feat: asset types support

lambda/deployment/build_context

@@ -173,6 +173,18 @@ LAMBDA_EPHEMERAL_STORAGE=$(get_config_value \
 )
 log debug "   ✅ ephemeral_storage=$LAMBDA_EPHEMERAL_STORAGE"
 
+LAMBDA_RUNTIME=$(get_config_value \
+  --provider '.scope.capabilities.runtime' \
+  --default "nodejs20.x"
+)
+log debug "   ✅ runtime=$LAMBDA_RUNTIME"
+
+LAMBDA_HANDLER=$(get_config_value \
+  --provider '.scope.capabilities.handler' \
+  --default "index.handler"
+)
+log debug "   ✅ handler=$LAMBDA_HANDLER"
+
 LAMBDA_LAYERS=$(echo "$CONTEXT" | jq -c '.scope.capabilities.layers // []')
 log debug "   ✅ layers=$LAMBDA_LAYERS"
 
@@ -230,6 +242,15 @@ if [ -n "${IMAGE_URI:-}" ]; then
   S3_BUCKET=""
   S3_KEY=""
   log debug "   ✅ image_uri=$IMAGE_URI (provided by caller)"
+elif [ -n "${LAMBDA_FILENAME:-}" ]; then
+  # LAMBDA_FILENAME already set by caller (e.g. scope create with placeholder zip) — skip asset resolution
+  PACKAGE_TYPE="Zip"
+  ASSET_TYPE="lambda"
+  ASSET_URL=""
+  IMAGE_URI=""
+  S3_BUCKET=""
+  S3_KEY=""
+  log debug "   ✅ lambda_filename=$LAMBDA_FILENAME (provided by caller)"
 else
   ASSET_URL=$(echo "$CONTEXT" | jq -r '.asset.url // ""')
   ASSET_TYPE=$(echo "$CONTEXT" | jq -r '.asset.type // "lambda-asset"')
@@ -421,6 +442,8 @@ TOFU_VARIABLES=$(jq -n \
   --arg timeout "$LAMBDA_TIMEOUT" \
   --arg architecture "$LAMBDA_ARCHITECTURE" \
   --arg ephemeral_storage "$LAMBDA_EPHEMERAL_STORAGE" \
+  --arg runtime "$LAMBDA_RUNTIME" \
+  --arg handler "$LAMBDA_HANDLER" \
   --argjson layers "$LAMBDA_LAYERS" \
   --arg reserved_concurrency_type "$RESERVED_CONCURRENCY_TYPE" \
   --arg reserved_concurrency_value "$RESERVED_CONCURRENCY_VALUE" \
@@ -461,6 +484,8 @@ TOFU_VARIABLES=$(jq -n \
     timeout: ($timeout | tonumber),
     architecture: $architecture,
     ephemeral_storage: ($ephemeral_storage | tonumber),
+    runtime: $runtime,
+    handler: $handler,
     layers: $layers,
     reserved_concurrency_type: $reserved_concurrency_type,
     reserved_concurrency_value: ($reserved_concurrency_value | tonumber),
@@ -529,6 +554,8 @@ export LAMBDA_MEMORY
 export LAMBDA_TIMEOUT
 export LAMBDA_ARCHITECTURE
 export LAMBDA_EPHEMERAL_STORAGE
+export LAMBDA_RUNTIME
+export LAMBDA_HANDLER
 export LAMBDA_LAYERS
 export RESERVED_CONCURRENCY_TYPE
 export RESERVED_CONCURRENCY_VALUE
@@ -541,6 +568,7 @@ export SECURITY_GROUP_IDS
 export ASSET_TYPE
 export PACKAGE_TYPE
 export IMAGE_URI
+export LAMBDA_FILENAME
 export S3_BUCKET
 export S3_KEY
 export LAMBDA_ENVIRONMENT_VARIABLES

lambda/deployment/compute/lambda/modules/locals.tf

@@ -11,6 +11,9 @@ locals {
   # Whether this is a container image deployment
   lambda_is_image = var.lambda_package_type == "Image"
 
+  # Whether to use a local file instead of S3 for the deployment package
+  lambda_use_filename = !local.lambda_is_image && var.lambda_filename != "" && var.lambda_filename != null
+
   # Whether to create warmup alias
   lambda_create_warmup_alias = var.lambda_warmup_alias_name != "" && var.lambda_warmup_alias_name != null
 

lambda/deployment/compute/lambda/modules/main.tf

@@ -5,9 +5,10 @@ resource "aws_lambda_function" "main" {
   role          = local.lambda_role_arn
   package_type  = var.lambda_package_type
 
-  # Deployment package from S3 (Zip only)
-  s3_bucket = local.lambda_is_image ? null : var.lambda_s3_bucket
-  s3_key    = local.lambda_is_image ? null : var.lambda_s3_key
+  # Deployment package — local file takes precedence over S3 (Zip only)
+  filename  = local.lambda_use_filename ? var.lambda_filename : null
+  s3_bucket = local.lambda_is_image || local.lambda_use_filename ? null : var.lambda_s3_bucket
+  s3_key    = local.lambda_is_image || local.lambda_use_filename ? null : var.lambda_s3_key
 
   # Container image URI (Image only)
   image_uri = local.lambda_is_image ? var.lambda_image_uri : null

lambda/deployment/compute/lambda/modules/variables.tf

@@ -51,6 +51,12 @@ variable "lambda_image_uri" {
   default     = ""
 }
 
+variable "lambda_filename" {
+  description = "Path to a local zip deployment package (used for initial placeholder; takes precedence over S3)"
+  type        = string
+  default     = ""
+}
+
 variable "lambda_s3_bucket" {
   description = "S3 bucket containing the deployment package"
   type        = string

lambda/deployment/compute/lambda/setup

@@ -8,10 +8,11 @@ log info "🔍 Validating Lambda compute configuration..."
 lambda_function_name=$(echo "$CONTEXT" | jq -r '.lambda.function_name // empty')
 lambda_role_arn=$(echo "$CONTEXT" | jq -r '.lambda.role_arn // empty')
 
-# PACKAGE_TYPE, IMAGE_URI, S3_BUCKET, and S3_KEY are parsed by build_context and exported.
-# Use them directly to avoid re-parsing the asset URL.
+# PACKAGE_TYPE, IMAGE_URI, LAMBDA_FILENAME, S3_BUCKET, and S3_KEY are parsed by
+# build_context and exported. Use them directly to avoid re-parsing the asset URL.
 package_type="${PACKAGE_TYPE:-Zip}"
 lambda_image_uri="${IMAGE_URI:-}"
+lambda_filename="${LAMBDA_FILENAME:-}"
 lambda_s3_bucket="${S3_BUCKET:-}"
 lambda_s3_key="${S3_KEY:-}"
 
@@ -32,6 +33,9 @@ if [ "$package_type" = "Image" ]; then
   fi
   log debug "   ✅ package_type=Image"
   log debug "   ✅ image_uri=$lambda_image_uri"
+elif [ -n "$lambda_filename" ]; then
+  log debug "   ✅ package_type=Zip (local file)"
+  log debug "   ✅ lambda_filename=$lambda_filename"
 else
   if [ -z "$lambda_s3_bucket" ] || [ -z "$lambda_s3_key" ]; then
     echo ""
@@ -56,10 +60,22 @@ memory=$(echo "$CONTEXT" | jq -r '.scope.capabilities.memory // 256')
 timeout=$(echo "$CONTEXT" | jq -r '.scope.capabilities.timeout // 30')
 ephemeral_storage=$(echo "$CONTEXT" | jq -r '.scope.capabilities.ephemeral_storage // 512')
 architecture=$(echo "$CONTEXT" | jq -r '.scope.capabilities.architecture // "arm64"')
+runtime=$(echo "$CONTEXT" | jq -r '.scope.capabilities.runtime // "nodejs20.x"')
+handler=$(echo "$CONTEXT" | jq -r '.scope.capabilities.handler // "index.handler"')
+
+# When deploying the placeholder zip (scope creation), always use nodejs20.x so the
+# runtime matches the placeholder code. The first real deployment will set the correct
+# runtime from capabilities.
+if [ -n "$lambda_filename" ]; then
+  runtime="nodejs20.x"
+  handler="index.handler"
+fi
 
 log debug "   ✅ memory=${memory}MB"
 log debug "   ✅ timeout=${timeout}s"
 log debug "   ✅ architecture=$architecture"
+log debug "   ✅ runtime=$runtime"
+log debug "   ✅ handler=$handler"
 
 # Reserved concurrency
 reserved_type=$(echo "$CONTEXT" | jq -r '.scope.capabilities.reserved_concurrency.type // "unreserved"')
@@ -166,8 +182,11 @@ TOFU_VARIABLES=$(echo "$TOFU_VARIABLES" | jq \
   --argjson timeout "$timeout" \
   --argjson ephemeral_storage "$ephemeral_storage" \
   --arg architecture "$architecture" \
+  --arg runtime "$runtime" \
+  --arg handler "$handler" \
   --arg package_type "$package_type" \
   --arg image_uri "$lambda_image_uri" \
+  --arg lambda_filename "$lambda_filename" \
   --arg s3_bucket "$lambda_s3_bucket" \
   --arg s3_key "$lambda_s3_key" \
   --argjson environment_variables "$env_vars" \
@@ -186,8 +205,11 @@ TOFU_VARIABLES=$(echo "$TOFU_VARIABLES" | jq \
     lambda_timeout: $timeout,
     lambda_ephemeral_storage: $ephemeral_storage,
     lambda_architecture: $architecture,
+    lambda_runtime: $runtime,
+    lambda_handler: $handler,
     lambda_package_type: $package_type,
     lambda_image_uri: $image_uri,
+    lambda_filename: $lambda_filename,
     lambda_s3_bucket: $s3_bucket,
     lambda_s3_key: $s3_key,
     lambda_environment_variables: $environment_variables,

lambda/scope/build_context

@@ -70,10 +70,18 @@ ARCHITECTURE=$(get_config_value \
   --default "arm64"
 )
 
-# Determine package type from capabilities
-# If the scope has no runtime specified and is meant for container images,
-# the asset type at deployment time will determine the actual package type
-PACKAGE_TYPE=$(echo "$CONTEXT" | jq -r '.scope.capabilities.package_type // "Zip"')
+# Determine package type and asset type from deployment_type capability
+deployment_type=$(echo "$CONTEXT" | jq -r '.scope.capabilities.deployment_type // "docker-image"')
+if [ "$deployment_type" = "zip" ]; then
+  PACKAGE_TYPE="Zip"
+  ASSET_TYPE="lambda"
+else
+  PACKAGE_TYPE="Image"
+  ASSET_TYPE="docker-image"
+fi
+
+RUNTIME=$(echo "$CONTEXT" | jq -r '.scope.capabilities.runtime // "nodejs20.x"')
+HANDLER=$(echo "$CONTEXT" | jq -r '.scope.capabilities.handler // "index.handler"')
 
 echo "   ✅ package_type=$PACKAGE_TYPE"
 echo "   ✅ architecture=$ARCHITECTURE"
@@ -156,6 +164,9 @@ export ACCOUNT_SLUG
 export LAMBDA_FUNCTION_NAME
 export VISIBILITY
 export PACKAGE_TYPE
+export ASSET_TYPE
+export RUNTIME
+export HANDLER
 export ARCHITECTURE
 export OUTPUT_DIR
 export RESOURCE_TAGS_JSON

lambda/scope/placeholder/placeholder_lambda.zip.b64

@@ -0,0 +1 @@
+UEsDBBQAAAAIAJp1clwPv2nkeAAAAIIAAAAIABwAaW5kZXguanNVVAkAA5PkummT5LppdXgLAAEE9QEAAAQUAAAAHYuxCsJAEAX7fMXrkoCEYBmJjY1YaGFhfXprDJx7srsRj5B/9wi8Yhjm0e8TxbR5OfaBBD2cJn6goi+x1ej3mAtAyCbhFQE1Z5MeoqcO27bdrPIefepwul7OjZqMPIzPVM14k6obclgeKYSIW5TgSyx1Pi27Iu8PUEsBAh4DFAAAAAgAmnVyXA+/aeR4AAAAggAAAAgAGAAAAAAAAQAAAKSBAAAAAGluZGV4LmpzVVQFAAOT5LppdXgLAAEE9QEAAAQUAAAAUEsFBgAAAAABAAEATgAAALoAAAAAAA==

lambda/scope/scripts/resolve_placeholder_image

@@ -1,16 +1,38 @@
 #!/bin/bash
-# Resolve the placeholder container image URI for scope provisioning.
-# The placeholder Lambda is always a container image regardless of the scope's
-# eventual package type (Zip or Image). This sets IMAGE_URI so that the
-# deployment build_context uses the correct package type and image for the
-# initial Tofu apply.
+# Resolve the placeholder code for scope provisioning.
+# For Image deployments: resolves the placeholder container image URI from ECR.
+# For Zip deployments: generates a minimal placeholder zip and uploads it to S3.
 #
 # Image tags follow the Docker convention for architecture:
 #   arm64  → suffix "-arm64"
 #   x86_64 → suffix "-amd64"
 
 source "$SERVICE_PATH/utils/log"
 
+# ── Zip placeholder path ──────────────────────────────────────────────────────
+if [ "${PACKAGE_TYPE:-Image}" = "Zip" ]; then
+  log info "🔍 Generating placeholder zip for Zip deployment..."
+
+  placeholder_path="${OUTPUT_DIR}/placeholder.zip"
+  b64_file="$SERVICE_PATH/scope/placeholder/placeholder_lambda.zip.b64"
+
+  log debug "   📋 decoding placeholder zip to $placeholder_path"
+
+  # Decode the pre-built base64 zip (index.js handler, no external tools needed)
+  if ! base64 -d < "$b64_file" > "$placeholder_path" 2>/dev/null; then
+    echo "" >&2
+    echo "❌ Failed to decode placeholder zip from $b64_file" >&2
+    return 1
+  fi
+
+  export LAMBDA_FILENAME="$placeholder_path"
+
+  echo ""
+  log info "✨ Placeholder zip ready: $LAMBDA_FILENAME"
+  return 0
+fi
+
+# ── Image placeholder path ────────────────────────────────────────────────────
 log info "🔍 Resolving placeholder image URI..."
 
 placeholder_image_base="${PLACEHOLDER_IMAGE_URI:-public.ecr.aws/nullplatform/aws-lambda/nullplatform-lambda-placeholder:latest}"