# Arco Arco deploys this project to AWS Lambda Web Functions. Its configuration is `arco.php` at the project root; the CLI is `vendor/bin/arco`. **Before acting, read `vendor/multiapi/arco/docs/agents.md`** (the agent guide: ground rules, non-interactive use, every command and `arco.php` method, workflows, error keys and fixes). It links to the full reference in the same folder (`configuration.md`, `getting-started.md`, `local-floci.md`, `upgrading.md`). If `vendor/` is not installed, run `composer install` first, or read the docs at https://github.com/multi-api/arco/tree/main/docs. ## Rules that always apply - Ask the user before any command that changes AWS or runs code there: `deploy`, `remove`, `command`, `tinker`, `secret:set`, `queue:dlq --redrive`, `scheduler:pause`/`resume`, `scheduler:set`/`remove --apply`. Editing commands (`set`, `queue:add`, `storage:add`, `domain:add`, `vpc:set`, `certificate:set`, ...) and `info`, `logs`, `queue:list`, `storage:list`, `resources --json`, `profile` are safe. - Confirm which AWS profile and account to use; never assume `default`. - Never put secret values in `arco.php`, `.env` files you commit, command arguments or the chat. The user stores them with `vendor/bin/arco secret:set <name> --env=<env>`; reference them as `arco-ssm:/<app>/<env>/<name>`. - Never pass `--force` or `--force-dns` on your own: they override ownership and DNS safety checks. - Always pass `-n` and `--env=<env>`. Pass `--yes` only for the exact confirmation the user gave. - Validate after editing `arco.php`: `vendor/bin/arco info --env=<env> --json -n` (no AWS change). - Use `--json` and exit codes, not message text. `deploy --json` ends with one `result` line: `outcome` is `deployed`, `removed`, `refused` (nothing changed in AWS) or `failed` (check `rolled_back` and `error.key`). - Never run `arco logs --follow` in a foreground call: read a window with `--since`/`--until`. - Removed queues, buckets and tables stay in AWS with their data. Do not delete them unless the user asks.

Arco

Arco deploys this project to AWS Lambda Web Functions. Its configuration is arco.php at the project root; the CLI is vendor/bin/arco.

Before acting, read vendor/multiapi/arco/docs/agents.md (the agent guide: ground rules, non-interactive use, every command and arco.php method, workflows, error keys and fixes). It links to the full reference in the same folder (configuration.md, getting-started.md, local-floci.md, upgrading.md). If vendor/ is not installed, run composer install first, or read the docs at https://github.com/multi-api/arco/tree/main/docs.

Rules that always apply

Ask the user before any command that changes AWS or runs code there: deploy, remove, command, tinker, secret:set, queue:dlq --redrive, scheduler:pause/resume, scheduler:set/remove --apply. Editing commands (set, queue:add, storage:add, domain:add, vpc:set, certificate:set, ...) and info, logs, queue:list, storage:list, resources --json, profile are safe.
Confirm which AWS profile and account to use; never assume default.
Never put secret values in arco.php, .env files you commit, command arguments or the chat. The user stores them with vendor/bin/arco secret:set <name> --env=<env>; reference them as arco-ssm:/<app>/<env>/<name>.
Never pass --force or --force-dns on your own: they override ownership and DNS safety checks.
Always pass -n and --env=<env>. Pass --yes only for the exact confirmation the user gave.
Validate after editing arco.php: vendor/bin/arco info --env=<env> --json -n (no AWS change).
Use --json and exit codes, not message text. deploy --json ends with one result line: outcome is deployed, removed, refused (nothing changed in AWS) or failed (check rolled_back and error.key).
Never run arco logs --follow in a foreground call: read a window with --since/--until.
Removed queues, buckets and tables stay in AWS with their data. Do not delete them unless the user asks.