@lunora/container 1.0.0-alpha.42 → 1.0.0-alpha.44

package/README.md

@@ -172,12 +172,12 @@ export const api = defineContainer({
 
 ### Hard timeout
 
-`sleepAfter` caps _idle_ time; `hardTimeout` caps _total_ lifetime — a runaway-cost backstop measured from start, regardless of activity (same grammar as `sleepAfter`). When it elapses the generated class's `onHardTimeoutExpired` hook runs (default: `stop()`); the timer is run-generation-stamped so a stale timer from a slept/crashed run can't kill a fresh one.
+`sleepAfter` caps _idle_ time; `hardTimeout` caps _total_ lifetime — a runaway-cost backstop measured from start, regardless of activity (same grammar as `sleepAfter`). When it elapses the generated class's `onHardTimeoutExpired` hook runs (default: `stop()`, i.e. SIGTERM with no escalation — a container that ignores SIGTERM outlives its cap unless you override the hook and follow up with `destroy()`); the timer is run-generation-stamped so a stale timer from a slept/crashed run can't kill a fresh one.
 
 ```ts
 export const job = defineContainer({
     image: "./containers/job",
-    hardTimeout: "1h", // never run longer than an hour, busy or not
+    hardTimeout: "1h", // stopped after an hour, busy or not
 });
 ```
 

package/dist/do/index.d.mts

@@ -1,4 +1,4 @@
-import { C as ContainerDefinition, D as DurableObjectJurisdiction } from "../packem_shared/jurisdiction.d-KcQu2ZT_.mjs";
+import { C as ContainerDefinition, D as DurableObjectJurisdiction } from "../packem_shared/jurisdiction.d-rC2ejtvT.mjs";
 import { DurableObject, WorkerEntrypoint } from 'cloudflare:workers';
 /**
  * ContainerStartOptions as they come from worker types
@@ -522,16 +522,26 @@ declare class LunoraContainer<Env = unknown> extends Container<Env> {
   private readonly lunoraSecretsStore?;
   /** Memoised Secrets Store resolution: run once, then merged into `envVars` before the first start. */
   private lunoraSecretsStoreResolved?;
+  /**
+   * Count of runs observed to have ENDED, bumped by the `onStop` hook. Read
+   * across a start: a bump means the run that start snapshotted is over,
+   * whatever the `running` flag said at snapshot time. See `beginStart`.
+   */
+  private lunoraStops;
   constructor(context: DurableObjectContext, env: Env, definition: ContainerDefinition, exportName?: string, jurisdiction?: DurableObjectJurisdiction);
   /**
-   * Proxy entry for every `ctx.containers.<name>` fetch. Resolves the
-   * `secretsStore` bindings into `envVars` before delegating, so the values
-   * are present when the base implicitly starts the container for this
-   * request — a no-op when `secretsStore` is unset.
+   * Proxy entry for every `ctx.containers.<name>` fetch. The base starts the
+   * container for this request through {@link startAndWaitForPorts}, which is
+   * where the `secretsStore` resolution lives — a request that finds the
+   * container already healthy needs no resolution at all.
    */
   override containerFetch(...args: Parameters<Container<Env>["containerFetch"]>): Promise<Response>;
   /**
    * The start path `containerFetch` takes (and the one an app can call itself).
+   * Resolves the `secretsStore` bindings into `envVars` first — `doStartContainer`
+   * reads `this.envVars`, so a container started this way would otherwise boot
+   * without its Secrets Store values.
+   *
    * The base's last act is `blockConcurrencyWhile(… onStart())`, so this
    * override resumes on the far side of that gate — which is where
    * {@link afterContainerStart} has to run. See its docblock.
@@ -557,6 +567,14 @@ declare class LunoraContainer<Env = unknown> extends Container<Env> {
    * {@link onStart}). Default: stop the instance. Override to drain/checkpoint
    * first. A stale schedule from a previous run, or an already-stopped
    * instance, is ignored (upstream cloudflare/containers#85).
+   *
+   * `stop()` sends SIGTERM and returns; nothing escalates to `destroy()`. The
+   * cap is therefore a signal, not a bound — a container that traps or ignores
+   * SIGTERM keeps running, and the schedule is ONE-SHOT (the base deletes the
+   * row once it fires), so nothing signals it a second time either: an ignored
+   * SIGTERM means the cap is spent, not retried. Override this hook and follow
+   * the stop with a `destroy()` after a grace period if your workload needs a
+   * real ceiling.
    */
   onHardTimeoutExpired(payload?: {
     generation?: number;
@@ -588,6 +606,40 @@ declare class LunoraContainer<Env = unknown> extends Container<Env> {
    * the in-gate placement got this for free from `blockConcurrencyWhile`.
    */
   private afterContainerStart;
+  /**
+   * Decide — synchronously, before anything is started — whether this start
+   * begins a NEW container run, and drop the previous run's readiness gate when
+   * it does. Returns whether the container was already running.
+   *
+   * The gate has to be keyed on the run, and `onStop` alone cannot key it:
+   * `@cloudflare/containers` reaches `onStop` only through
+   * `syncPendingStoppedEvents`, which `start()` never calls (only
+   * `startAndWaitForPorts`, `stop()` and the alarm loop do), while the monitor
+   * callback that observes a container exit merely records the state. So a
+   * `start()` in the up-to-three-minute window before the next alarm found the
+   * finished run's settled gate and skipped BOTH `armHardTimeout` and the
+   * `readyOn` probes — run 2 ran uncapped and was proxied to before it reported
+   * ready. A `hardTimeout` firing its own SIGTERM lands in exactly that window.
+   *
+   * The mirror case is why the answer is not "always re-arm": a start that finds
+   * the container already up begins no run, and re-arming there moves the cap
+   * (see {@link afterContainerStart}).
+   *
+   * Read with no `await` between it and `super`, so two concurrent starts of a
+   * stopped container both observe `false` and the second joins the first's
+   * gate instead of arming a second schedule — and so the flag is as fresh as
+   * it can be. It is a snapshot either way, and the run can end after it: the
+   * base's own pre-start work (`getPortsToCheck`, `syncPendingStoppedEvents`)
+   * still runs on the far side of it, and a start that came in on a live
+   * container would then arm nothing for the run the base goes on to start.
+   * Hence the second half of the answer, in the callers: an `onStop` observed
+   * ACROSS the base call ({@link lunoraStops}) demotes the snapshot, because
+   * the run it described is over. What that does not cover is an exit inside
+   * `start()`'s own base call — that path never syncs pending stop events, so
+   * nothing reports the exit until the next alarm or `startAndWaitForPorts`,
+   * and the cap for such a run is armed only when one of those arrives.
+   */
+  private beginStart;
   /**
    * Block until the `readyOn` probes for the current start have passed.
    *

package/dist/do/index.d.ts

@@ -1,4 +1,4 @@
-import { C as ContainerDefinition, D as DurableObjectJurisdiction } from "../packem_shared/jurisdiction.d-KcQu2ZT_.js";
+import { C as ContainerDefinition, D as DurableObjectJurisdiction } from "../packem_shared/jurisdiction.d-rC2ejtvT.js";
 import { DurableObject, WorkerEntrypoint } from 'cloudflare:workers';
 /**
  * ContainerStartOptions as they come from worker types
@@ -522,16 +522,26 @@ declare class LunoraContainer<Env = unknown> extends Container<Env> {
   private readonly lunoraSecretsStore?;
   /** Memoised Secrets Store resolution: run once, then merged into `envVars` before the first start. */
   private lunoraSecretsStoreResolved?;
+  /**
+   * Count of runs observed to have ENDED, bumped by the `onStop` hook. Read
+   * across a start: a bump means the run that start snapshotted is over,
+   * whatever the `running` flag said at snapshot time. See `beginStart`.
+   */
+  private lunoraStops;
   constructor(context: DurableObjectContext, env: Env, definition: ContainerDefinition, exportName?: string, jurisdiction?: DurableObjectJurisdiction);
   /**
-   * Proxy entry for every `ctx.containers.<name>` fetch. Resolves the
-   * `secretsStore` bindings into `envVars` before delegating, so the values
-   * are present when the base implicitly starts the container for this
-   * request — a no-op when `secretsStore` is unset.
+   * Proxy entry for every `ctx.containers.<name>` fetch. The base starts the
+   * container for this request through {@link startAndWaitForPorts}, which is
+   * where the `secretsStore` resolution lives — a request that finds the
+   * container already healthy needs no resolution at all.
    */
   override containerFetch(...args: Parameters<Container<Env>["containerFetch"]>): Promise<Response>;
   /**
    * The start path `containerFetch` takes (and the one an app can call itself).
+   * Resolves the `secretsStore` bindings into `envVars` first — `doStartContainer`
+   * reads `this.envVars`, so a container started this way would otherwise boot
+   * without its Secrets Store values.
+   *
    * The base's last act is `blockConcurrencyWhile(… onStart())`, so this
    * override resumes on the far side of that gate — which is where
    * {@link afterContainerStart} has to run. See its docblock.
@@ -557,6 +567,14 @@ declare class LunoraContainer<Env = unknown> extends Container<Env> {
    * {@link onStart}). Default: stop the instance. Override to drain/checkpoint
    * first. A stale schedule from a previous run, or an already-stopped
    * instance, is ignored (upstream cloudflare/containers#85).
+   *
+   * `stop()` sends SIGTERM and returns; nothing escalates to `destroy()`. The
+   * cap is therefore a signal, not a bound — a container that traps or ignores
+   * SIGTERM keeps running, and the schedule is ONE-SHOT (the base deletes the
+   * row once it fires), so nothing signals it a second time either: an ignored
+   * SIGTERM means the cap is spent, not retried. Override this hook and follow
+   * the stop with a `destroy()` after a grace period if your workload needs a
+   * real ceiling.
    */
   onHardTimeoutExpired(payload?: {
     generation?: number;
@@ -588,6 +606,40 @@ declare class LunoraContainer<Env = unknown> extends Container<Env> {
    * the in-gate placement got this for free from `blockConcurrencyWhile`.
    */
   private afterContainerStart;
+  /**
+   * Decide — synchronously, before anything is started — whether this start
+   * begins a NEW container run, and drop the previous run's readiness gate when
+   * it does. Returns whether the container was already running.
+   *
+   * The gate has to be keyed on the run, and `onStop` alone cannot key it:
+   * `@cloudflare/containers` reaches `onStop` only through
+   * `syncPendingStoppedEvents`, which `start()` never calls (only
+   * `startAndWaitForPorts`, `stop()` and the alarm loop do), while the monitor
+   * callback that observes a container exit merely records the state. So a
+   * `start()` in the up-to-three-minute window before the next alarm found the
+   * finished run's settled gate and skipped BOTH `armHardTimeout` and the
+   * `readyOn` probes — run 2 ran uncapped and was proxied to before it reported
+   * ready. A `hardTimeout` firing its own SIGTERM lands in exactly that window.
+   *
+   * The mirror case is why the answer is not "always re-arm": a start that finds
+   * the container already up begins no run, and re-arming there moves the cap
+   * (see {@link afterContainerStart}).
+   *
+   * Read with no `await` between it and `super`, so two concurrent starts of a
+   * stopped container both observe `false` and the second joins the first's
+   * gate instead of arming a second schedule — and so the flag is as fresh as
+   * it can be. It is a snapshot either way, and the run can end after it: the
+   * base's own pre-start work (`getPortsToCheck`, `syncPendingStoppedEvents`)
+   * still runs on the far side of it, and a start that came in on a live
+   * container would then arm nothing for the run the base goes on to start.
+   * Hence the second half of the answer, in the callers: an `onStop` observed
+   * ACROSS the base call ({@link lunoraStops}) demotes the snapshot, because
+   * the run it described is over. What that does not cover is an exit inside
+   * `start()`'s own base call — that path never syncs pending stop events, so
+   * nothing reports the exit until the next alarm or `startAndWaitForPorts`,
+   * and the cap for such a run is armed only when one of those arrives.
+   */
+  private beginStart;
   /**
    * Block until the `readyOn` probes for the current start have passed.
    *

package/dist/do/index.mjs

@@ -1 +1 @@
-import{LunoraError as u}from"@lunora/errors";import{a as w}from"../packem_shared/abort-deadline-jwbW9Ala.mjs";import{resolveContainerEnvVars as y,parseDurationSeconds as f}from"../packem_shared/containerBindingName-C7SonAIK.mjs";import{a as g}from"../packem_shared/jurisdiction-DtE9s70w.mjs";import{Container as R}from"../packem_shared/ContainerProxy-fTW_pXWY.mjs";import{ContainerProxy as x,outboundParams as M}from"../packem_shared/ContainerProxy-fTW_pXWY.mjs";const E="lunora",N=(s,t,r,e)=>({container:s,event:r,instance:t,level:r==="error"?"error":"info",message:e,source:E,ts:Date.now(),type:"container"}),i=(s,t,r,e)=>{const n=N(s,t,r,e),o=JSON.stringify(n);return r==="error"?console.error(o):console.log(o),n},T="__lunora_admin__:recordContainerEvent",S="__root__",_=s=>{if(s===null||typeof s!="object")return!1;const t=s;return typeof t.get=="function"&&typeof t.idFromName=="function"},O=(s,t)=>{const r=g(s,t);return typeof r.getByName=="function"?r.getByName(S):r.get(r.idFromName(S))},I=async(s,t,r)=>{try{const e=s??{},n=e.SHARD;if(!_(n))return;const o=typeof e.LUNORA_ADMIN_TOKEN=="string"?e.LUNORA_ADMIN_TOKEN:void 0;if(!o||o.length===0)return;const a=new Request("https://shard.internal/rpc",{body:JSON.stringify({args:{event:t},functionPath:T}),headers:{authorization:`Bearer ${o}`,"content-type":"application/json"},method:"POST"});await O(n,r).fetch(a)}catch{}},v=500,m=3e4,d="__lunoraHardTimeoutGeneration";class $ extends R{lunoraJurisdiction;lunoraName;lunoraDefaultPort;lunoraHardTimeoutSeconds;lunoraReadiness;lunoraReadyOn;lunoraSecretsStore;lunoraSecretsStoreResolved;constructor(t,r,e,n,o){super(t,r,{defaultPort:e.defaultPort,entrypoint:e.entrypoint?[...e.entrypoint]:void 0,envVars:y(e,r,n),sleepAfter:e.sleepAfter}),e.enableInternet!==void 0&&(this.enableInternet=e.enableInternet),e.requiredPorts!==void 0&&(this.requiredPorts=[...e.requiredPorts]),e.interceptHttps!==void 0&&(this.interceptHttps=e.interceptHttps),e.allowedHosts!==void 0&&(this.allowedHosts=[...e.allowedHosts]),e.deniedHosts!==void 0&&(this.deniedHosts=[...e.deniedHosts]),e.pingEndpoint!==void 0&&(this.pingEndpoint=e.pingEndpoint),e.labels!==void 0&&(this.labels={...e.labels}),this.lunoraName=n??"container",this.lunoraJurisdiction=o,this.lunoraDefaultPort=e.defaultPort,this.lunoraReadyOn=e.readyOn?[...e.readyOn]:[],this.lunoraHardTimeoutSeconds=e.hardTimeout===void 0?void 0:f(e.hardTimeout),this.lunoraSecretsStore=e.secretsStore}async containerFetch(...t){return await this.resolveSecretsStoreEnv(),await this.awaitReadinessGate(),super.containerFetch(...t)}async startAndWaitForPorts(...t){await super.startAndWaitForPorts(...t),await this.afterContainerStart()}async start(...t){const[r]=t;r?.envVars===void 0&&await this.resolveSecretsStoreEnv(),await super.start(...t),await this.afterContainerStart()}async onActivityExpired(){const t=i(this.lunoraName,this.instanceId(),"sleep");this.surfaceInStudioLogs(t),await super.onActivityExpired()}onError(t){const r=i(this.lunoraName,this.instanceId(),"error",t instanceof Error?t.message:String(t));return this.surfaceInStudioLogs(r),super.onError(t)}async onStart(){const t=i(this.lunoraName,this.instanceId(),"start");this.surfaceInStudioLogs(t),await super.onStart()}async onHardTimeoutExpired(t){const r=await this.ctx.storage.get(d);if(t?.generation!==void 0&&t.generation!==r||this.ctx.container?.running!==!0)return;const e=i(this.lunoraName,this.instanceId(),"stop","hard timeout reached");this.surfaceInStudioLogs(e),await this.stop()}async onStop(t){const r=i(this.lunoraName,this.instanceId(),"stop",`${t.reason} (exit ${String(t.exitCode)})`);this.surfaceInStudioLogs(r),this.lunoraReadiness=void 0,await super.onStop(t)}async afterContainerStart(){const t=this.lunoraReadiness;if(t!==void 0){await t;return}const r=(async()=>{await this.armHardTimeout(),await this.awaitContainerReadiness()})();this.lunoraReadiness=r;try{await r}catch(e){throw this.lunoraReadiness=void 0,e}}async awaitReadinessGate(){if(this.lunoraReadyOn.length!==0){if(this.lunoraReadiness===void 0){const{status:t}=await this.getState();if(t!=="healthy")return;this.lunoraReadiness=this.awaitContainerReadiness()}try{await this.lunoraReadiness}catch(t){throw this.lunoraReadiness=void 0,t}}}async armHardTimeout(){if(this.lunoraHardTimeoutSeconds===void 0)return;const t=(await this.ctx.storage.get(d)??0)+1;await this.ctx.storage.put(d,t),await this.schedule(this.lunoraHardTimeoutSeconds,"onHardTimeoutExpired",{generation:t})}async resolveSecretsStoreEnv(){const t=this.lunoraSecretsStore;t!==void 0&&(this.lunoraSecretsStoreResolved??=(async()=>{const r=this.env,e={};for(const[n,o]of Object.entries(t)){const a=r[o];if(a===void 0||typeof a.get!="function")throw new u("INTERNAL",`container "${this.lunoraName}": secretsStore env "${n}" points at binding "${o}", which is not a Secrets Store binding on the Worker env. Add a \`secrets_store_secrets\` entry binding "${o}".`);const c=await a.get();if(typeof c!="string")throw new TypeError(`container "${this.lunoraName}": Secrets Store binding "${o}" (env "${n}") did not resolve to a string value.`);e[n]=c}this.envVars={...this.envVars,...e}})().catch(r=>{throw this.lunoraSecretsStoreResolved=void 0,r}),await this.lunoraSecretsStoreResolved)}async awaitContainerReadiness(){if(this.lunoraReadyOn.length===0)return;const{container:t}=this.ctx;if(t===void 0)return;const r=Date.now()+m;await Promise.all(this.lunoraReadyOn.map(async e=>this.awaitReadinessCheck(t,e,r)))}async awaitReadinessCheck(t,r,e){const n=r.port??this.lunoraDefaultPort;if(n===void 0)throw new u("INTERNAL",`container "${this.lunoraName}": readyOn check "${r.path}" has no port — set the check's \`port\` or the container \`defaultPort\`.`);const o=r.status??200,a=r.path.startsWith("/")?r.path:`/${r.path}`,c=t.getTcpPort(n);for(;;){const h=Math.max(v,e-Date.now()),l=w(void 0,h,()=>new DOMException(`readiness probe timed out after ${String(h)}ms`,"TimeoutError"));try{if((await c.fetch(`http://container${a}`,{signal:l.signal})).status===o)return}catch{}finally{l.dispose()}if(Date.now()>=e)throw new u("INTERNAL",`container "${this.lunoraName}": readiness check "${r.path}" (port ${String(n)}) did not return ${String(o)} within ${String(m)}ms`);await new Promise(p=>{setTimeout(p,v)})}}surfaceInStudioLogs(t){I(this.env,t,this.lunoraJurisdiction).catch(()=>{})}instanceId(){try{const{id:t}=this.ctx;return typeof t?.toString=="function"?t.toString():"unknown"}catch{return"unknown"}}}export{x as ContainerProxy,$ as LunoraContainer,M as outboundParams};
+import{LunoraError as u}from"@lunora/errors";import{a as f}from"../packem_shared/abort-deadline-jwbW9Ala.mjs";import{resolveContainerEnvVars as g,parseDurationSeconds as m}from"../packem_shared/containerBindingName-C7SonAIK.mjs";import{a as y}from"../packem_shared/jurisdiction-DtE9s70w.mjs";import{Container as R}from"../packem_shared/ContainerProxy-fTW_pXWY.mjs";import{ContainerProxy as D,outboundParams as M}from"../packem_shared/ContainerProxy-fTW_pXWY.mjs";const E="lunora",N=(o,t,n,e)=>({container:o,event:n,instance:t,level:n==="error"?"error":"info",message:e,source:E,ts:Date.now(),type:"container"}),i=(o,t,n,e)=>{const r=N(o,t,n,e),s=JSON.stringify(r);return n==="error"?console.error(s):console.log(s),r},T="__lunora_admin__:recordContainerEvent",S="__root__",_=o=>{if(o===null||typeof o!="object")return!1;const t=o;return typeof t.get=="function"&&typeof t.idFromName=="function"},O=(o,t)=>{const n=y(o,t);return typeof n.getByName=="function"?n.getByName(S):n.get(n.idFromName(S))},I=async(o,t,n)=>{try{const e=o??{},r=e.SHARD;if(!_(r))return;const s=typeof e.LUNORA_ADMIN_TOKEN=="string"?e.LUNORA_ADMIN_TOKEN:void 0;if(!s||s.length===0)return;const a=new Request("https://shard.internal/rpc",{body:JSON.stringify({args:{event:t},functionPath:T}),headers:{authorization:`Bearer ${s}`,"content-type":"application/json"},method:"POST"});await O(r,n).fetch(a)}catch{}},v=500,w=3e4,h="__lunoraHardTimeoutGeneration";class L extends R{lunoraJurisdiction;lunoraName;lunoraDefaultPort;lunoraHardTimeoutSeconds;lunoraReadiness;lunoraReadyOn;lunoraSecretsStore;lunoraSecretsStoreResolved;lunoraStops=0;constructor(t,n,e,r,s){super(t,n,{defaultPort:e.defaultPort,entrypoint:e.entrypoint?[...e.entrypoint]:void 0,envVars:g(e,n,r),sleepAfter:e.sleepAfter}),e.enableInternet!==void 0&&(this.enableInternet=e.enableInternet),e.requiredPorts!==void 0&&(this.requiredPorts=[...e.requiredPorts]),e.interceptHttps!==void 0&&(this.interceptHttps=e.interceptHttps),e.allowedHosts!==void 0&&(this.allowedHosts=[...e.allowedHosts]),e.deniedHosts!==void 0&&(this.deniedHosts=[...e.deniedHosts]),e.pingEndpoint!==void 0&&(this.pingEndpoint=e.pingEndpoint),e.labels!==void 0&&(this.labels={...e.labels}),this.lunoraName=r??"container",this.lunoraJurisdiction=s,this.lunoraDefaultPort=e.defaultPort,this.lunoraReadyOn=e.readyOn?[...e.readyOn]:[],this.lunoraHardTimeoutSeconds=e.hardTimeout===void 0?void 0:m(e.hardTimeout),this.lunoraSecretsStore=e.secretsStore}async containerFetch(...t){return await this.awaitReadinessGate(),super.containerFetch(...t)}async startAndWaitForPorts(...t){await this.resolveSecretsStoreEnv();const n=this.lunoraStops,e=this.beginStart();await super.startAndWaitForPorts(...t),await this.afterContainerStart(e&&this.lunoraStops===n)}async start(...t){const[n]=t;n?.envVars===void 0&&await this.resolveSecretsStoreEnv();const e=this.lunoraStops,r=this.beginStart();await super.start(...t),await this.afterContainerStart(r&&this.lunoraStops===e)}async onActivityExpired(){const t=i(this.lunoraName,this.instanceId(),"sleep");this.surfaceInStudioLogs(t),await super.onActivityExpired()}onError(t){const n=i(this.lunoraName,this.instanceId(),"error",t instanceof Error?t.message:String(t));return this.surfaceInStudioLogs(n),super.onError(t)}async onStart(){const t=i(this.lunoraName,this.instanceId(),"start");this.surfaceInStudioLogs(t),await super.onStart()}async onHardTimeoutExpired(t){const n=await this.ctx.storage.get(h);if(t?.generation!==void 0&&t.generation!==n||this.ctx.container?.running!==!0)return;const e=i(this.lunoraName,this.instanceId(),"stop","hard timeout reached");this.surfaceInStudioLogs(e),await this.stop()}async onStop(t){const n=i(this.lunoraName,this.instanceId(),"stop",`${t.reason} (exit ${String(t.exitCode)})`);this.surfaceInStudioLogs(n),this.lunoraReadiness=void 0,this.lunoraStops+=1,await super.onStop(t)}async afterContainerStart(t){const n=this.lunoraReadiness;if(n!==void 0){await n;return}const e=(async()=>{t||await this.armHardTimeout(),await this.awaitContainerReadiness()})();this.lunoraReadiness=e;try{await e}catch(r){throw this.lunoraReadiness===e&&(this.lunoraReadiness=void 0),r}}beginStart(){const t=this.ctx.container?.running===!0;return t||(this.lunoraReadiness=void 0),t}async awaitReadinessGate(){if(this.lunoraReadyOn.length===0)return;if(this.lunoraReadiness===void 0){const{status:n}=await this.getState();if(n!=="healthy")return;this.lunoraReadiness=this.awaitContainerReadiness()}const t=this.lunoraReadiness;try{await t}catch(n){throw this.lunoraReadiness===t&&(this.lunoraReadiness=void 0),n}}async armHardTimeout(){if(this.lunoraHardTimeoutSeconds===void 0)return;const t=(await this.ctx.storage.get(h)??0)+1;await this.ctx.storage.put(h,t),await this.schedule(this.lunoraHardTimeoutSeconds,"onHardTimeoutExpired",{generation:t})}async resolveSecretsStoreEnv(){const t=this.lunoraSecretsStore;t!==void 0&&(this.lunoraSecretsStoreResolved??=(async()=>{const n=this.env,e={};for(const[r,s]of Object.entries(t)){const a=n[s];if(a===void 0||typeof a.get!="function")throw new u("INTERNAL",`container "${this.lunoraName}": secretsStore env "${r}" points at binding "${s}", which is not a Secrets Store binding on the Worker env. Add a \`secrets_store_secrets\` entry binding "${s}".`);const c=await a.get();if(typeof c!="string")throw new TypeError(`container "${this.lunoraName}": Secrets Store binding "${s}" (env "${r}") did not resolve to a string value.`);e[r]=c}this.envVars={...this.envVars,...e}})().catch(n=>{throw this.lunoraSecretsStoreResolved=void 0,n}),await this.lunoraSecretsStoreResolved)}async awaitContainerReadiness(){if(this.lunoraReadyOn.length===0)return;const{container:t}=this.ctx;if(t===void 0)return;const n=Date.now()+w;await Promise.all(this.lunoraReadyOn.map(async e=>this.awaitReadinessCheck(t,e,n)))}async awaitReadinessCheck(t,n,e){const r=n.port??this.lunoraDefaultPort;if(r===void 0)throw new u("INTERNAL",`container "${this.lunoraName}": readyOn check "${n.path}" has no port — set the check's \`port\` or the container \`defaultPort\`.`);const s=n.status??200,a=n.path.startsWith("/")?n.path:`/${n.path}`,c=t.getTcpPort(r);for(;;){const d=Math.max(v,e-Date.now()),l=f(void 0,d,()=>new DOMException(`readiness probe timed out after ${String(d)}ms`,"TimeoutError"));try{if((await c.fetch(`http://container${a}`,{signal:l.signal})).status===s)return}catch{}finally{l.dispose()}if(Date.now()>=e)throw new u("INTERNAL",`container "${this.lunoraName}": readiness check "${n.path}" (port ${String(r)}) did not return ${String(s)} within ${String(w)}ms`);await new Promise(p=>{setTimeout(p,v)})}}surfaceInStudioLogs(t){I(this.env,t,this.lunoraJurisdiction).catch(()=>{})}instanceId(){try{const{id:t}=this.ctx;return typeof t?.toString=="function"?t.toString():"unknown"}catch{return"unknown"}}}export{D as ContainerProxy,L as LunoraContainer,M as outboundParams};

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { D as DurableObjectJurisdiction, a as ContainerConfig, C as ContainerDefinition, b as ContainerImageSource, N as NormalizedContainerImage } from "./packem_shared/jurisdiction.d-KcQu2ZT_.mjs";
-export type { B as BuildImageSource, c as ContainerInstanceType, d as ContainerReadinessCheck, e as ContainerRollout, f as CustomContainerInstanceType, g as NamedContainerInstanceType, R as RegistryImageSource } from "./packem_shared/jurisdiction.d-KcQu2ZT_.mjs";
+import { D as DurableObjectJurisdiction, a as ContainerConfig, C as ContainerDefinition, b as ContainerImageSource, N as NormalizedContainerImage } from "./packem_shared/jurisdiction.d-rC2ejtvT.mjs";
+export type { B as BuildImageSource, c as ContainerInstanceType, d as ContainerReadinessCheck, e as ContainerRollout, f as CustomContainerInstanceType, g as NamedContainerInstanceType, R as RegistryImageSource } from "./packem_shared/jurisdiction.d-rC2ejtvT.mjs";
 /**
  * Per-call options for `ContainerHandle.exec`.
  */

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { D as DurableObjectJurisdiction, a as ContainerConfig, C as ContainerDefinition, b as ContainerImageSource, N as NormalizedContainerImage } from "./packem_shared/jurisdiction.d-KcQu2ZT_.js";
-export type { B as BuildImageSource, c as ContainerInstanceType, d as ContainerReadinessCheck, e as ContainerRollout, f as CustomContainerInstanceType, g as NamedContainerInstanceType, R as RegistryImageSource } from "./packem_shared/jurisdiction.d-KcQu2ZT_.js";
+import { D as DurableObjectJurisdiction, a as ContainerConfig, C as ContainerDefinition, b as ContainerImageSource, N as NormalizedContainerImage } from "./packem_shared/jurisdiction.d-rC2ejtvT.js";
+export type { B as BuildImageSource, c as ContainerInstanceType, d as ContainerReadinessCheck, e as ContainerRollout, f as CustomContainerInstanceType, g as NamedContainerInstanceType, R as RegistryImageSource } from "./packem_shared/jurisdiction.d-rC2ejtvT.js";
 /**
  * Per-call options for `ContainerHandle.exec`.
  */

package/dist/packem_shared/{jurisdiction.d-KcQu2ZT_.d.mts → jurisdiction.d-rC2ejtvT.d.mts}

@@ -138,8 +138,10 @@ interface ContainerConfig {
    * of activity — a runaway-cost backstop on top of the idle
    * {@link ContainerConfig.sleepAfter}. Same grammar as `sleepAfter`
    * (`"30s"`, `"5m"`, `"1h"`, or a plain number of seconds). When it elapses,
-   * the `LunoraContainer.onHardTimeoutExpired` hook runs (default: `stop()`).
-   * (Upstream cloudflare/containers#85.)
+   * the `LunoraContainer.onHardTimeoutExpired` hook runs (default: `stop()`,
+   * which sends SIGTERM and does not escalate — a container that ignores the
+   * signal outlives its cap unless the hook is overridden to follow up with
+   * `destroy()`). (Upstream cloudflare/containers#85.)
    */
   hardTimeout?: number | string;
   /** Image source — a local Dockerfile path/directory or a registry reference. */

package/dist/packem_shared/{jurisdiction.d-KcQu2ZT_.d.ts → jurisdiction.d-rC2ejtvT.d.ts}

@@ -138,8 +138,10 @@ interface ContainerConfig {
    * of activity — a runaway-cost backstop on top of the idle
    * {@link ContainerConfig.sleepAfter}. Same grammar as `sleepAfter`
    * (`"30s"`, `"5m"`, `"1h"`, or a plain number of seconds). When it elapses,
-   * the `LunoraContainer.onHardTimeoutExpired` hook runs (default: `stop()`).
-   * (Upstream cloudflare/containers#85.)
+   * the `LunoraContainer.onHardTimeoutExpired` hook runs (default: `stop()`,
+   * which sends SIGTERM and does not escalate — a container that ignores the
+   * signal outlives its cap unless the hook is overridden to follow up with
+   * `destroy()`). (Upstream cloudflare/containers#85.)
    */
   hardTimeout?: number | string;
   /** Image source — a local Dockerfile path/directory or a registry reference. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/container",
-  "version": "1.0.0-alpha.42",
+  "version": "1.0.0-alpha.44",
   "description": "Cloudflare Containers for Lunora: defineContainer, generated Container DO classes, and the ctx.containers action surface",
   "keywords": [
     "cloudflare",
@@ -56,7 +56,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.30"
+    "@lunora/errors": "1.0.0-alpha.31"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"