@stacksjs/ts-cloud 0.3.1 → 0.4.0

package/dist/index.js

@@ -39,17 +39,22 @@ import { cpSync, mkdtempSync, rmSync, writeFileSync as writeFileSync32 } from "n
 import { tmpdir } from "node:os";
 import { dirname as dirname22, isAbsolute as isAbsolute3, join as join62, resolve as resolve13 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { readFileSync as readFileSync4 } from "node:fs";
-import { dirname as dirname32, join as join72 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { execFileSync } from "node:child_process";
-import { existsSync as existsSync52, mkdtempSync as mkdtempSync2, readdirSync as readdirSync52, readFileSync as readFileSync5, rmSync as rmSync2, statSync as statSync32, writeFileSync as writeFileSync42 } from "node:fs";
+import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync4, rmSync as rmSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join8, relative as relative22 } from "node:path";
+import { dirname as dirname32, join as join72 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { readFileSync as readFileSync5 } from "node:fs";
+import { dirname as dirname42, join as join8 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { existsSync as existsSync52, mkdtempSync as mkdtempSync3, readdirSync as readdirSync52, readFileSync as readFileSync6, rmSync as rmSync3, statSync as statSync32, writeFileSync as writeFileSync52 } from "node:fs";
+import { tmpdir as tmpdir3 } from "node:os";
+import { join as join9, relative as relative22 } from "node:path";
 import { execSync as execSync2 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
-import { readdirSync as readdirSync62, readFileSync as readFileSync6, statSync as statSync4 } from "node:fs";
-import { join as join9, relative as relative32, resolve as resolve22 } from "node:path";
+import { readdirSync as readdirSync62, readFileSync as readFileSync7, statSync as statSync4 } from "node:fs";
+import { join as join10, relative as relative32, resolve as resolve22 } from "node:path";
 function __exportSetter3(name, newValue) {
   this[name] = __returnValue3.bind(null, newValue);
 }
@@ -25711,7 +25716,7 @@ async function packageServerlessApp(opts) {
     opts.onStep?.("bundling application");
     const result = await Bun.build({
       entrypoints: [bootstrapPath],
-      target: "node",
+      target: app.kind === "bun" ? "bun" : "node",
       format: "esm",
       minify: false,
       sourcemap: "none"
@@ -25742,6 +25747,54 @@ ${logs}`);
     rmSync(stage, { recursive: true, force: true });
   }
 }
+function normalizeNodeVersion(v) {
+  if (!v)
+    return "22";
+  const m = String(v).match(/(\d+)/);
+  return m ? m[1] : "22";
+}
+function resolveServerlessRuntime(app) {
+  const kind = app.kind ?? "node";
+  if (kind === "php") {
+    return {
+      lambdaRuntime: "provided.al2023",
+      kind: "php",
+      version: app.phpVersion ?? "8.3",
+      usesLayer: true,
+      layerKind: "php",
+      layerEnvVar: "TSCLOUD_PHP_LAYER_ARN"
+    };
+  }
+  if (kind === "bun") {
+    return {
+      lambdaRuntime: "provided.al2023",
+      kind: "bun",
+      version: app.runtimeVersion ?? "latest",
+      usesLayer: true,
+      layerKind: "bun",
+      layerEnvVar: "TSCLOUD_BUN_LAYER_ARN"
+    };
+  }
+  const version2 = normalizeNodeVersion(app.runtimeVersion);
+  const explicitProvided = app.runtime === "provided.al2023";
+  const managed = !explicitProvided && MANAGED_NODE_VERSIONS.includes(version2);
+  if (managed) {
+    return {
+      lambdaRuntime: app.runtime && app.runtime.startsWith("nodejs") ? app.runtime : `nodejs${version2}.x`,
+      kind: "node",
+      version: version2,
+      usesLayer: false
+    };
+  }
+  return {
+    lambdaRuntime: "provided.al2023",
+    kind: "node",
+    version: version2,
+    usesLayer: true,
+    layerKind: "node",
+    layerEnvVar: "TSCLOUD_NODE_LAYER_ARN"
+  };
+}
 function resolveQueueNames(app, slug, env) {
   if (app.queues === false)
     return [];
@@ -25755,7 +25808,7 @@ function resolveQueueNames(app, slug, env) {
 function composeServerlessAppTemplate(opts) {
   const { app, environment, handlers } = opts;
   const slug = opts.config.project.slug;
-  const runtime = app.runtime ?? "nodejs20.x";
+  const runtime = resolveServerlessRuntime(app).lambdaRuntime;
   const architecture = app.architecture ?? "x86_64";
   const region = opts.config.project.region;
   const functionNames = {
@@ -26360,6 +26413,79 @@ COPY app/ \${LAMBDA_TASK_ROOT}/
 CMD [ "index.http" ]
 `;
 }
+function assetsDir() {
+  return dirname32(fileURLToPath2(import.meta.url));
+}
+function sharedRuntimeLoop() {
+  return readFileSync4(join72(assetsDir(), "runtime.mjs"), "utf-8");
+}
+function bootstrap(kind) {
+  return readFileSync4(join72(assetsDir(), `${kind}-bootstrap`), "utf-8");
+}
+function buildNodeRuntimeLayerZip(options) {
+  const architecture = options.architecture ?? "x86_64";
+  const nodeArch = architecture === "arm64" ? "arm64" : "x64";
+  const version2 = options.version.replace(/^v/, "");
+  const step = options.onStep ?? (() => {});
+  const stage = mkdtempSync2(join72(tmpdir2(), "tscloud-node-layer-"));
+  try {
+    const exact = version2.includes(".") ? version2 : resolveLatestNode(version2);
+    const dir = `node-v${exact}-linux-${nodeArch}`;
+    const url = `https://nodejs.org/dist/v${exact}/${dir}.tar.xz`;
+    step(`downloading Node ${exact} (${architecture})`);
+    const tar = join72(stage, "node.tar.xz");
+    fetchToFile(url, tar);
+    step("extracting node binary");
+    execFileSync("tar", ["-xf", tar, "-C", stage, `${dir}/bin/node`], { stdio: "inherit" });
+    const nodeBin = readFileSync4(join72(stage, dir, "bin", "node"));
+    step("packaging layer");
+    const entries = [
+      { name: "bootstrap", data: bootstrap("node"), mode: 493 },
+      { name: "runtime.mjs", data: sharedRuntimeLoop(), mode: 420 },
+      { name: "bin/node", data: nodeBin, mode: 493 }
+    ];
+    return { zip: createZip(entries), architecture, version: exact, fileCount: entries.length };
+  } finally {
+    rmSync2(stage, { recursive: true, force: true });
+  }
+}
+function buildBunRuntimeLayerZip(options) {
+  const architecture = options.architecture ?? "x86_64";
+  const bunArch = architecture === "arm64" ? "bun-linux-aarch64" : "bun-linux-x64";
+  const version2 = options.version === "latest" ? "" : options.version.replace(/^v/, "");
+  const step = options.onStep ?? (() => {});
+  const stage = mkdtempSync2(join72(tmpdir2(), "tscloud-bun-layer-"));
+  try {
+    const tag = version2 ? `bun-v${version2}` : "latest";
+    const url = `https://github.com/oven-sh/bun/releases/download/${tag}/${bunArch}.zip`;
+    step(`downloading Bun ${version2 || "latest"} (${architecture})`);
+    const zipPath = join72(stage, "bun.zip");
+    fetchToFile(url, zipPath);
+    step("extracting bun binary");
+    execFileSync("unzip", ["-o", "-q", zipPath, "-d", stage], { stdio: "inherit" });
+    const bunBin = readFileSync4(join72(stage, bunArch, "bun"));
+    step("packaging layer");
+    const entries = [
+      { name: "bootstrap", data: bootstrap("bun"), mode: 493 },
+      { name: "runtime.mjs", data: sharedRuntimeLoop(), mode: 420 },
+      { name: "bin/bun", data: bunBin, mode: 493 }
+    ];
+    return { zip: createZip(entries), architecture, version: version2 || "latest", fileCount: entries.length };
+  } finally {
+    rmSync2(stage, { recursive: true, force: true });
+  }
+}
+function fetchToFile(url, dest) {
+  execFileSync("curl", ["-fsSL", "-o", dest, url], { stdio: ["ignore", "ignore", "inherit"] });
+}
+function resolveLatestNode(major) {
+  const indexJson = execFileSync("curl", ["-fsSL", "https://nodejs.org/dist/index.json"], { encoding: "utf-8" });
+  const releases = JSON.parse(indexJson);
+  const match = releases.find((r) => r.version.startsWith(`v${major}.`));
+  if (!match)
+    throw new Error(`No Node release found for major version ${major}`);
+  return match.version.replace(/^v/, "");
+}
 function resolveApp(mod) {
   const m = mod;
   const def = m?.default ?? m;
@@ -26508,12 +26634,12 @@ php_admin_flag[log_errors] = on
 clear_env = no
 `;
 }
-function assetsDir() {
-  return join72(dirname32(fileURLToPath2(import.meta.url)), "runtime-assets");
+function assetsDir2() {
+  return join8(dirname42(fileURLToPath3(import.meta.url)), "runtime-assets");
 }
 function phpRuntimeLayerAssets() {
-  const dir = assetsDir();
-  const read = (f) => readFileSync4(join72(dir, f), "utf-8");
+  const dir = assetsDir2();
+  const read = (f) => readFileSync5(join8(dir, f), "utf-8");
   return [
     { path: "bootstrap", contents: read("bootstrap"), mode: 493 },
     { path: "tscloud/runtime.php", contents: read("runtime.php"), mode: 420 },
@@ -26543,7 +26669,7 @@ function laravelServerlessEnvDefaults(opts = {}) {
 }
 function* walk(dir) {
   for (const entry of readdirSync52(dir)) {
-    const full = join8(dir, entry);
+    const full = join9(dir, entry);
     if (statSync32(full).isDirectory())
       yield* walk(full);
     else
@@ -26554,19 +26680,19 @@ function buildPhpRuntimeLayerZip(options = {}) {
   const architecture = options.architecture ?? "x86_64";
   const platform = options.platform ?? (architecture === "arm64" ? "linux/arm64" : "linux/amd64");
   const step = options.onStep ?? (() => {});
-  const stage = mkdtempSync2(join8(tmpdir2(), "tscloud-php-layer-"));
+  const stage = mkdtempSync3(join9(tmpdir3(), "tscloud-php-layer-"));
   const imageTag = "tscloud-php-layer:build";
   try {
-    writeFileSync42(join8(stage, "Dockerfile"), generatePhpLayerDockerfile(options));
+    writeFileSync52(join9(stage, "Dockerfile"), generatePhpLayerDockerfile(options));
     step("Building PHP runtime image (docker)");
-    execFileSync("docker", ["build", "--platform", platform, "-t", imageTag, stage], { stdio: "inherit" });
+    execFileSync2("docker", ["build", "--platform", platform, "-t", imageTag, stage], { stdio: "inherit" });
     step("Extracting /opt from image");
-    const cid = execFileSync("docker", ["create", "--platform", platform, imageTag], { encoding: "utf-8" }).trim();
-    const optDir = join8(stage, "opt");
+    const cid = execFileSync2("docker", ["create", "--platform", platform, imageTag], { encoding: "utf-8" }).trim();
+    const optDir = join9(stage, "opt");
     try {
-      execFileSync("docker", ["cp", `${cid}:/opt/.`, optDir], { stdio: "inherit" });
+      execFileSync2("docker", ["cp", `${cid}:/opt/.`, optDir], { stdio: "inherit" });
     } finally {
-      execFileSync("docker", ["rm", cid], { stdio: "ignore" });
+      execFileSync2("docker", ["rm", cid], { stdio: "ignore" });
     }
     if (!existsSync52(optDir))
       throw new Error("layer build produced no /opt directory");
@@ -26574,7 +26700,7 @@ function buildPhpRuntimeLayerZip(options = {}) {
     for (const file of walk(optDir)) {
       const rel = relative22(optDir, file).replace(/\\/g, "/");
       const mode = statSync32(file).mode & 73 ? 493 : 420;
-      entries.push({ name: rel, data: readFileSync5(file), mode });
+      entries.push({ name: rel, data: readFileSync6(file), mode });
     }
     step("Injecting runtime assets");
     const assetPaths = new Set(phpRuntimeLayerAssets().map((a) => a.path));
@@ -26586,7 +26712,7 @@ function buildPhpRuntimeLayerZip(options = {}) {
     const zip2 = createZip(filtered);
     return { zip: zip2, architecture, fileCount: filtered.length };
   } finally {
-    rmSync2(stage, { recursive: true, force: true });
+    rmSync3(stage, { recursive: true, force: true });
   }
 }
 function isExcluded(rel, excludes) {
@@ -26594,7 +26720,7 @@ function isExcluded(rel, excludes) {
 }
 function* walk2(dir, root, excludes) {
   for (const entry of readdirSync62(dir)) {
-    const full = join9(dir, entry);
+    const full = join10(dir, entry);
     const rel = relative32(root, full).replace(/\\/g, "/");
     if (isExcluded(rel, excludes))
       continue;
@@ -26621,7 +26747,7 @@ function collectPhpAppEntries(projectRoot, exclude = []) {
   for (const file of walk2(root, root, excludes)) {
     const rel = relative32(root, file).replace(/\\/g, "/");
     const executable = (statSync4(file).mode & 73) !== 0;
-    entries.push({ name: rel, data: readFileSync6(file), mode: executable ? 493 : 420 });
+    entries.push({ name: rel, data: readFileSync7(file), mode: executable ? 493 : 420 });
   }
   return entries;
 }
@@ -28068,7 +28194,7 @@ catch (error) {
 
   return { statusCode: 200, body: 'OK' };
 };
-`, inbound_default, exports_advanced2, IVRBuilder, exports_advanced3, MmsSupport, SmsChatbot, fifoQueueManager, dlqMonitoringManager, batchProcessingManager, queueManagementManager, CRC_TABLE, PHP_LAYER_EXTENSIONS, TEXT_CONTENT, LARAVEL_SERVERLESS_BUILD_STEPS, PHP_DEFAULT_EXCLUDES, staticSiteManager, storageAdvancedManager, healthCheckManager, networkSecurityManager, resourceManagementManager;
+`, inbound_default, exports_advanced2, IVRBuilder, exports_advanced3, MmsSupport, SmsChatbot, fifoQueueManager, dlqMonitoringManager, batchProcessingManager, queueManagementManager, CRC_TABLE, MANAGED_NODE_VERSIONS, PHP_LAYER_EXTENSIONS, TEXT_CONTENT, LARAVEL_SERVERLESS_BUILD_STEPS, PHP_DEFAULT_EXCLUDES, staticSiteManager, storageAdvancedManager, healthCheckManager, networkSecurityManager, resourceManagementManager;
 var init_dist2 = __esm(async () => {
   __defProp3 = Object.defineProperty;
   __require3 = /* @__PURE__ */ createRequire2(import.meta.url);
@@ -41791,7 +41917,8 @@ Details:`;
             type: "object",
             description: "Serverless application manifest (Laravel-Vapor-equivalent). Defining this opts the environment into the serverless app deploy pipeline (http/queue/cli Lambda functions, assets, build/deploy hooks).",
             properties: {
-              runtime: { type: "string", description: "Lambda runtime (e.g. nodejs20.x, provided.al2023)" },
+              runtime: { type: "string", description: "Lambda runtime override (usually derived from kind + runtimeVersion)" },
+              runtimeVersion: { type: "string", description: "Node major (18/20/22 managed, 24+ custom layer) or Bun release for node/bun apps" },
               kind: { type: "string", enum: ["node", "bun", "php"], description: "Application kind (drives packaging + runtime)" },
               entry: { type: "string", description: "Entry file exporting the request handler" },
               memory: { type: "number", description: "HTTP function memory in MB" },
@@ -45604,6 +45731,7 @@ async function sendFallbackSms(to, message) {
     }
     return table2;
   })();
+  MANAGED_NODE_VERSIONS = ["18", "20", "22"];
   PHP_LAYER_EXTENSIONS = [
     "cli",
     "fpm",
@@ -46829,9 +46957,9 @@ __export(exports_client, {
   AWSClient: () => AWSClient
 });
 import * as crypto2 from "node:crypto";
-import { existsSync as existsSync14, readFileSync as readFileSync7 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync8 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 function resolveS3Endpoint(options) {
   const base = options.endpoint || `s3.${options.region}.amazonaws.com`;
   if (!options.bucket) {
@@ -46889,12 +47017,12 @@ class AWSClient {
   }
   loadCredentialsFromFile() {
     const profile = process.env.AWS_PROFILE || "default";
-    const credentialsPath = process.env.AWS_SHARED_CREDENTIALS_FILE || join10(homedir6(), ".aws", "credentials");
+    const credentialsPath = process.env.AWS_SHARED_CREDENTIALS_FILE || join11(homedir6(), ".aws", "credentials");
     if (!existsSync14(credentialsPath)) {
       return null;
     }
     try {
-      const content = readFileSync7(credentialsPath, "utf-8");
+      const content = readFileSync8(credentialsPath, "utf-8");
       const credentials = this.parseCredentialsFile(content, profile);
       if (credentials.accessKeyId && credentials.secretAccessKey) {
         return credentials;
@@ -47388,7 +47516,7 @@ function detectCredentialSource() {
     };
   }
   const profile = process.env.AWS_PROFILE || "default";
-  const credentialsPath = process.env.AWS_SHARED_CREDENTIALS_FILE || join10(homedir6(), ".aws", "credentials");
+  const credentialsPath = process.env.AWS_SHARED_CREDENTIALS_FILE || join11(homedir6(), ".aws", "credentials");
   if (existsSync14(credentialsPath)) {
     return {
       source: "file",
@@ -47430,13 +47558,13 @@ function resolveCredentials2(profile) {
   return loadProfileFromFile(process.env.AWS_PROFILE || "default") ?? { accessKeyId: "", secretAccessKey: "" };
 }
 function loadProfileFromFile(profile) {
-  const { existsSync: existsSync15, readFileSync: readFileSync8 } = __require("node:fs");
+  const { existsSync: existsSync15, readFileSync: readFileSync9 } = __require("node:fs");
   const { homedir: homedir5 } = __require("node:os");
-  const { join: join11 } = __require("node:path");
-  const credentialsPath = process.env.AWS_SHARED_CREDENTIALS_FILE || join11(homedir5(), ".aws", "credentials");
+  const { join: join12 } = __require("node:path");
+  const credentialsPath = process.env.AWS_SHARED_CREDENTIALS_FILE || join12(homedir5(), ".aws", "credentials");
   if (!existsSync15(credentialsPath))
     return null;
-  const content = readFileSync8(credentialsPath, "utf-8");
+  const content = readFileSync9(credentialsPath, "utf-8");
   let currentProfile = null;
   let accessKeyId;
   let secretAccessKey;
@@ -47482,8 +47610,8 @@ function loadProfileFromFile(profile) {
 // src/aws/s3.ts
 import * as crypto3 from "node:crypto";
 import { readdir as readdir4 } from "node:fs/promises";
-import { join as join12 } from "node:path";
-import { readFileSync as readFileSync9 } from "node:fs";
+import { join as join13 } from "node:path";
+import { readFileSync as readFileSync10 } from "node:fs";
 function toFetchBody(data) {
   const { buffer, byteOffset, byteLength } = data;
   if (buffer instanceof ArrayBuffer) {
@@ -47885,7 +48013,7 @@ class S3Client2 {
     }
   }
   async copy(options) {
-    const fileContent = readFileSync9(options.source);
+    const fileContent = readFileSync10(options.source);
     await this.putObject({
       bucket: options.bucket,
       key: options.key,
@@ -47908,7 +48036,7 @@ class S3Client2 {
       const relativePath = file.substring(options.source.length + 1);
       const s3Key = options.prefix ? `${options.prefix}/${relativePath}` : relativePath;
       if (!options.dryRun) {
-        const fileContent = readFileSync9(file);
+        const fileContent = readFileSync10(file);
         await this.putObject({
           bucket: options.bucket,
           key: s3Key,
@@ -47939,7 +48067,7 @@ class S3Client2 {
     const files = [];
     const entries = await readdir4(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join12(dir, entry.name);
+      const fullPath = join13(dir, entry.name);
       if (entry.isDirectory()) {
         const subFiles = await this.listFilesRecursive(fullPath);
         files.push(...subFiles);
@@ -56895,13 +57023,13 @@ async function uploadStaticFiles(options) {
   const { sourceDir, bucket, region, cacheControl = "max-age=31536000, public", onProgress } = options;
   const s32 = new S3Client2(region);
   const { readdir: readdir5 } = await import("node:fs/promises");
-  const { join: join11, relative: relative5 } = await import("node:path");
+  const { join: join12, relative: relative5 } = await import("node:path");
   const { createHash: createHash7 } = await import("node:crypto");
   async function listFiles(dir) {
     const files2 = [];
     const entries = await readdir5(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join11(dir, entry.name);
+      const fullPath = join12(dir, entry.name);
       if (entry.isDirectory()) {
         files2.push(...await listFiles(fullPath));
       } else {
@@ -57122,13 +57250,13 @@ var exports_serverless_image = {};
 __export(exports_serverless_image, {
   buildAndPushServerlessImage: () => buildAndPushServerlessImage
 });
-import { execFileSync as execFileSync2, execSync as execSync3 } from "node:child_process";
-import { mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync3, rmSync as rmSync3, writeFileSync as writeFileSync10 } from "node:fs";
-import { tmpdir as tmpdir3 } from "node:os";
-import { dirname as dirname7, join as join14 } from "node:path";
+import { execFileSync as execFileSync3, execSync as execSync3 } from "node:child_process";
+import { mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "node:fs";
+import { tmpdir as tmpdir4 } from "node:os";
+import { dirname as dirname7, join as join15 } from "node:path";
 function writeEntries(baseDir, entries) {
   for (const e of entries) {
-    const dest = join14(baseDir, e.name);
+    const dest = join15(baseDir, e.name);
     mkdirSync7(dirname7(dest), { recursive: true });
     writeFileSync10(dest, e.data, e.mode ? { mode: e.mode } : undefined);
   }
@@ -57139,9 +57267,9 @@ async function buildAndPushServerlessImage(opts) {
   const platform = arch === "arm64" ? "linux/arm64" : "linux/amd64";
   const isPhp = app.kind === "php";
   const step2 = opts.onStep ?? (() => {});
-  const stage = mkdtempSync3(join14(tmpdir3(), "tscloud-img-"));
+  const stage = mkdtempSync4(join15(tmpdir4(), "tscloud-img-"));
   try {
-    const appDir = join14(stage, "app");
+    const appDir = join15(stage, "app");
     mkdirSync7(appDir, { recursive: true });
     let handlers;
     let contentHash;
@@ -57150,19 +57278,19 @@ async function buildAndPushServerlessImage(opts) {
       step2("staging application tree");
       const entries = collectPhpAppEntries(projectRoot);
       writeEntries(appDir, entries);
-      writeEntries(join14(stage, "runtime"), phpRuntimeLayerAssets().map((a) => ({ name: a.path, data: a.contents, mode: a.mode })));
+      writeEntries(join15(stage, "runtime"), phpRuntimeLayerAssets().map((a) => ({ name: a.path, data: a.contents, mode: a.mode })));
       const handler8 = app.handlers?.http ?? "public/index.php";
       handlers = { http: handler8, queue: app.handlers?.queue ?? handler8, cli: app.handlers?.cli ?? handler8 };
       contentHash = sha256(entries.map((e) => `${e.name}:${e.data.length}`).join("|"));
     } else {
       step2("bundling application");
       const artifact = await packageServerlessApp({ projectRoot, app, skipBuild: opts.skipBuild, onStep: step2 });
-      writeFileSync10(join14(appDir, "index.mjs"), artifact.bundle);
+      writeFileSync10(join15(appDir, "index.mjs"), artifact.bundle);
       handlers = artifact.handlers;
       contentHash = artifact.sha256;
     }
     const tag = contentHash.slice(0, 16);
-    writeFileSync10(join14(stage, "Dockerfile"), generateAppImageDockerfile({
+    writeFileSync10(join15(stage, "Dockerfile"), generateAppImageDockerfile({
       kind: app.kind ?? "node",
       phpVersion: app.phpVersion,
       architecture: arch
@@ -57184,16 +57312,16 @@ async function buildAndPushServerlessImage(opts) {
       throw new Error(`could not resolve ECR repository URI for ${repository}`);
     const imageUri = `${repoUri}:${tag}`;
     step2("docker build");
-    execFileSync2("docker", ["build", "--platform", platform, "-t", imageUri, stage], { stdio: "inherit" });
+    execFileSync3("docker", ["build", "--platform", platform, "-t", imageUri, stage], { stdio: "inherit" });
     step2("ecr login");
     const loginCmd = await ecr2.getDockerLoginCommand();
     execSync3(loginCmd, { stdio: "inherit" });
     step2("docker push");
-    execFileSync2("docker", ["push", imageUri], { stdio: "inherit" });
+    execFileSync3("docker", ["push", imageUri], { stdio: "inherit" });
     info(`Image: ${imageUri}`);
     return { imageUri, tag, handlers };
   } finally {
-    rmSync3(stage, { recursive: true, force: true });
+    rmSync4(stage, { recursive: true, force: true });
   }
 }
 var init_serverless_image = __esm(async () => {
@@ -78421,7 +78549,7 @@ class ApplicationAutoScalingClient {
 init_s3();
 import * as net from "node:net";
 import * as tls from "node:tls";
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 import * as crypto4 from "node:crypto";
 
 class ImapServer {
@@ -78456,8 +78584,8 @@ class ImapServer {
     });
     if (this.config.tls?.key && this.config.tls?.cert) {
       const tlsOptions = {
-        key: readFileSync10(this.config.tls.key),
-        cert: readFileSync10(this.config.tls.cert)
+        key: readFileSync11(this.config.tls.key),
+        cert: readFileSync11(this.config.tls.cert)
       };
       this.tlsServer = tls.createServer(tlsOptions, (socket) => {
         this.handleConnection(socket);
@@ -79261,8 +79389,8 @@ class ImapServer {
     }
     this.send(session, `${tag} OK Begin TLS negotiation`);
     const tlsOptions = {
-      key: readFileSync10(this.config.tls.key),
-      cert: readFileSync10(this.config.tls.cert),
+      key: readFileSync11(this.config.tls.key),
+      cert: readFileSync11(this.config.tls.cert),
       isServer: true
     };
     const tlsSocket = new tls.TLSSocket(session.socket, tlsOptions);
@@ -79855,7 +79983,7 @@ init_ses();
 init_s3();
 import * as net2 from "node:net";
 import * as tls2 from "node:tls";
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
 import * as crypto5 from "node:crypto";
 
 class SmtpServer {
@@ -79886,8 +80014,8 @@ class SmtpServer {
     });
     if (this.config.tls?.key && this.config.tls?.cert) {
       const tlsOptions = {
-        key: readFileSync11(this.config.tls.key),
-        cert: readFileSync11(this.config.tls.cert)
+        key: readFileSync12(this.config.tls.key),
+        cert: readFileSync12(this.config.tls.cert)
       };
       this.tlsServer = tls2.createServer(tlsOptions, (socket) => {
         this.handleConnection(socket, true);
@@ -80021,8 +80149,8 @@ class SmtpServer {
     }
     this.send(session, "220 Ready to start TLS");
     const tlsOptions = {
-      key: readFileSync11(this.config.tls.key),
-      cert: readFileSync11(this.config.tls.cert),
+      key: readFileSync12(this.config.tls.key),
+      cert: readFileSync12(this.config.tls.cert),
       isServer: true
     };
     const tlsSocket = new tls2.TLSSocket(session.socket, tlsOptions);
@@ -82721,11 +82849,11 @@ init_static_site_external_dns();
 init_static_site_external_dns();
 import process19 from "node:process";
 import { existsSync as existsSync16 } from "node:fs";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 async function deploySite(config6) {
   const start = Date.now();
   const sourceDir = config6.sourceDir ?? "dist";
-  if (!existsSync16(join13(sourceDir, "index.html"))) {
+  if (!existsSync16(join14(sourceDir, "index.html"))) {
     return fail(start, `${sourceDir}/ has no index.html — build first.`);
   }
   if (!process19.env.AWS_ACCESS_KEY_ID || !process19.env.AWS_SECRET_ACCESS_KEY) {
@@ -82796,8 +82924,8 @@ function fail(start, message) {
 // src/deploy/serverless-app.ts
 init_cloudformation();
 await init_dist2();
-import { existsSync as existsSync17, readdirSync as readdirSync8, readFileSync as readFileSync12, statSync as statSync5 } from "node:fs";
-import { join as join15, relative as relative6 } from "node:path";
+import { existsSync as existsSync17, readdirSync as readdirSync8, readFileSync as readFileSync13, statSync as statSync5 } from "node:fs";
+import { join as join16, relative as relative6 } from "node:path";
 init_s3();
 init_cli();
 function resolveContext(config6, environment) {
@@ -82925,7 +83053,7 @@ function contentType(file) {
 }
 function* walk3(dir) {
   for (const entry of readdirSync8(dir)) {
-    const full = join15(dir, entry);
+    const full = join16(dir, entry);
     if (statSync5(full).isDirectory())
       yield* walk3(full);
     else
@@ -82939,7 +83067,7 @@ async function uploadAssets(s32, bucket, dir, prefix) {
     await s32.putObject({
       bucket,
       key,
-      body: readFileSync12(file),
+      body: readFileSync13(file),
       contentType: contentType(file),
       cacheControl: "public, max-age=31536000, immutable"
     });
@@ -82966,11 +83094,15 @@ async function deployServerlessApp(config6, environment, opts = {}) {
   const lambda2 = new LambdaClient(region);
   const isPhp = app.kind === "php";
   const imageMode = app.packaging === "image";
+  const resolved = resolveServerlessRuntime(app);
   let handlers;
   let codeSource;
   let artifactSha;
   let runtimeLayers;
   const parameters = [];
+  if (imageMode && resolved.usesLayer && resolved.layerKind !== "php") {
+    throw new Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ` + `${resolved.kind}${resolved.kind === "node" ? ` ${resolved.version}` : ""} uses a custom runtime — ` + `use the default zip packaging (the runtime layer is built + attached automatically).`);
+  }
   if (imageMode) {
     step("Building + pushing container image");
     const { buildAndPushServerlessImage: buildAndPushServerlessImage2 } = await init_serverless_image().then(() => exports_serverless_image);
@@ -82993,10 +83125,12 @@ async function deployServerlessApp(config6, environment, opts = {}) {
     info(`Artifact: ${artifact.sha256.slice(0, 12)} (${(artifact.zip.length / 1024).toFixed(0)} KB)`);
     handlers = artifact.handlers;
     artifactSha = artifact.sha256;
-    if (isPhp) {
-      runtimeLayers = app.layers ?? (process.env.TSCLOUD_PHP_LAYER_ARN ? [process.env.TSCLOUD_PHP_LAYER_ARN] : undefined);
+    if (resolved.usesLayer) {
+      const envArn = resolved.layerEnvVar ? process.env[resolved.layerEnvVar] : undefined;
+      runtimeLayers = app.layers ?? (envArn ? [envArn] : undefined);
       if (!runtimeLayers?.length) {
-        throw new Error("PHP serverless apps need a runtime layer. Set environments.<env>.app.layers or the TSCLOUD_PHP_LAYER_ARN env var (build one with `cloud serverless:build-php-layer`), or use packaging: 'image'.");
+        const buildCmd = resolved.layerKind === "php" ? "serverless:build-php-layer" : resolved.layerKind === "bun" ? "serverless:build-bun-layer" : "serverless:build-node-layer";
+        throw new Error(`${resolved.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${resolved.layerEnvVar} env var (build one with \`cloud ${buildCmd}\`)${resolved.kind === "node" ? ", or use a managed Node version (18/20/22)" : ""}.`);
       }
     }
     if (!await s32.bucketExists(artifactBucket)) {
@@ -83036,15 +83170,15 @@ async function deployServerlessApp(config6, environment, opts = {}) {
   const outputs = await cfn.getStackOutputs(stackName).catch(() => ({}));
   let assetUrl;
   if (app.assets) {
-    const assetsDir2 = join15(projectRoot, app.assets);
-    if (existsSync17(assetsDir2)) {
+    const assetsDir3 = join16(projectRoot, app.assets);
+    if (existsSync17(assetsDir3)) {
       const cdn = outputs.AssetsCdnDomain;
       assetUrl = cdn ? `https://${cdn}/${artifactSha}` : undefined;
       step(`Syncing assets from ${app.assets}`);
-      const n = await uploadAssets(s32, ctx.assetsBucket, assetsDir2, artifactSha);
+      const n = await uploadAssets(s32, ctx.assetsBucket, assetsDir3, artifactSha);
       info(`Uploaded ${n} asset(s)${assetUrl ? ` → ${assetUrl}` : ""}`);
     } else {
-      warn(`Assets directory not found: ${assetsDir2}`);
+      warn(`Assets directory not found: ${assetsDir3}`);
     }
   }
   step("Resolving secrets");
@@ -83185,10 +83319,26 @@ await init_dist2();
 // src/drivers/aws/driver.ts
 init_cloudformation();
 await init_dist2();
-import { readFileSync as readFileSync13 } from "node:fs";
+import { readFileSync as readFileSync14 } from "node:fs";
 init_s3();
 
 // src/drivers/shared/package-manager.ts
+var PANTRY_PACKAGES = {
+  php: "php.net",
+  nginx: "nginx.org",
+  composer: "getcomposer.org",
+  mysql: "mysql.com",
+  mariadb: "mariadb.com/server",
+  postgres: "postgresql.org",
+  redis: "redis.io",
+  memcached: "memcached.org",
+  meilisearch: "meilisearch.com",
+  git: "git-scm.com",
+  certbot: "certbot.eff.org",
+  bun: "bun.sh",
+  node: "nodejs.org",
+  deno: "deno.land"
+};
 var PANTRY_INSTALL_DIR = "/usr/local/bin";
 var PANTRY_PROJECT_DIR = "/opt/pantry";
 function sh(value) {
@@ -83228,10 +83378,6 @@ function buildPantryServiceScript(services) {
 function enabled(spec) {
   return spec === true || typeof spec === "object" && spec != null;
 }
-function sq(value) {
-  const escaped = value.split("'").join("'\\''");
-  return `'${escaped}'`;
-}
 function planServices(services) {
   const packages = [];
   const names = [];
@@ -83239,7 +83385,7 @@ function planServices(services) {
     packages.push("mysql.com");
     names.push("mysql");
   } else if (enabled(services.mariadb)) {
-    packages.push("mariadb.org");
+    packages.push(PANTRY_PACKAGES.mariadb);
     names.push("mariadb");
   }
   if (enabled(services.postgres)) {
@@ -83281,17 +83427,26 @@ function buildDatabaseSetupScript(database, services = {}) {
   const useMariadb = enabled(services.mariadb) || database.engine === "mariadb";
   const useMysql = enabled(services.mysql) || database.engine === "mysql";
   if (usePostgres && !useMysql && !useMariadb) {
-    const psql = "psql -h 127.0.0.1 -p 5432 -U postgres";
+    const pgIdent = (v) => `"${v.replace(/"/g, '""')}"`;
+    const pgLit = (v) => `'${v.replace(/'/g, "''")}'`;
     return [
       pantryEnvActivation(),
-      `${psql} -tc "SELECT 1 FROM pg_roles WHERE rolname=${sq(user)}" | grep -q 1 ` + `|| ${psql} -c "CREATE ROLE ${sq(user)} LOGIN PASSWORD ${sq(pass)};"`,
-      `${psql} -tc "SELECT 1 FROM pg_database WHERE datname=${sq(name)}" | grep -q 1 ` + `|| ${psql} -c "CREATE DATABASE ${sq(name)} OWNER ${sq(user)};"`
+      "for i in $(seq 1 30); do pg_isready -h 127.0.0.1 -p 5432 -q && break; sleep 2; done",
+      "psql -h 127.0.0.1 -p 5432 -U postgres <<'TS_CLOUD_PG_EOF'",
+      "DO $$ BEGIN",
+      `  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${pgLit(user)}) THEN`,
+      `    CREATE ROLE ${pgIdent(user)} LOGIN PASSWORD ${pgLit(pass)};`,
+      "  END IF;",
+      "END $$;",
+      `SELECT 'CREATE DATABASE ${pgIdent(name)} OWNER ${pgIdent(user)}' ` + `WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${pgLit(name)})\\gexec`,
+      "TS_CLOUD_PG_EOF"
     ];
   }
   const ident = (v) => v.replace(/`/g, "``");
   const lit = (v) => v.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
   return [
     pantryEnvActivation(),
+    "for i in $(seq 1 30); do mysqladmin -h 127.0.0.1 -P 3306 -u root ping 2>/dev/null | grep -q alive && break; sleep 2; done",
     "mysql -h 127.0.0.1 -P 3306 -u root <<'TS_CLOUD_SQL_EOF'",
     `CREATE DATABASE IF NOT EXISTS \`${ident(name)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`,
     `CREATE USER IF NOT EXISTS '${lit(user)}'@'%' IDENTIFIED BY '${lit(pass)}';`,
@@ -83438,9 +83593,9 @@ function buildNginxVhostScript(options) {
   const out = [];
   if (options.auth) {
     const file = htpasswdPath(options.siteName);
-    const sq2 = (v) => v.split("'").join("'\\''");
-    const pw = sq2(options.auth.password);
-    const user = sq2(options.auth.username);
+    const sq = (v) => v.split("'").join("'\\''");
+    const pw = sq(options.auth.password);
+    const user = sq(options.auth.username);
     out.push(`TS_CLOUD_HTPASS=$(openssl passwd -apr1 '${pw}')`, `printf '%s:%s\\n' '${user}' "$TS_CLOUD_HTPASS" > ${file}`, `chmod 640 ${file}`, `chown root:www-data ${file} 2>/dev/null || true`);
   }
   out.push(`cat > ${available} <<'TS_CLOUD_NGINX_EOF'`, vhost.replace(/\n$/, ""), "TS_CLOUD_NGINX_EOF", `ln -sf ${available} ${enabled2}`, "rm -f /etc/nginx/sites-enabled/default", `${NGINX_WRAPPER} -t`, "systemctl reload ts-cloud-nginx 2>/dev/null || systemctl restart ts-cloud-nginx 2>/dev/null || true");
@@ -84204,7 +84359,7 @@ class AwsDriver {
     await s32.putObject({
       bucket,
       key: options.remoteKey,
-      body: readFileSync13(options.localPath),
+      body: readFileSync14(options.localPath),
       contentType: "application/gzip"
     });
     return { artifactRef: `s3://${bucket}/${options.remoteKey}` };
@@ -84311,9 +84466,9 @@ class AwsDriver {
 
 // src/drivers/hetzner/driver.ts
 await init_dist2();
-import { existsSync as existsSync18, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync15 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 import { execSync as execSync5 } from "node:child_process";
 
 // src/drivers/hetzner/client.ts
@@ -84743,10 +84898,10 @@ function matchesTsCloudLabels(labels, slug, environment, role = "app") {
 
 // src/drivers/hetzner/state.ts
 import { mkdir as mkdir4, readFile, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 var STATE_DIR = ".ts-cloud/state";
 function driverStatePath(stackName) {
-  return join16(process.cwd(), STATE_DIR, `${stackName}.json`);
+  return join17(process.cwd(), STATE_DIR, `${stackName}.json`);
 }
 async function readDriverState(stackName) {
   try {
@@ -84758,7 +84913,7 @@ async function readDriverState(stackName) {
 }
 async function writeDriverState(stackName, state) {
   const path = driverStatePath(stackName);
-  await mkdir4(join16(process.cwd(), STATE_DIR), { recursive: true });
+  await mkdir4(join17(process.cwd(), STATE_DIR), { recursive: true });
   await writeFile4(path, `${JSON.stringify(state, null, 2)}
 `, "utf8");
 }
@@ -84766,7 +84921,7 @@ async function writeDriverState(stackName, state) {
 // src/drivers/hetzner/driver.ts
 var SSH_MAX_BUFFER = 1024 * 1024 * 256;
 function expandHome(path) {
-  return path.startsWith("~/") ? join17(homedir7(), path.slice(2)) : path;
+  return path.startsWith("~/") ? join18(homedir7(), path.slice(2)) : path;
 }
 
 class HetznerDriver {
@@ -84838,7 +84993,7 @@ class HetznerDriver {
     }) : undefined;
     const provision = buildComputeProvisionScripts(config6);
     const baked = compute.bakedImage === true;
-    const bootstrap = buildUbuntuBootstrapScript({
+    const bootstrap2 = buildUbuntuBootstrapScript({
       runtime: provision.runtime,
       runtimeVersion: provision.runtimeVersion,
       systemPackages: compute.systemPackages,
@@ -84848,7 +85003,7 @@ class HetznerDriver {
       rpxProvision,
       baked
     });
-    const userData = wrapCloudInitUserData(bootstrap);
+    const userData = wrapCloudInitUserData(bootstrap2);
     const serverType = resolveHetznerServerType(compute.size);
     const image = compute.image || config6.hetzner?.image || "ubuntu-24.04";
     const firewallName = `${slug}-${environment}-app-fw`;
@@ -85197,7 +85352,7 @@ class HetznerDriver {
     if (!existsSync18(this.sshPublicKeyPath)) {
       throw new Error(`SSH public key not found at ${this.sshPublicKeyPath}. ts-cloud deploys to Hetzner over SSH and needs a public key to authorize on the server. ` + `Generate one (\`ssh-keygen -t ed25519\`) or set hetzner.sshPrivateKeyPath / HCLOUD_SSH_PUBLIC_KEY.`);
     }
-    const publicKey = readFileSync14(this.sshPublicKeyPath, "utf8").trim();
+    const publicKey = readFileSync15(this.sshPublicKeyPath, "utf8").trim();
     const normalized = normalizeSshPublicKey(publicKey);
     const existing = await this.client.listSshKeys();
     const match = existing.find((key) => normalizeSshPublicKey(key.public_key) === normalized);
@@ -86077,6 +86232,7 @@ export {
   stackDependencyManager,
   signRequestAsync,
   signRequest,
+  sharedRuntimeLoop,
   sha256,
   setupDns01Challenge,
   setMaintenance,
@@ -86103,6 +86259,7 @@ export {
   resolveSiteKind,
   resolveSiteDeployTarget,
   resolveSiteBucketName,
+  resolveServerlessRuntime,
   resolveServerlessAssetBucketName,
   resolveServerlessArtifactBucketName,
   resolveServerlessAppStackName,
@@ -86333,8 +86490,10 @@ export {
   buildSiteDeployScript,
   buildPhpRuntimeLayerZip,
   buildOptimizationManager,
+  buildNodeRuntimeLayerZip,
   buildFunctionEnv,
   buildCloudFormationTemplate,
+  buildBunRuntimeLayerZip,
   buildAndPushServerlessImage,
   bounceComplaintHandler,
   blueGreenManager,
@@ -86439,6 +86598,7 @@ export {
   MigrationManager,
   MetricsManager,
   Messaging,
+  MANAGED_NODE_VERSIONS,
   LogsManager,
   LambdaVersionsManager,
   LambdaVPCManager,