@ts-cloud/core 0.5.1 → 0.5.3

package/dist/bun-bootstrap

@@ -0,0 +1,5 @@
+#!/bin/sh
+# ts-cloud Bun custom-runtime entrypoint (provided.al2023).
+# Puts the bundled Bun binary on PATH and runs the shared Runtime API loop.
+export PATH="/opt/bin:$PATH"
+exec /opt/bin/bun /opt/runtime.mjs

package/dist/index.js

@@ -45522,11 +45522,16 @@ function composeServerlessAppTemplate(opts) {
     ...hasQueue ? { TSCLOUD_QUEUE: queueNames[0] } : {},
     ...app.env ?? {}
   });
+  const efsEnabled = Boolean(app.efs);
+  const efsOpts = typeof app.efs === "object" ? app.efs : {};
+  const efsMountPath = efsOpts.mountPath ?? "/mnt/local";
+  const efsProvision = efsEnabled && !efsOpts.accessPointArn;
+  const efsAccessPoint = efsOpts.accessPointArn ?? (efsProvision ? Fn2.getAtt("EfsAccessPoint", "Arn") : undefined);
   const subnets = app.vpc?.subnets ?? [];
   const hasVpc = subnets.length > 0;
-  const needsDataVpc = app.cache?.driver === "elasticache" || app.database?.connection === "aurora-serverless" || Boolean(app.rdsProxy);
+  const needsDataVpc = app.cache?.driver === "elasticache" || app.database?.connection === "aurora-serverless" || Boolean(app.rdsProxy) || efsEnabled;
   if (needsDataVpc && !hasVpc) {
-    throw new Error("serverless app: elasticache / aurora-serverless / rdsProxy require app.vpc.subnets (private subnets) to be set.");
+    throw new Error("serverless app: elasticache / aurora-serverless / rdsProxy / efs require app.vpc.subnets (private subnets) to be set.");
   }
   const vpcConfig = hasVpc ? {
     VpcConfig: {
@@ -45537,6 +45542,15 @@ function composeServerlessAppTemplate(opts) {
       ]
     }
   } : {};
+  const efsDependsOn = efsProvision ? subnets.map((_, i) => `EfsMountTarget${i}`) : [];
+  const efsConfig = efsEnabled ? { FileSystemConfigs: [{ Arn: efsAccessPoint, LocalMountPath: efsMountPath }] } : {};
+  if (efsEnabled) {
+    inlinePolicies[0].PolicyDocument.Statement.push({
+      Effect: "Allow",
+      Action: ["elasticfilesystem:ClientMount", "elasticfilesystem:ClientWrite", "elasticfilesystem:ClientRootAccess", "elasticfilesystem:DescribeMountTargets"],
+      Resource: "*"
+    });
+  }
   function addFunction(logicalId, name, handler8, mode, memory, timeout, reservedConcurrency, tmp = tmpStorage) {
     resources[`${logicalId}LogGroup`] = {
       Type: "AWS::Logs::LogGroup",
@@ -45554,7 +45568,7 @@ function composeServerlessAppTemplate(opts) {
     };
     resources[logicalId] = {
       Type: "AWS::Lambda::Function",
-      DependsOn: [`${logicalId}LogGroup`],
+      DependsOn: [`${logicalId}LogGroup`, ...efsDependsOn],
       Properties: {
         FunctionName: name,
         Architectures: [architecture],
@@ -45565,7 +45579,8 @@ function composeServerlessAppTemplate(opts) {
         EphemeralStorage: { Size: tmp },
         ...codeProps,
         ...reservedConcurrency !== undefined ? { ReservedConcurrentExecutions: reservedConcurrency } : {},
-        ...vpcConfig
+        ...vpcConfig,
+        ...efsConfig
       }
     };
   }
@@ -45814,10 +45829,37 @@ function composeServerlessAppTemplate(opts) {
             DomainName: Fn2.getAtt("AssetsBucket", "RegionalDomainName"),
             OriginAccessControlId: Fn2.ref("AssetsOAC"),
             S3OriginConfig: { OriginAccessIdentity: "" }
-          }]
+          }],
+          ...app.assetDomain ? {
+            Aliases: [app.assetDomain],
+            ViewerCertificate: {
+              AcmCertificateArn: app.assetCertificateArn,
+              SslSupportMethod: "sni-only",
+              MinimumProtocolVersion: "TLSv1.2_2021"
+            }
+          } : {}
         }
       }
     };
+    if (app.assetDomain) {
+      if (!app.assetCertificateArn)
+        throw new Error("serverless app: `assetDomain` requires `assetCertificateArn` (a us-east-1 ACM cert — CloudFront only accepts certs from us-east-1).");
+      if (app.hostedZoneId) {
+        resources.AssetsDomainRecord = {
+          Type: "AWS::Route53::RecordSet",
+          Properties: {
+            HostedZoneId: app.hostedZoneId,
+            Name: app.assetDomain,
+            Type: "A",
+            AliasTarget: {
+              DNSName: Fn2.getAtt("AssetsDistribution", "DomainName"),
+              HostedZoneId: "Z2FDTNDATAQYW2"
+            }
+          }
+        };
+      }
+      outputs.AssetDomain = { Description: "Custom asset CDN host", Value: app.assetDomain };
+    }
     resources.AssetsBucketPolicy = {
       Type: "AWS::S3::BucketPolicy",
       Properties: {
@@ -45896,6 +45938,37 @@ function composeServerlessAppTemplate(opts) {
       }
     };
   }
+  if (efsProvision) {
+    resources.EfsFileSystem = {
+      Type: "AWS::EFS::FileSystem",
+      Properties: {
+        Encrypted: true,
+        FileSystemTags: [{ Key: "Name", Value: `${slug}-${environment}-efs` }]
+      }
+    };
+    subnets.forEach((subnetId, i) => {
+      resources[`EfsMountTarget${i}`] = {
+        Type: "AWS::EFS::MountTarget",
+        Properties: {
+          FileSystemId: Fn2.ref("EfsFileSystem"),
+          SubnetId: subnetId,
+          SecurityGroups: [Fn2.getAtt("DataSecurityGroup", "GroupId")]
+        }
+      };
+    });
+    resources.EfsAccessPoint = {
+      Type: "AWS::EFS::AccessPoint",
+      Properties: {
+        FileSystemId: Fn2.ref("EfsFileSystem"),
+        PosixUser: { Uid: 1001, Gid: 1001 },
+        RootDirectory: {
+          Path: "/lambda",
+          CreationInfo: { OwnerUid: 1001, OwnerGid: 1001, Permissions: "0755" }
+        }
+      }
+    };
+    outputs.EfsFileSystemId = { Description: "EFS file system id", Value: Fn2.ref("EfsFileSystem") };
+  }
   if (app.cache?.driver === "elasticache") {
     resources.CacheSubnetGroup = {
       Type: "AWS::ElastiCache::SubnetGroup",

package/dist/node-bootstrap

@@ -0,0 +1,5 @@
+#!/bin/sh
+# ts-cloud Node custom-runtime entrypoint (provided.al2023).
+# Puts the bundled Node binary on PATH and runs the shared Runtime API loop.
+export PATH="/opt/bin:$PATH"
+exec /opt/bin/node /opt/runtime.mjs

package/dist/runtime/adapter.ts

@@ -0,0 +1,287 @@
+/**
+ * Serverless runtime adapter (Node/Bun).
+ *
+ * This module is **bundled into the Lambda deployment artifact** and runs inside
+ * the AWS Lambda Node.js runtime, so it must rely only on globals available
+ * there: `Request`, `Response`, `Headers`, `URL`, `Buffer`, `atob`/`btoa`.
+ * It contains no AWS SDK calls and no Node-only filesystem access.
+ *
+ * It translates the three event sources of a Vapor-style serverless app into
+ * plain, framework-agnostic callbacks:
+ *   - HTTP  : API Gateway v2 (payload format 2.0) ⇄ WHATWG `Request`/`Response`
+ *   - Queue : SQS records → per-message job handler with partial-batch failures
+ *   - CLI   : `{ command, args }` → command handler (scheduler / migrations)
+ */
+
+// ── Event/response shapes (minimal subsets of the AWS types) ────────────────
+
+export interface ApiGatewayProxyEventV2 {
+  version: '2.0'
+  rawPath: string
+  rawQueryString?: string
+  cookies?: string[]
+  headers?: Record<string, string | undefined>
+  body?: string
+  isBase64Encoded?: boolean
+  requestContext: {
+    domainName?: string
+    http: {
+      method: string
+      path: string
+      protocol?: string
+      sourceIp?: string
+      userAgent?: string
+    }
+  }
+}
+
+export interface ApiGatewayProxyResultV2 {
+  statusCode: number
+  headers?: Record<string, string>
+  cookies?: string[]
+  body?: string
+  isBase64Encoded?: boolean
+}
+
+export interface SqsRecord {
+  messageId: string
+  receiptHandle?: string
+  body: string
+  attributes?: Record<string, string>
+  messageAttributes?: Record<string, unknown>
+  eventSourceARN?: string
+}
+
+export interface SqsEvent {
+  Records: SqsRecord[]
+}
+
+export interface SqsBatchResponse {
+  batchItemFailures: Array<{ itemIdentifier: string }>
+}
+
+export interface CliEvent {
+  command: string
+  args?: string[]
+}
+
+export interface CliResult {
+  statusCode: number
+  output: string
+}
+
+// ── Handler callback contracts ──────────────────────────────────────────────
+
+export type FetchHandler = (request: Request) => Response | Promise<Response>
+export type JobHandler = (payload: unknown, record: SqsRecord) => unknown | Promise<unknown>
+export type CommandHandler = (event: CliEvent) => CliResult | Promise<CliResult>
+
+/** Lambda handler invoked by API Gateway v2. */
+export type LambdaHttpHandler = (event: ApiGatewayProxyEventV2) => Promise<ApiGatewayProxyResultV2>
+/** Lambda handler invoked by an SQS event source mapping. */
+export type LambdaQueueHandler = (event: SqsEvent) => Promise<SqsBatchResponse>
+/** Lambda handler invoked by EventBridge / on-demand for CLI commands. */
+export type LambdaCliHandler = (event: CliEvent) => Promise<CliResult>
+
+export interface ServerlessApp {
+  fetch?: FetchHandler
+  queue?: JobHandler
+  cli?: CommandHandler
+}
+
+/**
+ * Normalize whatever the user's entry module exports into a {@link ServerlessApp}.
+ * Accepts a bare fetch function, an object with `fetch`/`queue`/`cli`, or a
+ * Bun.serve-style `{ default: { fetch } }`.
+ */
+export function resolveApp(mod: unknown): ServerlessApp {
+  const m = mod as Record<string, unknown>
+  const def = (m?.default ?? m) as Record<string, unknown>
+  if (typeof def === 'function') return { fetch: def as FetchHandler }
+  return {
+    fetch: (def?.fetch ?? m?.fetch) as FetchHandler | undefined,
+    queue: (def?.queue ?? m?.queue) as JobHandler | undefined,
+    cli: (def?.cli ?? m?.cli) as CommandHandler | undefined,
+  }
+}
+
+// ── Body / content helpers ──────────────────────────────────────────────────
+
+const TEXT_CONTENT = /^(?:text\/|application\/(?:json|xml|javascript|graphql|x-www-form-urlencoded|.*\+json|.*\+xml)|image\/svg)/i
+
+function isTextContentType(contentType: string | null): boolean {
+  // No declared type → treat as text (the common case for `new Response(str)`).
+  // Binary payloads in practice always carry an explicit content-type.
+  if (!contentType) return true
+  return TEXT_CONTENT.test(contentType)
+}
+
+// ── HTTP ────────────────────────────────────────────────────────────────────
+
+export interface HttpAdapterOptions {
+  /**
+   * Read maintenance state from the environment. When `MAINTENANCE_MODE` is
+   * truthy, requests get a 503 unless they carry the bypass secret in the
+   * `x-maintenance-bypass` header or a `tscloud_bypass` cookie.
+   */
+  maintenance?: {
+    enabled: boolean
+    bypassSecret?: string
+  }
+}
+
+function readMaintenance(opts?: HttpAdapterOptions): { enabled: boolean, bypassSecret?: string } {
+  if (opts?.maintenance) return opts.maintenance
+  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env ?? {}
+  return {
+    enabled: env.MAINTENANCE_MODE === '1' || env.MAINTENANCE_MODE === 'true',
+    bypassSecret: env.MAINTENANCE_BYPASS_SECRET,
+  }
+}
+
+/** Translate an API Gateway v2 event into a WHATWG `Request`. */
+export function eventToRequest(event: ApiGatewayProxyEventV2): Request {
+  const host = event.requestContext?.domainName ?? 'localhost'
+  const query = event.rawQueryString ? `?${event.rawQueryString}` : ''
+  const url = `https://${host}${event.rawPath || '/'}${query}`
+
+  const headers = new Headers()
+  for (const [key, value] of Object.entries(event.headers ?? {})) {
+    if (value !== undefined) headers.set(key, value)
+  }
+  if (event.cookies?.length) headers.set('cookie', event.cookies.join('; '))
+
+  const method = event.requestContext.http.method
+  let body: Uint8Array | undefined
+  if (event.body !== undefined && method !== 'GET' && method !== 'HEAD') {
+    body = event.isBase64Encoded
+      ? new Uint8Array(Buffer.from(event.body, 'base64'))
+      : new TextEncoder().encode(event.body)
+  }
+
+  return new Request(url, { method, headers, body })
+}
+
+/** Serialize a WHATWG `Response` into an API Gateway v2 result. */
+export async function responseToResult(response: Response): Promise<ApiGatewayProxyResultV2> {
+  const headers: Record<string, string> = {}
+  const cookies: string[] = []
+
+  // `getSetCookie` is available in the Lambda runtime's undici Headers.
+  const setCookies = typeof (response.headers as { getSetCookie?: () => string[] }).getSetCookie === 'function'
+    ? (response.headers as { getSetCookie: () => string[] }).getSetCookie()
+    : []
+  for (const c of setCookies) cookies.push(c)
+
+  response.headers.forEach((value, key) => {
+    if (key.toLowerCase() === 'set-cookie') return
+    headers[key] = value
+  })
+
+  const buffer = Buffer.from(await response.arrayBuffer())
+  const textual = isTextContentType(response.headers.get('content-type'))
+
+  return {
+    statusCode: response.status,
+    headers,
+    ...(cookies.length ? { cookies } : {}),
+    body: textual ? buffer.toString('utf-8') : buffer.toString('base64'),
+    isBase64Encoded: !textual,
+  }
+}
+
+/**
+ * Wrap a fetch-style handler into a Lambda HTTP handler for API Gateway v2.
+ * Honors maintenance mode (503 + bypass) before invoking the app.
+ */
+export function createHttpHandler(handler: FetchHandler | undefined, opts?: HttpAdapterOptions): LambdaHttpHandler {
+  return async (event: ApiGatewayProxyEventV2): Promise<ApiGatewayProxyResultV2> => {
+    // Warmer pings (from the scheduled keep-warm rule) just keep the container
+    // alive — short-circuit before treating the event as an HTTP request.
+    if ((event as unknown as { warmer?: boolean }).warmer) {
+      return { statusCode: 200, headers: { 'content-type': 'text/plain' }, body: 'warm', isBase64Encoded: false }
+    }
+
+    if (!handler) {
+      return { statusCode: 501, headers: { 'content-type': 'text/plain' }, body: 'No HTTP handler configured', isBase64Encoded: false }
+    }
+
+    const maintenance = readMaintenance(opts)
+    if (maintenance.enabled) {
+      const bypass = event.headers?.['x-maintenance-bypass']
+        ?? (event.cookies?.find(c => c.startsWith('tscloud_bypass='))?.split('=')[1])
+      if (!maintenance.bypassSecret || bypass !== maintenance.bypassSecret) {
+        return {
+          statusCode: 503,
+          headers: { 'content-type': 'text/plain', 'retry-after': '120' },
+          body: 'Service temporarily unavailable (maintenance mode)',
+          isBase64Encoded: false,
+        }
+      }
+    }
+
+    const request = eventToRequest(event)
+    const response = await handler(request)
+    return responseToResult(response)
+  }
+}
+
+// ── Queue ─────────────────────────────────────────────────────────────────--
+
+function parseRecordBody(body: string): unknown {
+  try {
+    return JSON.parse(body)
+  }
+  catch {
+    return body
+  }
+}
+
+/**
+ * Wrap a job handler into a Lambda SQS handler. Each record is processed
+ * individually; failures are reported via `batchItemFailures` so only failed
+ * messages are retried (requires `ReportBatchItemFailures` on the mapping).
+ */
+export function createQueueHandler(handler: JobHandler | undefined): LambdaQueueHandler {
+  return async (event: SqsEvent): Promise<SqsBatchResponse> => {
+    const batchItemFailures: Array<{ itemIdentifier: string }> = []
+    if (!handler) return { batchItemFailures }
+
+    for (const record of event.Records ?? []) {
+      try {
+        await handler(parseRecordBody(record.body), record)
+      }
+      catch {
+        batchItemFailures.push({ itemIdentifier: record.messageId })
+      }
+    }
+    return { batchItemFailures }
+  }
+}
+
+// ── CLI / scheduler ─────────────────────────────────────────────────────────
+
+/**
+ * Wrap a command handler into a Lambda CLI handler. Used by the EventBridge
+ * scheduler (`{ command: 'schedule:run' }`) and on-demand invocations
+ * (deploy hooks, migrations, `cloud command`).
+ */
+export function createCliHandler(handler: CommandHandler | undefined): LambdaCliHandler {
+  return async (event: CliEvent): Promise<CliResult> => {
+    if (!handler) return { statusCode: 501, output: 'No CLI handler configured' }
+    return handler(event)
+  }
+}
+
+/** Convenience: build all three Lambda handlers from a resolved app. */
+export function createHandlers(app: ServerlessApp, opts?: HttpAdapterOptions): {
+  http: LambdaHttpHandler
+  queue: LambdaQueueHandler
+  cli: LambdaCliHandler
+} {
+  return {
+    http: createHttpHandler(app.fetch, opts),
+    queue: createQueueHandler(app.queue),
+    cli: createCliHandler(app.cli),
+  }
+}

package/dist/runtime-assets/bootstrap

@@ -0,0 +1,39 @@
+#!/bin/sh
+# ts-cloud PHP custom runtime bootstrap for AWS Lambda (provided.al2023).
+#
+# Selects the runtime mode from TSCLOUD_LAMBDA_MODE:
+#   http  -> start php-fpm and run the FastCGI bridge loop (runtime.php)
+#   queue -> SQS worker loop (cli-runtime.php)
+#   cli   -> scheduler / on-demand artisan commands (cli-runtime.php)
+#
+# The PHP binary + extensions + these scripts are provided by the ts-cloud PHP
+# runtime layer mounted at /opt.
+set -e
+
+export PATH="/opt/bin:/opt/php/bin:/opt/php/sbin:${PATH}"
+export LD_LIBRARY_PATH="/opt/php/lib:${LD_LIBRARY_PATH}"
+# The relocated PHP's compiled-in ini path points at the build-time SCL location,
+# so point it at the layer's ini (sets extension_dir + loads every extension).
+export PHPRC="/opt/php/etc/php.ini"
+
+# Only /tmp is writable on Lambda; pre-create Laravel's runtime directories.
+mkdir -p \
+  /tmp/storage/framework/cache/data \
+  /tmp/storage/framework/sessions \
+  /tmp/storage/framework/views \
+  /tmp/storage/logs \
+  /tmp/bootstrap/cache
+
+MODE="${TSCLOUD_LAMBDA_MODE:-http}"
+
+if [ "$MODE" = "http" ]; then
+  if [ "${TSCLOUD_OCTANE:-0}" = "1" ]; then
+    # Persistent mode: boot Laravel once, serve in-process (no php-fpm).
+    exec php /opt/tscloud/octane-runtime.php
+  fi
+  # Launch php-fpm (listening on a unix socket in /tmp) then run the bridge loop.
+  php-fpm --nodaemonize --fpm-config /opt/tscloud/php-fpm.conf &
+  exec php /opt/tscloud/runtime.php
+else
+  exec php /opt/tscloud/cli-runtime.php
+fi

package/dist/runtime-assets/cli-runtime.php

@@ -0,0 +1,148 @@
+<?php
+/**
+ * ts-cloud PHP Lambda CLI runtime — handles the queue, scheduler, and cli modes.
+ *
+ * Implements the Lambda Runtime API loop and dispatches based on the event:
+ *   - SQS event ({Records:[...]})        -> one artisan queue job per record
+ *   - EventBridge / {command:'schedule:run'} -> `php artisan schedule:run`
+ *   - {command:'<artisan command>'}      -> arbitrary artisan command
+ *
+ * Queue records are passed to a Laravel bridge command (default
+ * `tscloud:sqs-handle`, override via TSCLOUD_QUEUE_COMMAND) provided by the
+ * `tscloud/serverless` composer package. This avoids the double-delivery hazard
+ * of running stock `queue:work` (which would re-poll SQS alongside Lambda's own
+ * poller).
+ */
+
+$runtimeApi = getenv('AWS_LAMBDA_RUNTIME_API');
+$taskRoot = getenv('LAMBDA_TASK_ROOT') ?: '/var/task';
+$artisan = $taskRoot . '/artisan';
+$queueCommand = getenv('TSCLOUD_QUEUE_COMMAND') ?: 'tscloud:sqs-handle';
+
+while (true) {
+    $ctx = nextInvocation($runtimeApi);
+    if ($ctx === null) {
+        continue;
+    }
+    [$requestId, $event] = $ctx;
+
+    try {
+        $result = dispatch($event, $artisan, $queueCommand);
+        postResponse($runtimeApi, $requestId, $result);
+    } catch (\Throwable $e) {
+        postError($runtimeApi, $requestId, $e);
+    }
+}
+
+function dispatch(array $event, string $artisan, string $queueCommand): array
+{
+    // SQS queue event.
+    if (isset($event['Records']) && is_array($event['Records'])) {
+        $failures = [];
+        foreach ($event['Records'] as $record) {
+            $body = $record['body'] ?? '';
+            $messageId = $record['messageId'] ?? '';
+            $exit = runArtisan($artisan, [$queueCommand], ['TSCLOUD_SQS_RECORD' => $body], $out);
+            if ($exit !== 0) {
+                $failures[] = ['itemIdentifier' => $messageId];
+            }
+        }
+        return ['batchItemFailures' => $failures];
+    }
+
+    // Scheduler / arbitrary command.
+    $command = $event['command'] ?? 'schedule:run';
+
+    // Sub-minute scheduling: EventBridge fires once a minute, so loop
+    // `schedule:run` within the invocation (~every 10s for ~55s) to honor tasks
+    // scheduled more frequently than once a minute.
+    if ($command === 'schedule:run' && getenv('TSCLOUD_SCHEDULER') === 'sub-minute') {
+        $deadline = time() + 55;
+        $last = '';
+        do {
+            runArtisan($artisan, ['schedule:run'], [], $last);
+            if (time() < $deadline) {
+                sleep(10);
+            }
+        } while (time() < $deadline);
+        return ['statusCode' => 0, 'output' => $last];
+    }
+
+    $args = preg_split('/\s+/', trim($command));
+    $exit = runArtisan($artisan, $args, [], $out);
+    return ['statusCode' => $exit, 'output' => $out];
+}
+
+/**
+ * @param string[] $args
+ * @param array<string,string> $env
+ */
+function runArtisan(string $artisan, array $args, array $env, ?string &$out): int
+{
+    $cmd = array_merge(['php', $artisan], $args);
+    $descriptors = [1 => ['pipe', 'w'], 2 => ['pipe', 'w']];
+    $fullEnv = array_merge(getenv(), $env);
+    $proc = proc_open($cmd, $descriptors, $pipes, getenv('LAMBDA_TASK_ROOT') ?: '/var/task', $fullEnv);
+    if (!is_resource($proc)) {
+        $out = 'failed to start artisan';
+        return 1;
+    }
+    $stdout = stream_get_contents($pipes[1]);
+    $stderr = stream_get_contents($pipes[2]);
+    fclose($pipes[1]);
+    fclose($pipes[2]);
+    $exit = proc_close($proc);
+    $out = trim($stdout . "\n" . $stderr);
+    // Surface output to CloudWatch.
+    fwrite(STDERR, $out . "\n");
+    return $exit;
+}
+
+/**
+ * @return array{0:string,1:array}|null
+ */
+function nextInvocation(string $api): ?array
+{
+    $ch = curl_init("http://{$api}/2018-06-01/runtime/invocation/next");
+    $headers = [];
+    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+    curl_setopt($ch, CURLOPT_HEADERFUNCTION, function ($c, $h) use (&$headers) {
+        $parts = explode(':', $h, 2);
+        if (count($parts) === 2) {
+            $headers[strtolower(trim($parts[0]))] = trim($parts[1]);
+        }
+        return strlen($h);
+    });
+    $body = curl_exec($ch);
+    curl_close($ch);
+    if ($body === false) {
+        return null;
+    }
+    $requestId = $headers['lambda-runtime-aws-request-id'] ?? '';
+    $event = json_decode($body, true) ?: [];
+    return [$requestId, $event];
+}
+
+function postResponse(string $api, string $requestId, array $response): void
+{
+    $ch = curl_init("http://{$api}/2018-06-01/runtime/invocation/{$requestId}/response");
+    curl_setopt($ch, CURLOPT_POST, true);
+    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($response));
+    curl_exec($ch);
+    curl_close($ch);
+}
+
+function postError(string $api, string $requestId, \Throwable $e): void
+{
+    $ch = curl_init("http://{$api}/2018-06-01/runtime/invocation/{$requestId}/error");
+    curl_setopt($ch, CURLOPT_POST, true);
+    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+    curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
+    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
+        'errorType' => get_class($e),
+        'errorMessage' => $e->getMessage(),
+    ]));
+    curl_exec($ch);
+    curl_close($ch);
+}