diff --git a/doc/AUDIT_PROVIDER_VS_FISSION_2026-06-03.md b/doc/AUDIT_PROVIDER_VS_FISSION_2026-06-03.md
new file mode 100644
index 0000000..51d95ab
--- /dev/null
+++ b/doc/AUDIT_PROVIDER_VS_FISSION_2026-06-03.md
@@ -0,0 +1,473 @@
+# Аудит: Terraform Provider vs Fission Canonical CRD
+
+**Дата:** 2026-06-03  
+**Ветка:** `feat/provider-audit`  
+**Предыдущая версия:** v0.2.4 (ветка `feat/console`)
+
+## Методология
+
+Сравнение производилось по трём источникам:
+1. **Наш код** — `/terraform/provider/internal/resources/*.go` и `/terraform/provider/internal/client/client.go`
+2. **Fission CRD types.go** — `github.com/fission/fission/pkg/apis/core/v1/types.go` (канонические Go-структуры)
+3. **Реальные CRD объекты в кластере** — `kubectl get` для environments/packages/functions/httptriggers (наши vs CLI-созданные)
+
+---
+
+## 1. ENVIRONMENT (fission_environment)
+
+### 1.1 Что у нас
+
+```go
+// environmentResourceModel
+ID, Name, Image, Version(default=3), PoolSize(default=3), Namespace, UID
+```
+
+`environmentToUnstructured` генерирует:
+```json
+{
+  "spec": {
+    "version": 3,
+    "runtime": { "image": "..." },
+    "poolsize": 3
+  }
+}
+```
+
+### 1.2 Что делает Fission CLI (`fission env create`)
+
+Fission CLI (из `environment/create.go`) создает полный `EnvironmentSpec`:
+```json
+{
+  "spec": {
+    "version": 3,
+    "runtime": {
+      "image": "ghcr.io/fission/python-env",
+      "container": { "name": "env-name", "resources": {} },
+      "podspec": { "containers": [{"name": "env-name", "resources": {}}] }
+    },
+    "builder": {
+      "image": "ghcr.io/fission/go-builder",
+      "command": "build",
+      "container": { "name": "builder", "resources": {} },
+      "podspec": { "containers": [{"name": "builder", "resources": {}}] }
+    },
+    "poolsize": 3,
+    "resources": {},
+    "imagepullsecret": "",
+    "keeparchive": false
+  }
+}
+```
+
+### 1.3 Реальное сравнение в кластере
+
+| Поле | Наш (tf-python-env) | CLI (python) | Вердикт |
+|------|---------------------|--------------|---------|
+| `spec.version` | 3 | 3 | ✅ OK |
+| `spec.runtime.image` | ✅ | ✅ | ✅ OK |
+| `spec.runtime.container` | ❌ отсутствует | `{name, resources}` | ⚠️ Fission заполняет defaults — не критично |
+| `spec.runtime.podspec` | ❌ отсутствует | `{containers}` | ⚠️ Fission заполняет defaults — не критично |
+| `spec.builder` | ❌ ОТСУТСТВУЕТ | `{image, command, container, podspec}` | 🔴 **КРИТИЧНО для Go** |
+| `spec.poolsize` | 3 | 3 | ✅ OK |
+| `spec.resources` | ❌ отсутствует | `{}` | ⚠️ Defaults — не критично |
+| `spec.imagepullsecret` | ❌ | `""` | ⚠️ Можно добавить позже |
+| `spec.keeparchive` | ❌ | `false` | ⚠️ Нужно для JVM — не критично сейчас |
+
+### 1.4 Выводы по Environment
+
+**Критичный баг:** Невозможно создать environment с builder (нет полей `builder_image`, `builder_command`). Это блокирует Go, любой язык с build step.
+
+**Что добавить (приоритетно):**
+- `builder_image` (string, optional) → `spec.builder.image`
+- `builder_command` (string, optional) → `spec.builder.command`
+
+**Что можно добавить позже:**
+- `resources` (object) → `spec.resources`
+- `imagepullsecret` (string) → `spec.imagepullsecret`
+- `keeparchive` (bool) → `spec.keeparchive`
+- `runtime_container_name` — Fission автозаполняет, мы не ставим, k8s принимает без него
+
+**Что НЕ нужно (Fission автозаполняет):**
+- `spec.runtime.container`, `spec.runtime.podspec` — заливаются defaults на стороне сервера
+- `spec.builder.container`, `spec.builder.podspec` — аналогично
+
+---
+
+## 2. PACKAGE (fission_package)
+
+### 2.1 Что у нас
+
+```go
+// packageResourceModel
+ID, Name, Environment, SourceDir, CodePath, CodeHash, BuildCmd, Namespace, UID, BuildStatus, BuildLog
+```
+
+`packageToUnstructured` генерирует:
+```json
+{
+  "spec": {
+    "deployment": {
+      "type": "literal",
+      "literal": "base64..."
+    },
+    "environment": { "name": "...", "namespace": "..." },
+    "source": {}
+  }
+}
+```
+
+### 2.2 Что делает Fission CLI
+
+Для **deploy-only** (literal):
+```json
+{
+  "spec": {
+    "deployment": {
+      "type": "literal",
+      "literal": "base64...",
+      "checksum": {}
+    },
+    "environment": { "name": "...", "namespace": "..." },
+    "source": { "checksum": {} }
+  },
+  "status": {
+    "buildstatus": "none"
+  }
+}
+```
+
+Для **source-with-builder** (Go, Node с build):
+```json
+{
+  "spec": {
+    "source": {
+      "type": "literal",
+      "literal": "base64-of-zip...",
+      "checksum": {}
+    },
+    "environment": { "name": "...", "namespace": "..." },
+    "buildcmd": "build"
+  },
+  "status": {
+    "buildstatus": "pending"
+  }
+}
+```
+
+Для **large archives** (>256KB):
+- Загрузка через StorageSvc `/v1/archive` (multipart POST)
+- В CRD сохраняется `type: "url"`, `url: "http://storagesvc/v1/archive?id=..."`
+
+### 2.3 Реальное сравнение в кластере
+
+| Поле | Наш (tf-hello-pkg) | CLI (hello-*) | Вердикт |
+|------|---------------------|---------------|---------|
+| `spec.deployment.type` | `"literal"` | `"literal"` | ✅ OK |
+| `spec.deployment.literal` | ✅ base64 | ✅ base64 | ✅ OK |
+| `spec.deployment.checksum` | ❌ отсутствует | `{}` | ⚠️ K8s принимает без, но лучше добавить |
+| `spec.environment` | ✅ | ✅ | ✅ OK |
+| `spec.source` | `{}` (пустая map) | `{"checksum":{}}` | 🟡 **БАГ**: мы ставим пустой source — не мешает, но мусор |
+| `spec.buildcmd` | ✅ (если задан) | ✅ | ✅ OK |
+| `status.buildstatus` | `"none"` (от k8s default) | `"none"` | ✅ OK (k8s сам ставит) |
+
+### 2.4 Что ОТСУТСТВУЕТ для builder pipeline (Go)
+
+Для Go-функций нужен **source** package (не deployment):
+1. Код упаковывается в zip
+2. zip кодируется в base64 → `spec.source.literal` (если <256KB)
+3. `spec.source.type` = `"literal"`
+4. `spec.deployment` = пусто
+5. `spec.buildcmd` = `"build"` (или пользовательская)
+6. `status.buildstatus` = `"pending"` → builder собирает → `"succeeded"`/`"failed"`
+7. После build: `spec.deployment` заполняется builder'ом (url на StorageSvc)
+
+### 2.5 Выводы по Package
+
+**Баг (некритичный):** Мы ВСЕГДА ставим `"source": {}` — пустой объект. Fission ставит `"source": {"checksum": {}}`. Оба варианта работают, но чистый вариант — не ставить source вообще если нет source archive.
+
+**Что добавить (приоритетно):**
+- **Режим source archive** — для Go и языков с build step. Нужно:
+  - Флаг/переключатель: deployment-only vs source-with-build
+  - Упаковка source_dir в zip → base64 → `spec.source.literal`
+  - Проверка размера <256KB (лимит ArchiveLiteralSizeLimit)
+  - Очистка `spec.deployment` при source mode
+  - `status.buildstatus` = `"pending"` на create
+
+**Что можно добавить позже:**
+- StorageSvc загрузка для >256KB архивов
+- `spec.source.checksum`
+- Поддержка `type: "url"` (для уже загруженных архивов)
+
+---
+
+## 3. FUNCTION (fission_function)
+
+### 3.1 Что у нас
+
+```go
+// functionResourceModel
+ID, Name, Environment, PackageName, Entrypoint, Namespace, UID
+```
+
+`functionToUnstructured` генерирует:
+```json
+{
+  "spec": {
+    "environment": { "name": "...", "namespace": "..." },
+    "InvokeStrategy": {
+      "ExecutionStrategy": { "ExecutorType": "poolmgr" },
+      "StrategyType": "execution"
+    },
+    "package": {
+      "packageref": { "name": "...", "namespace": "..." },
+      "functionName": "main.main"
+    }
+  }
+}
+```
+
+### 3.2 Что делает Fission CLI (`fission fn create`)
+
+```json
+{
+  "spec": {
+    "environment": { "name": "...", "namespace": "..." },
+    "InvokeStrategy": {
+      "ExecutionStrategy": {
+        "ExecutorType": "poolmgr",
+        "MaxScale": 0,
+        "MinScale": 0,
+        "SpecializationTimeout": 120,
+        "TargetCPUPercent": 0
+      },
+      "StrategyType": "execution"
+    },
+    "package": {
+      "packageref": {
+        "name": "...",
+        "namespace": "...",
+        "resourceversion": "6000598"
+      },
+      "functionName": ""
+    },
+    "functionTimeout": 60,
+    "idletimeout": 120,
+    "concurrency": 500,
+    "requestsPerPod": 1,
+    "resources": {}
+  }
+}
+```
+
+### 3.3 Реальное сравнение в кластере
+
+| Поле | Наш (tf-hello-fn) | CLI (fn-js-acc) | Вердикт |
+|------|---------------------|-----------------|---------|
+| `spec.environment` | ✅ | ✅ | ✅ OK |
+| `spec.InvokeStrategy.ExecutionStrategy.ExecutorType` | `"poolmgr"` | `"poolmgr"` | ✅ OK |
+| `spec.InvokeStrategy.ExecutionStrategy.MaxScale` | ❌ отсутствует | `0` | ⚠️ Defaults работают, но лучше ставить |
+| `spec.InvokeStrategy.ExecutionStrategy.MinScale` | ❌ | `0` | ⚠️ |
+| `spec.InvokeStrategy.ExecutionStrategy.SpecializationTimeout` | ❌ | `120` | ⚠️ |
+| `spec.InvokeStrategy.ExecutionStrategy.TargetCPUPercent` | ❌ | `0` | ⚠️ Не критично |
+| `spec.InvokeStrategy.StrategyType` | `"execution"` | `"execution"` | ✅ OK |
+| `spec.package.packageref.resourceversion` | ❌ отсутствует | ✅ | 🟡 CLI ставит для оптимизации, мы — нет |
+| `spec.package.functionName` | ✅ `"main.main"` | `""` (или функция) | ✅ OK |
+| `spec.functionTimeout` | ❌ | `60` | 🟡 Полезно для управления таймаутами |
+| `spec.idletimeout` | ❌ | `120` | 🟡 Полезно для scale-to-zero |
+| `spec.concurrency` | ❌ | `500` | ⚠️ |
+| `spec.requestsPerPod` | ❌ | `1` | ⚠️ |
+| `spec.resources` | ❌ | `{}` | ⚠️ |
+
+### 3.4 Выводы по Function
+
+**Критичных багов нет.** Наши функции работают, потому что k8s/Fission подставляет defaults. НО:
+
+**Что добавить (приоритетно):**
+- `executor_type` (string, optional, default="poolmgr") → для newdeploy/container strategies  
+- `function_timeout` (int, optional) → `spec.functionTimeout` — важно для долгих функций
+- `idle_timeout` (int, optional) → `spec.idletimeout` — управление scale-to-zero
+- `min_scale` / `max_scale` (int, optional) → ExecutionStrategy — для newdeploy
+
+**Что можно добавить позже:**
+- `concurrency` (int) → `spec.concurrency`
+- `requests_per_pod` (int) → `spec.requestsPerPod`
+- `specialization_timeout` (int) → `spec.InvokeStrategy.ExecutionStrategy.SpecializationTimeout`
+- `resources` (object) → CPU/MEM limits
+- `secrets`, `configmaps` (list) → volume mounts
+
+---
+
+## 4. HTTP TRIGGER (fission_http_trigger)
+
+### 4.1 Что у нас
+
+```go
+// httpTriggerResourceModel
+ID, Name, Function, URL, Methods, CreateIngress, Host, Namespace, UID
+```
+
+`httpTriggerToUnstructured` генерирует:
+```json
+{
+  "spec": {
+    "relativeurl": "/tf-hello",
+    "methods": ["GET"],
+    "functionref": { "type": "name", "name": "tf-hello-fn" },
+    "createingress": false
+  }
+}
+```
+
+### 4.2 Что делает Fission CLI
+
+```json
+{
+  "spec": {
+    "relativeurl": "/hello",
+    "methods": ["GET"],
+    "functionref": {
+      "type": "name",
+      "name": "hello",
+      "functionweights": null
+    },
+    "createingress": false,
+    "host": "",
+    "ingressconfig": {
+      "annotations": null,
+      "host": "*",
+      "path": "/hello",
+      "tls": ""
+    },
+    "method": "",
+    "prefix": ""
+  }
+}
+```
+
+### 4.3 Реальное сравнение в кластере
+
+| Поле | Наш (tf-hello-route) | CLI (hello-route) | Вердикт |
+|------|----------------------|-------------------|---------|
+| `spec.relativeurl` | ✅ | ✅ | ✅ OK |
+| `spec.methods` | ✅ | ✅ | ✅ OK |
+| `spec.functionref.type` | `"name"` | `"name"` | ✅ OK |
+| `spec.functionref.name` | ✅ | ✅ | ✅ OK |
+| `spec.functionref.functionweights` | ❌ | `null` | ✅ Не нужно |
+| `spec.createingress` | ✅ | ✅ | ✅ OK |
+| `spec.host` | ❌ (если пусто) | `""` | ✅ Не критично |
+| `spec.ingressconfig` | Частично (host) | Полный | ⚠️ IngressConfig неполный |
+| `spec.method` | ❌ | `""` | ✅ Legacy, не нужно |
+| `spec.prefix` | ❌ | `""` | ⚠️ Для prefix routing — добавить |
+
+### 4.4 Выводы по HTTPTrigger
+
+**Багов нет.** Работает корректно. Мелкие расхождения не влияют.
+
+**Что можно добавить позже:**
+- `prefix` (string) → `spec.prefix` — для prefix-based routing
+- `keep_prefix` (bool) → `spec.keepPrefix`
+- Полный `ingressconfig` (annotations, path, tls) — при `create_ingress=true`
+- `function_weights` (map) → для canary deployments
+
+---
+
+## 5. CLIENT (client.go)
+
+### 5.1 Оценка
+
+**Код корректный.** Чистый CRUD через `dynamic.Interface`:
+- 4 GVR определения (environments, packages, functions, httptriggers)
+- CRUD для каждого: Create/Get/Update/Delete
+- `IsNotFound()` для обработки 404
+- `New()` строит config из kubeconfig + context
+
+**Расхождений с Fission нет** — это наш собственный low-level клиент для работы с CRD.
+
+---
+
+## 6. VALIDATION (validation_helpers.go, entrypoint validation)
+
+### 6.1 Оценка
+
+- `ensureEnvironmentExists` — ✅ корректно (проверяет наличие env перед созданием pkg/fn)
+- `ensurePackageExists` — ✅ корректно
+- `validateEntrypointAgainstPackageSource` — ⚠️ Проверяет только Python `def funcname(`. Не проверяет:
+  - Node: `module.exports` или `export function`
+  - Go: plugin symbol
+  - PHP: `function handler(` 
+  - Ruby: `def handler`
+
+**Это допустимо** — избыточная валидация может мешать. Лучше валидировать только точно известные паттерны.
+
+---
+
+## 7. СВОДНАЯ ТАБЛИЦА ПРИОРИТЕТОВ
+
+### 🔴 Критично (блокирует функционал)
+
+| # | Ресурс | Проблема | Решение |
+|---|--------|----------|---------|
+| 1 | Environment | Нет builder support | Добавить `builder_image`, `builder_command` |
+| 2 | Package | Нет source archive mode | Добавить zip-упаковку source_dir → `spec.source.literal` |
+
+### 🟡 Важно (улучшает пользовательский опыт)
+
+| # | Ресурс | Проблема | Решение |
+|---|--------|----------|---------|
+| 3 | Function | Захардкожен poolmgr | Добавить `executor_type` с optional default |
+| 4 | Function | Нет пользовательских таймаутов | Добавить `function_timeout`, `idle_timeout` |
+| 5 | Function | Нет min/max scale | Добавить `min_scale`, `max_scale` |
+| 6 | Package | Пустой `source: {}` мусор | Убрать пустой source из payload |
+
+### ⚪ Не критично (можно позже)
+
+| # | Ресурс | Проблема |
+|---|--------|----------|
+| 7 | Environment | Нет resources, imagepullsecret, keeparchive |
+| 8 | Function | Нет concurrency, requestsPerPod, resources, secrets, configmaps |
+| 9 | HTTPTrigger | Нет prefix, keepPrefix, полного ingressconfig |
+| 10 | Package | Нет StorageSvc загрузки (>256KB) |
+| 11 | Package | Нет checksum |
+
+---
+
+## 8. ПЛАН РЕАЛИЗАЦИИ (предлагаемый)
+
+### Этап 1: Builder support (Environment + Package)
+
+**environment_resource.go:**
+- Добавить поля `builder_image` и `builder_command` в модель и schema
+- Добавить `spec.builder` в `environmentToUnstructured` (если builder_image задан)
+- Обновить `unstructuredToEnvironmentModel` для чтения builder полей
+
+**package_resource.go:**
+- Добавить поле `deploy_type` (string: `"literal"` или `"source"`, default `"literal"`)
+- При `deploy_type = "source"`: zip source_dir → base64 → `spec.source.literal`, `spec.deployment` пустой
+- Убрать пустой `"source": {}` при deploy_type = "literal"
+- Добавить base64 size check (<256KB) при literal mode
+
+### Этап 2: Function tuning
+
+**function_resource.go:**
+- Добавить optional поля: `executor_type`, `function_timeout`, `idle_timeout`, `min_scale`, `max_scale`
+- Обновить `functionToUnstructured` для заполнения ExecutionStrategy полностью  
+- Обновить `unstructuredToFunctionModel` для чтения новых полей
+
+### Этап 3: Мелкие улучшения
+- HTTPTrigger: prefix, keepPrefix
+- Package: checksum
+- Environment: resources, imagepullsecret
+
+---
+
+## 9. ВЫВОД
+
+Наш провайдер **работает корректно для основного сценария**: Python/Node/PHP/Ruby/Perl literal deployment + poolmgr executor. Все критические поля (version, runtime.image, poolsize, deployment.literal, functionName, relativeurl, methods) генерируются правильно.
+
+**Главные пробелы:**
+1. Нет builder support → Go и любые compiled languages не работают через builder pipeline
+2. Нет source archive → только deployment-only (literal из одного файла)
+3. Function executor hardcoded to poolmgr → нет newdeploy/container strategy
+4. Нет пользовательских таймаутов
+
+Ни один из пробелов не является **ошибкой** в существующем коде — это **недостающий функционал**. То, что есть, соответствует канону Fission.
diff --git a/doc/thinking/2026-06-03-audit.md b/doc/thinking/2026-06-03-audit.md
new file mode 100644
index 0000000..d43e407
--- /dev/null
+++ b/doc/thinking/2026-06-03-audit.md
@@ -0,0 +1,59 @@
+# Thinking Log — Аудит провайдера, 2026-06-03
+
+## Задача
+Тщательное сравнение нашего Terraform provider для Fission с каноническим поведением Fission CLI и CRD types.
+
+## Что было сделано
+
+### 1. Чтение нашего кода
+Прочитаны все 10 .go файлов (~1500 строк):
+- `environment_resource.go` (136 строк)
+- `package_resource.go` (460 строк)
+- `function_resource.go` (350 строк) 
+- `http_trigger_resource.go` (310 строк)
+- `client.go` (295 строк)
+- `validation_helpers.go`, `import_helpers.go`
+- 3 тест-файла
+
+### 2. Чтение канонических исходников Fission
+- `pkg/apis/core/v1/types.go` — все CRD Go-структуры
+- `pkg/apis/core/v1/const.go` — константы (ArchiveLiteralSizeLimit=256KB, BuildStatus*, ExecutorType*)
+- CLI: `environment/create.go`, `package/create.go`, `package/util/util.go`
+- StorageSvc: `storagesvc/client/client.go`
+
+### 3. Дамп реальных CRD из кластера
+Через kubectl получены ВСЕ объекты всех 4 типов из кластера:
+- 20+ environments (наши tf-* и CLI-созданные)
+- 15+ functions (наши tf-* и CLI-созданные)
+- 15+ packages (наши и CLI)
+- 15+ httptriggers
+
+### 4. Сравнительный анализ
+Для каждого ресурса: поле-за-полем наш payload vs CLI payload vs канон types.go.
+
+## Ключевые находки
+
+### Что правильно
+- environment: version, runtime.image, poolsize — ок
+- package: deployment.literal base64 — ок
+- function: InvokeStrategy structure, package.functionName — ок
+- httptrigger: relativeurl, methods, functionref, createingress — ок
+- client.go: чистый CRUD, GVR правильные — ок
+
+### Что отсутствует (критично)
+1. **Environment.builder** — нет builder_image/builder_command → Go не работает через builder pipeline
+2. **Package source archive** — только deployment-only, нет source+build flow
+
+### Что отсутствует (важно)
+3. **Function executor_type** — hardcoded poolmgr, нет newdeploy/container
+4. **Function timeouts** — нет functionTimeout, idleTimeout
+5. **Function scaling** — нет minScale, maxScale
+
+### Что отсутствует (некритично)
+6. Package: пустой `source: {}` — мусор но не bug
+7. Environment: resources, imagepullsecret, keeparchive
+8. Function: concurrency, requestsPerPod, resources, secrets
+9. HTTPTrigger: prefix, keepPrefix, полный ingressconfig
+
+## Решение
+Написан полный аудит-документ: `doc/AUDIT_PROVIDER_VS_FISSION_2026-06-03.md`
diff --git a/examples/bad-entrypoint/code/main.py b/examples/bad-entrypoint/code/main.py
new file mode 100644
index 0000000..0d97d74
--- /dev/null
+++ b/examples/bad-entrypoint/code/main.py
@@ -0,0 +1,5 @@
+def good_function():
+    return "correct"
+
+def main():
+    return "this is main"
diff --git a/examples/bad-entrypoint/main.tf b/examples/bad-entrypoint/main.tf
new file mode 100644
index 0000000..22fcd72
--- /dev/null
+++ b/examples/bad-entrypoint/main.tf
@@ -0,0 +1,39 @@
+terraform {
+  required_providers {
+    fission = {
+      source  = "nail/fission"
+      version = "~> 0.1.0"
+    }
+  }
+}
+
+provider "fission" {
+  kubeconfig_path = "/home/naeel/.kube/config"
+  namespace       = "default"
+}
+
+resource "fission_environment" "python" {
+  name    = "tf-bad-entry-env"
+  image   = "ghcr.io/fission/python-env"
+  version = 3
+}
+
+resource "fission_package" "pkg" {
+  name        = "tf-bad-entry-pkg"
+  environment = fission_environment.python.name
+  source_dir  = "${path.module}/code"
+}
+
+resource "fission_function" "fn" {
+  name         = "tf-bad-entry-fn"
+  environment  = fission_environment.python.name
+  package_name = fission_package.pkg.name
+  entrypoint   = "main.nonexistent_function"  # Wrong entrypoint
+}
+
+resource "fission_http_trigger" "route" {
+  name     = "tf-bad-entry-route"
+  url      = "/bad-entrypoint"
+  methods  = ["GET"]
+  function = fission_function.fn.name
+}
diff --git a/examples/deep-recursion/code/main.py b/examples/deep-recursion/code/main.py
new file mode 100644
index 0000000..6cf6d29
--- /dev/null
+++ b/examples/deep-recursion/code/main.py
@@ -0,0 +1,7 @@
+def fib(n):
+    if n <= 1:
+        return n
+    return fib(n-1) + fib(n-2)
+
+def main():
+    return f"fib(100)={fib(100)}"
diff --git a/examples/deep-recursion/main.tf b/examples/deep-recursion/main.tf
new file mode 100644
index 0000000..b8fc547
--- /dev/null
+++ b/examples/deep-recursion/main.tf
@@ -0,0 +1,39 @@
+terraform {
+  required_providers {
+    fission = {
+      source  = "nail/fission"
+      version = "~> 0.1.0"
+    }
+  }
+}
+
+provider "fission" {
+  kubeconfig_path = "/home/naeel/.kube/config"
+  namespace       = "default"
+}
+
+resource "fission_environment" "python" {
+  name    = "tf-deep-recursion-env"
+  image   = "ghcr.io/fission/python-env"
+  version = 3
+}
+
+resource "fission_package" "pkg" {
+  name        = "tf-deep-recursion-pkg"
+  environment = fission_environment.python.name
+  source_dir  = "${path.module}/code"
+}
+
+resource "fission_function" "fn" {
+  name         = "tf-deep-recursion-fn"
+  environment  = fission_environment.python.name
+  package_name = fission_package.pkg.name
+  entrypoint   = "main.main"
+}
+
+resource "fission_http_trigger" "route" {
+  name     = "tf-deep-recursion-route"
+  function = fission_function.fn.name
+  url      = "/deep-recursion"
+  methods  = ["GET"]
+}
diff --git a/examples/env-stress-1/code/main.py b/examples/env-stress-1/code/main.py
new file mode 100644
index 0000000..f0c9e06
--- /dev/null
+++ b/examples/env-stress-1/code/main.py
@@ -0,0 +1 @@
+def main(): return "env-1"
diff --git a/examples/env-stress-2/code/main.py b/examples/env-stress-2/code/main.py
new file mode 100644
index 0000000..b293647
--- /dev/null
+++ b/examples/env-stress-2/code/main.py
@@ -0,0 +1 @@
+def main(): return "env-2"
diff --git a/examples/env-stress-3/code/main.py b/examples/env-stress-3/code/main.py
new file mode 100644
index 0000000..3578e5e
--- /dev/null
+++ b/examples/env-stress-3/code/main.py
@@ -0,0 +1 @@
+def main(): return "env-3"
diff --git a/examples/env-stress-4/code/main.py b/examples/env-stress-4/code/main.py
new file mode 100644
index 0000000..8ba370f
--- /dev/null
+++ b/examples/env-stress-4/code/main.py
@@ -0,0 +1 @@
+def main(): return "env-4"
diff --git a/examples/env-stress-5/code/main.py b/examples/env-stress-5/code/main.py
new file mode 100644
index 0000000..f1c5f9c
--- /dev/null
+++ b/examples/env-stress-5/code/main.py
@@ -0,0 +1 @@
+def main(): return "env-5"
diff --git a/examples/frequent-update/code/main.py b/examples/frequent-update/code/main.py
new file mode 100644
index 0000000..f30a426
--- /dev/null
+++ b/examples/frequent-update/code/main.py
@@ -0,0 +1 @@
+def main(): return "v10"
diff --git a/examples/frequent-update/main.tf b/examples/frequent-update/main.tf
new file mode 100644
index 0000000..562dbc1
--- /dev/null
+++ b/examples/frequent-update/main.tf
@@ -0,0 +1,39 @@
+terraform {
+  required_providers {
+    fission = {
+      source  = "nail/fission"
+      version = "~> 0.1.0"
+    }
+  }
+}
+
+provider "fission" {
+  kubeconfig_path = "/home/naeel/.kube/config"
+  namespace       = "default"
+}
+
+resource "fission_environment" "python" {
+  name    = "tf-freq-update-env"
+  image   = "ghcr.io/fission/python-env"
+  version = 3
+}
+
+resource "fission_package" "pkg" {
+  name        = "tf-freq-update-pkg"
+  environment = fission_environment.python.name
+  source_dir  = "${path.module}/code"
+}
+
+resource "fission_function" "fn" {
+  name         = "tf-freq-update-fn"
+  environment  = fission_environment.python.name
+  package_name = fission_package.pkg.name
+  entrypoint   = "main.main"
+}
+
+resource "fission_http_trigger" "route" {
+  name     = "tf-freq-update-route"
+  function = fission_function.fn.name
+  url      = "/freq-update"
+  methods  = ["GET"]
+}
diff --git a/examples/invalid-manifest/code/main.py b/examples/invalid-manifest/code/main.py
new file mode 100644
index 0000000..64d722b
--- /dev/null
+++ b/examples/invalid-manifest/code/main.py
@@ -0,0 +1,2 @@
+def main():
+    return "test"
diff --git a/examples/invalid-manifest/main.tf b/examples/invalid-manifest/main.tf
new file mode 100644
index 0000000..e2de694
--- /dev/null
+++ b/examples/invalid-manifest/main.tf
@@ -0,0 +1,33 @@
+terraform {
+  required_providers {
+    fission = {
+      source  = "nail/fission"
+      version = "~> 0.1.0"
+    }
+  }
+}
+
+provider "fission" {
+  kubeconfig_path = "/home/naeel/.kube/config"
+  namespace       = "default"
+}
+
+# Missing image — should fail
+resource "fission_environment" "bad_env" {
+  name    = "tf-invalid-env"
+  # image   = "..."  # MISSING REQUIRED FIELD
+  version = 3
+}
+
+resource "fission_package" "pkg" {
+  name        = "tf-invalid-pkg"
+  environment = fission_environment.bad_env.name
+  source_dir  = "${path.module}/code"
+}
+
+resource "fission_function" "fn" {
+  name         = "tf-invalid-fn"
+  environment  = fission_environment.bad_env.name
+  package_name = fission_package.pkg.name
+  entrypoint   = "main.main"
+}
diff --git a/examples/missing-ref/code/main.py b/examples/missing-ref/code/main.py
new file mode 100644
index 0000000..64d722b
--- /dev/null
+++ b/examples/missing-ref/code/main.py
@@ -0,0 +1,2 @@
+def main():
+    return "test"
diff --git a/examples/missing-ref/main.tf b/examples/missing-ref/main.tf
new file mode 100644
index 0000000..119bbfe
--- /dev/null
+++ b/examples/missing-ref/main.tf
@@ -0,0 +1,20 @@
+terraform {
+  required_providers {
+    fission = {
+      source  = "nail/fission"
+      version = "~> 0.1.0"
+    }
+  }
+}
+
+provider "fission" {
+  kubeconfig_path = "/home/naeel/.kube/config"
+  namespace       = "default"
+}
+
+resource "fission_http_trigger" "route" {
+  name     = "tf-missing-ref-route"
+  url      = "/missing-ref"
+  methods  = ["GET"]
+  function = "tf-missing-ref-fn"
+}
diff --git a/examples/multi-env-1/code/main.py b/examples/multi-env-1/code/main.py
new file mode 100644
index 0000000..c0af74c
--- /dev/null
+++ b/examples/multi-env-1/code/main.py
@@ -0,0 +1,2 @@
+def main():
+    return "env-1"
diff --git a/examples/multi-env-2/code/main.py b/examples/multi-env-2/code/main.py
new file mode 100644
index 0000000..28241dd
--- /dev/null
+++ b/examples/multi-env-2/code/main.py
@@ -0,0 +1,2 @@
+def main():
+    return "env-2"
diff --git a/examples/multi-env-3/code/main.py b/examples/multi-env-3/code/main.py
new file mode 100644
index 0000000..4d8bd64
--- /dev/null
+++ b/examples/multi-env-3/code/main.py
@@ -0,0 +1,2 @@
+def main():
+    return "env-3"
diff --git a/examples/neg-tests/bad-import/code/main.py b/examples/neg-tests/bad-import/code/main.py
new file mode 100644
index 0000000..b5b5ff0
--- /dev/null
+++ b/examples/neg-tests/bad-import/code/main.py
@@ -0,0 +1,4 @@
+import nonexistent_module_xyz_12345
+
+def main():
+    return nonexistent_module_xyz_12345.do_something()
diff --git a/examples/neg-tests/bad-import/main.tf b/examples/neg-tests/bad-import/main.tf
new file mode 100644
index 0000000..1c2e4d2
--- /dev/null
+++ b/examples/neg-tests/bad-import/main.tf
@@ -0,0 +1,39 @@
+terraform {
+  required_providers {
+    fission = {
+      source  = "nail/fission"
+      version = "~> 0.1.0"
+    }
+  }
+}
+
+provider "fission" {
+  kubeconfig_path = "/home/naeel/.kube/config"
+  namespace       = "default"
+}
+
+resource "fission_environment" "python" {
+  name    = "tf-neg-badimport-env"
+  image   = "ghcr.io/fission/python-env"
+  version = 3
+}
+
+resource "fission_package" "pkg" {
+  name        = "tf-neg-badimport-pkg"
+  environment = fission_environment.python.name
+  source_dir  = "${path.module}/code"
+}
+
+resource "fission_function" "fn" {
+  name         = "tf-neg-badimport-fn"
+  environment  = fission_environment.python.name
+  package_name = fission_package.pkg.name
+  entrypoint   = "main.main"
+}
+
+resource "fission_http_trigger" "route" {
+  name     = "tf-neg-badimport-route"
+  function = fission_function.fn.name
+  url      = "/neg/badimport"
+  methods  = ["GET"]
+}
diff --git a/examples/neg-tests/name-conflict/main.tf b/examples/neg-tests/name-conflict/main.tf
new file mode 100644
index 0000000..7b83e62
--- /dev/null
+++ b/examples/neg-tests/name-conflict/main.tf
@@ -0,0 +1,20 @@
+terraform {
+  required_providers {
+    fission = {
+      source  = "nail/fission"
+      version = "~> 0.1.0"
+    }
+  }
+}
+
+provider "fission" {
+  kubeconfig_path = "/home/naeel/.kube/config"
+  namespace       = "default"
+}
+
+# Пытаемся создать environment с именем, которое уже существует (tf-python-env из hello-python)
+resource "fission_environment" "conflict" {
+  name    = "tf-python-env"
+  image   = "ghcr.io/fission/python-env"
+  version = 3
+}
diff --git a/examples/neg-tests/no-main/code/main.py b/examples/neg-tests/no-main/code/main.py
new file mode 100644
index 0000000..59edbae
--- /dev/null
+++ b/examples/neg-tests/no-main/code/main.py
@@ -0,0 +1,2 @@
+def not_main():
+    return "there is no main() here, Fission will fail to invoke"
diff --git a/examples/neg-tests/no-main/main.tf b/examples/neg-tests/no-main/main.tf
new file mode 100644
index 0000000..19cf176
--- /dev/null
+++ b/examples/neg-tests/no-main/main.tf
@@ -0,0 +1,39 @@
+terraform {
+  required_providers {
+    fission = {
+      source  = "nail/fission"
+      version = "~> 0.1.0"
+    }
+  }
+}
+
+provider "fission" {
+  kubeconfig_path = "/home/naeel/.kube/config"
+  namespace       = "default"
+}
+
+resource "fission_environment" "python" {
+  name    = "tf-neg-nomain-env"
+  image   = "ghcr.io/fission/python-env"
+  version = 3
+}
+
+resource "fission_package" "pkg" {
+  name        = "tf-neg-nomain-pkg"
+  environment = fission_environment.python.name
+  source_dir  = "${path.module}/code"
+}
+
+resource "fission_function" "fn" {
+  name         = "tf-neg-nomain-fn"
+  environment  = fission_environment.python.name
+  package_name = fission_package.pkg.name
+  entrypoint   = "main.main"
+}
+
+resource "fission_http_trigger" "route" {
+  name     = "tf-neg-nomain-route"
+  function = fission_function.fn.name
+  url      = "/neg/nomain"
+  methods  = ["GET"]
+}
diff --git a/examples/neg-tests/runtime-error/code/main.py b/examples/neg-tests/runtime-error/code/main.py
new file mode 100644
index 0000000..17b16d2
--- /dev/null
+++ b/examples/neg-tests/runtime-error/code/main.py
@@ -0,0 +1,3 @@
+def main():
+    x = 1 / 0
+    return f"result: {x}"
diff --git a/examples/neg-tests/runtime-error/main.tf b/examples/neg-tests/runtime-error/main.tf
new file mode 100644
index 0000000..6f6805a
--- /dev/null
+++ b/examples/neg-tests/runtime-error/main.tf
@@ -0,0 +1,39 @@
+terraform {
+  required_providers {
+    fission = {
+      source  = "nail/fission"
+      version = "~> 0.1.0"
+    }
+  }
+}
+
+provider "fission" {
+  kubeconfig_path = "/home/naeel/.kube/config"
+  namespace       = "default"
+}
+
+resource "fission_environment" "python" {
+  name    = "tf-neg-rterr-env"
+  image   = "ghcr.io/fission/python-env"
+  version = 3
+}
+
+resource "fission_package" "pkg" {
+  name        = "tf-neg-rterr-pkg"
+  environment = fission_environment.python.name
+  source_dir  = "${path.module}/code"
+}
+
+resource "fission_function" "fn" {
+  name         = "tf-neg-rterr-fn"
+  environment  = fission_environment.python.name
+  package_name = fission_package.pkg.name
+  entrypoint   = "main.main"
+}
+
+resource "fission_http_trigger" "route" {
+  name     = "tf-neg-rterr-route"
+  function = fission_function.fn.name
+  url      = "/neg/rterr"
+  methods  = ["GET"]
+}
diff --git a/examples/neg-tests/syntax-error/code/main.py b/examples/neg-tests/syntax-error/code/main.py
new file mode 100644
index 0000000..13c982a
--- /dev/null
+++ b/examples/neg-tests/syntax-error/code/main.py
@@ -0,0 +1,2 @@
+def main(:
+    return "this should never work"
diff --git a/examples/neg-tests/syntax-error/main.tf b/examples/neg-tests/syntax-error/main.tf
new file mode 100644
index 0000000..6c6874a
--- /dev/null
+++ b/examples/neg-tests/syntax-error/main.tf
@@ -0,0 +1,39 @@
+terraform {
+  required_providers {
+    fission = {
+      source  = "nail/fission"
+      version = "~> 0.1.0"
+    }
+  }
+}
+
+provider "fission" {
+  kubeconfig_path = "/home/naeel/.kube/config"
+  namespace       = "default"
+}
+
+resource "fission_environment" "python" {
+  name    = "tf-neg-syntax-env"
+  image   = "ghcr.io/fission/python-env"
+  version = 3
+}
+
+resource "fission_package" "pkg" {
+  name        = "tf-neg-syntax-pkg"
+  environment = fission_environment.python.name
+  source_dir  = "${path.module}/code"
+}
+
+resource "fission_function" "fn" {
+  name         = "tf-neg-syntax-fn"
+  environment  = fission_environment.python.name
+  package_name = fission_package.pkg.name
+  entrypoint   = "main.main"
+}
+
+resource "fission_http_trigger" "route" {
+  name     = "tf-neg-syntax-route"
+  function = fission_function.fn.name
+  url      = "/neg/syntax"
+  methods  = ["GET"]
+}
diff --git a/examples/orphan-test/code/main.py b/examples/orphan-test/code/main.py
new file mode 100644
index 0000000..e8407a3
--- /dev/null
+++ b/examples/orphan-test/code/main.py
@@ -0,0 +1,2 @@
+def main():
+    return "orphan-test"
diff --git a/examples/orphan-test/main.tf b/examples/orphan-test/main.tf
new file mode 100644
index 0000000..1a620a7
--- /dev/null
+++ b/examples/orphan-test/main.tf
@@ -0,0 +1,39 @@
+terraform {
+  required_providers {
+    fission = {
+      source  = "nail/fission"
+      version = "~> 0.1.0"
+    }
+  }
+}
+
+provider "fission" {
+  kubeconfig_path = "/home/naeel/.kube/config"
+  namespace       = "default"
+}
+
+resource "fission_environment" "python" {
+  name    = "tf-orphan-env"
+  image   = "ghcr.io/fission/python-env"
+  version = 3
+}
+
+resource "fission_package" "pkg" {
+  name        = "tf-orphan-pkg"
+  environment = fission_environment.python.name
+  source_dir  = "${path.module}/code"
+}
+
+resource "fission_function" "fn" {
+  name         = "tf-orphan-fn"
+  environment  = fission_environment.python.name
+  package_name = fission_package.pkg.name
+  entrypoint   = "main.main"
+}
+
+resource "fission_http_trigger" "route" {
+  name     = "tf-orphan-route"
+  function = fission_function.fn.name
+  url      = "/orphan-test"
+  methods  = ["GET"]
+}
diff --git a/examples/validate-bad-entrypoint/code/main.py b/examples/validate-bad-entrypoint/code/main.py
new file mode 100644
index 0000000..41f6d95
--- /dev/null
+++ b/examples/validate-bad-entrypoint/code/main.py
@@ -0,0 +1,2 @@
+def exists():
+    return "x"
diff --git a/examples/validate-bad-entrypoint/main.tf b/examples/validate-bad-entrypoint/main.tf
new file mode 100644
index 0000000..8779a8e
--- /dev/null
+++ b/examples/validate-bad-entrypoint/main.tf
@@ -0,0 +1,32 @@
+terraform {
+  required_providers {
+    fission = {
+      source  = "nail/fission"
+      version = "~> 0.1.0"
+    }
+  }
+}
+
+provider "fission" {
+  kubeconfig_path = "/home/naeel/.kube/config"
+  namespace       = "default"
+}
+
+resource "fission_environment" "env" {
+  name    = "tf-validate-bad-entry-env"
+  image   = "ghcr.io/fission/python-env"
+  version = 3
+}
+
+resource "fission_package" "pkg" {
+  name        = "tf-validate-bad-entry-pkg"
+  environment = fission_environment.env.name
+  source_dir  = "${path.module}/code"
+}
+
+resource "fission_function" "fn" {
+  name         = "tf-validate-bad-entry-fn"
+  environment  = fission_environment.env.name
+  package_name = fission_package.pkg.name
+  entrypoint   = "main.main"
+}
diff --git a/examples/validate-missing-env/code/main.py b/examples/validate-missing-env/code/main.py
new file mode 100644
index 0000000..8689aea
--- /dev/null
+++ b/examples/validate-missing-env/code/main.py
@@ -0,0 +1,2 @@
+def main():
+    return "x"
diff --git a/examples/validate-missing-env/main.tf b/examples/validate-missing-env/main.tf
new file mode 100644
index 0000000..16e50e3
--- /dev/null
+++ b/examples/validate-missing-env/main.tf
@@ -0,0 +1,19 @@
+terraform {
+  required_providers {
+    fission = {
+      source  = "nail/fission"
+      version = "~> 0.1.0"
+    }
+  }
+}
+
+provider "fission" {
+  kubeconfig_path = "/home/naeel/.kube/config"
+  namespace       = "default"
+}
+
+resource "fission_package" "pkg" {
+  name        = "tf-validate-missing-env-pkg"
+  environment = "env-does-not-exist-xyz"
+  source_dir  = "${path.module}/code"
+}
diff --git a/terraform/provider/internal/resources/environment_resource.go b/terraform/provider/internal/resources/environment_resource.go
index 875329c..899e998 100644
--- a/terraform/provider/internal/resources/environment_resource.go
+++ b/terraform/provider/internal/resources/environment_resource.go
@@ -24,13 +24,15 @@ type EnvironmentResource struct {
 }
 
 type environmentResourceModel struct {
-	ID        types.String `tfsdk:"id"`
-	Name      types.String `tfsdk:"name"`
-	Image     types.String `tfsdk:"image"`
-	Version   types.Int64  `tfsdk:"version"`
-	PoolSize  types.Int64  `tfsdk:"poolsize"`
-	Namespace types.String `tfsdk:"namespace"`
-	UID       types.String `tfsdk:"uid"`
+	ID             types.String `tfsdk:"id"`
+	Name           types.String `tfsdk:"name"`
+	Image          types.String `tfsdk:"image"`
+	Version        types.Int64  `tfsdk:"version"`
+	PoolSize       types.Int64  `tfsdk:"poolsize"`
+	BuilderImage   types.String `tfsdk:"builder_image"`
+	BuilderCommand types.String `tfsdk:"builder_command"`
+	Namespace      types.String `tfsdk:"namespace"`
+	UID            types.String `tfsdk:"uid"`
 }
 
 func NewEnvironmentResource() resource.Resource {
@@ -68,6 +70,14 @@ func (r *EnvironmentResource) Schema(_ context.Context, _ resource.SchemaRequest
 				Default:     int64default.StaticInt64(3),
 				Description: "Размер пула pre-warmed контейнеров.",
 			},
+			"builder_image": schema.StringAttribute{
+				Optional:    true,
+				Description: "Builder image для Environment (например ghcr.io/fission/go-builder). Нужен для языков с build step (Go и др.).",
+			},
+			"builder_command": schema.StringAttribute{
+				Optional:    true,
+				Description: "Команда сборки в builder контейнере (например 'build').",
+			},
 			"namespace": schema.StringAttribute{
 				Optional:    true,
 				Computed:    true,
@@ -216,6 +226,26 @@ func (r *EnvironmentResource) ImportState(ctx context.Context, req resource.Impo
 
 // environmentToUnstructured преобразует Terraform model в Kubernetes CRD payload.
 func environmentToUnstructured(model environmentResourceModel, namespace string) *unstructured.Unstructured {
+	spec := map[string]interface{}{
+		"version": model.Version.ValueInt64(),
+		"runtime": map[string]interface{}{
+			"image": model.Image.ValueString(),
+		},
+		"poolsize": model.PoolSize.ValueInt64(),
+	}
+
+	builderImage := model.BuilderImage.ValueString()
+	if builderImage != "" {
+		builder := map[string]interface{}{
+			"image": builderImage,
+		}
+		builderCmd := model.BuilderCommand.ValueString()
+		if builderCmd != "" {
+			builder["command"] = builderCmd
+		}
+		spec["builder"] = builder
+	}
+
 	return &unstructured.Unstructured{Object: map[string]interface{}{
 		"apiVersion": "fission.io/v1",
 		"kind":       "Environment",
@@ -223,13 +253,7 @@ func environmentToUnstructured(model environmentResourceModel, namespace string)
 			"name":      model.Name.ValueString(),
 			"namespace": namespace,
 		},
-		"spec": map[string]interface{}{
-			"version": model.Version.ValueInt64(),
-			"runtime": map[string]interface{}{
-				"image": model.Image.ValueString(),
-			},
-			"poolsize": model.PoolSize.ValueInt64(),
-		},
+		"spec": spec,
 	}}
 }
 
@@ -238,6 +262,8 @@ func unstructuredToEnvironmentModel(environmentObject *unstructured.Unstructured
 	imageValue, _, _ := unstructured.NestedString(environmentObject.Object, "spec", "runtime", "image")
 	versionValue, _, _ := unstructured.NestedInt64(environmentObject.Object, "spec", "version")
 	poolsizeValue, _, _ := unstructured.NestedInt64(environmentObject.Object, "spec", "poolsize")
+	builderImage, _, _ := unstructured.NestedString(environmentObject.Object, "spec", "builder", "image")
+	builderCommand, _, _ := unstructured.NestedString(environmentObject.Object, "spec", "builder", "command")
 
 	state := base
 	state.Name = types.StringValue(environmentObject.GetName())
@@ -254,6 +280,12 @@ func unstructuredToEnvironmentModel(environmentObject *unstructured.Unstructured
 	if poolsizeValue != 0 {
 		state.PoolSize = types.Int64Value(poolsizeValue)
 	}
+	if builderImage != "" {
+		state.BuilderImage = types.StringValue(builderImage)
+	}
+	if builderCommand != "" {
+		state.BuilderCommand = types.StringValue(builderCommand)
+	}
 
 	return state
 }
diff --git a/terraform/provider/internal/resources/environment_resource_test.go b/terraform/provider/internal/resources/environment_resource_test.go
index 33ebb44..ab7f6c2 100644
--- a/terraform/provider/internal/resources/environment_resource_test.go
+++ b/terraform/provider/internal/resources/environment_resource_test.go
@@ -4,6 +4,7 @@ import (
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-framework/types"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 )
 
 func TestEnvironmentToUnstructuredAndBack(t *testing.T) {
@@ -33,3 +34,51 @@ func TestEnvironmentToUnstructuredAndBack(t *testing.T) {
 		t.Fatalf("unexpected poolsize: %d", state.PoolSize.ValueInt64())
 	}
 }
+
+func TestEnvironmentToUnstructuredWithBuilder(t *testing.T) {
+	input := environmentResourceModel{
+		Name:           types.StringValue("go-env"),
+		Image:          types.StringValue("ghcr.io/fission/go-env"),
+		Version:        types.Int64Value(3),
+		PoolSize:       types.Int64Value(3),
+		BuilderImage:   types.StringValue("ghcr.io/fission/go-builder"),
+		BuilderCommand: types.StringValue("build"),
+	}
+
+	obj := environmentToUnstructured(input, "default")
+	state := unstructuredToEnvironmentModel(obj, input)
+
+	if state.BuilderImage.ValueString() != "ghcr.io/fission/go-builder" {
+		t.Fatalf("unexpected builder_image: %q", state.BuilderImage.ValueString())
+	}
+	if state.BuilderCommand.ValueString() != "build" {
+		t.Fatalf("unexpected builder_command: %q", state.BuilderCommand.ValueString())
+	}
+
+	// Verify the unstructured object has builder section
+	builderImage, found, _ := unstructured.NestedString(obj.Object, "spec", "builder", "image")
+	if !found || builderImage != "ghcr.io/fission/go-builder" {
+		t.Fatalf("builder.image not set correctly in unstructured: %q", builderImage)
+	}
+	builderCmd, found, _ := unstructured.NestedString(obj.Object, "spec", "builder", "command")
+	if !found || builderCmd != "build" {
+		t.Fatalf("builder.command not set correctly in unstructured: %q", builderCmd)
+	}
+}
+
+func TestEnvironmentToUnstructuredWithoutBuilder(t *testing.T) {
+	input := environmentResourceModel{
+		Name:     types.StringValue("py-env"),
+		Image:    types.StringValue("ghcr.io/fission/python-env"),
+		Version:  types.Int64Value(3),
+		PoolSize: types.Int64Value(3),
+	}
+
+	obj := environmentToUnstructured(input, "default")
+
+	// Verify no builder section when builder_image is not set
+	_, found, _ := unstructured.NestedString(obj.Object, "spec", "builder", "image")
+	if found {
+		t.Fatalf("builder should not be present when builder_image is not set")
+	}
+}
diff --git a/terraform/provider/internal/resources/function_resource.go b/terraform/provider/internal/resources/function_resource.go
index 09124c2..a2abdd7 100644
--- a/terraform/provider/internal/resources/function_resource.go
+++ b/terraform/provider/internal/resources/function_resource.go
@@ -9,6 +9,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringdefault"
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 
@@ -26,13 +27,18 @@ type FunctionResource struct {
 
 // functionResourceModel описывает состояние terraform ресурса fission_function.
 type functionResourceModel struct {
-	ID          types.String `tfsdk:"id"`
-	Name        types.String `tfsdk:"name"`
-	Environment types.String `tfsdk:"environment"`
-	PackageName types.String `tfsdk:"package_name"`
-	Entrypoint  types.String `tfsdk:"entrypoint"`
-	Namespace   types.String `tfsdk:"namespace"`
-	UID         types.String `tfsdk:"uid"`
+	ID              types.String `tfsdk:"id"`
+	Name            types.String `tfsdk:"name"`
+	Environment     types.String `tfsdk:"environment"`
+	PackageName     types.String `tfsdk:"package_name"`
+	Entrypoint      types.String `tfsdk:"entrypoint"`
+	ExecutorType    types.String `tfsdk:"executor_type"`
+	FunctionTimeout types.Int64  `tfsdk:"function_timeout"`
+	IdleTimeout     types.Int64  `tfsdk:"idle_timeout"`
+	MinScale        types.Int64  `tfsdk:"min_scale"`
+	MaxScale        types.Int64  `tfsdk:"max_scale"`
+	Namespace       types.String `tfsdk:"namespace"`
+	UID             types.String `tfsdk:"uid"`
 }
 
 // NewFunctionResource создает инстанс ресурса функции.
@@ -69,6 +75,28 @@ func (r *FunctionResource) Schema(_ context.Context, _ resource.SchemaRequest, r
 				Required:    true,
 				Description: "Имя точки входа в пакете (например main.main).",
 			},
+			"executor_type": schema.StringAttribute{
+				Optional:    true,
+				Computed:    true,
+				Default:     stringdefault.StaticString("poolmgr"),
+				Description: "Тип executor: poolmgr (default), newdeploy или container.",
+			},
+			"function_timeout": schema.Int64Attribute{
+				Optional:    true,
+				Description: "Таймаут выполнения функции в секундах (Fission default: 60).",
+			},
+			"idle_timeout": schema.Int64Attribute{
+				Optional:    true,
+				Description: "Время простоя до scale-to-zero в секундах (Fission default: 120).",
+			},
+			"min_scale": schema.Int64Attribute{
+				Optional:    true,
+				Description: "Минимальное число реплик (для newdeploy/container).",
+			},
+			"max_scale": schema.Int64Attribute{
+				Optional:    true,
+				Description: "Максимальное число реплик (для newdeploy/container).",
+			},
 			"namespace": schema.StringAttribute{
 				Optional:    true,
 				Computed:    true,
@@ -235,6 +263,46 @@ func (r *FunctionResource) ImportState(ctx context.Context, req resource.ImportS
 
 // functionToUnstructured преобразует Terraform model в Kubernetes CRD payload.
 func functionToUnstructured(model functionResourceModel, namespace string) *unstructured.Unstructured {
+	executorType := "poolmgr"
+	if !model.ExecutorType.IsNull() && !model.ExecutorType.IsUnknown() && model.ExecutorType.ValueString() != "" {
+		executorType = model.ExecutorType.ValueString()
+	}
+
+	executionStrategy := map[string]interface{}{
+		"ExecutorType": executorType,
+	}
+	if !model.MinScale.IsNull() && !model.MinScale.IsUnknown() {
+		executionStrategy["MinScale"] = model.MinScale.ValueInt64()
+	}
+	if !model.MaxScale.IsNull() && !model.MaxScale.IsUnknown() {
+		executionStrategy["MaxScale"] = model.MaxScale.ValueInt64()
+	}
+
+	spec := map[string]interface{}{
+		"environment": map[string]interface{}{
+			"name":      model.Environment.ValueString(),
+			"namespace": namespace,
+		},
+		"InvokeStrategy": map[string]interface{}{
+			"ExecutionStrategy": executionStrategy,
+			"StrategyType":      "execution",
+		},
+		"package": map[string]interface{}{
+			"packageref": map[string]interface{}{
+				"name":      model.PackageName.ValueString(),
+				"namespace": namespace,
+			},
+			"functionName": model.Entrypoint.ValueString(),
+		},
+	}
+
+	if !model.FunctionTimeout.IsNull() && !model.FunctionTimeout.IsUnknown() {
+		spec["functionTimeout"] = model.FunctionTimeout.ValueInt64()
+	}
+	if !model.IdleTimeout.IsNull() && !model.IdleTimeout.IsUnknown() {
+		spec["idletimeout"] = model.IdleTimeout.ValueInt64()
+	}
+
 	return &unstructured.Unstructured{Object: map[string]interface{}{
 		"apiVersion": "fission.io/v1",
 		"kind":       "Function",
@@ -242,25 +310,7 @@ func functionToUnstructured(model functionResourceModel, namespace string) *unst
 			"name":      model.Name.ValueString(),
 			"namespace": namespace,
 		},
-		"spec": map[string]interface{}{
-			"environment": map[string]interface{}{
-				"name":      model.Environment.ValueString(),
-				"namespace": namespace,
-			},
-			"InvokeStrategy": map[string]interface{}{
-				"ExecutionStrategy": map[string]interface{}{
-					"ExecutorType": "poolmgr",
-				},
-				"StrategyType": "execution",
-			},
-			"package": map[string]interface{}{
-				"packageref": map[string]interface{}{
-					"name":      model.PackageName.ValueString(),
-					"namespace": namespace,
-				},
-				"functionName": model.Entrypoint.ValueString(),
-			},
-		},
+		"spec": spec,
 	}}
 }
 
@@ -269,6 +319,11 @@ func unstructuredToFunctionModel(functionObject *unstructured.Unstructured, base
 	environmentName, _, _ := unstructured.NestedString(functionObject.Object, "spec", "environment", "name")
 	packageName, _, _ := unstructured.NestedString(functionObject.Object, "spec", "package", "packageref", "name")
 	entrypoint, _, _ := unstructured.NestedString(functionObject.Object, "spec", "package", "functionName")
+	executorType, _, _ := unstructured.NestedString(functionObject.Object, "spec", "InvokeStrategy", "ExecutionStrategy", "ExecutorType")
+	functionTimeout, foundFT, _ := unstructured.NestedInt64(functionObject.Object, "spec", "functionTimeout")
+	idleTimeout, foundIT, _ := unstructured.NestedInt64(functionObject.Object, "spec", "idletimeout")
+	minScale, foundMin, _ := unstructured.NestedInt64(functionObject.Object, "spec", "InvokeStrategy", "ExecutionStrategy", "MinScale")
+	maxScale, foundMax, _ := unstructured.NestedInt64(functionObject.Object, "spec", "InvokeStrategy", "ExecutionStrategy", "MaxScale")
 
 	state := base
 	state.Name = types.StringValue(functionObject.GetName())
@@ -285,6 +340,21 @@ func unstructuredToFunctionModel(functionObject *unstructured.Unstructured, base
 	if entrypoint != "" {
 		state.Entrypoint = types.StringValue(entrypoint)
 	}
+	if executorType != "" {
+		state.ExecutorType = types.StringValue(executorType)
+	}
+	if foundFT {
+		state.FunctionTimeout = types.Int64Value(functionTimeout)
+	}
+	if foundIT {
+		state.IdleTimeout = types.Int64Value(idleTimeout)
+	}
+	if foundMin {
+		state.MinScale = types.Int64Value(minScale)
+	}
+	if foundMax {
+		state.MaxScale = types.Int64Value(maxScale)
+	}
 
 	return state
 }
diff --git a/terraform/provider/internal/resources/function_resource_test.go b/terraform/provider/internal/resources/function_resource_test.go
index 88ff0ed..ac7b55f 100644
--- a/terraform/provider/internal/resources/function_resource_test.go
+++ b/terraform/provider/internal/resources/function_resource_test.go
@@ -31,6 +31,9 @@ func TestFunctionToUnstructuredAndBack(t *testing.T) {
 	if state.Entrypoint.ValueString() != "main.main" {
 		t.Fatalf("unexpected entrypoint: %q", state.Entrypoint.ValueString())
 	}
+	if state.ExecutorType.ValueString() != "poolmgr" {
+		t.Fatalf("unexpected executor_type: %q", state.ExecutorType.ValueString())
+	}
 
 	invoke, found, err := unstructured.NestedMap(obj.Object, "spec", "InvokeStrategy")
 	if err != nil || !found || len(invoke) == 0 {
@@ -38,6 +41,45 @@ func TestFunctionToUnstructuredAndBack(t *testing.T) {
 	}
 }
 
+func TestFunctionToUnstructuredWithTimeouts(t *testing.T) {
+	input := functionResourceModel{
+		Name:            types.StringValue("fn-b"),
+		Environment:     types.StringValue("env-a"),
+		PackageName:     types.StringValue("pkg-a"),
+		Entrypoint:      types.StringValue("main.main"),
+		ExecutorType:    types.StringValue("newdeploy"),
+		FunctionTimeout: types.Int64Value(120),
+		IdleTimeout:     types.Int64Value(60),
+		MinScale:        types.Int64Value(1),
+		MaxScale:        types.Int64Value(5),
+	}
+
+	obj := functionToUnstructured(input, "default")
+	state := unstructuredToFunctionModel(obj, input)
+
+	if state.ExecutorType.ValueString() != "newdeploy" {
+		t.Fatalf("unexpected executor_type: %q", state.ExecutorType.ValueString())
+	}
+	if state.FunctionTimeout.ValueInt64() != 120 {
+		t.Fatalf("unexpected function_timeout: %d", state.FunctionTimeout.ValueInt64())
+	}
+	if state.IdleTimeout.ValueInt64() != 60 {
+		t.Fatalf("unexpected idle_timeout: %d", state.IdleTimeout.ValueInt64())
+	}
+	if state.MinScale.ValueInt64() != 1 {
+		t.Fatalf("unexpected min_scale: %d", state.MinScale.ValueInt64())
+	}
+	if state.MaxScale.ValueInt64() != 5 {
+		t.Fatalf("unexpected max_scale: %d", state.MaxScale.ValueInt64())
+	}
+
+	// Verify executor type in unstructured
+	et, _, _ := unstructured.NestedString(obj.Object, "spec", "InvokeStrategy", "ExecutionStrategy", "ExecutorType")
+	if et != "newdeploy" {
+		t.Fatalf("unexpected ExecutorType in unstructured: %q", et)
+	}
+}
+
 func TestValidateEntrypointAgainstPackageSourcePythonOK(t *testing.T) {
 	source := "def main():\n    return 'ok'\n"
 	pkg := &unstructured.Unstructured{Object: map[string]interface{}{
diff --git a/terraform/provider/internal/resources/package_resource.go b/terraform/provider/internal/resources/package_resource.go
index d4d7105..0fea3cc 100644
--- a/terraform/provider/internal/resources/package_resource.go
+++ b/terraform/provider/internal/resources/package_resource.go
@@ -1,10 +1,13 @@
 package resources
 
 import (
+	"archive/zip"
+	"bytes"
 	"context"
 	"crypto/sha256"
 	"encoding/base64"
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 
@@ -12,6 +15,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringdefault"
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 
@@ -37,6 +41,7 @@ type packageResourceModel struct {
 	CodePath    types.String `tfsdk:"code_path"`
 	CodeHash    types.String `tfsdk:"code_hash"`
 	BuildCmd    types.String `tfsdk:"build_command"`
+	DeployType  types.String `tfsdk:"deploy_type"`
 	Namespace   types.String `tfsdk:"namespace"`
 	UID         types.String `tfsdk:"uid"`
 	BuildStatus types.String `tfsdk:"build_status"`
@@ -86,6 +91,12 @@ func (r *PackageResource) Schema(_ context.Context, _ resource.SchemaRequest, re
 				Optional:    true,
 				Description: "Команда сборки пакета в Fission.",
 			},
+			"deploy_type": schema.StringAttribute{
+				Optional:    true,
+				Computed:    true,
+				Default:     stringdefault.StaticString("literal"),
+				Description: "Тип деплоя: 'literal' (default) — код в deployment.literal, 'source' — код в source.literal (для Go и языков с build step).",
+			},
 			"namespace": schema.StringAttribute{
 				Optional:    true,
 				Computed:    true,
@@ -137,7 +148,7 @@ func (r *PackageResource) ModifyPlan(ctx context.Context, req resource.ModifyPla
 		return
 	}
 
-	literalBytes, err := loadPackageLiteral(plan.SourceDir.ValueString(), plan.CodePath.ValueString())
+	literalBytes, err := loadPackageContent(plan.SourceDir.ValueString(), plan.CodePath.ValueString(), plan.DeployType.ValueString())
 	if err != nil {
 		resp.Diagnostics.AddError("Ошибка чтения исходного кода пакета", err.Error())
 		return
@@ -183,7 +194,7 @@ func (r *PackageResource) Create(ctx context.Context, req resource.CreateRequest
 		return
 	}
 
-	literalBytes, err := loadPackageLiteral(plan.SourceDir.ValueString(), plan.CodePath.ValueString())
+	literalBytes, err := loadPackageContent(plan.SourceDir.ValueString(), plan.CodePath.ValueString(), plan.DeployType.ValueString())
 	if err != nil {
 		resp.Diagnostics.AddError("Ошибка чтения исходного кода пакета", err.Error())
 		return
@@ -246,7 +257,7 @@ func (r *PackageResource) Update(ctx context.Context, req resource.UpdateRequest
 		return
 	}
 
-	literalBytes, err := loadPackageLiteral(plan.SourceDir.ValueString(), plan.CodePath.ValueString())
+	literalBytes, err := loadPackageContent(plan.SourceDir.ValueString(), plan.CodePath.ValueString(), plan.DeployType.ValueString())
 	if err != nil {
 		resp.Diagnostics.AddError("Ошибка чтения исходного кода пакета", err.Error())
 		return
@@ -329,7 +340,7 @@ func resolveNamespace(resourceNamespace types.String, providerNamespace string)
 	return namespace
 }
 
-// loadPackageLiteral читает bytes для spec.deployment.literal.
+// loadPackageLiteral читает bytes для literal deployment (один файл).
 func loadPackageLiteral(sourceDir, codePath string) ([]byte, error) {
 	if sourceDir != "" {
 		mainFilePath, err := resolveMainSourceFile(sourceDir)
@@ -353,6 +364,57 @@ func loadPackageLiteral(sourceDir, codePath string) ([]byte, error) {
 	return literalBytes, nil
 }
 
+// loadPackageSourceArchive создает zip-архив из source_dir для builder pipeline.
+func loadPackageSourceArchive(sourceDir string) ([]byte, error) {
+	var buf bytes.Buffer
+	zipWriter := zip.NewWriter(&buf)
+
+	err := filepath.Walk(sourceDir, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if info.IsDir() {
+			return nil
+		}
+
+		relPath, err := filepath.Rel(sourceDir, path)
+		if err != nil {
+			return fmt.Errorf("compute relative path for %q: %w", path, err)
+		}
+
+		writer, err := zipWriter.Create(relPath)
+		if err != nil {
+			return fmt.Errorf("create zip entry %q: %w", relPath, err)
+		}
+
+		file, err := os.Open(path)
+		if err != nil {
+			return fmt.Errorf("open file %q: %w", path, err)
+		}
+		defer file.Close()
+
+		_, err = io.Copy(writer, file)
+		return err
+	})
+	if err != nil {
+		return nil, fmt.Errorf("zip source_dir %q: %w", sourceDir, err)
+	}
+
+	if err := zipWriter.Close(); err != nil {
+		return nil, fmt.Errorf("close zip writer: %w", err)
+	}
+
+	return buf.Bytes(), nil
+}
+
+// loadPackageContent загружает содержимое пакета в зависимости от deploy_type.
+func loadPackageContent(sourceDir, codePath, deployType string) ([]byte, error) {
+	if deployType == "source" && sourceDir != "" {
+		return loadPackageSourceArchive(sourceDir)
+	}
+	return loadPackageLiteral(sourceDir, codePath)
+}
+
 // resolveMainSourceFile выбирает основной файл исходника из source_dir.
 func resolveMainSourceFile(sourceDir string) (string, error) {
 	candidates := []string{"main.py", "main.js", "main.go", "main.php", "main.rb", "main.pl"}
@@ -371,6 +433,36 @@ func resolveMainSourceFile(sourceDir string) (string, error) {
 func packageToUnstructured(model packageResourceModel, namespace string, literalBytes []byte) *unstructured.Unstructured {
 	literalSource := base64.StdEncoding.EncodeToString(literalBytes)
 
+	deployType := "literal"
+	if !model.DeployType.IsNull() && !model.DeployType.IsUnknown() && model.DeployType.ValueString() != "" {
+		deployType = model.DeployType.ValueString()
+	}
+
+	spec := map[string]interface{}{
+		"environment": map[string]interface{}{
+			"name":      model.Environment.ValueString(),
+			"namespace": namespace,
+		},
+	}
+
+	if deployType == "source" {
+		// Source mode: код в spec.source (для builder pipeline — Go и др.)
+		spec["source"] = map[string]interface{}{
+			"type":    "literal",
+			"literal": literalSource,
+		}
+	} else {
+		// Literal/deployment mode: код в spec.deployment (Python, Node, PHP, Ruby, Perl)
+		spec["deployment"] = map[string]interface{}{
+			"type":    "literal",
+			"literal": literalSource,
+		}
+	}
+
+	if buildCommand := model.BuildCmd.ValueString(); buildCommand != "" {
+		spec["buildcmd"] = buildCommand
+	}
+
 	object := map[string]interface{}{
 		"apiVersion": "fission.io/v1",
 		"kind":       "Package",
@@ -378,21 +470,7 @@ func packageToUnstructured(model packageResourceModel, namespace string, literal
 			"name":      model.Name.ValueString(),
 			"namespace": namespace,
 		},
-		"spec": map[string]interface{}{
-			"deployment": map[string]interface{}{
-				"type":    "literal",
-				"literal": literalSource,
-			},
-			"environment": map[string]interface{}{
-				"name":      model.Environment.ValueString(),
-				"namespace": namespace,
-			},
-			"source": map[string]interface{}{},
-		},
-	}
-
-	if buildCommand := model.BuildCmd.ValueString(); buildCommand != "" {
-		_ = unstructured.SetNestedField(object, buildCommand, "spec", "buildcmd")
+		"spec": spec,
 	}
 
 	return &unstructured.Unstructured{Object: object}
@@ -405,6 +483,7 @@ func unstructuredToPackageModel(packageObject *unstructured.Unstructured, base p
 	buildStatus, _, _ := unstructured.NestedString(packageObject.Object, "status", "buildstatus")
 	buildLog, _, _ := unstructured.NestedString(packageObject.Object, "status", "buildlog")
 	deploymentLiteral, _, _ := unstructured.NestedString(packageObject.Object, "spec", "deployment", "literal")
+	sourceLiteral, _, _ := unstructured.NestedString(packageObject.Object, "spec", "source", "literal")
 
 	state := packageResourceModel{
 		ID:          types.StringValue(fmt.Sprintf("%s/%s", packageObject.GetNamespace(), packageObject.GetName())),
@@ -414,6 +493,7 @@ func unstructuredToPackageModel(packageObject *unstructured.Unstructured, base p
 		CodePath:    base.CodePath,
 		CodeHash:    base.CodeHash,
 		BuildCmd:    base.BuildCmd,
+		DeployType:  base.DeployType,
 		Namespace:   types.StringValue(packageObject.GetNamespace()),
 		UID:         types.StringValue(string(packageObject.GetUID())),
 		BuildStatus: types.StringNull(),
@@ -433,8 +513,13 @@ func unstructuredToPackageModel(packageObject *unstructured.Unstructured, base p
 		state.BuildLog = types.StringValue(buildLog)
 	}
 
-	if deploymentLiteral != "" {
-		if literalBytes, err := base64.StdEncoding.DecodeString(deploymentLiteral); err == nil {
+	// Определить hash из содержимого (deployment или source)
+	literalForHash := deploymentLiteral
+	if literalForHash == "" {
+		literalForHash = sourceLiteral
+	}
+	if literalForHash != "" {
+		if literalBytes, err := base64.StdEncoding.DecodeString(literalForHash); err == nil {
 			state.CodeHash = types.StringValue(calculateCodeHash(literalBytes))
 		}
 	}
diff --git a/terraform/provider/internal/resources/package_resource_test.go b/terraform/provider/internal/resources/package_resource_test.go
index 1ccd804..906d19f 100644
--- a/terraform/provider/internal/resources/package_resource_test.go
+++ b/terraform/provider/internal/resources/package_resource_test.go
@@ -1,6 +1,8 @@
 package resources
 
 import (
+	"archive/zip"
+	"bytes"
 	"context"
 	"crypto/sha256"
 	"encoding/base64"
@@ -104,6 +106,47 @@ func TestPackageToUnstructured(t *testing.T) {
 	if string(decoded) != "print('hi')" {
 		t.Fatalf("unexpected decoded literal: %q", string(decoded))
 	}
+
+	// Verify no empty source map is generated
+	_, sourceFound, _ := unstructured.NestedMap(obj.Object, "spec", "source")
+	if sourceFound {
+		t.Fatalf("empty source should not be present in deployment mode")
+	}
+}
+
+func TestPackageToUnstructuredSourceMode(t *testing.T) {
+	input := packageResourceModel{
+		Name:        types.StringValue("pkg-go"),
+		Environment: types.StringValue("go-env"),
+		DeployType:  types.StringValue("source"),
+		BuildCmd:    types.StringValue("build"),
+	}
+
+	obj := packageToUnstructured(input, "default", []byte("zip-content"))
+	sourceLiteral, found, err := unstructured.NestedString(obj.Object, "spec", "source", "literal")
+	if err != nil || !found {
+		t.Fatalf("source.literal not found")
+	}
+
+	decoded, err := base64.StdEncoding.DecodeString(sourceLiteral)
+	if err != nil {
+		t.Fatalf("decode source literal: %v", err)
+	}
+	if string(decoded) != "zip-content" {
+		t.Fatalf("unexpected source literal: %q", string(decoded))
+	}
+
+	// Verify no deployment section in source mode
+	_, deployFound, _ := unstructured.NestedMap(obj.Object, "spec", "deployment")
+	if deployFound {
+		t.Fatalf("deployment should not be present in source mode")
+	}
+
+	// Verify buildcmd is set
+	buildCmd, _, _ := unstructured.NestedString(obj.Object, "spec", "buildcmd")
+	if buildCmd != "build" {
+		t.Fatalf("unexpected buildcmd: %q", buildCmd)
+	}
 }
 
 func TestResolveNamespace(t *testing.T) {
@@ -179,3 +222,39 @@ func TestHTTPTriggerRoundTrip(t *testing.T) {
 		t.Fatalf("unexpected url: %q", state.URL.ValueString())
 	}
 }
+
+func TestLoadPackageSourceArchive(t *testing.T) {
+	tempDir := t.TempDir()
+	// Create multiple files to zip
+	files := map[string]string{
+		"main.go": "package main\n\nimport \"net/http\"\n\nfunc Handler(w http.ResponseWriter, r *http.Request) {}\n",
+		"go.mod":  "module example.com/fn\n\ngo 1.21\n",
+	}
+	for name, content := range files {
+		if err := os.WriteFile(filepath.Join(tempDir, name), []byte(content), 0o600); err != nil {
+			t.Fatalf("write %s: %v", name, err)
+		}
+	}
+
+	zipBytes, err := loadPackageSourceArchive(tempDir)
+	if err != nil {
+		t.Fatalf("loadPackageSourceArchive error: %v", err)
+	}
+
+	// Verify it's a valid zip
+	reader, err := zip.NewReader(bytes.NewReader(zipBytes), int64(len(zipBytes)))
+	if err != nil {
+		t.Fatalf("invalid zip: %v", err)
+	}
+
+	foundFiles := map[string]bool{}
+	for _, f := range reader.File {
+		foundFiles[f.Name] = true
+	}
+	if !foundFiles["main.go"] {
+		t.Fatalf("main.go not found in zip")
+	}
+	if !foundFiles["go.mod"] {
+		t.Fatalf("go.mod not found in zip")
+	}
+}