@lunora/container 0.0.0 → 1.0.0-alpha.1

package/dist/index.d.ts

@@ -0,0 +1,189 @@
+import { a as ContainerConfig, C as ContainerDefinition, b as ContainerImageSource, N as NormalizedContainerImage } from "./packem_shared/types.d-D2l2SYol.js";
+export type { B as BuildImageSource, c as ContainerInstanceType, d as ContainerRollout, e as CustomContainerInstanceType, f as NamedContainerInstanceType, R as RegistryImageSource } from "./packem_shared/types.d-D2l2SYol.js";
+/**
+* The `ctx.containers` action surface: typed handles over the `CONTAINER_*`
+* Durable Object namespace bindings the config layer reconciles.
+*
+* Deliberately structural (no `@cloudflare/containers` import): a Durable
+* Object namespace stub is all that is needed to route a request to a
+* container-enabled DO, so this module stays Node-safe and the test double
+* below can satisfy the exact same shape without a workerd runtime.
+*/
+/** Options for explicitly starting an instance (mirrors `@cloudflare/containers`). */
+interface ContainerStartOptions {
+  /** Override outbound internet access for this start. */
+  enableInternet?: boolean;
+  /** Override the container entrypoint. */
+  entrypoint?: string[];
+  /** Per-instance environment, merged over the definition's `env`/secrets. */
+  envVars?: Record<string, string>;
+  /** Metadata labels attached for metrics/observability. */
+  labels?: Record<string, string>;
+}
+/** A container instance's runtime state, as returned by `getState()`. Structural — the platform adds fields over time. */
+interface ContainerInstanceState {
+  [key: string]: unknown;
+  lastChange?: number;
+}
+/** What a handle needs from a Durable Object stub — `fetch` plus the optional lifecycle RPCs the container DO exposes. */
+interface ContainerStubLike {
+  destroy?: () => Promise<void>;
+  fetch: (input: Request) => Promise<Response>;
+  getState?: () => Promise<ContainerInstanceState>;
+  start?: (options?: ContainerStartOptions) => Promise<void>;
+  stop?: (signal?: number | string) => Promise<void>;
+}
+/** What the client needs from a Durable Object namespace binding. */
+interface ContainerNamespaceLike {
+  get: (id: unknown) => ContainerStubLike;
+  idFromName: (name: string) => unknown;
+}
+/** A handle on one container instance (one Durable Object). */
+interface ContainerHandle {
+  /**
+  * Send an HTTP (or WebSocket-upgrade) request to the container. A path
+  * string (`"/transcode"`) is resolved against a synthetic origin; a full
+  * `Request`/URL passes through unchanged.
+  */
+  fetch: (input: Request | string, init?: RequestInit) => Promise<Response>;
+}
+/**
+* A handle on a *named* instance (from `.get(name)`) — `fetch` plus explicit
+* lifecycle control. The per-entity pattern (a sandbox per user, a room per
+* game, a job runner per id) often needs to tear down or inspect the instance
+* rather than wait for `sleepAfter`, so these wrap the container DO's
+* `start`/`stop`/`destroy`/`getState`.
+*/
+interface ContainerInstanceHandle extends ContainerHandle {
+  /** Stop and discard the instance (its ephemeral disk is lost). */
+  destroy: () => Promise<void>;
+  /** Read the instance's current runtime state. */
+  getState: () => Promise<ContainerInstanceState>;
+  /** Explicitly start the instance, optionally with per-instance env/entrypoint. */
+  start: (options?: ContainerStartOptions) => Promise<void>;
+  /** Stop the instance (optionally with a signal); it can start again on the next request. */
+  stop: (signal?: number | string) => Promise<void>;
+}
+/** The per-definition accessor exposed as `ctx.containers.&lt;exportName>`. */
+interface ContainerAccessor {
+  /**
+  * A random instance from a fixed pool of `count` (defaults to the
+  * definition's `maxInstances`, else 3 — mirroring `getRandom` from
+  * `@cloudflare/containers`). For stateless, interchangeable workloads.
+  */
+  any: (count?: number) => ContainerHandle;
+  /** The instance for `name` — one container per entity (user, room, job…), with lifecycle control. */
+  get: (name: string) => ContainerInstanceHandle;
+  /**
+  * A resilient handle over the pool: each `fetch` picks a random instance and,
+  * on a thrown error or a retryable response (5xx by default), retries on a
+  * freshly-picked instance with exponential backoff. Until Cloudflare ships
+  * native autoscaling + health-aware routing this is the recommended way to
+  * call a stateless container pool — it rides over a single cold/unhealthy
+  * instance instead of failing the whole request.
+  *
+  * Because a retry re-issues the request, pass a **replayable** body — a path
+  * string plus an `init.body` string/`ArrayBuffer` (re-created each attempt).
+  * A pre-built `Request` carrying a stream body can only be sent once, so it
+  * is not retry-safe here; use `.get()`/`.any()` for those.
+  */
+  pool: (options?: PoolOptions) => ContainerHandle;
+}
+/** Tuning for a pooled, retrying container handle. See {@link ContainerAccessor.pool}. */
+interface PoolOptions {
+  /** Total attempts before giving up (each on a freshly-picked instance). Default 3. */
+  attempts?: number;
+  /** Base backoff in ms between attempts; doubles each retry (0 disables the wait). Default 100. */
+  backoffMs?: number;
+  /**
+  * Upper bound on a single backoff sleep, in ms. The doubling delay is clamped
+  * to this ceiling so a large `attempts` count can't produce an unboundedly
+  * long wait. Default {@link DEFAULT_MAX_BACKOFF_MS} (30s).
+  */
+  maxBackoffMs?: number;
+  /**
+  * Whether a *returned* response should be retried on another instance.
+  * Defaults to retrying any `5xx`. A thrown error (network/start failure) is
+  * always retried regardless of this predicate.
+  */
+  retryOn?: (response: Response) => boolean;
+  /** Pool size to spread picks across. Defaults to the definition's `maxInstances`, else 3. */
+  size?: number;
+}
+/** Wiring info for one definition, emitted by codegen into the generated DO. */
+interface ContainerBindingSpec {
+  /** Durable Object binding name, e.g. `CONTAINER_TRANSCODER`. */
+  binding: string;
+  /** The `lunora/containers.ts` export name, e.g. `transcoder`. */
+  exportName: string;
+  /** Pool size default for `.any()`. */
+  maxInstances?: number;
+}
+/**
+* Build the `ctx.containers` record from the Worker `env`. Called by the
+* generated ShardDO with the specs codegen derived from
+* `lunora/containers.ts`. A missing binding doesn't throw here — only when the
+* handle is actually used — so one unprovisioned container never breaks
+* unrelated functions.
+*/
+declare const createContainerContext: (env: Record<string, unknown>, specs: ReadonlyArray<ContainerBindingSpec>) => Record<string, ContainerAccessor>;
+/** A test handler: receives the request plus the targeted instance name. */
+type ContainerTestHandler = (request: Request, instance: {
+  name: string;
+}) => Promise<Response> | Response;
+/**
+* Docker-free test double for `ctx.containers`: each export name maps to a
+* fetch handler that plays the container. Mirrors the real shape exactly, so
+* action handlers under test can't tell the difference.
+*
+* ```ts
+* const containers = createContainerTestContext({
+*     transcoder: (request) => new Response("ok"),
+* });
+* ```
+*/
+declare const createContainerTestContext: (handlers: Record<string, ContainerTestHandler>) => Record<string, ContainerAccessor>;
+/**
+* Normalize a `ContainerImageSource` into the shape wrangler wants: a
+* Dockerfile path + build context for local builds, or a fully-qualified
+* reference for pre-built images.
+*
+* A local-path string whose basename starts with `Dockerfile` (so
+* `Dockerfile.dev` also counts) is used as-is with its directory as the build
+* context; any other path is treated as the build-context directory and the
+* Dockerfile is expected at `&lt;dir>/Dockerfile`.
+*/
+declare const normalizeContainerImage: (image: ContainerImageSource) => NormalizedContainerImage;
+/**
+* The generated Container DO class name for a `lunora/containers.ts` export:
+* `transcoder` → `TranscoderContainer`. wrangler's `containers[].class_name`
+* and the Durable Object binding's `class_name` both reference it, so codegen
+* and the config layer MUST derive it identically — always via this helper.
+*/
+declare const containerClassName: (exportName: string) => string;
+/**
+* The Durable Object binding name for a container export: `transcoder` →
+* `CONTAINER_TRANSCODER`, `imageResizer` → `CONTAINER_IMAGE_RESIZER`. The
+* `CONTAINER_` prefix namespaces these away from `SHARD`/`SESSION`/`SCHEDULER`
+* so a container export can never collide with the built-in bindings.
+*/
+declare const containerBindingName: (exportName: string) => string;
+/**
+* The local image tag a Railpack `{ build }` container is built and pushed
+* under: `transcoder` → `lunora-transcoder:build`. The config reconciler writes
+* it as the wrangler `containers[].image`, and `lunora deploy` builds that tag
+* with Railpack and `wrangler containers push`es it before deploying — so all
+* three derive the tag from this one helper and can never disagree.
+*/
+declare const containerBuildTag: (exportName: string) => string;
+declare const defineContainer: (config: ContainerConfig) => ContainerDefinition;
+/** True when a value is a `defineContainer` result (the runtime brand check). */
+declare const isContainerDefinition: (value: unknown) => value is ContainerDefinition;
+/**
+* The container's full environment at instance start: the static `env` block
+* plus every declared secret resolved from the Worker `env`. A declared secret
+* missing from the Worker env fails fast — starting the container without a
+* credential it was promised yields far worse errors downstream.
+*/
+declare const resolveContainerEnvVariables: (definition: ContainerDefinition, workerEnv: Record<string, unknown>, exportName?: string) => Record<string, string>;
+export { type ContainerAccessor, type ContainerBindingSpec, type ContainerConfig, type ContainerDefinition, type ContainerHandle, type ContainerImageSource, type ContainerInstanceHandle, type ContainerInstanceState, type ContainerNamespaceLike, type ContainerStartOptions, type ContainerTestHandler, type NormalizedContainerImage, type PoolOptions, containerBindingName, containerBuildTag, containerClassName, createContainerContext, createContainerTestContext, defineContainer, isContainerDefinition, normalizeContainerImage, resolveContainerEnvVariables as resolveContainerEnvVars };

package/dist/index.mjs

@@ -0,0 +1,2 @@
+export { createContainerContext, createContainerTestContext } from './packem_shared/createContainerContext-ChDD53ys.mjs';
+export { containerBindingName, containerBuildTag, containerClassName, defineContainer, isContainerDefinition, normalizeContainerImage, resolveContainerEnvVars } from './packem_shared/containerBindingName-BGdSdFNA.mjs';

package/dist/packem_shared/containerBindingName-BGdSdFNA.mjs

@@ -0,0 +1,116 @@
+const NAMED_INSTANCE_TYPES = /* @__PURE__ */ new Set(["basic", "lite", "standard-1", "standard-2", "standard-3", "standard-4"]);
+const ENV_NAME_PATTERN = /^[A-Z_]\w*$/i;
+const SLEEP_AFTER_PATTERN = /^\d+[smh]$/;
+const basename = (path) => {
+  const trimmed = path.endsWith("/") ? path.slice(0, -1) : path;
+  const separatorIndex = trimmed.lastIndexOf("/");
+  return separatorIndex === -1 ? trimmed : trimmed.slice(separatorIndex + 1);
+};
+const dirname = (path) => {
+  const separatorIndex = path.lastIndexOf("/");
+  return separatorIndex === -1 ? "." : path.slice(0, separatorIndex) || "/";
+};
+const normalizeContainerImage = (image) => {
+  if (typeof image !== "string") {
+    if ("build" in image) {
+      const buildDirectory = image.build.endsWith("/") ? image.build.slice(0, -1) : image.build;
+      return { buildDir: buildDirectory, kind: "build" };
+    }
+    return { kind: "registry", reference: image.registry };
+  }
+  if (basename(image).startsWith("Dockerfile")) {
+    return { buildContext: dirname(image), dockerfilePath: image, kind: "dockerfile" };
+  }
+  const context = image.endsWith("/") ? image.slice(0, -1) : image;
+  return { buildContext: context, dockerfilePath: `${context}/Dockerfile`, kind: "dockerfile" };
+};
+const containerClassName = (exportName) => `${exportName.charAt(0).toUpperCase()}${exportName.slice(1)}Container`;
+const containerBindingName = (exportName) => `CONTAINER_${exportName.replaceAll(/(?<=[a-z0-9])(?=[A-Z])/g, "_").toUpperCase()}`;
+const containerBuildTag = (exportName) => `lunora-${exportName.replaceAll(/(?<=[a-z0-9])(?=[A-Z])/g, "-").toLowerCase()}:build`;
+const assertValidImage = (image) => {
+  if (typeof image === "string") {
+    if (image.length === 0) {
+      throw new TypeError("defineContainer: `image` must be a non-empty path or a { registry } reference");
+    }
+    if (image.includes(":")) {
+      throw new TypeError(
+        `defineContainer: \`image\` string "${image}" looks like a registry reference — pass it as { registry: "${image}" } instead. Plain strings are local Dockerfile paths.`
+      );
+    }
+    return;
+  }
+  if ("build" in image) {
+    if (typeof image.build !== "string" || image.build.length === 0) {
+      throw new TypeError("defineContainer: `image.build` must be a non-empty source directory for Railpack to build");
+    }
+    return;
+  }
+  if (typeof image.registry !== "string" || image.registry.length === 0) {
+    throw new TypeError("defineContainer: `image.registry` must be a non-empty fully-qualified image reference");
+  }
+};
+const assertValidEnvAndSecrets = (config) => {
+  for (const name of Object.keys(config.env ?? {})) {
+    if (!ENV_NAME_PATTERN.test(name)) {
+      throw new TypeError(`defineContainer: env variable name "${name}" is not a valid environment variable name`);
+    }
+  }
+  for (const name of Object.keys(config.buildArgs ?? {})) {
+    if (!ENV_NAME_PATTERN.test(name)) {
+      throw new TypeError(`defineContainer: buildArg name "${name}" is not a valid environment variable name`);
+    }
+  }
+  const envNames = new Set(Object.keys(config.env ?? {}));
+  for (const secret of config.secrets ?? []) {
+    if (!ENV_NAME_PATTERN.test(secret)) {
+      throw new TypeError(`defineContainer: secret name "${secret}" is not a valid environment variable name`);
+    }
+    if (envNames.has(secret)) {
+      throw new TypeError(
+        `defineContainer: "${secret}" is declared in both \`env\` and \`secrets\` — a secret would silently overwrite the static env value; pick one`
+      );
+    }
+  }
+};
+const defineContainer = (config) => {
+  assertValidImage(config.image);
+  if (config.defaultPort !== void 0 && (!Number.isInteger(config.defaultPort) || config.defaultPort < 1 || config.defaultPort > 65535)) {
+    throw new TypeError(`defineContainer: \`defaultPort\` must be an integer in 1–65535 (got ${String(config.defaultPort)})`);
+  }
+  const stepPercentage = config.rollout?.stepPercentage;
+  if (stepPercentage !== void 0 && (!Number.isInteger(stepPercentage) || stepPercentage < 1 || stepPercentage > 100)) {
+    throw new TypeError(`defineContainer: \`rollout.stepPercentage\` must be an integer in 1–100 (got ${String(stepPercentage)})`);
+  }
+  if (config.maxInstances !== void 0 && (!Number.isInteger(config.maxInstances) || config.maxInstances < 1)) {
+    throw new TypeError(`defineContainer: \`maxInstances\` must be a positive integer (got ${String(config.maxInstances)})`);
+  }
+  if (typeof config.instanceType === "string" && !NAMED_INSTANCE_TYPES.has(config.instanceType)) {
+    throw new TypeError(
+      `defineContainer: unknown \`instanceType\` "${config.instanceType}" — use one of ${[...NAMED_INSTANCE_TYPES].join(", ")}, or a custom { vcpu, memoryMib, diskMb } object`
+    );
+  }
+  if (typeof config.sleepAfter === "string" && !SLEEP_AFTER_PATTERN.test(config.sleepAfter)) {
+    throw new TypeError(
+      `defineContainer: \`sleepAfter\` string "${config.sleepAfter}" must be a number of seconds followed by a unit, e.g. "30s", "5m", or "1h"`
+    );
+  }
+  assertValidEnvAndSecrets(config);
+  return { ...config, isLunoraContainer: true };
+};
+const isContainerDefinition = (value) => typeof value === "object" && value !== null && value.isLunoraContainer === true;
+const resolveContainerEnvVariables = (definition, workerEnv, exportName) => {
+  const resolved = { ...definition.env };
+  for (const secret of definition.secrets ?? []) {
+    const value = workerEnv[secret];
+    if (typeof value !== "string") {
+      const label = exportName === void 0 ? "container" : `container "${exportName}"`;
+      throw new Error(
+        `${label}: declared secret "${secret}" is not set on the Worker environment. Add it to .dev.vars for local dev and run \`wrangler secret put ${secret}\` for production.`
+      );
+    }
+    resolved[secret] = value;
+  }
+  return resolved;
+};
+
+export { containerBindingName, containerBuildTag, containerClassName, defineContainer, isContainerDefinition, normalizeContainerImage, resolveContainerEnvVariables as resolveContainerEnvVars };

package/dist/packem_shared/createContainerContext-ChDD53ys.mjs

@@ -0,0 +1,122 @@
+const DEFAULT_POOL_SIZE = 3;
+const DEFAULT_MAX_BACKOFF_MS = 3e4;
+const toRequest = (input, init) => {
+  if (typeof input === "string" && input.startsWith("/")) {
+    return new Request(`http://container${input}`, init);
+  }
+  return new Request(input, init);
+};
+const handleFor = (namespace, instanceName) => {
+  return {
+    fetch: async (input, init) => namespace.get(namespace.idFromName(instanceName)).fetch(toRequest(input, init))
+  };
+};
+const lifecycleCall = async (stub, method, binding, argument) => {
+  const rpc = stub[method];
+  if (typeof rpc !== "function") {
+    throw new TypeError(`ctx.containers: the "${binding}" container DO does not expose ${method}() — is @lunora/container/do up to date?`);
+  }
+  return rpc(argument);
+};
+const instanceHandleFor = (namespace, spec, instanceName) => {
+  const stub = () => namespace.get(namespace.idFromName(instanceName));
+  return {
+    destroy: async () => lifecycleCall(stub(), "destroy", spec.binding),
+    fetch: async (input, init) => stub().fetch(toRequest(input, init)),
+    getState: async () => lifecycleCall(stub(), "getState", spec.binding),
+    start: async (options) => lifecycleCall(stub(), "start", spec.binding, options),
+    stop: async (signal) => lifecycleCall(stub(), "stop", spec.binding, signal)
+  };
+};
+const randomPoolName = (size) => (
+  // eslint-disable-next-line sonarjs/pseudo-random -- load-balancing pick across interchangeable instances, not a security decision
+  `pool-${String(Math.floor(Math.random() * size))}`
+);
+const sleep = async (ms) => {
+  if (ms <= 0) {
+    return;
+  }
+  await new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+};
+const retryOnServerError = (response) => response.status >= 500;
+const poolHandleFor = (namespace, spec, options = {}) => {
+  const size = options.size ?? spec.maxInstances ?? DEFAULT_POOL_SIZE;
+  const attempts = Math.max(1, options.attempts ?? 3);
+  const baseBackoff = options.backoffMs ?? 100;
+  const maxBackoff = options.maxBackoffMs ?? DEFAULT_MAX_BACKOFF_MS;
+  const shouldRetry = options.retryOn ?? retryOnServerError;
+  return {
+    fetch: async (input, init) => {
+      let lastError;
+      for (let attempt = 0; attempt < attempts; attempt += 1) {
+        if (attempt > 0) {
+          await sleep(Math.min(baseBackoff * 2 ** (attempt - 1), maxBackoff));
+        }
+        const request = toRequest(input, init);
+        try {
+          const response = await namespace.get(namespace.idFromName(randomPoolName(size))).fetch(request);
+          if (attempt === attempts - 1 || !shouldRetry(response)) {
+            return response;
+          }
+        } catch (error) {
+          lastError = error;
+        }
+      }
+      throw lastError instanceof Error ? lastError : new Error(`ctx.containers.${spec.exportName}.pool(): all ${String(attempts)} attempts failed`);
+    }
+  };
+};
+const accessorFor = (namespace, spec) => {
+  return {
+    any: (count) => handleFor(namespace, randomPoolName(count ?? spec.maxInstances ?? DEFAULT_POOL_SIZE)),
+    get: (name) => instanceHandleFor(namespace, spec, name),
+    pool: (options) => poolHandleFor(namespace, spec, options)
+  };
+};
+const missingBindingAccessor = (spec) => {
+  const fail = () => {
+    throw new Error(
+      `ctx.containers.${spec.exportName}: no "${spec.binding}" Durable Object binding found. Run \`lunora dev\` (or \`lunora deploy\`) to reconcile wrangler.jsonc, and make sure the worker entry re-exports the generated container classes.`
+    );
+  };
+  return { any: fail, get: fail, pool: fail };
+};
+const createContainerContext = (env, specs) => {
+  const containers = {};
+  for (const spec of specs) {
+    const namespace = env[spec.binding];
+    containers[spec.exportName] = namespace && typeof namespace.idFromName === "function" && typeof namespace.get === "function" ? accessorFor(namespace, spec) : missingBindingAccessor(spec);
+  }
+  return containers;
+};
+const createContainerTestContext = (handlers) => {
+  const containers = {};
+  for (const [exportName, handler] of Object.entries(handlers)) {
+    const testHandleFor = (instanceName) => {
+      return {
+        fetch: async (input, init) => handler(toRequest(input, init), { name: instanceName })
+      };
+    };
+    const testInstanceHandleFor = (instanceName) => {
+      return {
+        ...testHandleFor(instanceName),
+        destroy: () => Promise.resolve(),
+        getState: () => Promise.resolve({ lastChange: 0 }),
+        start: () => Promise.resolve(),
+        stop: () => Promise.resolve()
+      };
+    };
+    containers[exportName] = {
+      any: () => testHandleFor("pool-0"),
+      get: (name) => testInstanceHandleFor(name),
+      // The double doesn't simulate failure/retry — pool() just routes to
+      // the handler like any other call, so tests stay deterministic.
+      pool: () => testHandleFor("pool-0")
+    };
+  }
+  return containers;
+};
+
+export { createContainerContext, createContainerTestContext };

package/dist/packem_shared/types.d-D2l2SYol.d.mts

@@ -0,0 +1,140 @@
+/**
+* Public configuration types for `@lunora/container`.
+*
+* Everything in this module is pure data — no Cloudflare runtime imports — so
+* it is safe to import from Node tooling (codegen, the config layer) as well
+* as from worker code.
+*/
+/** Named instance types Cloudflare Containers provides. */
+type NamedContainerInstanceType = "basic" | "lite" | "standard-1" | "standard-2" | "standard-3" | "standard-4";
+/**
+* A custom instance type. Cloudflare's bounds at the time of writing: up to
+* 4 vCPU, 12 GiB memory, 20 GB disk, ≥ 3 GiB memory per vCPU and ≤ 2 GB disk
+* per GiB memory. The config-layer validator enforces the documented ranges.
+*/
+interface CustomContainerInstanceType {
+  /** Disk in MB. Cloudflare's default is 2000 (2 GB). */
+  diskMb?: number;
+  /** Memory in MiB. Cloudflare's default is 256. */
+  memoryMib?: number;
+  /** vCPU count. Cloudflare's default is 0.0625 (1/16 vCPU). */
+  vcpu?: number;
+}
+type ContainerInstanceType = CustomContainerInstanceType | NamedContainerInstanceType;
+/** Rolling-deploy tuning for a container. */
+interface ContainerRollout {
+  /** Seconds an active instance runs before it's eligible for update (wrangler `rollout_active_grace_period`). */
+  gracePeriodSeconds?: number;
+  /** Percentage of instances updated per rollout step, 1–100 (wrangler `rollout_step_percentage`). */
+  stepPercentage?: number;
+}
+/**
+* A pre-built image pulled from a registry — the Cloudflare Registry, Docker
+* Hub, or Amazon ECR (the registries `wrangler deploy` supports). The
+* reference must be fully qualified, e.g. `docker.io/acme/transcoder:1.4`.
+*/
+interface RegistryImageSource {
+  registry: string;
+}
+/**
+* A Dockerfile-less build via [Railpack](https://railpack.com): point at a
+* source directory and `lunora deploy` builds an OCI image with Railpack
+* (needs a BuildKit instance) and pushes it to the Cloudflare Registry before
+* wrangler runs. Opt-in — the Dockerfile path is the zero-extra-deps default.
+*/
+interface BuildImageSource {
+  build: string;
+}
+/**
+* Where the container image comes from. A `string` is a **local path** —
+* either a directory containing a `Dockerfile` (normalized to
+* `<dir>/Dockerfile` with the directory as the build context) or a path to
+* the Dockerfile itself — while `{ registry }` is a pre-built image reference.
+*/
+type ContainerImageSource = BuildImageSource | RegistryImageSource | string;
+interface ContainerConfig {
+  /**
+  * Build-time variables for a Dockerfile/Railpack image — wrangler's
+  * `image_vars` (equivalent to `docker build --build-arg`). For *runtime*
+  * values use {@link ContainerConfig.env} / {@link ContainerConfig.secrets}.
+  * Ignored for a pre-built `{ registry }` image.
+  */
+  buildArgs?: Readonly<Record<string, string>>;
+  /**
+  * The port the container listens on. Worker → container requests target
+  * this port. Locally the Dockerfile must also `EXPOSE` it.
+  */
+  defaultPort?: number;
+  /**
+  * Whether the container may open outbound internet connections. Defaults
+  * to `true` — the platform default. Note that container egress is billed
+  * per GB by Cloudflare.
+  */
+  enableInternet?: boolean;
+  /**
+  * Static environment variables passed to the container on every start.
+  * For secret values use {@link ContainerConfig.secrets} instead so they
+  * flow through Worker Secrets rather than source code.
+  */
+  env?: Readonly<Record<string, string>>;
+  /** Image source — a local Dockerfile path/directory or a registry reference. */
+  image: ContainerImageSource;
+  /**
+  * Resource class for each instance: a named Cloudflare instance type or a
+  * custom `{ vcpu, memoryMib, diskMb }` object.
+  */
+  instanceType?: ContainerInstanceType;
+  /**
+  * Maximum number of concurrently *running* instances. Stopped (slept)
+  * containers don't count. Also the default pool size for `.any()`.
+  */
+  maxInstances?: number;
+  /**
+  * Override for the wrangler `containers[].name` identifier. Defaults to
+  * wrangler's own default (worker name + class name + environment).
+  */
+  name?: string;
+  /**
+  * Rolling-deploy tuning. `stepPercentage` is the share of instances updated
+  * per rollout step (wrangler `rollout_step_percentage`); `gracePeriodSeconds`
+  * is how long an active instance is left running before it's eligible for
+  * update (wrangler `rollout_active_grace_period`).
+  */
+  rollout?: ContainerRollout;
+  /**
+  * Names of Worker secrets (from `wrangler secret` / `.dev.vars`) forwarded
+  * into the container's environment at instance start. Each declared name
+  * must exist on the Worker `env` — a missing one fails fast with a
+  * directed error instead of starting the container without it.
+  */
+  secrets?: ReadonlyArray<string>;
+  /**
+  * Idle timeout after which the instance is put to sleep, e.g. `"5m"`,
+  * `"30s"`, or a number of seconds. Cloudflare's default is `"10m"`.
+  */
+  sleepAfter?: number | string;
+}
+/**
+* The value `defineContainer` returns: the validated config plus a brand the
+* codegen discovery and the generated Container DO class key on.
+*/
+interface ContainerDefinition extends ContainerConfig {
+  /** Brand marking a value as a Lunora container definition. */
+  readonly isLunoraContainer: true;
+}
+/** A normalized image source, as written into `wrangler.jsonc`. */
+type NormalizedContainerImage = {
+  /** Build context directory (wrangler `image_build_context`). */
+  buildContext: string;
+  /** Path to the Dockerfile (wrangler `image`). */
+  dockerfilePath: string;
+  kind: "dockerfile";
+} | {
+  /** Railpack source directory built + pushed at deploy time. */
+  buildDir: string;
+  kind: "build";
+} | {
+  kind: "registry"; /** Fully-qualified image reference (wrangler `image`). */
+  reference: string;
+};
+export { BuildImageSource as B, ContainerDefinition as C, NormalizedContainerImage as N, RegistryImageSource as R, ContainerConfig as a, ContainerImageSource as b, ContainerInstanceType as c, ContainerRollout as d, CustomContainerInstanceType as e, NamedContainerInstanceType as f };