@ts-cloud/core 0.2.26 → 0.3.0

package/dist/index.js

@@ -1670,6 +1670,15 @@ function resolveStorageBucketName(slug, environment, bucketKey, explicitBucket)
 function resolveDeployBucketName(slug, environment) {
   return `${slug}-${environment}-deploy`;
 }
+function resolveServerlessAppStackName(config, environment) {
+  return `${config.project.slug}-${environment}-app`;
+}
+function resolveServerlessArtifactBucketName(slug, environment) {
+  return `${slug}-${environment}-deployments`;
+}
+function resolveServerlessAssetBucketName(slug, environment) {
+  return `${slug}-${environment}-assets`;
+}
 // src/dependency-graph.ts
 class DependencyGraph {
   nodes = new Map;
@@ -2567,7 +2576,7 @@ class Storage {
     for (const docsPath of docsPaths) {
       const fullPath = join(projectRoot, docsPath);
       if (existsSync(fullPath)) {
-        const distPaths = ["dist", "build", ".vitepress/dist", "_site", "out", "public"];
+        const distPaths = ["dist", "build", ".bunpress/dist", "_site", "out", "public"];
         for (const distPath of distPaths) {
           const fullDistPath = join(fullPath, distPath);
           if (existsSync(fullDistPath)) {
@@ -3408,7 +3417,7 @@ exports.handler = async (event) => {
   }
 
   // Try to determine if this is a directory or a file
-  // First, try appending .html (for VitePress clean URLs)
+  // First, try appending .html (for BunPress clean URLs)
   // If the file doesn't exist, CloudFront will try the directory with index.html
 
   // Check if the URI looks like a file path without extension
@@ -6041,7 +6050,8 @@ echo "Database tools installed!"
       java21: "java21",
       java17: "java17",
       go: "provided.al2023",
-      rust: "provided.al2023"
+      rust: "provided.al2023",
+      bun: "provided.al2023"
     },
     presets: {
       api: {
@@ -20631,6 +20641,45 @@ function createNodeJsServerlessPreset(options) {
     }
   };
 }
+// src/presets/serverless-node.ts
+function createServerlessNodePreset(options) {
+  const {
+    name,
+    slug,
+    entry,
+    domain,
+    runtime = "nodejs20.x",
+    memory = 1024,
+    build,
+    deploy,
+    assets,
+    queues = true,
+    scheduler = "on",
+    region = "us-east-1"
+  } = options;
+  return {
+    project: { name, slug, region },
+    mode: "serverless",
+    environments: {
+      production: {
+        type: "production",
+        domain,
+        app: {
+          kind: "node",
+          runtime,
+          entry,
+          memory,
+          build,
+          deploy,
+          assets,
+          queues,
+          scheduler,
+          domain
+        }
+      }
+    }
+  };
+}
 // src/presets/fullstack-app.ts
 function createFullStackAppPreset(options) {
   const {
@@ -22145,6 +22194,119 @@ function createTraditionalWebAppPreset(options) {
     }
   };
 }
+// src/presets/laravel.ts
+function createLaravelPreset(options) {
+  const {
+    name,
+    slug,
+    domain,
+    repository,
+    phpVersion = "8.3",
+    size = "small",
+    database: database2 = slug.replace(/-/g, "_"),
+    databasePassword,
+    sslEmail,
+    deployStrategy = "push",
+    provider = "hetzner"
+  } = options;
+  return {
+    project: { name, slug, region: "us-east-1" },
+    mode: "server",
+    cloud: { provider },
+    environments: {
+      production: { type: "production", domain }
+    },
+    infrastructure: {
+      compute: {
+        mode: "server",
+        size,
+        runtime: "php",
+        webServer: "nginx",
+        php: { versions: [phpVersion], default: phpVersion },
+        managedServices: { mysql: true, redis: true },
+        firewall: { enabled: true },
+        autoUpdates: true,
+        monitoring: true,
+        backups: { enabled: true, schedule: "0 2 * * *", retentionCount: 7 }
+      },
+      appDatabase: {
+        engine: "mysql",
+        name: database2,
+        username: database2,
+        password: databasePassword
+      }
+    },
+    sites: {
+      main: {
+        root: ".",
+        type: "laravel",
+        domain,
+        phpVersion,
+        repository: { ...repository, strategy: deployStrategy },
+        scheduler: true,
+        queues: [{ connection: "redis", queue: "default", processes: 1 }],
+        ssl: { provider: "letsencrypt", email: sslEmail }
+      }
+    }
+  };
+}
+// src/presets/serverless-laravel.ts
+function createServerlessLaravelPreset(options) {
+  const {
+    name,
+    slug,
+    domain,
+    layers,
+    phpVersion = "8.3",
+    architecture = "x86_64",
+    memory = 1024,
+    build,
+    deploy = ["migrate --force"],
+    cache: cache2 = "dynamodb",
+    scheduler = "on",
+    region = "us-east-1"
+  } = options;
+  return {
+    project: { name, slug, region },
+    mode: "serverless",
+    environments: {
+      production: {
+        type: "production",
+        domain,
+        app: {
+          kind: "php",
+          runtime: "provided.al2023",
+          phpVersion,
+          architecture,
+          layers,
+          memory,
+          build,
+          deploy,
+          assets: "public",
+          queues: true,
+          scheduler,
+          cache: { driver: cache2 },
+          domain
+        }
+      }
+    }
+  };
+}
+// src/presets/dashboard.ts
+function createDashboardSite(options) {
+  return {
+    root: options.root ?? "ui/dist",
+    deploy: "server",
+    type: "static",
+    domain: options.domain,
+    build: options.build ?? "cd ui && bun install && bun run build",
+    ssl: { provider: "letsencrypt" },
+    auth: {
+      username: options.username ?? "admin",
+      password: options.password
+    }
+  };
+}
 // src/presets/extend.ts
 function deepMerge(target, source) {
   const result = { ...target };
@@ -25003,6 +25165,27 @@ var cloud_config_schema_default = {
         region: {
           type: "string",
           description: "AWS region override for this environment"
+        },
+        app: {
+          type: "object",
+          description: "Serverless application manifest (Laravel-Vapor-equivalent). Defining this opts the environment into the serverless app deploy pipeline (http/queue/cli Lambda functions, assets, build/deploy hooks).",
+          properties: {
+            runtime: { type: "string", description: "Lambda runtime (e.g. nodejs20.x, provided.al2023)" },
+            kind: { type: "string", enum: ["node", "bun", "php"], description: "Application kind (drives packaging + runtime)" },
+            entry: { type: "string", description: "Entry file exporting the request handler" },
+            memory: { type: "number", description: "HTTP function memory in MB" },
+            timeout: { type: "number", description: "HTTP request timeout in seconds" },
+            gatewayVersion: { type: "number", enum: [1, 2], description: "API Gateway version (2 = HTTP API, 1 = REST)" },
+            warm: { type: "number", description: "Keep-warm / provisioned concurrency count" },
+            queues: { description: "Queue names (true = single default queue, false = disabled)" },
+            scheduler: { type: "string", enum: ["off", "on", "sub-minute"], description: "Task scheduler mode" },
+            build: { type: "array", items: { type: "string" }, description: "Commands run locally before packaging" },
+            deploy: { type: "array", items: { type: "string" }, description: "Commands run remotely after activation (e.g. migrations)" },
+            octane: { type: "boolean", description: "Persistent application mode (Laravel Octane)" },
+            packaging: { type: "string", enum: ["zip", "image"], description: "Deployment package format (zip or container image)" },
+            phpVersion: { type: "string", description: "PHP version for the runtime layer (kind: php)" },
+            architecture: { type: "string", enum: ["x86_64", "arm64"], description: "CPU architecture" }
+          }
         }
       }
     },
@@ -44953,6 +45136,1145 @@ class QueueManagementManager {
   }
 }
 var queueManagementManager = new QueueManagementManager;
+// src/serverless/zip.ts
+import { deflateRawSync } from "node:zlib";
+var CRC_TABLE = (() => {
+  const table2 = [];
+  for (let i = 0;i < 256; i++) {
+    let c = i;
+    for (let j = 0;j < 8; j++)
+      c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+    table2[i] = c >>> 0;
+  }
+  return table2;
+})();
+function crc32(data) {
+  let crc = 4294967295;
+  for (let i = 0;i < data.length; i++)
+    crc = CRC_TABLE[(crc ^ data[i]) & 255] ^ crc >>> 8;
+  return (crc ^ 4294967295) >>> 0;
+}
+function toBuffer(data) {
+  if (typeof data === "string")
+    return Buffer.from(data, "utf-8");
+  if (Buffer.isBuffer(data))
+    return data;
+  return Buffer.from(data);
+}
+function dosTimeDate(date) {
+  const year = Math.max(1980, date.getFullYear());
+  const time = (date.getHours() << 11 | date.getMinutes() << 5 | date.getSeconds() >> 1) & 65535;
+  const d = (year - 1980 << 9 | date.getMonth() + 1 << 5 | date.getDate()) & 65535;
+  return { time, date: d };
+}
+function createZip(entries) {
+  const localParts = [];
+  const centralParts = [];
+  let offset = 0;
+  for (const entry of entries) {
+    const raw = toBuffer(entry.data);
+    const compressed = deflateRawSync(raw);
+    const crc = crc32(raw);
+    const nameBuf = Buffer.from(entry.name.replace(/\\/g, "/"), "utf-8");
+    const { time, date } = dosTimeDate(entry.date ?? new Date(0));
+    const mode = entry.mode ?? 420;
+    const local = Buffer.alloc(30 + nameBuf.length);
+    local.writeUInt32LE(67324752, 0);
+    local.writeUInt16LE(20, 4);
+    local.writeUInt16LE(0, 6);
+    local.writeUInt16LE(8, 8);
+    local.writeUInt16LE(time, 10);
+    local.writeUInt16LE(date, 12);
+    local.writeUInt32LE(crc, 14);
+    local.writeUInt32LE(compressed.length, 18);
+    local.writeUInt32LE(raw.length, 22);
+    local.writeUInt16LE(nameBuf.length, 26);
+    local.writeUInt16LE(0, 28);
+    nameBuf.copy(local, 30);
+    const central = Buffer.alloc(46 + nameBuf.length);
+    central.writeUInt32LE(33639248, 0);
+    central.writeUInt16LE(798, 4);
+    central.writeUInt16LE(20, 6);
+    central.writeUInt16LE(0, 8);
+    central.writeUInt16LE(8, 10);
+    central.writeUInt16LE(time, 12);
+    central.writeUInt16LE(date, 14);
+    central.writeUInt32LE(crc, 16);
+    central.writeUInt32LE(compressed.length, 20);
+    central.writeUInt32LE(raw.length, 24);
+    central.writeUInt16LE(nameBuf.length, 28);
+    central.writeUInt16LE(0, 30);
+    central.writeUInt16LE(0, 32);
+    central.writeUInt16LE(0, 34);
+    central.writeUInt16LE(0, 36);
+    central.writeUInt32LE((mode & 65535) << 16, 38);
+    central.writeUInt32LE(offset, 42);
+    nameBuf.copy(central, 46);
+    localParts.push(local, compressed);
+    centralParts.push(central);
+    offset += local.length + compressed.length;
+  }
+  const centralDir = Buffer.concat(centralParts);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(101010256, 0);
+  end.writeUInt16LE(0, 4);
+  end.writeUInt16LE(0, 6);
+  end.writeUInt16LE(entries.length, 8);
+  end.writeUInt16LE(entries.length, 10);
+  end.writeUInt32LE(centralDir.length, 12);
+  end.writeUInt32LE(offset, 16);
+  end.writeUInt16LE(0, 20);
+  return Buffer.concat([...localParts, centralDir, end]);
+}
+// src/serverless/bootstrap.ts
+function generateBootstrap(opts) {
+  const adapter = opts.adapterImport ?? "./adapter";
+  const entry = opts.entryImport.replace(/\\/g, "/");
+  return `// Generated by ts-cloud — serverless app bootstrap. Do not edit.
+import * as __userModule from ${JSON.stringify(entry)}
+import { resolveApp, createHandlers } from ${JSON.stringify(adapter)}
+
+const __app = resolveApp(__userModule)
+const __handlers = createHandlers(__app)
+
+export const http = __handlers.http
+export const queue = __handlers.queue
+export const cli = __handlers.cli
+`;
+}
+// src/serverless/package.ts
+import { execSync } from "node:child_process";
+import { createHash as createHash4 } from "node:crypto";
+import { cpSync, mkdtempSync, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname as dirname2, isAbsolute, join as join6, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+function adapterSourcePath() {
+  return join6(dirname2(fileURLToPath(import.meta.url)), "runtime", "adapter.ts");
+}
+function runBuildHooks(hooks, cwd, onStep) {
+  for (const hook of hooks ?? []) {
+    onStep?.(`build: ${hook}`);
+    execSync(hook, { stdio: "inherit", cwd });
+  }
+}
+function sha256(data) {
+  return createHash4("sha256").update(data).digest("hex");
+}
+function artifactKey(slug, environment, hash2) {
+  return `deployments/${slug}/${environment}/${hash2}.zip`;
+}
+async function packageServerlessApp(opts) {
+  const projectRoot = resolve(opts.projectRoot ?? process.cwd());
+  const { app } = opts;
+  if (!opts.skipBuild)
+    runBuildHooks(app.build, projectRoot, opts.onStep);
+  const entry = app.entry;
+  if (!entry)
+    throw new Error("serverless app: `entry` is required to package a Node/Bun application");
+  const entryPath = isAbsolute(entry) ? entry : join6(projectRoot, entry);
+  const stage = mkdtempSync(join6(tmpdir(), "tscloud-pkg-"));
+  try {
+    cpSync(adapterSourcePath(), join6(stage, "adapter.ts"));
+    const bootstrapPath = join6(stage, "bootstrap.ts");
+    writeFileSync3(bootstrapPath, generateBootstrap({ entryImport: entryPath, adapterImport: "./adapter" }));
+    opts.onStep?.("bundling application");
+    const result = await Bun.build({
+      entrypoints: [bootstrapPath],
+      target: "node",
+      format: "esm",
+      minify: false,
+      sourcemap: "none"
+    });
+    if (!result.success) {
+      const logs = result.logs.map((l) => String(l)).join(`
+`);
+      throw new Error(`serverless app bundle failed:
+${logs}`);
+    }
+    const output = result.outputs[0];
+    const bundle = Buffer.from(await output.arrayBuffer());
+    const handlerFile = "index";
+    const zip = createZip([{ name: `${handlerFile}.mjs`, data: bundle }]);
+    return {
+      zip,
+      bundle,
+      sha256: sha256(zip),
+      handlerFile,
+      handlers: {
+        http: app.handlers?.http ?? `${handlerFile}.http`,
+        queue: app.handlers?.queue ?? `${handlerFile}.queue`,
+        cli: app.handlers?.cli ?? `${handlerFile}.cli`
+      },
+      bundleBytes: bundle.length
+    };
+  } finally {
+    rmSync(stage, { recursive: true, force: true });
+  }
+}
+// src/serverless/composer.ts
+function resolveQueueNames(app, slug, env) {
+  if (app.queues === false)
+    return [];
+  if (app.queues === undefined || app.queues === true)
+    return [`${slug}-${env}-default`];
+  return app.queues.map((q) => {
+    const name = typeof q === "string" ? q : Object.keys(q)[0];
+    return `${slug}-${env}-${name}`;
+  });
+}
+function composeServerlessAppTemplate(opts) {
+  const { app, environment, handlers } = opts;
+  const slug = opts.config.project.slug;
+  const runtime = app.runtime ?? "nodejs20.x";
+  const architecture = app.architecture ?? "x86_64";
+  const region = opts.config.project.region;
+  const functionNames = {
+    http: `${slug}-${environment}-http`,
+    queue: `${slug}-${environment}-queue`,
+    cli: `${slug}-${environment}-cli`
+  };
+  const queueNames = resolveQueueNames(app, slug, environment);
+  const hasQueue = queueNames.length > 0;
+  const imageMode = app.packaging === "image";
+  const schedulerEnabled = (app.scheduler ?? "on") !== "off";
+  const cacheEnabled = (app.cache?.driver ?? "dynamodb") === "dynamodb";
+  const assetsEnabled = Boolean(app.assets);
+  const assetsBucket = resolveServerlessAssetBucketName(slug, environment);
+  const tmpStorage = app.tmpStorage ?? 512;
+  const resources = {};
+  const outputs = {};
+  const inlinePolicies = [
+    {
+      PolicyName: "tscloud-serverless-app",
+      PolicyDocument: {
+        Version: "2012-10-17",
+        Statement: [
+          {
+            Effect: "Allow",
+            Action: ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
+            Resource: Fn2.sub("arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*")
+          },
+          {
+            Effect: "Allow",
+            Action: ["lambda:InvokeFunction"],
+            Resource: Fn2.sub("arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:" + `${slug}-${environment}-*`)
+          },
+          {
+            Effect: "Allow",
+            Action: ["secretsmanager:GetSecretValue", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath"],
+            Resource: [
+              Fn2.sub("arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:" + `${slug}/${environment}/*`),
+              Fn2.sub("arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/" + `${slug}/${environment}/*`)
+            ]
+          },
+          {
+            Effect: "Allow",
+            Action: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket"],
+            Resource: [
+              Fn2.sub(`arn:aws:s3:::${assetsBucket}`),
+              Fn2.sub(`arn:aws:s3:::${assetsBucket}/*`),
+              ...app.storage?.bucket ? [Fn2.sub(`arn:aws:s3:::${app.storage.bucket}`), Fn2.sub(`arn:aws:s3:::${app.storage.bucket}/*`)] : []
+            ]
+          }
+        ]
+      }
+    }
+  ];
+  if (hasQueue) {
+    inlinePolicies[0].PolicyDocument.Statement.push({
+      Effect: "Allow",
+      Action: ["sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:GetQueueUrl"],
+      Resource: Fn2.sub("arn:aws:sqs:${AWS::Region}:${AWS::AccountId}:" + `${slug}-${environment}-*`)
+    });
+  }
+  if (cacheEnabled) {
+    inlinePolicies[0].PolicyDocument.Statement.push({
+      Effect: "Allow",
+      Action: ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem"],
+      Resource: Fn2.sub("arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/" + `${slug}-${environment}-cache*`)
+    });
+  }
+  const managedPolicies = ["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"];
+  if (app.vpc?.subnets?.length)
+    managedPolicies.push("arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole");
+  resources.AppRole = {
+    Type: "AWS::IAM::Role",
+    Properties: {
+      RoleName: `${slug}-${environment}-app-role`,
+      AssumeRolePolicyDocument: {
+        Version: "2012-10-17",
+        Statement: [{ Effect: "Allow", Principal: { Service: "lambda.amazonaws.com" }, Action: "sts:AssumeRole" }]
+      },
+      ManagedPolicyArns: managedPolicies,
+      Policies: inlinePolicies
+    }
+  };
+  const baseEnv = (mode) => ({
+    TSCLOUD_LAMBDA_MODE: mode,
+    TSCLOUD_ENV: environment,
+    ...app.octane ? { TSCLOUD_OCTANE: "1" } : {},
+    ...cacheEnabled ? { TSCLOUD_CACHE_TABLE: `${slug}-${environment}-cache` } : {},
+    ...hasQueue ? { TSCLOUD_QUEUE: queueNames[0] } : {},
+    ...app.env ?? {}
+  });
+  const subnets = app.vpc?.subnets ?? [];
+  const hasVpc = subnets.length > 0;
+  const needsDataVpc = app.cache?.driver === "elasticache" || app.database?.connection === "aurora-serverless" || Boolean(app.rdsProxy);
+  if (needsDataVpc && !hasVpc) {
+    throw new Error("serverless app: elasticache / aurora-serverless / rdsProxy require app.vpc.subnets (private subnets) to be set.");
+  }
+  const vpcConfig = hasVpc ? {
+    VpcConfig: {
+      SubnetIds: subnets,
+      SecurityGroupIds: [
+        ...app.vpc?.securityGroups ?? [],
+        ...needsDataVpc ? [Fn2.getAtt("DataSecurityGroup", "GroupId")] : []
+      ]
+    }
+  } : {};
+  function addFunction(logicalId, name, handler8, mode, memory, timeout, reservedConcurrency) {
+    resources[`${logicalId}LogGroup`] = {
+      Type: "AWS::Logs::LogGroup",
+      Properties: { LogGroupName: `/aws/lambda/${name}`, RetentionInDays: 14 }
+    };
+    const codeProps = imageMode ? {
+      PackageType: "Image",
+      Code: { ImageUri: Fn2.ref("ImageUri") },
+      ...app.kind === "php" ? {} : { ImageConfig: { Command: [handler8] } }
+    } : {
+      Runtime: runtime,
+      Handler: handler8,
+      Code: { S3Bucket: Fn2.ref("ArtifactBucket"), S3Key: Fn2.ref("ArtifactKey") },
+      ...opts.runtimeLayers?.length ? { Layers: opts.runtimeLayers } : {}
+    };
+    resources[logicalId] = {
+      Type: "AWS::Lambda::Function",
+      DependsOn: [`${logicalId}LogGroup`],
+      Properties: {
+        FunctionName: name,
+        Architectures: [architecture],
+        MemorySize: memory,
+        Timeout: timeout,
+        Role: Fn2.getAtt("AppRole", "Arn"),
+        Environment: { Variables: baseEnv(mode) },
+        EphemeralStorage: { Size: tmpStorage },
+        ...codeProps,
+        ...reservedConcurrency !== undefined ? { ReservedConcurrentExecutions: reservedConcurrency } : {},
+        ...vpcConfig
+      }
+    };
+  }
+  addFunction("HttpFunction", functionNames.http, handlers.http, "http", app.memory ?? 1024, app.timeout ?? 28, app.concurrency);
+  addFunction("CliFunction", functionNames.cli, handlers.cli, "cli", app.cliMemory ?? 1024, app.cliTimeout ?? 900);
+  if (hasQueue)
+    addFunction("QueueFunction", functionNames.queue, handlers.queue, "queue", app.queueMemory ?? 1024, app.queueTimeout ?? 120);
+  resources.HttpApi = {
+    Type: "AWS::ApiGatewayV2::Api",
+    Properties: {
+      Name: `${slug}-${environment}`,
+      ProtocolType: "HTTP"
+    }
+  };
+  resources.HttpIntegration = {
+    Type: "AWS::ApiGatewayV2::Integration",
+    Properties: {
+      ApiId: Fn2.ref("HttpApi"),
+      IntegrationType: "AWS_PROXY",
+      IntegrationUri: Fn2.getAtt("HttpFunction", "Arn"),
+      PayloadFormatVersion: "2.0"
+    }
+  };
+  resources.HttpRoute = {
+    Type: "AWS::ApiGatewayV2::Route",
+    Properties: {
+      ApiId: Fn2.ref("HttpApi"),
+      RouteKey: "$default",
+      Target: Fn2.join("/", ["integrations", Fn2.ref("HttpIntegration")])
+    }
+  };
+  resources.HttpStage = {
+    Type: "AWS::ApiGatewayV2::Stage",
+    Properties: {
+      ApiId: Fn2.ref("HttpApi"),
+      StageName: "$default",
+      AutoDeploy: true
+    }
+  };
+  resources.HttpPermission = {
+    Type: "AWS::Lambda::Permission",
+    Properties: {
+      FunctionName: Fn2.ref("HttpFunction"),
+      Action: "lambda:InvokeFunction",
+      Principal: "apigateway.amazonaws.com",
+      SourceArn: Fn2.sub("arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${HttpApi}/*/*")
+    }
+  };
+  outputs.HttpApiEndpoint = {
+    Description: "HTTP API endpoint",
+    Value: Fn2.getAtt("HttpApi", "ApiEndpoint")
+  };
+  outputs.HttpApiId = { Description: "HTTP API id", Value: Fn2.ref("HttpApi") };
+  if (hasQueue) {
+    resources.AppQueueDlq = {
+      Type: "AWS::SQS::Queue",
+      Properties: {
+        QueueName: `${slug}-${environment}-dlq`,
+        MessageRetentionPeriod: 1209600
+      }
+    };
+    queueNames.forEach((qName, i) => {
+      const qId = `AppQueue${i}`;
+      resources[qId] = {
+        Type: "AWS::SQS::Queue",
+        Properties: {
+          QueueName: qName,
+          VisibilityTimeout: Math.max(app.queueTimeout ?? 120, app.queueTimeout ?? 120),
+          RedrivePolicy: {
+            deadLetterTargetArn: Fn2.getAtt("AppQueueDlq", "Arn"),
+            maxReceiveCount: app.queueTries ?? 3
+          }
+        }
+      };
+      resources[`${qId}Mapping`] = {
+        Type: "AWS::Lambda::EventSourceMapping",
+        Properties: {
+          EventSourceArn: Fn2.getAtt(qId, "Arn"),
+          FunctionName: Fn2.ref("QueueFunction"),
+          BatchSize: 1,
+          FunctionResponseTypes: ["ReportBatchItemFailures"],
+          ...app.queueConcurrency ? { ScalingConfig: { MaximumConcurrency: Math.max(2, app.queueConcurrency) } } : {}
+        }
+      };
+      outputs[`QueueUrl${i}`] = { Description: `Queue URL: ${qName}`, Value: Fn2.ref(qId) };
+    });
+  }
+  if (schedulerEnabled) {
+    resources.SchedulerRule = {
+      Type: "AWS::Events::Rule",
+      Properties: {
+        Name: `${slug}-${environment}-scheduler`,
+        ScheduleExpression: "rate(1 minute)",
+        State: "ENABLED",
+        Targets: [{
+          Id: "cli",
+          Arn: Fn2.getAtt("CliFunction", "Arn"),
+          Input: JSON.stringify({ command: "schedule:run" })
+        }]
+      }
+    };
+    resources.SchedulerPermission = {
+      Type: "AWS::Lambda::Permission",
+      Properties: {
+        FunctionName: Fn2.ref("CliFunction"),
+        Action: "lambda:InvokeFunction",
+        Principal: "events.amazonaws.com",
+        SourceArn: Fn2.getAtt("SchedulerRule", "Arn")
+      }
+    };
+  }
+  if (app.warm && app.warm > 0) {
+    const TARGETS_PER_RULE = 5;
+    const ruleCount = Math.ceil(app.warm / TARGETS_PER_RULE);
+    let warmed = 0;
+    for (let r = 0;r < ruleCount; r++) {
+      const targets = Math.min(TARGETS_PER_RULE, app.warm - warmed);
+      resources[`WarmerRule${r}`] = {
+        Type: "AWS::Events::Rule",
+        Properties: {
+          Name: `${slug}-${environment}-warmer-${r}`,
+          ScheduleExpression: "rate(5 minutes)",
+          State: "ENABLED",
+          Targets: Array.from({ length: targets }, (_, i) => ({
+            Id: `warm-${r}-${i}`,
+            Arn: Fn2.getAtt("HttpFunction", "Arn"),
+            Input: JSON.stringify({ warmer: true })
+          }))
+        }
+      };
+      warmed += targets;
+    }
+    resources.WarmerPermission = {
+      Type: "AWS::Lambda::Permission",
+      Properties: {
+        FunctionName: Fn2.ref("HttpFunction"),
+        Action: "lambda:InvokeFunction",
+        Principal: "events.amazonaws.com",
+        SourceArn: Fn2.sub("arn:aws:events:${AWS::Region}:${AWS::AccountId}:rule/" + `${slug}-${environment}-warmer-*`)
+      }
+    };
+  }
+  if (cacheEnabled) {
+    resources.CacheTable = {
+      Type: "AWS::DynamoDB::Table",
+      Properties: {
+        TableName: `${slug}-${environment}-cache`,
+        BillingMode: "PAY_PER_REQUEST",
+        AttributeDefinitions: [{ AttributeName: "key", AttributeType: "S" }],
+        KeySchema: [{ AttributeName: "key", KeyType: "HASH" }],
+        TimeToLiveSpecification: { AttributeName: "expires_at", Enabled: true }
+      }
+    };
+    outputs.CacheTableName = { Description: "DynamoDB cache table", Value: Fn2.ref("CacheTable") };
+  }
+  if (assetsEnabled) {
+    resources.AssetsBucket = {
+      Type: "AWS::S3::Bucket",
+      Properties: {
+        BucketName: assetsBucket,
+        PublicAccessBlockConfiguration: {
+          BlockPublicAcls: true,
+          BlockPublicPolicy: true,
+          IgnorePublicAcls: true,
+          RestrictPublicBuckets: true
+        }
+      }
+    };
+    resources.AssetsOAC = {
+      Type: "AWS::CloudFront::OriginAccessControl",
+      Properties: {
+        OriginAccessControlConfig: {
+          Name: `${slug}-${environment}-assets-oac`,
+          OriginAccessControlOriginType: "s3",
+          SigningBehavior: "always",
+          SigningProtocol: "sigv4"
+        }
+      }
+    };
+    resources.AssetsDistribution = {
+      Type: "AWS::CloudFront::Distribution",
+      Properties: {
+        DistributionConfig: {
+          Enabled: true,
+          DefaultCacheBehavior: {
+            TargetOriginId: "assets",
+            ViewerProtocolPolicy: "redirect-to-https",
+            Compress: true,
+            CachePolicyId: "658327ea-f89d-4fab-a63d-7e88639e58f6"
+          },
+          Origins: [{
+            Id: "assets",
+            DomainName: Fn2.getAtt("AssetsBucket", "RegionalDomainName"),
+            OriginAccessControlId: Fn2.ref("AssetsOAC"),
+            S3OriginConfig: { OriginAccessIdentity: "" }
+          }]
+        }
+      }
+    };
+    resources.AssetsBucketPolicy = {
+      Type: "AWS::S3::BucketPolicy",
+      Properties: {
+        Bucket: Fn2.ref("AssetsBucket"),
+        PolicyDocument: {
+          Version: "2012-10-17",
+          Statement: [{
+            Effect: "Allow",
+            Principal: { Service: "cloudfront.amazonaws.com" },
+            Action: "s3:GetObject",
+            Resource: Fn2.sub(`arn:aws:s3:::${assetsBucket}/*`),
+            Condition: { StringEquals: { "AWS:SourceArn": Fn2.sub("arn:aws:cloudfront::${AWS::AccountId}:distribution/${AssetsDistribution}") } }
+          }]
+        }
+      }
+    };
+    outputs.AssetsBucketName = { Description: "Assets bucket", Value: Fn2.ref("AssetsBucket") };
+    outputs.AssetsCdnDomain = { Description: "Assets CloudFront domain", Value: Fn2.getAtt("AssetsDistribution", "DomainName") };
+  }
+  if (app.firewall?.enabled) {
+    const wafRules = [];
+    let priority = 0;
+    if (app.firewall.rateLimit) {
+      wafRules.push({
+        Name: "rate-limit",
+        Priority: priority++,
+        Action: { Block: {} },
+        Statement: { RateBasedStatement: { Limit: app.firewall.rateLimit, AggregateKeyType: "IP" } },
+        VisibilityConfig: { SampledRequestsEnabled: true, CloudWatchMetricsEnabled: true, MetricName: `${slug}-${environment}-rate` }
+      });
+    }
+    const managed = {
+      sqlInjection: "AWSManagedRulesSQLiRuleSet",
+      xss: "AWSManagedRulesCommonRuleSet",
+      common: "AWSManagedRulesCommonRuleSet",
+      botControl: "AWSManagedRulesBotControlRuleSet",
+      ipReputation: "AWSManagedRulesAmazonIpReputationList"
+    };
+    for (const rule of app.firewall.rules ?? []) {
+      const name = managed[rule];
+      if (!name)
+        continue;
+      wafRules.push({
+        Name: `managed-${rule}`,
+        Priority: priority++,
+        OverrideAction: { None: {} },
+        Statement: { ManagedRuleGroupStatement: { VendorName: "AWS", Name: name } },
+        VisibilityConfig: { SampledRequestsEnabled: true, CloudWatchMetricsEnabled: true, MetricName: `${slug}-${environment}-${rule}` }
+      });
+    }
+    resources.WebAcl = {
+      Type: "AWS::WAFv2::WebACL",
+      Properties: {
+        Name: `${slug}-${environment}-waf`,
+        Scope: "REGIONAL",
+        DefaultAction: { Allow: {} },
+        Rules: wafRules,
+        VisibilityConfig: { SampledRequestsEnabled: true, CloudWatchMetricsEnabled: true, MetricName: `${slug}-${environment}-waf` }
+      }
+    };
+    resources.WebAclAssociation = {
+      Type: "AWS::WAFv2::WebACLAssociation",
+      DependsOn: ["HttpStage"],
+      Properties: {
+        ResourceArn: Fn2.sub("arn:aws:apigateway:${AWS::Region}::/apis/${HttpApi}/stages/$default"),
+        WebACLArn: Fn2.getAtt("WebAcl", "Arn")
+      }
+    };
+  }
+  if (hasVpc && needsDataVpc) {
+    resources.DataSecurityGroup = {
+      Type: "AWS::EC2::SecurityGroup",
+      Properties: {
+        GroupDescription: `${slug}-${environment} serverless data access`,
+        SecurityGroupIngress: [{ IpProtocol: "-1", CidrIp: "10.0.0.0/8" }]
+      }
+    };
+  }
+  if (app.cache?.driver === "elasticache") {
+    resources.CacheSubnetGroup = {
+      Type: "AWS::ElastiCache::SubnetGroup",
+      Properties: { Description: `${slug}-${environment} cache subnets`, SubnetIds: subnets }
+    };
+    resources.CacheCluster = {
+      Type: "AWS::ElastiCache::ReplicationGroup",
+      Properties: {
+        ReplicationGroupId: `${slug}-${environment}-cache`,
+        ReplicationGroupDescription: `${slug}-${environment} redis`,
+        Engine: "redis",
+        CacheNodeType: "cache.t4g.micro",
+        NumCacheClusters: 1,
+        AutomaticFailoverEnabled: false,
+        CacheSubnetGroupName: Fn2.ref("CacheSubnetGroup"),
+        SecurityGroupIds: [Fn2.getAtt("DataSecurityGroup", "GroupId")],
+        TransitEncryptionEnabled: false
+      }
+    };
+    outputs.CacheEndpoint = { Description: "Redis primary endpoint", Value: Fn2.getAtt("CacheCluster", "PrimaryEndPoint.Address") };
+  }
+  if (app.database?.connection === "aurora-serverless") {
+    resources.DbSubnetGroup = {
+      Type: "AWS::RDS::DBSubnetGroup",
+      Properties: { DBSubnetGroupDescription: `${slug}-${environment} db subnets`, SubnetIds: subnets }
+    };
+    resources.DbSecret = {
+      Type: "AWS::SecretsManager::Secret",
+      Properties: {
+        Name: `${slug}/${environment}/db`,
+        GenerateSecretString: {
+          SecretStringTemplate: JSON.stringify({ username: "app" }),
+          GenerateStringKey: "password",
+          PasswordLength: 32,
+          ExcludePunctuation: true
+        }
+      }
+    };
+    resources.DbCluster = {
+      Type: "AWS::RDS::DBCluster",
+      Properties: {
+        Engine: "aurora-mysql",
+        EngineMode: "provisioned",
+        DBClusterIdentifier: `${slug}-${environment}-db`,
+        MasterUsername: Fn2.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:username}}"),
+        MasterUserPassword: Fn2.sub("{{resolve:secretsmanager:${DbSecret}:SecretString:password}}"),
+        ServerlessV2ScalingConfiguration: { MinCapacity: 0.5, MaxCapacity: 4 },
+        DBSubnetGroupName: Fn2.ref("DbSubnetGroup"),
+        VpcSecurityGroupIds: [Fn2.getAtt("DataSecurityGroup", "GroupId")]
+      }
+    };
+    resources.DbInstance = {
+      Type: "AWS::RDS::DBInstance",
+      Properties: {
+        Engine: "aurora-mysql",
+        DBInstanceClass: "db.serverless",
+        DBClusterIdentifier: Fn2.ref("DbCluster")
+      }
+    };
+    outputs.DbEndpoint = { Description: "Aurora cluster endpoint", Value: Fn2.getAtt("DbCluster", "Endpoint.Address") };
+  }
+  if (app.rdsProxy && app.database?.connection === "aurora-serverless") {
+    resources.DbProxyRole = {
+      Type: "AWS::IAM::Role",
+      Properties: {
+        AssumeRolePolicyDocument: {
+          Version: "2012-10-17",
+          Statement: [{ Effect: "Allow", Principal: { Service: "rds.amazonaws.com" }, Action: "sts:AssumeRole" }]
+        },
+        Policies: [{
+          PolicyName: "read-db-secret",
+          PolicyDocument: {
+            Version: "2012-10-17",
+            Statement: [{ Effect: "Allow", Action: ["secretsmanager:GetSecretValue"], Resource: Fn2.ref("DbSecret") }]
+          }
+        }]
+      }
+    };
+    resources.DbProxy = {
+      Type: "AWS::RDS::DBProxy",
+      Properties: {
+        DBProxyName: typeof app.rdsProxy === "object" && app.rdsProxy.name ? app.rdsProxy.name : `${slug}-${environment}-proxy`,
+        EngineFamily: "MYSQL",
+        RoleArn: Fn2.getAtt("DbProxyRole", "Arn"),
+        Auth: [{ AuthScheme: "SECRETS", SecretArn: Fn2.ref("DbSecret"), IAMAuth: "DISABLED" }],
+        VpcSubnetIds: subnets,
+        VpcSecurityGroupIds: [Fn2.getAtt("DataSecurityGroup", "GroupId")],
+        RequireTLS: false
+      }
+    };
+    outputs.DbProxyEndpoint = { Description: "RDS Proxy endpoint", Value: Fn2.getAtt("DbProxy", "Endpoint") };
+  }
+  outputs.HttpFunctionName = { Description: "HTTP function name", Value: Fn2.ref("HttpFunction") };
+  outputs.CliFunctionName = { Description: "CLI function name", Value: Fn2.ref("CliFunction") };
+  if (hasQueue)
+    outputs.QueueFunctionName = { Description: "Queue function name", Value: Fn2.ref("QueueFunction") };
+  const template = {
+    AWSTemplateFormatVersion: "2010-09-09",
+    Description: `Serverless application for ${opts.config.project.name} (${slug}-${environment})`,
+    Parameters: imageMode ? {
+      ImageUri: { Type: "String", Description: "ECR image URI of the deployment artifact" }
+    } : {
+      ArtifactBucket: { Type: "String", Description: "S3 bucket holding the deployment artifact" },
+      ArtifactKey: { Type: "String", Description: "S3 key of the deployment artifact (zip)" }
+    },
+    Resources: resources,
+    Outputs: outputs
+  };
+  const resourceSummary = {};
+  for (const r of Object.values(resources)) {
+    resourceSummary[r.Type] = (resourceSummary[r.Type] ?? 0) + 1;
+  }
+  return { template, functionNames, queueNames, resourceSummary };
+}
+// src/serverless-php/dockerfile.ts
+var PHP_LAYER_EXTENSIONS = [
+  "cli",
+  "fpm",
+  "mbstring",
+  "xml",
+  "pdo",
+  "mysqlnd",
+  "gd",
+  "bcmath",
+  "intl",
+  "opcache",
+  "sodium",
+  "process",
+  "pecl-redis6",
+  "pecl-apcu",
+  "pgsql"
+];
+function phpLayerPackages(phpVersion) {
+  const scl = `php${phpVersion.replace(".", "")}`;
+  return PHP_LAYER_EXTENSIONS.map((ext) => `${scl}-php-${ext}`);
+}
+function phpLayerBuildStage(phpVersion, asName) {
+  const scl = `php${phpVersion.replace(".", "")}`;
+  const packages = phpLayerPackages(phpVersion).join(" \\\n      ");
+  const sclRoot = `/opt/remi/${scl}/root`;
+  const from = asName ? `FROM amazonlinux:2023 AS ${asName}` : "FROM amazonlinux:2023";
+  return `${from}
+
+# Remi provides version-isolated PHP SCL packages for EL9 (AL2023 compatible).
+RUN dnf -y install dnf-plugins-core 'dnf-command(config-manager)' && \\
+    dnf -y install https://rpms.remirepo.net/enterprise/remi-release-9.rpm && \\
+    dnf -y update && \\
+    dnf -y install \\
+      ${packages} \\
+      findutils tar gzip && \\
+    dnf clean all
+
+# Relocate PHP + php-fpm + extensions and their shared libs under /opt.
+RUN set -eux; \\
+    mkdir -p /opt/php/bin /opt/php/sbin /opt/php/lib /opt/php/lib/php/modules /opt/php/etc/php.d /opt/tscloud; \\
+    cp ${sclRoot}/usr/bin/php /opt/php/bin/php; \\
+    cp ${sclRoot}/usr/sbin/php-fpm /opt/php/sbin/php-fpm; \\
+    EXT_DIR="$(${sclRoot}/usr/bin/php -r 'echo ini_get("extension_dir");')"; \\
+    cp -a "$EXT_DIR"/*.so /opt/php/lib/php/modules/ || true; \\
+    cp -a ${sclRoot}/etc/php.d/*.ini /opt/php/etc/php.d/ 2>/dev/null || true; \\
+    # Copy shared-library dependencies of php, php-fpm, and the extension modules.
+    for bin in /opt/php/bin/php /opt/php/sbin/php-fpm /opt/php/lib/php/modules/*.so; do \\
+      ldd "$bin" 2>/dev/null | awk '/=>/{print $3}/ld-linux/{print $1}' | sort -u | while read -r lib; do \\
+        [ -f "$lib" ] && cp -Ln "$lib" /opt/php/lib/ || true; \\
+      done; \\
+    done
+
+# Point PHP at the relocated config + extension dir.
+RUN printf 'extension_dir=/opt/php/lib/php/modules\\n' > /opt/php/etc/php.ini && \\
+    cat /opt/php/etc/php.d/*.ini >> /opt/php/etc/php.ini 2>/dev/null || true
+ENV PHP_INI_SCAN_DIR=/opt/php/etc/php.d
+
+# Runtime assets (bootstrap, runtime loops, fpm config) are added by the build
+# orchestrator after the image is produced. Export /opt as the layer payload.
+CMD ["true"]
+`;
+}
+function generatePhpLayerDockerfile(options = {}) {
+  const phpVersion = options.phpVersion ?? "8.3";
+  return `# ts-cloud PHP ${phpVersion} runtime layer (generated) — AWS Lambda provided.al2023.
+${phpLayerBuildStage(phpVersion)}`;
+}
+
+// src/serverless/app-image.ts
+function generateAppImageDockerfile(options) {
+  if (options.kind === "php") {
+    const phpVersion = options.phpVersion ?? "8.3";
+    return `# ts-cloud serverless PHP app image (generated, multi-stage).
+${phpLayerBuildStage(phpVersion, "phpbuild")}
+
+FROM public.ecr.aws/lambda/provided:al2023
+# Bake the relocated PHP runtime from the build stage.
+COPY --from=phpbuild /opt/ /opt/
+# ts-cloud runtime assets (bootstrap, runtime loops, fpm config).
+COPY runtime/ /opt/
+# The application source tree.
+COPY app/ /var/task/
+# /opt/bootstrap is the runtime entrypoint; mode comes from TSCLOUD_LAMBDA_MODE.
+ENTRYPOINT [ "/opt/bootstrap" ]
+`;
+  }
+  const nodeMajor = options.nodeMajor ?? "20";
+  return `# ts-cloud serverless Node app image (generated).
+FROM public.ecr.aws/lambda/nodejs:${nodeMajor}
+
+# The bundled handler artifact (index.mjs) at the Lambda task root.
+COPY app/ \${LAMBDA_TASK_ROOT}/
+
+# Per-function CMD (e.g. index.http) is supplied via ImageConfig.Command.
+CMD [ "index.http" ]
+`;
+}
+// src/serverless/runtime/adapter.ts
+function resolveApp(mod) {
+  const m = mod;
+  const def = m?.default ?? m;
+  if (typeof def === "function")
+    return { fetch: def };
+  return {
+    fetch: def?.fetch ?? m?.fetch,
+    queue: def?.queue ?? m?.queue,
+    cli: def?.cli ?? m?.cli
+  };
+}
+var TEXT_CONTENT = /^(?:text\/|application\/(?:json|xml|javascript|graphql|x-www-form-urlencoded|.*\+json|.*\+xml)|image\/svg)/i;
+function isTextContentType(contentType) {
+  if (!contentType)
+    return true;
+  return TEXT_CONTENT.test(contentType);
+}
+function readMaintenance(opts) {
+  if (opts?.maintenance)
+    return opts.maintenance;
+  const env = globalThis.process?.env ?? {};
+  return {
+    enabled: env.MAINTENANCE_MODE === "1" || env.MAINTENANCE_MODE === "true",
+    bypassSecret: env.MAINTENANCE_BYPASS_SECRET
+  };
+}
+function eventToRequest(event) {
+  const host = event.requestContext?.domainName ?? "localhost";
+  const query = event.rawQueryString ? `?${event.rawQueryString}` : "";
+  const url = `https://${host}${event.rawPath || "/"}${query}`;
+  const headers = new Headers;
+  for (const [key, value] of Object.entries(event.headers ?? {})) {
+    if (value !== undefined)
+      headers.set(key, value);
+  }
+  if (event.cookies?.length)
+    headers.set("cookie", event.cookies.join("; "));
+  const method = event.requestContext.http.method;
+  let body;
+  if (event.body !== undefined && method !== "GET" && method !== "HEAD") {
+    body = event.isBase64Encoded ? new Uint8Array(Buffer.from(event.body, "base64")) : new TextEncoder().encode(event.body);
+  }
+  return new Request(url, { method, headers, body });
+}
+async function responseToResult(response) {
+  const headers = {};
+  const cookies = [];
+  const setCookies = typeof response.headers.getSetCookie === "function" ? response.headers.getSetCookie() : [];
+  for (const c of setCookies)
+    cookies.push(c);
+  response.headers.forEach((value, key) => {
+    if (key.toLowerCase() === "set-cookie")
+      return;
+    headers[key] = value;
+  });
+  const buffer = Buffer.from(await response.arrayBuffer());
+  const textual = isTextContentType(response.headers.get("content-type"));
+  return {
+    statusCode: response.status,
+    headers,
+    ...cookies.length ? { cookies } : {},
+    body: textual ? buffer.toString("utf-8") : buffer.toString("base64"),
+    isBase64Encoded: !textual
+  };
+}
+function createHttpHandler(handler8, opts) {
+  return async (event) => {
+    if (event.warmer) {
+      return { statusCode: 200, headers: { "content-type": "text/plain" }, body: "warm", isBase64Encoded: false };
+    }
+    if (!handler8) {
+      return { statusCode: 501, headers: { "content-type": "text/plain" }, body: "No HTTP handler configured", isBase64Encoded: false };
+    }
+    const maintenance = readMaintenance(opts);
+    if (maintenance.enabled) {
+      const bypass = event.headers?.["x-maintenance-bypass"] ?? event.cookies?.find((c) => c.startsWith("tscloud_bypass="))?.split("=")[1];
+      if (!maintenance.bypassSecret || bypass !== maintenance.bypassSecret) {
+        return {
+          statusCode: 503,
+          headers: { "content-type": "text/plain", "retry-after": "120" },
+          body: "Service temporarily unavailable (maintenance mode)",
+          isBase64Encoded: false
+        };
+      }
+    }
+    const request = eventToRequest(event);
+    const response = await handler8(request);
+    return responseToResult(response);
+  };
+}
+function parseRecordBody(body) {
+  try {
+    return JSON.parse(body);
+  } catch {
+    return body;
+  }
+}
+function createQueueHandler(handler8) {
+  return async (event) => {
+    const batchItemFailures = [];
+    if (!handler8)
+      return { batchItemFailures };
+    for (const record of event.Records ?? []) {
+      try {
+        await handler8(parseRecordBody(record.body), record);
+      } catch {
+        batchItemFailures.push({ itemIdentifier: record.messageId });
+      }
+    }
+    return { batchItemFailures };
+  };
+}
+function createCliHandler(handler8) {
+  return async (event) => {
+    if (!handler8)
+      return { statusCode: 501, output: "No CLI handler configured" };
+    return handler8(event);
+  };
+}
+function createHandlers(app, opts) {
+  return {
+    http: createHttpHandler(app.fetch, opts),
+    queue: createQueueHandler(app.queue),
+    cli: createCliHandler(app.cli)
+  };
+}
+// src/serverless-php/php-fpm-conf.ts
+function generatePhpFpmConfig(options = {}) {
+  const socket = options.socketPath ?? "/tmp/.tscloud-fpm.sock";
+  const maxChildren = options.maxChildren ?? 1;
+  const errorLog = options.errorLog ?? "/tmp/storage/logs/php-fpm.log";
+  return `; ts-cloud php-fpm configuration (generated) — AWS Lambda custom runtime.
+[global]
+daemonize = no
+error_log = ${errorLog}
+log_level = warning
+
+[www]
+listen = ${socket}
+listen.mode = 0666
+pm = static
+pm.max_children = ${maxChildren}
+catch_workers_output = yes
+decorate_workers_output = no
+; Surface fatal errors / fpm logs to the Lambda log stream.
+php_admin_value[error_log] = /dev/stderr
+php_admin_flag[log_errors] = on
+clear_env = no
+`;
+}
+// src/serverless-php/runtime-assets.ts
+import { readFileSync as readFileSync4 } from "node:fs";
+import { dirname as dirname3, join as join7 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+function assetsDir() {
+  return join7(dirname3(fileURLToPath2(import.meta.url)), "runtime-assets");
+}
+function phpRuntimeLayerAssets() {
+  const dir = assetsDir();
+  const read = (f) => readFileSync4(join7(dir, f), "utf-8");
+  return [
+    { path: "bootstrap", contents: read("bootstrap"), mode: 493 },
+    { path: "tscloud/runtime.php", contents: read("runtime.php"), mode: 420 },
+    { path: "tscloud/octane-runtime.php", contents: read("octane-runtime.php"), mode: 420 },
+    { path: "tscloud/cli-runtime.php", contents: read("cli-runtime.php"), mode: 420 },
+    { path: "tscloud/fastcgi-client.php", contents: read("fastcgi-client.php"), mode: 420 },
+    { path: "tscloud/php-fpm.conf", contents: generatePhpFpmConfig(), mode: 420 }
+  ];
+}
+function laravelServerlessEnvDefaults(opts = {}) {
+  const cache2 = opts.cacheDriver ?? "dynamodb";
+  return {
+    APP_ENV: "production",
+    LOG_CHANNEL: "stderr",
+    CACHE_STORE: cache2,
+    CACHE_DRIVER: cache2,
+    SESSION_DRIVER: cache2,
+    QUEUE_CONNECTION: "sqs",
+    FILESYSTEM_DISK: "s3",
+    VIEW_COMPILED_PATH: "/tmp/storage/framework/views",
+    APP_SERVICES_CACHE: "/tmp/bootstrap/cache/services.php",
+    APP_PACKAGES_CACHE: "/tmp/bootstrap/cache/packages.php",
+    APP_CONFIG_CACHE: "/tmp/bootstrap/cache/config.php",
+    APP_ROUTES_CACHE: "/tmp/bootstrap/cache/routes.php",
+    APP_EVENTS_CACHE: "/tmp/bootstrap/cache/events.php"
+  };
+}
+var LARAVEL_SERVERLESS_BUILD_STEPS = [
+  "composer install --no-dev --optimize-autoloader --no-interaction",
+  "php artisan config:cache",
+  "php artisan route:cache",
+  "php artisan event:cache",
+  "php artisan view:cache"
+];
+// src/serverless-php/layer-build.ts
+import { execFileSync } from "node:child_process";
+import { existsSync as existsSync5, mkdtempSync as mkdtempSync2, readdirSync as readdirSync5, readFileSync as readFileSync5, rmSync as rmSync2, statSync as statSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join8, relative as relative2 } from "node:path";
+function* walk(dir) {
+  for (const entry of readdirSync5(dir)) {
+    const full = join8(dir, entry);
+    if (statSync3(full).isDirectory())
+      yield* walk(full);
+    else
+      yield full;
+  }
+}
+function buildPhpRuntimeLayerZip(options = {}) {
+  const architecture = options.architecture ?? "x86_64";
+  const platform = options.platform ?? (architecture === "arm64" ? "linux/arm64" : "linux/amd64");
+  const step = options.onStep ?? (() => {});
+  const stage = mkdtempSync2(join8(tmpdir2(), "tscloud-php-layer-"));
+  const imageTag = "tscloud-php-layer:build";
+  try {
+    writeFileSync4(join8(stage, "Dockerfile"), generatePhpLayerDockerfile(options));
+    step("Building PHP runtime image (docker)");
+    execFileSync("docker", ["build", "--platform", platform, "-t", imageTag, stage], { stdio: "inherit" });
+    step("Extracting /opt from image");
+    const cid = execFileSync("docker", ["create", "--platform", platform, imageTag], { encoding: "utf-8" }).trim();
+    const optDir = join8(stage, "opt");
+    try {
+      execFileSync("docker", ["cp", `${cid}:/opt/.`, optDir], { stdio: "inherit" });
+    } finally {
+      execFileSync("docker", ["rm", cid], { stdio: "ignore" });
+    }
+    if (!existsSync5(optDir))
+      throw new Error("layer build produced no /opt directory");
+    const entries = [];
+    for (const file of walk(optDir)) {
+      const rel = relative2(optDir, file).replace(/\\/g, "/");
+      const mode = statSync3(file).mode & 73 ? 493 : 420;
+      entries.push({ name: rel, data: readFileSync5(file), mode });
+    }
+    step("Injecting runtime assets");
+    const assetPaths = new Set(phpRuntimeLayerAssets().map((a) => a.path));
+    const filtered = entries.filter((e) => !assetPaths.has(e.name));
+    for (const asset of phpRuntimeLayerAssets()) {
+      filtered.push({ name: asset.path, data: asset.contents, mode: asset.mode });
+    }
+    step("Packaging layer ZIP");
+    const zip2 = createZip(filtered);
+    return { zip: zip2, architecture, fileCount: filtered.length };
+  } finally {
+    rmSync2(stage, { recursive: true, force: true });
+  }
+}
+// src/serverless-php/package-php.ts
+import { execSync as execSync2 } from "node:child_process";
+import { createHash as createHash5 } from "node:crypto";
+import { readdirSync as readdirSync6, readFileSync as readFileSync6, statSync as statSync4 } from "node:fs";
+import { join as join9, relative as relative3, resolve as resolve2 } from "node:path";
+var PHP_DEFAULT_EXCLUDES = [
+  ".git",
+  ".github",
+  "node_modules",
+  "tests",
+  "storage/logs",
+  "storage/framework/cache",
+  "storage/framework/sessions",
+  "storage/framework/views",
+  ".env",
+  ".env.local",
+  ".vapor",
+  ".ts-cloud",
+  "dist-lambda"
+];
+function isExcluded(rel, excludes) {
+  return excludes.some((ex) => rel === ex || rel.startsWith(`${ex}/`));
+}
+function* walk2(dir, root, excludes) {
+  for (const entry of readdirSync6(dir)) {
+    const full = join9(dir, entry);
+    const rel = relative3(root, full).replace(/\\/g, "/");
+    if (isExcluded(rel, excludes))
+      continue;
+    if (statSync4(full).isDirectory())
+      yield* walk2(full, root, excludes);
+    else
+      yield full;
+  }
+}
+function runPhpBuildHooks(opts) {
+  if (opts.skipBuild)
+    return;
+  const projectRoot = resolve2(opts.projectRoot ?? process.cwd());
+  const steps = opts.app.build ?? LARAVEL_SERVERLESS_BUILD_STEPS;
+  for (const step of steps) {
+    opts.onStep?.(`build: ${step}`);
+    execSync2(step, { stdio: "inherit", cwd: projectRoot });
+  }
+}
+function collectPhpAppEntries(projectRoot, exclude = []) {
+  const root = resolve2(projectRoot);
+  const excludes = [...PHP_DEFAULT_EXCLUDES, ...exclude];
+  const entries = [];
+  for (const file of walk2(root, root, excludes)) {
+    const rel = relative3(root, file).replace(/\\/g, "/");
+    const executable = (statSync4(file).mode & 73) !== 0;
+    entries.push({ name: rel, data: readFileSync6(file), mode: executable ? 493 : 420 });
+  }
+  return entries;
+}
+function packagePhpApp(opts) {
+  const projectRoot = resolve2(opts.projectRoot ?? process.cwd());
+  runPhpBuildHooks(opts);
+  opts.onStep?.("packaging application tree");
+  const entries = collectPhpAppEntries(projectRoot, opts.exclude);
+  if (!entries.length)
+    throw new Error(`No files to package under ${projectRoot}`);
+  const zip2 = createZip(entries);
+  const handler8 = opts.app.handlers?.http ?? "public/index.php";
+  return {
+    zip: zip2,
+    sha256: createHash5("sha256").update(zip2).digest("hex"),
+    handlers: {
+      http: handler8,
+      queue: opts.app.handlers?.queue ?? handler8,
+      cli: opts.app.handlers?.cli ?? handler8
+    },
+    fileCount: entries.length
+  };
+}
 // src/static-site/index.ts
 class StaticSiteManager {
   optimizations = new Map;
@@ -45421,6 +46743,7 @@ export {
   stackDependencyManager,
   signRequestAsync,
   signRequest,
+  sha256,
   serviceMeshManager,
   sequence,
   senderReputationManager,
@@ -45430,18 +46753,26 @@ export {
   secretsManager,
   searchCommands,
   sanitizeName,
+  runPhpBuildHooks,
+  runBuildHooks,
   route53RoutingManager,
   route53ResolverManager,
+  responseToResult,
   resourceManagementManager,
   resolveStorageBucketName,
   resolveSiteStackName,
   resolveSiteResourceName,
   resolveSiteBucketName,
+  resolveServerlessAssetBucketName,
+  resolveServerlessArtifactBucketName,
+  resolveServerlessAppStackName,
   resolveRegion,
+  resolveQueueNames,
   resolveProjectStackName,
   resolveDeployBucketName,
   resolveCredentials,
   resolveCloudProvider,
+  resolveApp,
   requiresReplacement,
   replicaManager,
   regionPairManager,
@@ -45451,12 +46782,17 @@ export {
   processInChunks,
   previewNotifications,
   previewManager,
+  phpRuntimeLayerAssets,
+  phpLayerPackages,
+  phpLayerBuildStage,
   performanceManager,
   parseXMLResponse,
   parseJSONResponse,
   parallelWithRetry,
   parallelMap,
   parallel,
+  packageServerlessApp,
+  packagePhpApp,
   organizationManager,
   networkSecurityManager,
   multiRegionManager,
@@ -45468,6 +46804,7 @@ export {
   makeAWSRequestAsync,
   makeAWSRequest,
   logsManager,
+  laravelServerlessEnvDefaults,
   lambdaVersionsManager,
   lambdaVPCManager,
   lambdaLayersManager,
@@ -45518,6 +46855,8 @@ export {
   generateResourceName,
   generatePreviewWorkflow,
   generatePreviewPipeline,
+  generatePhpLayerDockerfile,
+  generatePhpFpmConfig,
   generateParallelConfig,
   generatePRPreviewWorkflow,
   generateMultiEnvWorkflow,
@@ -45532,7 +46871,9 @@ export {
   generateCrossAccountRoleCF,
   generateCostReportWorkflow,
   generateCleanupWorkflow,
+  generateBootstrap,
   generateApprovalConfig,
+  generateAppImageDockerfile,
   fromWebIdentity,
   fromSharedCredentials,
   fromEnvironment,
@@ -45556,6 +46897,7 @@ export {
   findChangedFiles,
   fifoQueueManager,
   extendPreset,
+  eventToRequest,
   emailTemplateManager,
   emailAnalyticsManager,
   drManager,
@@ -45567,11 +46909,15 @@ export {
   defaultLocalConfig,
   databaseUserManager,
   crossRegionReferenceManager,
+  createZip,
   createWordPressPreset,
   createTraditionalWebAppPreset,
   createStaticSitePreset,
+  createServerlessNodePreset,
+  createServerlessLaravelPreset,
   createS3Client,
   createRealtimeAppPreset,
+  createQueueHandler,
   createPresignedUrlAsync,
   createPresignedUrl,
   createPreset,
@@ -45580,14 +46926,21 @@ export {
   createMockAWS,
   createMicroservicesPreset,
   createMLApiPreset,
+  createLaravelPreset,
   createJamstackPreset,
+  createHttpHandler,
+  createHandlers,
   createFullStackAppPreset,
   createError,
   createDataPipelinePreset,
+  createDashboardSite,
   createCredentialProvider,
+  createCliHandler,
   createApiBackendPreset,
   containerRegistryManager,
+  composeServerlessAppTemplate,
   composePresets,
+  collectPhpAppEntries,
   cloudTrailManager,
   cloud_config_schema_default as cloudConfigSchema,
   clearSigningKeyCache,
@@ -45597,6 +46950,7 @@ export {
   certificateManager,
   categorizeChanges,
   canaryManager,
+  buildPhpRuntimeLayerZip,
   buildOptimizationManager,
   buildCloudFormationTemplate,
   bounceComplaintHandler,
@@ -45606,6 +46960,7 @@ export {
   backupManager,
   awsConfigManager,
   autocomplete,
+  artifactKey,
   analyzeStackDiff,
   abTestManager,
   XRayManager,
@@ -45663,6 +47018,8 @@ export {
   Permissions,
   PerformanceManager,
   ParameterStore,
+  PHP_LAYER_EXTENSIONS,
+  PHP_DEFAULT_EXCLUDES,
   OrganizationManager,
   NetworkSecurityManager,
   Network,
@@ -45683,6 +47040,7 @@ export {
   LambdaDestinationsManager,
   LambdaDLQManager,
   LambdaConcurrencyManager,
+  LARAVEL_SERVERLESS_BUILD_STEPS,
   JobLoader,
   ImageScanningManager,
   HealthCheckManager,