The PHP runtime

The handler contract, Request and Response, the sandbox, bundle format.

The runtime

PHP 8.3, one supported runtime today. Additional languages are a registry entry when they arrive; nothing pretends they are here now.

The handler contract

index.php returns a callable that takes a Request and returns a Response. That is the only shape:

<?php

use Flares\Functions\Request;
use Flares\Functions\Response;

return function (Request $request): Response {
    $body = $request->json() ?? [];

    return Response::json(['received' => $body], 201);
};

Request

Response

Response::json($data, $status = 200, $headers = []);
Response::text($body, $status = 200, $headers = []);
Response::html($body, $status = 200, $headers = []);
Response::empty($status = 204);

Anything you echo is captured as a log, not mixed into the body — a stray var_dump cannot corrupt your JSON. It appears in Logs.

The bundle

my-function/
├── index.php        required — returns the handler
├── function.json    optional — {"handler": "index.php"}
├── composer.json    optional
└── composer.lock    optional

function.json is deliberately tiny; the only key that moves anything today is handler.

The sandbox

Your code never runs inside the Flares web process. Each invocation gets a dedicated, hardened PHP process:

• Filesystem — your bundle and a scratch temp directory. The host, the platform's code and its .env, and every other project's bundle are outside the wall.
• No process spawning — exec, shell_exec, system, proc_open, popen, pcntl_* are disabled. Fork bombs have nothing to fork with.
• No outbound network in V1 — allow_url_fopen off; curl and socket functions disabled. Outbound HTTP will arrive as a deliberate capability, not as an accidental hole.
• Limits — memory ceiling, CPU ceiling, and a wall-clock kill (a sleeping function burns no CPU, so the wall clock is the one that always fires).
• Clean environment — the process sees your variables and nothing of the platform's. getenv('DB_PASSWORD') finds nothing because nothing is there.