[global]
+daemonize = no
+error_log = ${errorLog}
+log_level = warning
+
+[www]
+listen = ${socket}
+listen.mode = 0666
+pm = static
+pm.max_children = ${maxChildren}
+catch_workers_output = yes
+decorate_workers_output = no
+; Surface fatal errors / fpm logs to the Lambda log stream.
+php_admin_value[error_log] = /dev/stderr
+php_admin_flag[log_errors] = on
+clear_env = no
+`;
+}
+function assetsDir() {
+  return join72(dirname32(fileURLToPath2(import.meta.url)), "runtime-assets");
+}
+function phpRuntimeLayerAssets() {
+  const dir = assetsDir();
+  const read = (f) => readFileSync4(join72(dir, f), "utf-8");
+  return [
+    { path: "bootstrap", contents: read("bootstrap"), mode: 493 },
+    { path: "tscloud/runtime.php", contents: read("runtime.php"), mode: 420 },
+    { path: "tscloud/octane-runtime.php", contents: read("octane-runtime.php"), mode: 420 },
+    { path: "tscloud/cli-runtime.php", contents: read("cli-runtime.php"), mode: 420 },
+    { path: "tscloud/fastcgi-client.php", contents: read("fastcgi-client.php"), mode: 420 },
+    { path: "tscloud/php-fpm.conf", contents: generatePhpFpmConfig(), mode: 420 }
+  ];
+}
+function laravelServerlessEnvDefaults(opts = {}) {
+  const cache2 = opts.cacheDriver ?? "dynamodb";
+  return {
+    APP_ENV: "production",
+    LOG_CHANNEL: "stderr",
+    CACHE_STORE: cache2,
+    CACHE_DRIVER: cache2,
+    SESSION_DRIVER: cache2,
+    QUEUE_CONNECTION: "sqs",
+    FILESYSTEM_DISK: "s3",
+    VIEW_COMPILED_PATH: "/tmp/storage/framework/views",
+    APP_SERVICES_CACHE: "/tmp/bootstrap/cache/services.php",
+    APP_PACKAGES_CACHE: "/tmp/bootstrap/cache/packages.php",
+    APP_CONFIG_CACHE: "/tmp/bootstrap/cache/config.php",
+    APP_ROUTES_CACHE: "/tmp/bootstrap/cache/routes.php",
+    APP_EVENTS_CACHE: "/tmp/bootstrap/cache/events.php"
+  };
+}
+var LARAVEL_SERVERLESS_BUILD_STEPS = [
+  "composer install --no-dev --optimize-autoloader --no-interaction",
+  "php artisan config:cache",
+  "php artisan route:cache",
+  "php artisan event:cache",
+  "php artisan view:cache"
+];
+function* walk(dir) {
+  for (const entry of readdirSync52(dir)) {
+    const full = join8(dir, entry);
+    if (statSync32(full).isDirectory())
+      yield* walk(full);
+    else
+      yield full;
+  }
+}
+function buildPhpRuntimeLayerZip(options = {}) {
+  const architecture = options.architecture ?? "x86_64";
+  const platform = options.platform ?? (architecture === "arm64" ? "linux/arm64" : "linux/amd64");
+  const step = options.onStep ?? (() => {});
+  const stage = mkdtempSync2(join8(tmpdir2(), "tscloud-php-layer-"));
+  const imageTag = "tscloud-php-layer:build";
+  try {
+    writeFileSync42(join8(stage, "Dockerfile"), generatePhpLayerDockerfile(options));
+    step("Building PHP runtime image (docker)");
+    execFileSync("docker", ["build", "--platform", platform, "-t", imageTag, stage], { stdio: "inherit" });
+    step("Extracting /opt from image");
+    const cid = execFileSync("docker", ["create", "--platform", platform, imageTag], { encoding: "utf-8" }).trim();
+    const optDir = join8(stage, "opt");
+    try {
+      execFileSync("docker", ["cp", `${cid}:/opt/.`, optDir], { stdio: "inherit" });
+    } finally {
+      execFileSync("docker", ["rm", cid], { stdio: "ignore" });
+    }
+    if (!existsSync52(optDir))
+      throw new Error("layer build produced no /opt directory");
+    const entries = [];
+    for (const file of walk(optDir)) {
+      const rel = relative22(optDir, file).replace(/\\/g, "/");
+      const mode = statSync32(file).mode & 73 ? 493 : 420;
+      entries.push({ name: rel, data: readFileSync5(file), mode });
+    }
+    step("Injecting runtime assets");
+    const assetPaths = new Set(phpRuntimeLayerAssets().map((a) => a.path));
+    const filtered = entries.filter((e) => !assetPaths.has(e.name));
+    for (const asset of phpRuntimeLayerAssets()) {
+      filtered.push({ name: asset.path, data: asset.contents, mode: asset.mode });
+    }
+    step("Packaging layer ZIP");
+    const zip2 = createZip(filtered);
+    return { zip: zip2, architecture, fileCount: filtered.length };
+  } finally {
+    rmSync2(stage, { recursive: true, force: true });
+  }
+}
+var PHP_DEFAULT_EXCLUDES = [
+  ".git",
+  ".github",
+  "node_modules",
+  "tests",
+  "storage/logs",
+  "storage/framework/cache",
+  "storage/framework/sessions",
+  "storage/framework/views",
+  ".env",
+  ".env.local",
+  ".vapor",
+  ".ts-cloud",
+  "dist-lambda"
+];
+function isExcluded(rel, excludes) {
+  return excludes.some((ex) => rel === ex || rel.startsWith(`${ex}/`));
+}
+function* walk2(dir, root, excludes) {
+  for (const entry of readdirSync62(dir)) {
+    const full = join9(dir, entry);
+    const rel = relative32(root, full).replace(/\\/g, "/");
+    if (isExcluded(rel, excludes))
+      continue;
+    if (statSync4(full).isDirectory())
+      yield* walk2(full, root, excludes);
+    else
+      yield full;
+  }
+}
+function runPhpBuildHooks(opts) {
+  if (opts.skipBuild)
+    return;
+  const projectRoot = resolve22(opts.projectRoot ?? process.cwd());
+  const steps = opts.app.build ?? LARAVEL_SERVERLESS_BUILD_STEPS;
+  for (const step of steps) {
+    opts.onStep?.(`build: ${step}`);
+    execSync2(step, { stdio: "inherit", cwd: projectRoot });
+  }
+}
+function collectPhpAppEntries(projectRoot, exclude = []) {
+  const root = resolve22(projectRoot);
+  const excludes = [...PHP_DEFAULT_EXCLUDES, ...exclude];
+  const entries = [];
+  for (const file of walk2(root, root, excludes)) {
+    const rel = relative32(root, file).replace(/\\/g, "/");
+    const executable = (statSync4(file).mode & 73) !== 0;
+    entries.push({ name: rel, data: readFileSync6(file), mode: executable ? 493 : 420 });
+  }
+  return entries;
+}
+function packagePhpApp(opts) {
+  const projectRoot = resolve22(opts.projectRoot ?? process.cwd());
+  runPhpBuildHooks(opts);
+  opts.onStep?.("packaging application tree");
+  const entries = collectPhpAppEntries(projectRoot, opts.exclude);
+  if (!entries.length)
+    throw new Error(`No files to package under ${projectRoot}`);
+  const zip2 = createZip(entries);
+  const handler8 = opts.app.handlers?.http ?? "public/index.php";
+  return {
+    zip: zip2,
+    sha256: createHash5("sha256").update(zip2).digest("hex"),
+    handlers: {
+      http: handler8,
+      queue: opts.app.handlers?.queue ?? handler8,
+      cli: opts.app.handlers?.cli ?? handler8
+    },
+    fileCount: entries.length
+  };
+}
 
 class StaticSiteManager {
   optimizations = new Map;
@@ -68336,7 +69572,7 @@ class EC2Client {
       if (instance?.State?.Name === targetState) {
         return instance;
       }
-      await new Promise((resolve13) => setTimeout(resolve13, pollInterval));
+      await new Promise((resolve14) => setTimeout(resolve14, pollInterval));
     }
     return;
   }
@@ -69796,7 +71032,7 @@ class ECSClient {
           return true;
         }
       }
-      await new Promise((resolve13) => setTimeout(resolve13, delayMs));
+      await new Promise((resolve14) => setTimeout(resolve14, delayMs));
     }
     return false;
   }
@@ -70337,7 +71573,7 @@ class SSMClient {
     const maxWait = options?.maxWaitMs || 300000;
     const startTime = Date.now();
     while (Date.now() - startTime < maxWait) {
-      await new Promise((resolve13) => setTimeout(resolve13, pollInterval));
+      await new Promise((resolve14) => setTimeout(resolve14, pollInterval));
       try {
         const invocation = await this.getCommandInvocation({
           CommandId: sendResult.CommandId,
@@ -70415,7 +71651,7 @@ class SSMClient {
     const terminalStatuses = new Set(["Success", "Failed", "Cancelled", "TimedOut"]);
     let lastInvocations = [];
     while (Date.now() - startTime < maxWait) {
-      await new Promise((resolve13) => setTimeout(resolve13, pollInterval));
+      await new Promise((resolve14) => setTimeout(resolve14, pollInterval));
       try {
         lastInvocations = await this.listCommandInvocations({
           CommandId: sendResult.CommandId,
@@ -71696,11 +72932,11 @@ class SQSClient {
 }
 // src/aws/lambda.ts
 init_client();
-import { deflateRawSync } from "zlib";
+import { deflateRawSync as deflateRawSync2 } from "zlib";
 function createZipFile(filename, content) {
   const data = typeof content === "string" ? Buffer.from(content, "utf-8") : content;
-  const compressedData = deflateRawSync(data);
-  const crc32 = calculateCrc32(data);
+  const compressedData = deflateRawSync2(data);
+  const crc322 = calculateCrc32(data);
   const now = new Date;
   const dosTime = (now.getHours() << 11 | now.getMinutes() << 5 | now.getSeconds() >> 1) & 65535;
   const dosDate = (now.getFullYear() - 1980 << 9 | now.getMonth() + 1 << 5 | now.getDate()) & 65535;
@@ -71712,7 +72948,7 @@ function createZipFile(filename, content) {
   localHeader.writeUInt16LE(8, 8);
   localHeader.writeUInt16LE(dosTime, 10);
   localHeader.writeUInt16LE(dosDate, 12);
-  localHeader.writeUInt32LE(crc32, 14);
+  localHeader.writeUInt32LE(crc322, 14);
   localHeader.writeUInt32LE(compressedData.length, 18);
   localHeader.writeUInt32LE(data.length, 22);
   localHeader.writeUInt16LE(filenameBuffer.length, 26);
@@ -71726,7 +72962,7 @@ function createZipFile(filename, content) {
   centralHeader.writeUInt16LE(8, 10);
   centralHeader.writeUInt16LE(dosTime, 12);
   centralHeader.writeUInt16LE(dosDate, 14);
-  centralHeader.writeUInt32LE(crc32, 16);
+  centralHeader.writeUInt32LE(crc322, 16);
   centralHeader.writeUInt32LE(compressedData.length, 20);
   centralHeader.writeUInt32LE(data.length, 24);
   centralHeader.writeUInt16LE(filenameBuffer.length, 28);
@@ -71957,10 +73193,10 @@ class LambdaClient {
         if (state === "Failed") {
           throw new Error(`Function ${functionName} failed: ${response.Configuration?.StateReason}`);
         }
-        await new Promise((resolve13) => setTimeout(resolve13, 2000));
+        await new Promise((resolve14) => setTimeout(resolve14, 2000));
       } catch (error) {
         if (error.code === "ResourceNotFoundException") {
-          await new Promise((resolve13) => setTimeout(resolve13, 2000));
+          await new Promise((resolve14) => setTimeout(resolve14, 2000));
           continue;
         }
         throw error;
@@ -73898,7 +75134,7 @@ class RDSClient {
       if (["deleted", "failed", "incompatible-restore", "incompatible-parameters"].includes(instance?.DBInstanceStatus || "")) {
         throw new Error(`DB instance ${dbInstanceIdentifier} is in terminal state: ${instance?.DBInstanceStatus}`);
       }
-      await new Promise((resolve13) => setTimeout(resolve13, delayMs));
+      await new Promise((resolve14) => setTimeout(resolve14, delayMs));
     }
     throw new Error(`Timeout waiting for DB instance ${dbInstanceIdentifier} to become available`);
   }
@@ -73907,7 +75143,7 @@ class RDSClient {
       try {
         const instance = await this.describeDBInstance(dbInstanceIdentifier);
         if (instance?.DBInstanceStatus === "deleting") {
-          await new Promise((resolve13) => setTimeout(resolve13, delayMs));
+          await new Promise((resolve14) => setTimeout(resolve14, delayMs));
           continue;
         }
         throw new Error(`DB instance ${dbInstanceIdentifier} is in state: ${instance?.DBInstanceStatus}`);
@@ -74678,7 +75914,7 @@ class BedrockClient {
       if (job.status === "Completed" || job.status === "Failed" || job.status === "Stopped") {
         return job;
       }
-      await new Promise((resolve13) => setTimeout(resolve13, pollIntervalMs));
+      await new Promise((resolve14) => setTimeout(resolve14, pollIntervalMs));
     }
     throw new Error(`Timeout waiting for model customization job ${jobIdentifier}`);
   }
@@ -75442,7 +76678,7 @@ class TextractClient {
       if (result.JobStatus === "FAILED") {
         throw new Error(`Textract job ${jobId} failed`);
       }
-      await new Promise((resolve13) => setTimeout(resolve13, pollIntervalMs));
+      await new Promise((resolve14) => setTimeout(resolve14, pollIntervalMs));
     }
     throw new Error(`Timeout waiting for Textract job ${jobId}`);
   }
@@ -75645,7 +76881,7 @@ class PollyClient {
       if (task?.TaskStatus === "failed") {
         throw new Error(`Polly task ${taskId} failed: ${task.TaskStatusReason}`);
       }
-      await new Promise((resolve13) => setTimeout(resolve13, pollIntervalMs));
+      await new Promise((resolve14) => setTimeout(resolve14, pollIntervalMs));
     }
     throw new Error(`Timeout waiting for Polly task ${taskId}`);
   }
@@ -75755,7 +76991,7 @@ class TranslateClient {
       if (job?.JobStatus === "FAILED" || job?.JobStatus === "STOPPED") {
         throw new Error(`Translation job ${jobId} failed: ${job.Message}`);
       }
-      await new Promise((resolve13) => setTimeout(resolve13, pollIntervalMs));
+      await new Promise((resolve14) => setTimeout(resolve14, pollIntervalMs));
     }
     throw new Error(`Timeout waiting for translation job ${jobId}`);
   }
@@ -75857,7 +77093,7 @@ class PersonalizeClient {
       if (sv?.status === "CREATE FAILED") {
         throw new Error(`Solution version failed: ${sv.failureReason}`);
       }
-      await new Promise((resolve13) => setTimeout(resolve13, pollIntervalMs));
+      await new Promise((resolve14) => setTimeout(resolve14, pollIntervalMs));
     }
     throw new Error(`Timeout waiting for solution version ${solutionVersionArn}`);
   }
@@ -75874,7 +77110,7 @@ class PersonalizeClient {
       if (campaign?.status === "CREATE FAILED") {
         throw new Error(`Campaign failed: ${campaign.failureReason}`);
       }
-      await new Promise((resolve13) => setTimeout(resolve13, pollIntervalMs));
+      await new Promise((resolve14) => setTimeout(resolve14, pollIntervalMs));
     }
     throw new Error(`Timeout waiting for campaign ${campaignArn}`);
   }
@@ -75891,7 +77127,7 @@ class PersonalizeClient {
       if (job?.status === "CREATE FAILED") {
         throw new Error(`Dataset import job failed: ${job.failureReason}`);
       }
-      await new Promise((resolve13) => setTimeout(resolve13, pollIntervalMs));
+      await new Promise((resolve14) => setTimeout(resolve14, pollIntervalMs));
     }
     throw new Error(`Timeout waiting for dataset import job ${jobArn}`);
   }
@@ -76046,7 +77282,7 @@ class KendraClient {
       if (result.Status === "FAILED") {
         throw new Error(`Index creation failed: ${result.ErrorMessage}`);
       }
-      await new Promise((resolve13) => setTimeout(resolve13, pollIntervalMs));
+      await new Promise((resolve14) => setTimeout(resolve14, pollIntervalMs));
     }
     throw new Error(`Timeout waiting for index ${indexId}`);
   }
@@ -76065,7 +77301,7 @@ class KendraClient {
       if (result.Status === "FAILED") {
         throw new Error(`Data source creation failed: ${result.ErrorMessage}`);
       }
-      await new Promise((resolve13) => setTimeout(resolve13, pollIntervalMs));
+      await new Promise((resolve14) => setTimeout(resolve14, pollIntervalMs));
     }
     throw new Error(`Timeout waiting for data source ${dataSourceId}`);
   }
@@ -77099,7 +78335,7 @@ class ApplicationAutoScalingClient {
 init_s3();
 import * as net from "node:net";
 import * as tls from "node:tls";
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 import * as crypto4 from "node:crypto";
 
 class ImapServer {
@@ -77134,8 +78370,8 @@ class ImapServer {
     });
     if (this.config.tls?.key && this.config.tls?.cert) {
       const tlsOptions = {
-        key: readFileSync7(this.config.tls.key),
-        cert: readFileSync7(this.config.tls.cert)
+        key: readFileSync10(this.config.tls.key),
+        cert: readFileSync10(this.config.tls.cert)
       };
       this.tlsServer = tls.createServer(tlsOptions, (socket) => {
         this.handleConnection(socket);
@@ -77939,8 +79175,8 @@ class ImapServer {
     }
     this.send(session, `${tag} OK Begin TLS negotiation`);
     const tlsOptions = {
-      key: readFileSync7(this.config.tls.key),
-      cert: readFileSync7(this.config.tls.cert),
+      key: readFileSync10(this.config.tls.key),
+      cert: readFileSync10(this.config.tls.cert),
       isServer: true
     };
     const tlsSocket = new tls.TLSSocket(session.socket, tlsOptions);
@@ -78533,7 +79769,7 @@ init_ses();
 init_s3();
 import * as net2 from "node:net";
 import * as tls2 from "node:tls";
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 import * as crypto5 from "node:crypto";
 
 class SmtpServer {
@@ -78564,8 +79800,8 @@ class SmtpServer {
     });
     if (this.config.tls?.key && this.config.tls?.cert) {
       const tlsOptions = {
-        key: readFileSync8(this.config.tls.key),
-        cert: readFileSync8(this.config.tls.cert)
+        key: readFileSync11(this.config.tls.key),
+        cert: readFileSync11(this.config.tls.cert)
       };
       this.tlsServer = tls2.createServer(tlsOptions, (socket) => {
         this.handleConnection(socket, true);
@@ -78699,8 +79935,8 @@ class SmtpServer {
     }
     this.send(session, "220 Ready to start TLS");
     const tlsOptions = {
-      key: readFileSync8(this.config.tls.key),
-      cert: readFileSync8(this.config.tls.cert),
+      key: readFileSync11(this.config.tls.key),
+      cert: readFileSync11(this.config.tls.cert),
       isServer: true
     };
     const tlsSocket = new tls2.TLSSocket(session.socket, tlsOptions);
@@ -79469,7 +80705,7 @@ class SmsClient {
       if (receipt && (receipt.status === "delivered" || receipt.status === "failed")) {
         return receipt;
       }
-      await new Promise((resolve13) => setTimeout(resolve13, pollInterval));
+      await new Promise((resolve14) => setTimeout(resolve14, pollInterval));
     }
     return await this.getDeliveryReceipt(messageId);
   }
@@ -81041,15 +82277,15 @@ async function cleanupDns01Challenge(options) {
 }
 function needsRenewal(certPath) {
   try {
-    const { execSync } = __require("node:child_process");
-    const _result = execSync(`openssl x509 -checkend 2592000 -noout -in ${certPath}/cert.pem`, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+    const { execSync: execSync3 } = __require("node:child_process");
+    const _result = execSync3(`openssl x509 -checkend 2592000 -noout -in ${certPath}/cert.pem`, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
     return false;
   } catch {
     return true;
   }
 }
 // src/ssl/acme-client.ts
-import { createHash as createHash7, createSign, generateKeyPairSync } from "node:crypto";
+import { createHash as createHash9, createSign, generateKeyPairSync } from "node:crypto";
 var ACME_DIRECTORIES = {
   production: "https://acme-v02.api.letsencrypt.org/directory",
   staging: "https://acme-staging-v02.api.letsencrypt.org/directory"
@@ -81119,7 +82355,7 @@ class AcmeClient {
       x: jwk.x,
       y: jwk.y
     });
-    const hash2 = createHash7("sha256").update(canonical).digest();
+    const hash2 = createHash9("sha256").update(canonical).digest();
     return this.base64UrlEncode(hash2);
   }
   base64UrlEncode(data) {
@@ -81232,7 +82468,7 @@ class AcmeClient {
           identifier: `/.well-known/acme-challenge/${c.token}`
         };
       } else {
-        const dnsValue = this.base64UrlEncode(createHash7("sha256").update(keyAuthorization).digest());
+        const dnsValue = this.base64UrlEncode(createHash9("sha256").update(keyAuthorization).digest());
         return {
           type: "dns-01",
           token: c.token,
@@ -81256,7 +82492,7 @@ class AcmeClient {
       if (body.status === "invalid") {
         throw new Error(`Authorization failed: ${JSON.stringify(body)}`);
       }
-      await new Promise((resolve13) => setTimeout(resolve13, 2000));
+      await new Promise((resolve14) => setTimeout(resolve14, 2000));
     }
     throw new Error("Authorization timed out");
   }
@@ -81399,11 +82635,11 @@ init_static_site_external_dns();
 init_static_site_external_dns();
 import process19 from "node:process";
 import { existsSync as existsSync16 } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join13 } from "node:path";
 async function deploySite(config6) {
   const start = Date.now();
   const sourceDir = config6.sourceDir ?? "dist";
-  if (!existsSync16(join11(sourceDir, "index.html"))) {
+  if (!existsSync16(join13(sourceDir, "index.html"))) {
     return fail(start, `${sourceDir}/ has no index.html — build first.`);
   }
   if (!process19.env.AWS_ACCESS_KEY_ID || !process19.env.AWS_SECRET_ACCESS_KEY) {
@@ -81472,10 +82708,46 @@ function fail(start, message) {
   return { success: false, message, durationMs: Date.now() - start };
 }
 // src/drivers/aws/driver.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 init_cloudformation();
 init_s3();
 
+// src/drivers/shared/package-manager.ts
+var PANTRY_INSTALL_DIR = "/usr/local/bin";
+var PANTRY_PROJECT_DIR = "/opt/pantry";
+function sh(value) {
+  return `'${value.split("'").join("'\\''")}'`;
+}
+function buildPantryBootstrapScript(options = {}) {
+  const versionLine = options.version ? `export PANTRY_VERSION=${sh(options.version)}` : 'export PANTRY_VERSION="${PANTRY_VERSION:-latest}"';
+  return [
+    "export DEBIAN_FRONTEND=noninteractive",
+    "export PANTRY_SERVICE_SCOPE=system",
+    `export PANTRY_INSTALL_DIR=${PANTRY_INSTALL_DIR}`,
+    versionLine,
+    "command -v curl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y curl ca-certificates)",
+    "command -v unzip >/dev/null 2>&1 || (apt-get update -y && apt-get install -y unzip)",
+    "command -v pantry >/dev/null 2>&1 || curl -fsSL https://pantry.dev | bash",
+    `export PATH="${PANTRY_INSTALL_DIR}:$PATH"`,
+    `mkdir -p ${PANTRY_PROJECT_DIR}`
+  ];
+}
+function pantryEnvActivation() {
+  return `eval "$(cd ${PANTRY_PROJECT_DIR} && pantry env 2>/dev/null)" || true`;
+}
+function buildPantryInstallScript(specs) {
+  if (specs.length === 0)
+    return [];
+  const unique = [...new Set(specs)];
+  return [`(cd ${PANTRY_PROJECT_DIR} && pantry install ${unique.map(sh).join(" ")})`];
+}
+function buildPantryServiceScript(services) {
+  return [...new Set(services)].flatMap((name) => [
+    `(cd ${PANTRY_PROJECT_DIR} && pantry start ${sh(name)})`,
+    `(cd ${PANTRY_PROJECT_DIR} && pantry enable ${sh(name)})`
+  ]);
+}
+
 // src/drivers/shared/db-provision.ts
 function enabled(spec) {
   return spec === true || typeof spec === "object" && spec != null;
@@ -81484,50 +82756,42 @@ function sq(value) {
   const escaped = value.split("'").join("'\\''");
   return `'${escaped}'`;
 }
-function buildServicesProvisionScript(services = {}, options = {}) {
-  const out = ["export DEBIAN_FRONTEND=noninteractive"];
-  let touchedApt = false;
-  const ensureUpdate = () => {
-    if (!touchedApt) {
-      out.push("apt-get update -y");
-      touchedApt = true;
-    }
-  };
-  const bind = options.bindPrivate === true;
-  if (enabled(services.mysql) || enabled(services.mariadb)) {
-    ensureUpdate();
-    const pkg = enabled(services.mysql) ? "mysql-server" : "mariadb-server";
-    const svc = enabled(services.mysql) ? "mysql" : "mariadb";
-    out.push(`apt-get install -y ${pkg}`);
-    if (bind) {
-      out.push("find /etc/mysql -name '*.cnf' -exec sed -i 's/^[[:space:]]*bind-address.*/bind-address = 0.0.0.0/; s/^[[:space:]]*mysqlx-bind-address.*/mysqlx-bind-address = 0.0.0.0/' {} + 2>/dev/null || true", `for d in /etc/mysql/mysql.conf.d /etc/mysql/mariadb.conf.d; do [ -d "$d" ] && printf '[mysqld]\\nbind-address = 0.0.0.0\\n' > "$d/zz-ts-cloud-bind.cnf"; done`);
-    }
-    out.push(`systemctl enable ${svc}`, `systemctl restart ${svc}`);
+function planServices(services) {
+  const packages = [];
+  const names = [];
+  if (enabled(services.mysql)) {
+    packages.push("mysql.com");
+    names.push("mysql");
+  } else if (enabled(services.mariadb)) {
+    packages.push("mariadb.org");
+    names.push("mariadb");
   }
   if (enabled(services.postgres)) {
-    ensureUpdate();
-    out.push("apt-get install -y postgresql postgresql-contrib");
-    if (bind) {
-      out.push(`echo "listen_addresses = '*'" > /etc/postgresql/conf.d-ts-cloud.conf 2>/dev/null || true`, `CONF=$(ls /etc/postgresql/*/main/postgresql.conf 2>/dev/null | head -1); [ -n "$CONF" ] && sed -i "s/^#\\?listen_addresses.*/listen_addresses = '*'/" "$CONF" || true`, 'HBA=$(ls /etc/postgresql/*/main/pg_hba.conf 2>/dev/null | head -1); [ -n "$HBA" ] && echo "host all all 10.0.0.0/8 md5" >> "$HBA" || true');
-    }
-    out.push("systemctl enable postgresql", "systemctl restart postgresql");
+    packages.push("postgresql.org");
+    names.push("postgres");
   }
   if (enabled(services.redis)) {
-    ensureUpdate();
-    out.push("apt-get install -y redis-server");
-    if (bind) {
-      out.push("sed -i 's/^bind .*/bind 0.0.0.0/' /etc/redis/redis.conf || true", "sed -i 's/^protected-mode yes/protected-mode no/' /etc/redis/redis.conf || true");
-    }
-    out.push("systemctl enable redis-server", "systemctl restart redis-server");
+    packages.push("redis.io");
+    names.push("redis");
   }
   if (enabled(services.memcached)) {
-    ensureUpdate();
-    out.push("apt-get install -y memcached", "systemctl enable memcached", "systemctl start memcached");
+    packages.push("memcached.org");
+    names.push("memcached");
   }
   if (enabled(services.meilisearch)) {
-    out.push("curl -fsSL https://install.meilisearch.com | sh", "mv ./meilisearch /usr/local/bin/meilisearch", "getent passwd meilisearch >/dev/null || useradd --system --home-dir /var/lib/meilisearch --create-home --shell /usr/sbin/nologin meilisearch", "mkdir -p /var/lib/meilisearch", "chown -R meilisearch:meilisearch /var/lib/meilisearch", "cat > /etc/systemd/system/meilisearch.service <<'TS_CLOUD_MEILI_EOF'", "[Unit]", "Description=Meilisearch", "After=network.target", "", "[Service]", "Type=simple", "User=meilisearch", "Group=meilisearch", `ExecStart=/usr/local/bin/meilisearch --db-path /var/lib/meilisearch/data --env production${bind ? " --http-addr 0.0.0.0:7700" : ""}`, "Restart=always", "RestartSec=5", "", "[Install]", "WantedBy=multi-user.target", "TS_CLOUD_MEILI_EOF", "systemctl daemon-reload", "systemctl enable meilisearch", "systemctl start meilisearch");
+    packages.push("meilisearch.com");
+    names.push("meilisearch");
   }
-  return out;
+  return { packages, services: names };
+}
+function buildServicesProvisionScript(services = {}, _options = {}) {
+  const plan = planServices(services);
+  if (plan.packages.length === 0)
+    return [];
+  return [
+    ...buildPantryInstallScript(plan.packages),
+    ...buildPantryServiceScript(plan.services)
+  ];
 }
 function buildDatabaseSetupScript(database, services = {}) {
   if (!database?.name)
@@ -81541,15 +82805,18 @@ function buildDatabaseSetupScript(database, services = {}) {
   const useMariadb = enabled(services.mariadb) || database.engine === "mariadb";
   const useMysql = enabled(services.mysql) || database.engine === "mysql";
   if (usePostgres && !useMysql && !useMariadb) {
+    const psql = "psql -h 127.0.0.1 -p 5432 -U postgres";
     return [
-      `sudo -u postgres psql -tc "SELECT 1 FROM pg_roles WHERE rolname=${sq(user)}" | grep -q 1 ` + `|| sudo -u postgres psql -c "CREATE ROLE ${sq(user)} LOGIN PASSWORD ${sq(pass)};"`,
-      `sudo -u postgres psql -tc "SELECT 1 FROM pg_database WHERE datname=${sq(name)}" | grep -q 1 ` + `|| sudo -u postgres psql -c "CREATE DATABASE ${sq(name)} OWNER ${sq(user)};"`
+      pantryEnvActivation(),
+      `${psql} -tc "SELECT 1 FROM pg_roles WHERE rolname=${sq(user)}" | grep -q 1 ` + `|| ${psql} -c "CREATE ROLE ${sq(user)} LOGIN PASSWORD ${sq(pass)};"`,
+      `${psql} -tc "SELECT 1 FROM pg_database WHERE datname=${sq(name)}" | grep -q 1 ` + `|| ${psql} -c "CREATE DATABASE ${sq(name)} OWNER ${sq(user)};"`
     ];
   }
   const ident = (v) => v.replace(/`/g, "``");
   const lit = (v) => v.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
   return [
-    "mysql <<'TS_CLOUD_SQL_EOF'",
+    pantryEnvActivation(),
+    "mysql -h 127.0.0.1 -P 3306 -u root <<'TS_CLOUD_SQL_EOF'",
     `CREATE DATABASE IF NOT EXISTS \`${ident(name)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`,
     `CREATE USER IF NOT EXISTS '${lit(user)}'@'%' IDENTIFIED BY '${lit(pass)}';`,
     `GRANT ALL PRIVILEGES ON \`${ident(name)}\`.* TO '${lit(user)}'@'%';`,
@@ -81576,60 +82843,225 @@ function buildManagedDbEnv(database) {
 }
 
 // src/drivers/shared/php-provision.ts
-var LARAVEL_PHP_EXTENSIONS = [
-  "fpm",
-  "cli",
-  "common",
-  "mbstring",
-  "xml",
-  "curl",
-  "mysql",
-  "pgsql",
-  "sqlite3",
-  "redis",
-  "gd",
-  "bcmath",
-  "zip",
-  "intl",
-  "readline",
-  "soap",
-  "gmp",
-  "opcache"
-];
-function phpPackagesForVersion(version2, extensions) {
-  return extensions.map((suffix) => `php${version2}-${suffix}`);
+var PHP_FPM_LISTEN = "127.0.0.1:9074";
+function phpFpmSocketPath(_version) {
+  return PHP_FPM_LISTEN;
 }
-function phpFpmSocketPath(version2) {
-  return `/run/php/php${version2}-fpm.sock`;
+function resolveDefaultPhpVersion(options = {}) {
+  const versions = options.versions?.length ? options.versions : ["8.3"];
+  return options.default && versions.includes(options.default) ? options.default : versions[0];
 }
 function buildPhpProvisionScript(options = {}) {
-  const versions = options.versions?.length ? [...new Set(options.versions)] : ["8.3"];
-  const defaultVersion = options.default && versions.includes(options.default) ? options.default : versions[0];
+  const defaultVersion = resolveDefaultPhpVersion(options);
   const installNginx = options.installNginx !== false;
   const installComposer = options.installComposer !== false;
-  const extensions = [...new Set([...LARAVEL_PHP_EXTENSIONS, ...options.extensions || []])];
+  const specs = [`php.net@${defaultVersion}`];
+  if (installComposer)
+    specs.push("getcomposer.org");
+  if (installNginx)
+    specs.push("nginx.org");
+  return [
+    ...buildPantryInstallScript(specs),
+    ...buildPantryServiceScript(["php-fpm"])
+  ];
+}
+
+// src/drivers/shared/nginx-vhost.ts
+function htpasswdPath(siteName) {
+  return `/etc/nginx/.htpasswd-${siteName}`;
+}
+var PHP_TYPES = new Set(["laravel", "php", "statamic", "wordpress"]);
+function isPhpSiteType(type) {
+  return PHP_TYPES.has(type);
+}
+function defaultWebDirectory(type) {
+  return type === "laravel" || type === "statamic" || type === "wordpress" ? "public" : "";
+}
+function resolveRoot(appDir, webDirectory) {
+  const base = appDir.replace(/\/+$/, "");
+  const sub = webDirectory.replace(/^\/+|\/+$/g, "");
+  return sub ? `${base}/${sub}` : base;
+}
+function vhostBody(options) {
+  const type = options.type ?? "laravel";
+  const webDirectory = options.webDirectory ?? defaultWebDirectory(type);
+  const root = resolveRoot(options.appDir, webDirectory);
+  const isPhp = isPhpSiteType(type);
+  const phpVersion = options.phpVersion ?? "8.3";
   const lines = [
-    "export DEBIAN_FRONTEND=noninteractive",
-    'export HOME="${HOME:-/root}"',
-    'export COMPOSER_HOME="${COMPOSER_HOME:-/root/.composer}"',
-    "apt-get update -y",
-    "apt-get install -y software-properties-common ca-certificates apt-transport-https lsb-release gnupg",
-    "add-apt-repository -y ppa:ondrej/php",
-    "apt-get update -y"
+    `    root ${root};`,
+    "",
+    '    add_header X-Frame-Options "SAMEORIGIN";',
+    '    add_header X-Content-Type-Options "nosniff";',
+    "",
+    `    index ${isPhp ? "index.php index.html" : "index.html index.htm"};`,
+    "",
+    "    charset utf-8;",
+    ""
   ];
-  if (installNginx) {
-    lines.push("apt-get install -y nginx", "systemctl enable nginx");
+  if (options.auth) {
+    lines.push(`    auth_basic "${options.auth.realm || "Restricted"}";`, `    auth_basic_user_file ${htpasswdPath(options.siteName)};`, "");
   }
-  for (const version2 of versions) {
-    const pkgs = phpPackagesForVersion(version2, extensions);
-    lines.push(`apt-get install -y ${pkgs.join(" ")}`, `systemctl enable php${version2}-fpm`, `systemctl start php${version2}-fpm`);
+  for (const [from, to] of Object.entries(options.redirects || {})) {
+    lines.push(`    location = ${from} { return 301 ${to}; }`);
   }
-  lines.push(`update-alternatives --set php /usr/bin/php${defaultVersion}`);
-  if (installComposer) {
-    lines.push("curl -fsSL https://getcomposer.org/installer -o /tmp/composer-setup.php", "php /tmp/composer-setup.php --install-dir=/usr/local/bin --filename=composer", "rm -f /tmp/composer-setup.php");
+  if (Object.keys(options.redirects || {}).length > 0)
+    lines.push("");
+  if (isPhp) {
+    lines.push("    location / {", "        try_files $uri $uri/ /index.php?$query_string;", "    }", "", "    location = /favicon.ico { access_log off; log_not_found off; }", "    location = /robots.txt  { access_log off; log_not_found off; }", "", "    error_page 404 /index.php;", "", "    location ~ \\.php$ {", `        fastcgi_pass ${phpFpmSocketPath(phpVersion)};`, "        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;", "        include fastcgi_params;", "    }", "", "    location ~ /\\.(?!well-known).* {", "        deny all;", "    }");
+  } else if (type === "spa") {
+    lines.push("    location / {", "        try_files $uri $uri/ /index.html;", "    }");
+  } else {
+    lines.push("    location / {", "        try_files $uri $uri/ =404;", "    }");
   }
   return lines;
 }
+function buildNginxVhost(options) {
+  const serverNames = [options.domain, ...options.aliases || []].filter(Boolean).join(" ");
+  const body = vhostBody(options);
+  if (options.ssl) {
+    const redirect = [
+      "server {",
+      "    listen 80;",
+      "    listen [::]:80;",
+      `    server_name ${serverNames};`,
+      "    return 301 https://$host$request_uri;",
+      "}"
+    ];
+    const tls3 = [
+      "server {",
+      "    listen 443 ssl;",
+      "    listen [::]:443 ssl;",
+      `    server_name ${serverNames};`,
+      `    ssl_certificate ${options.ssl.certPath};`,
+      `    ssl_certificate_key ${options.ssl.keyPath};`,
+      "",
+      ...body,
+      "}"
+    ];
+    return `${[...redirect, "", ...tls3].join(`
+`)}
+`;
+  }
+  const lines = [
+    "server {",
+    "    listen 80;",
+    "    listen [::]:80;",
+    `    server_name ${serverNames};`,
+    ...body,
+    "}"
+  ];
+  return `${lines.join(`
+`)}
+`;
+}
+function buildNginxVhostScript(options) {
+  const available = `/etc/nginx/sites-available/${options.siteName}`;
+  const enabled2 = `/etc/nginx/sites-enabled/${options.siteName}`;
+  const vhost = buildNginxVhost(options);
+  const out = [];
+  if (options.auth) {
+    const file = htpasswdPath(options.siteName);
+    const sq2 = (v) => v.split("'").join("'\\''");
+    const pw = sq2(options.auth.password);
+    const user = sq2(options.auth.username);
+    out.push(`TS_CLOUD_HTPASS=$(openssl passwd -apr1 '${pw}')`, `printf '%s:%s\\n' '${user}' "$TS_CLOUD_HTPASS" > ${file}`, `chmod 640 ${file}`, `chown root:www-data ${file} 2>/dev/null || true`);
+  }
+  out.push(`cat > ${available} <<'TS_CLOUD_NGINX_EOF'`, vhost.replace(/\n$/, ""), "TS_CLOUD_NGINX_EOF", `ln -sf ${available} ${enabled2}`, "rm -f /etc/nginx/sites-enabled/default", `${NGINX_WRAPPER} -t`, "systemctl reload ts-cloud-nginx 2>/dev/null || systemctl restart ts-cloud-nginx 2>/dev/null || true");
+  return out;
+}
+var NGINX_WRAPPER = "/usr/local/bin/ts-cloud-nginx";
+function buildNginxServiceScript(projectDir = "/opt/pantry") {
+  return [
+    "mkdir -p /etc/nginx/sites-available /etc/nginx/sites-enabled /var/log/nginx /var/lib/nginx/body /var/lib/nginx/proxy /var/lib/nginx/fastcgi /var/lib/nginx/uwsgi /var/lib/nginx/scgi",
+    "getent passwd www-data >/dev/null || useradd --system --no-create-home --shell /usr/sbin/nologin www-data",
+    "chown -R www-data:www-data /var/lib/nginx /var/log/nginx",
+    `cat > ${NGINX_WRAPPER} <<'TS_CLOUD_NGINXBIN_EOF'`,
+    "#!/bin/sh",
+    `eval "$(cd ${projectDir} && pantry env 2>/dev/null)"`,
+    "NGINX_BIN=$(command -v nginx || echo /opt/pantry/pantry/.bin/nginx)",
+    'exec "$NGINX_BIN" -c /etc/nginx/nginx.conf "$@"',
+    "TS_CLOUD_NGINXBIN_EOF",
+    `chmod +x ${NGINX_WRAPPER}`,
+    "cat > /etc/nginx/fastcgi_params <<'TS_CLOUD_FCGI_EOF'",
+    "fastcgi_param  QUERY_STRING       $query_string;",
+    "fastcgi_param  REQUEST_METHOD     $request_method;",
+    "fastcgi_param  CONTENT_TYPE       $content_type;",
+    "fastcgi_param  CONTENT_LENGTH     $content_length;",
+    "fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;",
+    "fastcgi_param  REQUEST_URI        $request_uri;",
+    "fastcgi_param  DOCUMENT_URI       $document_uri;",
+    "fastcgi_param  DOCUMENT_ROOT      $document_root;",
+    "fastcgi_param  SERVER_PROTOCOL    $server_protocol;",
+    "fastcgi_param  REQUEST_SCHEME     $scheme;",
+    "fastcgi_param  HTTPS              $https if_not_empty;",
+    "fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;",
+    "fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;",
+    "fastcgi_param  REMOTE_ADDR        $remote_addr;",
+    "fastcgi_param  REMOTE_PORT        $remote_port;",
+    "fastcgi_param  SERVER_ADDR        $server_addr;",
+    "fastcgi_param  SERVER_PORT        $server_port;",
+    "fastcgi_param  SERVER_NAME        $server_name;",
+    "fastcgi_param  REDIRECT_STATUS    200;",
+    "TS_CLOUD_FCGI_EOF",
+    "cat > /etc/nginx/nginx.conf <<'TS_CLOUD_NGINXCONF_EOF'",
+    "user www-data;",
+    "worker_processes auto;",
+    "pid /run/nginx.pid;",
+    "error_log /var/log/nginx/error.log;",
+    "events { worker_connections 1024; }",
+    "http {",
+    "    default_type application/octet-stream;",
+    "    types {",
+    "        text/html html htm;",
+    "        text/css css;",
+    "        application/javascript js;",
+    "        application/json json;",
+    "        image/svg+xml svg;",
+    "        image/png png;",
+    "        image/jpeg jpg jpeg;",
+    "        image/gif gif;",
+    "        image/x-icon ico;",
+    "        image/webp webp;",
+    "        font/woff2 woff2;",
+    "        font/woff woff;",
+    "        text/plain txt;",
+    "    }",
+    "    access_log /var/log/nginx/access.log;",
+    "    sendfile on;",
+    "    tcp_nopush on;",
+    "    keepalive_timeout 65;",
+    "    server_tokens off;",
+    "    client_max_body_size 100m;",
+    "    client_body_temp_path /var/lib/nginx/body;",
+    "    proxy_temp_path /var/lib/nginx/proxy;",
+    "    fastcgi_temp_path /var/lib/nginx/fastcgi;",
+    "    uwsgi_temp_path /var/lib/nginx/uwsgi;",
+    "    scgi_temp_path /var/lib/nginx/scgi;",
+    "    include /etc/nginx/sites-enabled/*;",
+    "}",
+    "TS_CLOUD_NGINXCONF_EOF",
+    "cat > /etc/systemd/system/ts-cloud-nginx.service <<'TS_CLOUD_NGINXUNIT_EOF'",
+    "[Unit]",
+    "Description=ts-cloud nginx (pantry)",
+    "After=network.target",
+    "",
+    "[Service]",
+    "Type=simple",
+    `ExecStartPre=${NGINX_WRAPPER} -t`,
+    `ExecStart=${NGINX_WRAPPER} -g 'daemon off;'`,
+    `ExecReload=${NGINX_WRAPPER} -s reload`,
+    "Restart=always",
+    "RestartSec=3",
+    "",
+    "[Install]",
+    "WantedBy=multi-user.target",
+    "TS_CLOUD_NGINXUNIT_EOF",
+    "systemctl daemon-reload",
+    "systemctl enable ts-cloud-nginx",
+    "ls /etc/nginx/sites-enabled/* >/dev/null 2>&1 && systemctl restart ts-cloud-nginx || true"
+  ];
+}
 
 // src/drivers/shared/ufw.ts
 var UFW_BASE_PORTS = [80, 443];
@@ -81858,6 +83290,17 @@ function backupEntryFor(database) {
 }
 function buildBackupsConfigTs(database, backups) {
   const entry = database ? backupEntryFor(database) : null;
+  const destinations = backups.bucket ? [
+    "  destinations: [",
+    "    {",
+    "      type: 's3',",
+    `      bucket: '${backups.bucket}',`,
+    "      prefix: 'db-backups',",
+    ...backups.endpoint ? [`      endpoint: '${backups.endpoint}',`] : [],
+    "      optional: false,",
+    "    },",
+    "  ],"
+  ] : [];
   return [
     "import type { BackupConfig } from 'ts-backups'",
     "",
@@ -81871,6 +83314,7 @@ function buildBackupsConfigTs(database, backups) {
     "  databases: [",
     ...entry ? [entry] : [],
     "  ],",
+    ...destinations,
     "}",
     "",
     "export default config",
@@ -81884,21 +83328,21 @@ function buildBackupProvisionScript(options) {
     return [];
   const schedule = backups.schedule || "0 2 * * *";
   const configTs = buildBackupsConfigTs(database, backups);
-  const syncCmd = backups.bucket ? `aws s3 sync ${BACKUP_OUTPUT_DIR} s3://${backups.bucket}/db-backups${backups.endpoint ? ` --endpoint-url ${backups.endpoint}` : ""}` : `echo "ts-cloud: no backup bucket configured; keeping ${BACKUP_OUTPUT_DIR} local only"`;
   return [
     "export DEBIAN_FRONTEND=noninteractive",
     `mkdir -p /etc/ts-cloud ${BACKUP_OUTPUT_DIR}`,
     "command -v bun >/dev/null 2>&1 || (curl -fsSL https://bun.sh/install | bash && ln -sf /root/.bun/bin/bun /usr/local/bin/bun)",
+    "bun add -g ts-backups || true",
     `cat > ${BACKUP_CONFIG_PATH} <<'TS_CLOUD_BACKUP_CFG_EOF'`,
     configTs.replace(/\n$/, ""),
     "TS_CLOUD_BACKUP_CFG_EOF",
     `cat > ${BACKUP_RUNNER_PATH} <<'TS_CLOUD_BACKUP_RUN_EOF'`,
     "#!/bin/bash",
     "set -uo pipefail",
+    'export PATH="/root/.bun/bin:/usr/local/bin:$PATH"',
     'notify() { [ -x /usr/local/bin/ts-cloud-notify ] && /usr/local/bin/ts-cloud-notify "$1" || true; }',
     "cd /etc/ts-cloud",
-    'if ! bunx ts-backups backup --config /etc/ts-cloud/backups.config.ts; then notify "❌ ts-cloud backup failed (dump)"; exit 1; fi',
-    `if ! ${syncCmd}; then notify "❌ ts-cloud backup failed (upload)"; exit 1; fi`,
+    'if ! ts-backups backup --config /etc/ts-cloud/backups.config.ts; then notify "❌ ts-cloud backup failed"; exit 1; fi',
     "TS_CLOUD_BACKUP_RUN_EOF",
     `chmod +x ${BACKUP_RUNNER_PATH}`,
     `cat > ${BACKUP_CRON_PATH} <<'TS_CLOUD_BACKUP_CRON_EOF'`,
@@ -81912,13 +83356,22 @@ function buildBackupProvisionScript(options) {
 function buildComputeProvisionScripts(config6) {
   const compute = config6.infrastructure?.compute ?? {};
   const phpBox = compute.runtime === "php" || !!compute.php;
-  const phpProvision = phpBox ? buildPhpProvisionScript({
-    versions: compute.php?.versions,
-    default: compute.php?.default,
-    extensions: compute.php?.extensions,
-    installNginx: compute.webServer !== "rpx"
-  }) : undefined;
+  const needsPantry = phpBox || !!compute.managedServices;
+  const pantryBootstrap = needsPantry ? buildPantryBootstrapScript() : [];
+  const useNginx = compute.webServer !== "rpx";
+  const phpProvision = phpBox ? [
+    ...pantryBootstrap,
+    ...buildPhpProvisionScript({
+      versions: compute.php?.versions,
+      default: compute.php?.default,
+      extensions: compute.php?.extensions,
+      installNginx: useNginx
+    }),
+    ...useNginx ? buildNginxServiceScript() : []
+  ] : undefined;
   const extras = [];
+  if (!phpBox && needsPantry)
+    extras.push(...pantryBootstrap);
   extras.push(...buildNotifierScript(config6.notifications));
   if (compute.managedServices) {
     extras.push(...buildServicesProvisionScript(compute.managedServices), ...buildDatabaseSetupScript(config6.infrastructure?.appDatabase, compute.managedServices));
@@ -82165,7 +83618,7 @@ class AwsDriver {
       GroupId: groupId,
       IpPermissions: rules.map((r) => ({ IpProtocol: r.protocol, FromPort: r.port, ToPort: r.port, IpRanges: [{ CidrIp: r.cidr }] }))
     }).catch((e) => {
-      if (!/InvalidPermission\.Duplicate/.test(e?.message || ""))
+      if (!/InvalidPermission\.Duplicate/.test(e instanceof Error ? e.message : ""))
         throw e;
     });
     const userData = encodeUserData(buildAwsUserData(config6));
@@ -82245,7 +83698,7 @@ class AwsDriver {
         sshUser: "ec2-user"
       };
     } catch (err) {
-      if (!/does not exist|ValidationError/i.test(err?.message || ""))
+      if (!/does not exist|ValidationError/i.test(err instanceof Error ? err.message : ""))
         throw err;
       const targets = await this.findComputeTargets({
         slug: options.config.project.slug,
@@ -82275,7 +83728,7 @@ class AwsDriver {
     await s32.putObject({
       bucket,
       key: options.remoteKey,
-      body: readFileSync9(options.localPath),
+      body: readFileSync12(options.localPath),
       contentType: "application/gzip"
     });
     return { artifactRef: `s3://${bucket}/${options.remoteKey}` };
@@ -82355,7 +83808,7 @@ class AwsDriver {
     const terminalStatuses = new Set(["Success", "Failed", "Cancelled", "TimedOut"]);
     let lastInvocations = [];
     while (Date.now() - startTime < maxWait) {
-      await new Promise((resolve13) => setTimeout(resolve13, pollInterval));
+      await new Promise((resolve14) => setTimeout(resolve14, pollInterval));
       try {
         const invocations = await ssm2.listCommandInvocations({ CommandId: commandId, Details: true });
         lastInvocations = invocations;
@@ -82381,10 +83834,10 @@ class AwsDriver {
 }
 
 // src/drivers/hetzner/driver.ts
-import { existsSync as existsSync17, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync13 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join13 } from "node:path";
-import { execSync } from "node:child_process";
+import { join as join15 } from "node:path";
+import { execSync as execSync3 } from "node:child_process";
 
 // src/drivers/hetzner/client.ts
 var DEFAULT_API_URL = "https://api.hetzner.cloud/v1";
@@ -82483,7 +83936,15 @@ class HetznerClient {
       services: options.services.map((s) => ({
         protocol: s.protocol ?? "tcp",
         listen_port: s.listenPort,
-        destination_port: s.destinationPort
+        destination_port: s.destinationPort,
+        health_check: {
+          protocol: "http",
+          port: 80,
+          interval: 15,
+          timeout: 10,
+          retries: 3,
+          http: { path: "/", status_codes: ["2??", "3??"] }
+        }
       }))
     });
     return data.load_balancer;
@@ -82546,7 +84007,7 @@ class HetznerClient {
       if (data.action.status === "error") {
         throw new Error(data.action.error?.message || "Hetzner action failed");
       }
-      await new Promise((resolve13) => setTimeout(resolve13, pollInterval));
+      await new Promise((resolve14) => setTimeout(resolve14, pollInterval));
     }
     throw new Error(`Timed out waiting for Hetzner action ${actionId}`);
   }
@@ -82558,7 +84019,7 @@ class HetznerClient {
       const server = await this.getServer(serverId);
       if (server.status === "running")
         return server;
-      await new Promise((resolve13) => setTimeout(resolve13, pollInterval));
+      await new Promise((resolve14) => setTimeout(resolve14, pollInterval));
     }
     throw new Error(`Timed out waiting for server ${serverId} to reach running state`);
   }
@@ -82805,10 +84266,10 @@ function matchesTsCloudLabels(labels, slug, environment, role = "app") {
 
 // src/drivers/hetzner/state.ts
 import { mkdir as mkdir4, readFile, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { join as join14 } from "node:path";
 var STATE_DIR = ".ts-cloud/state";
 function driverStatePath(stackName) {
-  return join12(process.cwd(), STATE_DIR, `${stackName}.json`);
+  return join14(process.cwd(), STATE_DIR, `${stackName}.json`);
 }
 async function readDriverState(stackName) {
   try {
@@ -82820,7 +84281,7 @@ async function readDriverState(stackName) {
 }
 async function writeDriverState(stackName, state) {
   const path = driverStatePath(stackName);
-  await mkdir4(join12(process.cwd(), STATE_DIR), { recursive: true });
+  await mkdir4(join14(process.cwd(), STATE_DIR), { recursive: true });
   await writeFile4(path, `${JSON.stringify(state, null, 2)}
 `, "utf8");
 }
@@ -82828,7 +84289,7 @@ async function writeDriverState(stackName, state) {
 // src/drivers/hetzner/driver.ts
 var SSH_MAX_BUFFER = 1024 * 1024 * 256;
 function expandHome(path) {
-  return path.startsWith("~/") ? join13(homedir7(), path.slice(2)) : path;
+  return path.startsWith("~/") ? join15(homedir7(), path.slice(2)) : path;
 }
 
 class HetznerDriver {
@@ -82960,12 +84421,12 @@ class HetznerDriver {
     const baked = compute.bakedImage === true;
     const existingState = await readDriverState(stackName);
     if (existingState?.loadBalancerId) {
-      const lbs2 = await this.client.listLoadBalancers().catch(() => []);
-      const lb2 = lbs2.find((l) => l.id === existingState.loadBalancerId);
-      if (lb2) {
+      const lbs = await this.client.listLoadBalancers().catch(() => []);
+      const lb = lbs.find((l) => l.id === existingState.loadBalancerId);
+      if (lb) {
         return {
-          appPublicIp: lb2.public_net?.ipv4?.ip,
-          loadBalancerIp: lb2.public_net?.ipv4?.ip,
+          appPublicIp: lb.public_net?.ipv4?.ip,
+          loadBalancerIp: lb.public_net?.ipv4?.ip,
           servicesPrivateIp: existingState.servicesPrivateIp,
           deployStoragePath: "/var/ts-cloud/staging",
           sshUser: this.sshUser
@@ -82992,20 +84453,27 @@ class HetznerDriver {
       ...buildAuthorizedKeysScript(compute.sshKeys)
     ];
     const servicesUserData = wrapCloudInitUserData(buildUbuntuBootstrapScript({ runtime: "php", servicesProvision, baked }));
-    const { server: svcCreate, action: svcAction } = await this.client.createServer({
-      name: `${slug}-${environment}-services`,
-      serverType: resolveHetznerServerType(typeof compute.servicesServer === "object" ? compute.servicesServer.size : compute.size),
-      image,
-      location,
-      userData: servicesUserData,
-      labels: tsCloudLabels(slug, environment, "services"),
-      sshKeys: sshKeyId ? [sshKeyId] : undefined,
-      firewalls: [{ firewall: svcFw.id }],
-      networks: [network.id]
-    });
-    await this.client.waitForAction(svcAction.id);
-    const svcRunning = await this.client.waitForServerRunning(svcCreate.id);
-    const servicesPrivateIp = svcRunning.private_net?.[0]?.ip;
+    const all = await this.client.listServers().catch(() => []);
+    const newServerIds = [];
+    let svcServer = all.find((s) => matchesTsCloudLabels(s.labels, slug, environment, "services"));
+    if (!svcServer) {
+      const { server, action } = await this.client.createServer({
+        name: `${slug}-${environment}-services`,
+        serverType: resolveHetznerServerType(typeof compute.servicesServer === "object" ? compute.servicesServer.size : compute.size),
+        image,
+        location,
+        userData: servicesUserData,
+        labels: tsCloudLabels(slug, environment, "services"),
+        sshKeys: sshKeyId ? [sshKeyId] : undefined,
+        firewalls: [{ firewall: svcFw.id }],
+        networks: [network.id]
+      });
+      await this.client.waitForAction(action.id);
+      svcServer = await this.client.waitForServerRunning(server.id);
+      newServerIds.push(server.id);
+    }
+    const servicesServerId = svcServer.id;
+    const servicesPrivateIp = svcServer.private_net?.[0]?.ip ?? (await this.client.getServer(servicesServerId)).private_net?.[0]?.ip;
     const appProvision = [
       ...buildAutoUpdatesScript(true),
       ...buildMonitoringScript(true),
@@ -83019,8 +84487,15 @@ class HetznerDriver {
       installNginx: compute.webServer !== "rpx"
     });
     const appUserData = wrapCloudInitUserData(buildUbuntuBootstrapScript({ runtime: "php", phpProvision: appPhp, servicesProvision: appProvision, baked }));
-    const appServerIds = [];
-    for (let i = 0;i < topology.appServers; i++) {
+    const existingApp = all.filter((s) => matchesTsCloudLabels(s.labels, slug, environment, "app"));
+    const appServerIds = existingApp.map((s) => s.id);
+    if (existingApp.length > topology.appServers) {
+      for (const extra of existingApp.slice(topology.appServers)) {
+        await this.client.deleteServer(extra.id).catch(() => {});
+        appServerIds.splice(appServerIds.indexOf(extra.id), 1);
+      }
+    }
+    for (let i = existingApp.length;i < topology.appServers; i++) {
       const { server, action } = await this.client.createServer({
         name: `${slug}-${environment}-app-${i + 1}`,
         serverType,
@@ -83034,10 +84509,10 @@ class HetznerDriver {
       });
       await this.client.waitForAction(action.id);
       appServerIds.push(server.id);
+      newServerIds.push(server.id);
     }
-    if (this.waitForBoot) {
-      const waitIds = [svcCreate.id, ...appServerIds];
-      await Promise.all(waitIds.map(async (id) => {
+    if (this.waitForBoot && newServerIds.length > 0) {
+      await Promise.all(newServerIds.map(async (id) => {
         const running = await this.client.waitForServerRunning(id);
         const ip = running.public_net.ipv4?.ip;
         if (ip) {
@@ -83047,33 +84522,42 @@ class HetznerDriver {
       }));
     }
     const lbName = `${slug}-${environment}-lb`;
-    const lbs = await this.client.listLoadBalancers().catch(() => []);
-    const lb = lbs.find((l) => l.name === lbName) ?? await this.client.createLoadBalancer({
-      name: lbName,
-      location,
-      network: network.id,
-      labels: tsCloudLabels(slug, environment, "lb"),
-      labelSelector: `ts-cloud/project=${slug},ts-cloud/environment=${environment},ts-cloud/role=app`,
-      services: [
-        { listenPort: 80, destinationPort: 80 },
-        { listenPort: 443, destinationPort: 443 }
-      ]
-    });
+    let lbIp;
+    let lbId;
+    if (topology.loadBalancer) {
+      const lbs = await this.client.listLoadBalancers().catch(() => []);
+      const lb = lbs.find((l) => l.name === lbName) ?? await this.client.createLoadBalancer({
+        name: lbName,
+        location,
+        network: network.id,
+        labels: tsCloudLabels(slug, environment, "lb"),
+        labelSelector: `ts-cloud/project=${slug},ts-cloud/environment=${environment},ts-cloud/role=app`,
+        services: [
+          { listenPort: 80, destinationPort: 80 },
+          { listenPort: 443, destinationPort: 443 }
+        ]
+      });
+      lbId = lb.id;
+      lbIp = lb.public_net?.ipv4?.ip;
+    }
+    const appPublicIp = lbIp ?? (await this.client.getServer(appServerIds[0]).catch(() => {
+      return;
+    }))?.public_net.ipv4?.ip;
     const state = {
       provider: "hetzner",
       stackName,
       networkId: network.id,
-      loadBalancerId: lb.id,
-      servicesServerId: svcCreate.id,
+      loadBalancerId: lbId,
+      servicesServerId,
       servicesPrivateIp,
-      publicIp: lb.public_net?.ipv4?.ip,
+      publicIp: appPublicIp,
       deployStoragePath: "/var/ts-cloud/staging",
       sshUser: this.sshUser
     };
     await writeDriverState(stackName, state);
     return {
-      appPublicIp: lb.public_net?.ipv4?.ip,
-      loadBalancerIp: lb.public_net?.ipv4?.ip,
+      appPublicIp,
+      loadBalancerIp: lbIp,
       servicesPrivateIp,
       deployStoragePath: "/var/ts-cloud/staging",
       sshUser: this.sshUser
@@ -83089,8 +84573,10 @@ class HetznerDriver {
     const lbs = await this.client.listLoadBalancers().catch(() => []);
     const lb = lbs.find((l) => l.name === lbName);
     if (lb) {
-      await this.client.deleteLoadBalancer(lb.id).catch(() => {});
-      destroyed.push(`load balancer ${lbName}`);
+      try {
+        await this.client.deleteLoadBalancer(lb.id);
+        destroyed.push(`load balancer ${lbName}`);
+      } catch {}
     }
     const allServers = await this.client.listServers().catch(() => []);
     const serverIds = new Set;
@@ -83103,8 +84589,10 @@ class HetznerDriver {
     if (state?.servicesServerId)
       serverIds.add(state.servicesServerId);
     for (const id of serverIds) {
-      await this.client.deleteServer(id).catch(() => {});
-      destroyed.push(`server ${id}`);
+      try {
+        await this.client.deleteServer(id);
+        destroyed.push(`server ${id}`);
+      } catch {}
     }
     const firewalls = await this.client.listFirewalls().catch(() => []);
     for (const name of [`${slug}-${environment}-app-fw`, `${slug}-${environment}-services-fw`]) {
@@ -83232,7 +84720,7 @@ class HetznerDriver {
     if (!existsSync17(this.sshPublicKeyPath)) {
       throw new Error(`SSH public key not found at ${this.sshPublicKeyPath}. ts-cloud deploys to Hetzner over SSH and needs a public key to authorize on the server. ` + `Generate one (\`ssh-keygen -t ed25519\`) or set hetzner.sshPrivateKeyPath / HCLOUD_SSH_PUBLIC_KEY.`);
     }
-    const publicKey = readFileSync10(this.sshPublicKeyPath, "utf8").trim();
+    const publicKey = readFileSync13(this.sshPublicKeyPath, "utf8").trim();
     const normalized = normalizeSshPublicKey(publicKey);
     const existing = await this.client.listSshKeys();
     const match = existing.find((key) => normalizeSshPublicKey(key.public_key) === normalized);
@@ -83275,7 +84763,7 @@ class HetznerDriver {
     return [...ports].filter((port) => ![80, 443].includes(port));
   }
   async sleep(ms) {
-    await new Promise((resolve13) => setTimeout(resolve13, ms));
+    await new Promise((resolve14) => setTimeout(resolve14, ms));
   }
   async waitForSshReady(host) {
     const { sshIntervalMs, sshTimeoutMs } = this.bootWait;
@@ -83283,7 +84771,7 @@ class HetznerDriver {
     let lastErr;
     while (Date.now() - start < sshTimeoutMs) {
       try {
-        execSync(`ssh ${this.sshBaseArgs(host, ["-o", "ConnectTimeout=5"]).map((a) => `"${a.replace(/"/g, "\\\"")}"`).join(" ")} true`, {
+        execSync3(`ssh ${this.sshBaseArgs(host, ["-o", "ConnectTimeout=5"]).map((a) => `"${a.replace(/"/g, "\\\"")}"`).join(" ")} true`, {
           stdio: "pipe",
           maxBuffer: SSH_MAX_BUFFER
         });
@@ -83343,7 +84831,7 @@ ${out}`);
     ];
   }
   scpToHost(host, localPath, remotePath) {
-    execSync([
+    execSync3([
       "scp",
       "-i",
       this.sshPrivateKeyPath,
@@ -83356,7 +84844,7 @@ ${out}`);
   }
   sshExec(host, script) {
     const escaped = script.replace(/'/g, `'\\''`);
-    return execSync(`ssh ${this.sshBaseArgs(host).map((a) => `"${a.replace(/"/g, "\\\"")}"`).join(" ")} '${escaped}'`, {
+    return execSync3(`ssh ${this.sshBaseArgs(host).map((a) => `"${a.replace(/"/g, "\\\"")}"`).join(" ")} '${escaped}'`, {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"],
       maxBuffer: SSH_MAX_BUFFER
@@ -83678,8 +85166,7 @@ function buildLaravelDeployScript(options) {
   if (!site.repository?.url)
     throw new Error(`Site '${siteName}' is a PHP/git site but has no repository.url to clone`);
   const base = options.appBase ?? `/var/www/${siteName}`;
-  const phpVersion = site.phpVersion ?? options.defaultPhpVersion ?? "8.3";
-  const phpBin = `php${phpVersion}`;
+  const phpBin = "php";
   const paths = releasePaths(base, releaseId);
   const sharedPaths = site.sharedPaths ?? DEFAULT_SHARED_PATHS;
   const keepReleases = site.keepReleases ?? DEFAULT_KEEP_RELEASES;
@@ -83688,7 +85175,8 @@ function buildLaravelDeployScript(options) {
     "set -euo pipefail",
     'export HOME="${HOME:-/root}"',
     'export COMPOSER_HOME="${COMPOSER_HOME:-/root/.composer}"',
-    "export COMPOSER_ALLOW_SUPERUSER=1"
+    "export COMPOSER_ALLOW_SUPERUSER=1",
+    pantryEnvActivation()
   ];
   out.push(...buildEnsureReleaseLayout(paths, sharedPaths));
   if (site.env && Object.keys(site.env).length > 0)
@@ -83703,7 +85191,7 @@ function buildLaravelDeployScript(options) {
     } else if (line === MACRO_ACTIVATE_RELEASE) {
       out.push(...buildActivateRelease(paths));
       out.push(...buildPruneReleases(paths, keepReleases));
-      out.push(`systemctl reload php${phpVersion}-fpm || true`);
+      out.push(`(cd ${PANTRY_PROJECT_DIR} && pantry restart php-fpm) 2>/dev/null || true`);
     } else if (line === MACRO_RESTART_QUEUES) {
       out.push(`${phpBin} artisan queue:restart || true`);
     } else {
@@ -83714,6 +85202,10 @@ function buildLaravelDeployScript(options) {
 }
 
 // src/drivers/shared/laravel-services.ts
+var PANTRY_ENV_EVAL = `eval "$(cd ${PANTRY_PROJECT_DIR} && pantry env 2>/dev/null)"`;
+function pantryExec(cmd) {
+  return `/bin/sh -lc '${PANTRY_ENV_EVAL}; exec ${cmd}'`;
+}
 function reEscape(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -83777,8 +85269,7 @@ function schedulerCronPath(slug, siteName) {
 }
 function buildSiteServicesScript(options) {
   const { slug, siteName, site } = options;
-  const phpVersion = site.phpVersion ?? options.phpVersion ?? "8.3";
-  const phpBin = `php${phpVersion}`;
+  const phpBin = "php";
   const base = options.appBase ?? `/var/www/${siteName}`;
   const current = `${base}/current`;
   const artisan = `${current}/artisan`;
@@ -83793,7 +85284,7 @@ function buildSiteServicesScript(options) {
       out.push(...writeUnitScript(name, systemdUnit({
         description: `${siteName} queue worker ${qIndex}.${p} (managed by ts-cloud)`,
         workingDir: current,
-        execStart: queueExecStart(worker, phpBin, artisan),
+        execStart: pantryExec(queueExecStart(worker, phpBin, artisan)),
         stopWaitSecs: worker.stopWaitSecs ?? 90
       })));
     }
@@ -83807,7 +85298,7 @@ function buildSiteServicesScript(options) {
       out.push(...writeUnitScript(name, systemdUnit({
         description: `${siteName} daemon ${daemon.name || daemon.command} (managed by ts-cloud)`,
         workingDir: daemon.directory || current,
-        execStart: daemon.command,
+        execStart: pantryExec(daemon.command),
         restart: daemon.restart,
         user: daemon.user
       })));
@@ -83820,7 +85311,7 @@ function buildSiteServicesScript(options) {
   }
   const cronPath = schedulerCronPath(slug, siteName);
   if (site.scheduler) {
-    const cron = `* * * * * root cd ${current} && ${phpBin} artisan schedule:run >> /dev/null 2>&1
+    const cron = `* * * * * root cd ${current} && ${PANTRY_ENV_EVAL} && ${phpBin} artisan schedule:run >> /dev/null 2>&1
 `;
     out.push(`cat > ${cronPath} <<'TS_CLOUD_CRON_EOF'`, cron.replace(/\n$/, ""), "TS_CLOUD_CRON_EOF", `chmod 644 ${cronPath}`);
   } else {
@@ -83832,111 +85323,6 @@ function siteHasServices(site) {
   return !!(site.queues?.length || site.daemons?.length || site.scheduler);
 }
 
-// src/drivers/shared/nginx-vhost.ts
-function htpasswdPath(siteName) {
-  return `/etc/nginx/.htpasswd-${siteName}`;
-}
-var PHP_TYPES = new Set(["laravel", "php", "statamic", "wordpress"]);
-function isPhpSiteType(type) {
-  return PHP_TYPES.has(type);
-}
-function defaultWebDirectory(type) {
-  return type === "laravel" || type === "statamic" || type === "wordpress" ? "public" : "";
-}
-function resolveRoot(appDir, webDirectory) {
-  const base = appDir.replace(/\/+$/, "");
-  const sub = webDirectory.replace(/^\/+|\/+$/g, "");
-  return sub ? `${base}/${sub}` : base;
-}
-function vhostBody(options) {
-  const type = options.type ?? "laravel";
-  const webDirectory = options.webDirectory ?? defaultWebDirectory(type);
-  const root = resolveRoot(options.appDir, webDirectory);
-  const isPhp = isPhpSiteType(type);
-  const phpVersion = options.phpVersion ?? "8.3";
-  const lines = [
-    `    root ${root};`,
-    "",
-    '    add_header X-Frame-Options "SAMEORIGIN";',
-    '    add_header X-Content-Type-Options "nosniff";',
-    "",
-    `    index ${isPhp ? "index.php index.html" : "index.html index.htm"};`,
-    "",
-    "    charset utf-8;",
-    ""
-  ];
-  if (options.auth) {
-    lines.push(`    auth_basic "${options.auth.realm || "Restricted"}";`, `    auth_basic_user_file ${htpasswdPath(options.siteName)};`, "");
-  }
-  for (const [from, to] of Object.entries(options.redirects || {})) {
-    lines.push(`    location = ${from} { return 301 ${to}; }`);
-  }
-  if (Object.keys(options.redirects || {}).length > 0)
-    lines.push("");
-  if (isPhp) {
-    lines.push("    location / {", "        try_files $uri $uri/ /index.php?$query_string;", "    }", "", "    location = /favicon.ico { access_log off; log_not_found off; }", "    location = /robots.txt  { access_log off; log_not_found off; }", "", "    error_page 404 /index.php;", "", "    location ~ \\.php$ {", `        fastcgi_pass unix:${phpFpmSocketPath(phpVersion)};`, "        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;", "        include fastcgi_params;", "    }", "", "    location ~ /\\.(?!well-known).* {", "        deny all;", "    }");
-  } else if (type === "spa") {
-    lines.push("    location / {", "        try_files $uri $uri/ /index.html;", "    }");
-  } else {
-    lines.push("    location / {", "        try_files $uri $uri/ =404;", "    }");
-  }
-  return lines;
-}
-function buildNginxVhost(options) {
-  const serverNames = [options.domain, ...options.aliases || []].filter(Boolean).join(" ");
-  const body = vhostBody(options);
-  if (options.ssl) {
-    const redirect = [
-      "server {",
-      "    listen 80;",
-      "    listen [::]:80;",
-      `    server_name ${serverNames};`,
-      "    return 301 https://$host$request_uri;",
-      "}"
-    ];
-    const tls3 = [
-      "server {",
-      "    listen 443 ssl;",
-      "    listen [::]:443 ssl;",
-      `    server_name ${serverNames};`,
-      `    ssl_certificate ${options.ssl.certPath};`,
-      `    ssl_certificate_key ${options.ssl.keyPath};`,
-      "",
-      ...body,
-      "}"
-    ];
-    return `${[...redirect, "", ...tls3].join(`
-`)}
-`;
-  }
-  const lines = [
-    "server {",
-    "    listen 80;",
-    "    listen [::]:80;",
-    `    server_name ${serverNames};`,
-    ...body,
-    "}"
-  ];
-  return `${lines.join(`
-`)}
-`;
-}
-function buildNginxVhostScript(options) {
-  const available = `/etc/nginx/sites-available/${options.siteName}`;
-  const enabled2 = `/etc/nginx/sites-enabled/${options.siteName}`;
-  const vhost = buildNginxVhost(options);
-  const out = [];
-  if (options.auth) {
-    const file = htpasswdPath(options.siteName);
-    const sq2 = (v) => v.split("'").join("'\\''");
-    const pw = sq2(options.auth.password);
-    const user = sq2(options.auth.username);
-    out.push(`TS_CLOUD_HTPASS=$(openssl passwd -apr1 '${pw}')`, `printf '%s:%s\\n' '${user}' "$TS_CLOUD_HTPASS" > ${file}`, `chmod 640 ${file}`, `chown root:www-data ${file} 2>/dev/null || true`);
-  }
-  out.push(`cat > ${available} <<'TS_CLOUD_NGINX_EOF'`, vhost.replace(/\n$/, ""), "TS_CLOUD_NGINX_EOF", `ln -sf ${available} ${enabled2}`, "rm -f /etc/nginx/sites-enabled/default", "nginx -t", "systemctl reload nginx");
-  return out;
-}
-
 // src/drivers/shared/compute-deploy.ts
 var noopLogger = {
   info: () => {},
@@ -84210,6 +85596,7 @@ export {
   stackDependencyManager,
   signRequestAsync,
   signRequest,
+  sha256,
   setupDns01Challenge,
   serviceMeshManager,
   sequence,
@@ -84220,8 +85607,11 @@ export {
   secretsManager,
   searchCommands,
   sanitizeName,
+  runPhpBuildHooks,
+  runBuildHooks,
   route53RoutingManager,
   route53ResolverManager,
+  responseToResult,
   resourceManagementManager,
   resolveStorageBucketName,
   resolveSiteStackName,
@@ -84229,7 +85619,11 @@ export {
   resolveSiteKind,
   resolveSiteDeployTarget,
   resolveSiteBucketName,
+  resolveServerlessAssetBucketName,
+  resolveServerlessArtifactBucketName,
+  resolveServerlessAppStackName,
   resolveRegion,
+  resolveQueueNames,
   resolveProjectStackName,
   resolveObjectStorage,
   resolveHetznerApiToken,
@@ -84237,6 +85631,7 @@ export {
   resolveDeployBucketName,
   resolveCredentials,
   resolveCloudProvider,
+  resolveApp,
   requiresReplacement,
   replicaManager,
   remapKey,
@@ -84248,12 +85643,17 @@ export {
   processInChunks,
   previewNotifications,
   previewManager,
+  phpRuntimeLayerAssets,
+  phpLayerPackages,
+  phpLayerBuildStage,
   performanceManager,
   parseXMLResponse,
   parseJSONResponse,
   parallelWithRetry,
   parallelMap,
   parallel,
+  packageServerlessApp,
+  packagePhpApp,
   organizationManager,
   networkSecurityManager,
   needsRenewal,
@@ -84268,6 +85668,7 @@ export {
   makeAWSRequest,
   logsManager,
   loadCloudConfig,
+  laravelServerlessEnvDefaults,
   lambdaVersionsManager,
   lambdaVPCManager,
   lambdaLayersManager,
@@ -84323,6 +85724,8 @@ export {
   generateResourceName,
   generatePreviewWorkflow,
   generatePreviewPipeline,
+  generatePhpLayerDockerfile,
+  generatePhpFpmConfig,
   generateParallelConfig,
   generatePRPreviewWorkflow,
   generateMultiEnvWorkflow,
@@ -84340,7 +85743,9 @@ export {
   generateCrossAccountRoleCF,
   generateCostReportWorkflow,
   generateCleanupWorkflow,
+  generateBootstrap,
   generateApprovalConfig,
+  generateAppImageDockerfile,
   fromWebIdentity,
   fromSharedCredentials,
   fromEnvironment,
@@ -84364,6 +85769,7 @@ export {
   findChangedFiles,
   fifoQueueManager,
   extendPreset,
+  eventToRequest,
   emailTemplateManager,
   emailAnalyticsManager,
   drManager,
@@ -84386,12 +85792,16 @@ export {
   defaultConfig4 as defaultConfig,
   databaseUserManager,
   crossRegionReferenceManager,
+  createZip,
   createWordPressPreset,
   createTraditionalWebAppPreset,
   createStaticSitePreset,
+  createServerlessNodePreset,
+  createServerlessLaravelPreset,
   createS3Client,
   createRoute53Validator,
   createRealtimeAppPreset,
+  createQueueHandler,
   createPresignedUrlAsync,
   createPresignedUrl,
   createPreset,
@@ -84404,6 +85814,8 @@ export {
   createMLApiPreset,
   createLaravelPreset,
   createJamstackPreset,
+  createHttpHandler,
+  createHandlers,
   createGoDaddyValidator,
   createFullStackAppPreset,
   createError,
@@ -84412,10 +85824,13 @@ export {
   createDashboardSite,
   createCredentialProvider,
   createCloudDriver,
+  createCliHandler,
   createApiBackendPreset,
   containerRegistryManager,
   config5 as config,
+  composeServerlessAppTemplate,
   composePresets,
+  collectPhpAppEntries,
   cloudTrailManager,
   cloudDrivers,
   cloud_config_schema_default as cloudConfigSchema,
@@ -84429,6 +85844,7 @@ export {
   canaryManager,
   buildStaticSiteDeployScript,
   buildSiteDeployScript,
+  buildPhpRuntimeLayerZip,
   buildOptimizationManager,
   buildCloudFormationTemplate,
   bounceComplaintHandler,
@@ -84438,6 +85854,7 @@ export {
   backupManager,
   awsConfigManager,
   autocomplete,
+  artifactKey,
   analyzeStackDiff,
   abTestManager,
   XRayManager,
@@ -84517,6 +85934,8 @@ export {
   Permissions,
   PerformanceManager,
   ParameterStore,
+  PHP_LAYER_EXTENSIONS,
+  PHP_DEFAULT_EXCLUDES,
   OrganizationManager,
   OpenSearchClient,
   NetworkSecurityManager,
@@ -84539,6 +85958,7 @@ export {
   LambdaDLQManager,
   LambdaConcurrencyManager,
   LambdaClient,
+  LARAVEL_SERVERLESS_BUILD_STEPS,
   KendraClient,
   JobLoader,
   InfrastructureGenerator,