alchemy 2.0.0-beta.59 → 2.0.0-beta.60

package/src/Cloudflare/Access/Application.ts

@@ -3,6 +3,7 @@ import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 
+import { Unowned } from "../../AdoptPolicy.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
@@ -312,25 +313,47 @@ export const ApplicationProvider = () =>
       }
     }),
 
-    read: Effect.fn(function* ({ output }) {
+    read: Effect.fn(function* ({ output, olds }) {
       const { accountId } = yield* yield* CloudflareEnvironment;
 
-      if (!output?.applicationId) return undefined;
-      const observed = yield* observeById(accountId, output.applicationId);
+      // Prefer the persisted physical id. After state loss there is no
+      // applicationId to probe, so fall back to matching an existing app
+      // by domain — without this the engine plans a blind `create`, and
+      // Cloudflare happily creates a second application on the same
+      // domain with a fresh `aud`, silently breaking existing JWT
+      // validation. Warp apps are excluded from the fallback: they are a
+      // per-account singleton that `reconcile` already recovers.
+      let observed: ObservedApp | undefined;
+      if (output?.applicationId) {
+        observed = yield* observeById(accountId, output.applicationId);
+      } else if (olds?.type !== "warp" && typeof olds?.domain === "string") {
+        observed = yield* findByDomain(accountId, olds.domain);
+      } else {
+        return undefined;
+      }
       if (!observed?.id || !observed.aud || !observed.type) {
         return undefined;
       }
-      return {
+      const domain = observed.domain ?? output?.domain ?? olds?.domain;
+      const name = observed.name ?? output?.name;
+      if (domain === undefined || name === undefined) {
+        return undefined;
+      }
+      const attrs = {
         applicationId: observed.id,
         aud: observed.aud,
-        domain: observed.domain ?? output.domain,
-        destinations: observed.destinations ?? output.destinations,
+        domain,
+        destinations: observed.destinations ?? output?.destinations,
         type: observed.type,
-        name: observed.name ?? output.name,
-        accountId: output.accountId,
-        createdAt: observed.createdAt ?? output.createdAt,
-        updatedAt: observed.updatedAt ?? output.updatedAt,
+        name,
+        accountId: output?.accountId ?? accountId,
+        createdAt: observed.createdAt ?? output?.createdAt,
+        updatedAt: observed.updatedAt ?? output?.updatedAt,
       } satisfies ApplicationAttributes;
+      // Recovered by id → positively ours. Recovered by domain scan →
+      // existence is certain but ownership is not (Access applications
+      // carry no alchemy marker), so gate takeover behind `--adopt`.
+      return output?.applicationId ? attrs : Unowned(attrs);
     }),
 
     reconcile: Effect.fn(function* ({ id, news, output }) {
@@ -532,6 +555,10 @@ const resolveAllowedIdps = (
 const findWarpApp = (accountId: string) =>
   zeroTrust.listAccessApplicationsForAccount.items({ accountId }).pipe(
     Stream.runCollect,
+    // A sibling app mid-teardown can transiently reject the whole
+    // enumeration (AccessReferenceNotFound), and Cloudflare 403s when
+    // throttling — same transient windows `list` rides out.
+    retryTransientAccessError,
     Effect.map((chunk) =>
       Array.from(chunk).find(
         (a) => (a as { type?: string | null }).type === "warp",
@@ -544,6 +571,30 @@ const findWarpApp = (accountId: string) =>
     ),
   );
 
+// Cold-recovery scan for `read` when no applicationId was persisted:
+// match an existing application by its domain (unique per account for
+// non-warp app types).
+const findByDomain = (accountId: string, domain: string) =>
+  zeroTrust.listAccessApplicationsForAccount.items({ accountId }).pipe(
+    Stream.runCollect,
+    // A sibling app mid-teardown can transiently reject the whole
+    // enumeration (AccessReferenceNotFound), and Cloudflare 403s when
+    // throttling. A missed scan here is worse than a slow one: the engine
+    // would plan a blind `create` and either duplicate the app or trip
+    // Cloudflare's `application_already_exists` Conflict.
+    retryTransientAccessError,
+    Effect.map((chunk) =>
+      Array.from(chunk).find(
+        (a) => (a as { domain?: string | null }).domain === domain,
+      ),
+    ),
+    Effect.map((found) =>
+      found === undefined
+        ? undefined
+        : narrowApp(found as Parameters<typeof narrowApp>[0]),
+    ),
+  );
+
 const observeById = (accountId: string, appId: string) =>
   Effect.gen(function* () {
     const r = yield* zeroTrust

package/src/Cloudflare/Alerting/Webhook.ts

@@ -234,13 +234,24 @@ export const NotificationWebhookProvider = () =>
         olds?.secret === undefined ? undefined : Redacted.value(olds.secret);
       const secretChanged = secret !== oldSecret;
       if (observed.name !== name || observed.url !== url || secretChanged) {
-        yield* alerting.updateDestinationWebhook({
-          accountId,
-          webhookId: observed.id,
-          name,
-          url,
-          secret,
-        });
+        // The update PUT fires the same test POST as create — ride out edge
+        // propagation of a just-deployed destination URL the same way.
+        yield* alerting
+          .updateDestinationWebhook({
+            accountId,
+            webhookId: observed.id,
+            name,
+            url,
+            secret,
+          })
+          .pipe(
+            Effect.retry({
+              while: (e) => e._tag === "WebhookTestFailed",
+              schedule: Schedule.exponential("1 second").pipe(
+                Schedule.both(Schedule.recurs(5)),
+              ),
+            }),
+          );
         const fresh = yield* observeWebhook(accountId, observed.id);
         return toWebhookAttributes(fresh ?? observed, accountId);
       }

package/src/Cloudflare/AnalyticsEngine/WriteDataset.ts

@@ -10,7 +10,7 @@ import type { Dataset as AnalyticsEngineDatasetLike } from "./Dataset.ts";
  *
  * `WriteDataset` is a single identifier that is simultaneously the binding's
  * Context tag, its type, and the callable —
- * `yield* Cloudflare.AnalyticsEngineDataset.WriteDataset(dataset)`.
+ * `yield* Cloudflare.AnalyticsEngine.WriteDataset(dataset)`.
  *
  * @binding
  * @product Analytics Engine
@@ -18,7 +18,7 @@ import type { Dataset as AnalyticsEngineDatasetLike } from "./Dataset.ts";
  *
  * @example Write a data point inside a Worker
  * ```typescript
- * const analytics = yield* Cloudflare.AnalyticsEngineDataset.WriteDataset(Dataset);
+ * const analytics = yield* Cloudflare.AnalyticsEngine.WriteDataset(Dataset);
  * yield* analytics.writeDataPoint({ blobs: ["signup"] });
  * ```
  */

package/src/Cloudflare/ApiToken/AccountApiToken.ts

@@ -255,6 +255,10 @@ export const AccountApiTokenProvider = () =>
           // `TokenNotFound`. Either is fine; we just want the resource gone.
           Effect.catchTag("InvalidRoute", () => Effect.void),
           Effect.catchTag("TokenNotFound", () => Effect.void),
+          // Cloudflare-managed tokens (e.g. "Cloudflare Resource Tagging
+          // System") can never be deleted (code 1001). We don't own them, so
+          // treat the refusal as a no-op rather than a failure.
+          Effect.catchTag("TokenManagedByCloudflare", () => Effect.void),
         );
     }),
     list: Effect.fn(function* () {

package/src/Cloudflare/Auth/AuthProvider.ts

@@ -105,7 +105,7 @@ const selectAccount = (accessToken: string) =>
     const response = yield* list({});
     const accounts = response.result;
     if (accounts.length === 0) {
-      yield* new AuthError({
+      return yield* new AuthError({
         message: "Cloudflare: no accounts found for this credential.",
       });
     }

package/src/Cloudflare/Containers/Container.ts

@@ -43,6 +43,45 @@ export class ContainerError extends Data.TaggedError("ContainerError")<{
   readonly cause?: unknown;
 }> {}
 
+/**
+ * No container instance could be allocated within the start budget — the
+ * account is at its concurrent-instance cap (`maxInstances`) or the platform
+ * is still provisioning. Mirrors `@cloudflare/containers`'
+ * `NO_CONTAINER_INSTANCE_ERROR` (surfaced as HTTP 503 by native).
+ */
+export class NoContainerInstanceError extends Data.TaggedError(
+  "NoContainerInstanceError",
+)<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+/**
+ * Cloudflare is rate limiting container starts ("too many containers per
+ * second"). Mirrors `@cloudflare/containers`' `RATE_LIMITED_ERROR` (HTTP 429).
+ * Hammering `start()` while rate limited only prolongs it, so callers should
+ * back off rather than retry tightly.
+ */
+export class ContainerRateLimitedError extends Data.TaggedError(
+  "ContainerRateLimitedError",
+)<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+/**
+ * The container instance exited/crashed while we were waiting for its port —
+ * the entrypoint failed to bind or died. Mirrors native's "container exited"
+ * detection (`!this.container.running` mid-wait); not curable by continuing to
+ * poll the same instance.
+ */
+export class ContainerCrashedError extends Data.TaggedError(
+  "ContainerCrashedError",
+)<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
 export interface ContainerStartupOptions extends cf.ContainerStartupOptions {}
 
 /**
@@ -50,7 +89,7 @@ export interface ContainerStartupOptions extends cf.ContainerStartupOptions {}
  * {@link main} and bakes it in as the container's entrypoint.
  */
 export interface EffectfulContainerProps extends ContainerApplicationProps {
-  /** Entrypoint file for the Effect program, typically `import.meta.filename`. */
+  /** Entrypoint file for the Effect program, typically `import.meta.url`. */
   main: string;
 }
 /**
@@ -154,7 +193,7 @@ export type Container<Id extends string = string> = Named<Id> & {
  * ```typescript
  * // src/Sandbox.runtime.ts — props are the first argument to `.make()`
  * export default Sandbox.make(
- *   { main: import.meta.filename },
+ *   { main: import.meta.url },
  *   Effect.gen(function* () {
  *     const cp = yield* ChildProcessSpawner;
  *
@@ -202,7 +241,7 @@ export type Container<Id extends string = string> = Named<Id> & {
  * >()("Sandbox") {}
  *
  * export default Sandbox.make(
- *   { main: import.meta.filename },
+ *   { main: import.meta.url },
  *   Effect.gen(function* () {
  *     return Sandbox.of({
  *       ping: () => Effect.succeed("pong"),
@@ -265,7 +304,7 @@ export type Container<Id extends string = string> = Named<Id> & {
  * ```typescript
  * export const SandboxLive = Sandbox.make(
  *   Stack.useSync((stack) => ({
- *     main: import.meta.filename,
+ *     main: import.meta.url,
  *     instanceType: stack.stage === "prod" ? "standard-1" : "dev",
  *     observability: { logs: { enabled: true } },
  *   })),

package/src/Cloudflare/Containers/ContainerApplication.ts

@@ -149,13 +149,17 @@ export interface ContainerApplicationProps extends PlatformProps {
    */
   dockerfile?: string;
   /**
-   * Initial number of instances to maintain.
-   * @default 1
+   * Initial number of instances to maintain. Matches wrangler, which forces
+   * this to 0 whenever {@link maxInstances} is set (pure scale-from-zero).
+   * @default 0
    */
   instances?: number;
   /**
-   * Maximum number of instances the application may scale to.
-   * @default 1
+   * Maximum number of instances the application may scale to. Matches
+   * wrangler's default of 20. A value of 1 serializes every Durable Object
+   * instance through a single container slot, so the default lets containers
+   * scale concurrently out of the box.
+   * @default 20
    */
   maxInstances?: number;
   /**
@@ -164,8 +168,10 @@ export interface ContainerApplicationProps extends PlatformProps {
    */
   schedulingPolicy?: ContainerApplication.SchedulingPolicy;
   /**
-   * Instance type for each deployment.
-   * @default "dev"
+   * Instance type for each deployment. Defaults to wrangler's `"lite"` tier
+   * (1/16 vCPU, 256 MiB, 2 GB disk) when no explicit {@link vcpu}/{@link memory}/
+   * {@link disk} is set. (`"dev"` is wrangler's deprecated alias for `"lite"`.)
+   * @default "lite"
    */
   instanceType?: ContainerApplication.InstanceType;
   /**
@@ -285,7 +291,7 @@ export type ContainerShape = Main<ContainerServices>;
  * import * as Cloudflare from "alchemy/Cloudflare";
  *
  * export class Sandbox extends Cloudflare.Container<Sandbox>()("Sandbox", {
- *   main: import.meta.filename,
+ *   main: import.meta.url,
  * }) {}
  * ```
  *
@@ -297,7 +303,7 @@ export type ContainerShape = Main<ContainerServices>;
  * @example Named container with a non-default handler export
  * ```typescript
  * export class Worker extends Cloudflare.Container<Worker>()("Worker", {
- *   main: import.meta.filename,
+ *   main: import.meta.url,
  *   handler: "runWorker",
  *   name: "background-worker",
  * }) {}
@@ -346,7 +352,7 @@ export type ContainerShape = Main<ContainerServices>;
  * @example Node runtime with external native deps
  * ```typescript
  * export class ImageApi extends Cloudflare.Container<ImageApi>()("ImageApi", {
- *   main: import.meta.filename,
+ *   main: import.meta.url,
  *   runtime: "node",
  *   external: ["sharp"],
  *   autoInstallExternals: true,
@@ -360,7 +366,7 @@ export type ContainerShape = Main<ContainerServices>;
  * @example Custom Dockerfile base and registry
  * ```typescript
  * export class Custom extends Cloudflare.Container<Custom>()("Custom", {
- *   main: import.meta.filename,
+ *   main: import.meta.url,
  *   dockerfile: "FROM oven/bun:1\nRUN apt-get update && apt-get install -y ffmpeg",
  *   autoInstallExternals: false,
  *   registryId: "registry.cloudflare.com",
@@ -380,7 +386,7 @@ export type ContainerShape = Main<ContainerServices>;
  * @example Autoscaling with a larger instance type
  * ```typescript
  * export class Sandbox extends Cloudflare.Container<Sandbox>()("Sandbox", {
- *   main: import.meta.filename,
+ *   main: import.meta.url,
  *   instanceType: "standard-1",
  *   instances: 1,
  *   maxInstances: 5,
@@ -394,7 +400,7 @@ export type ContainerShape = Main<ContainerServices>;
  * @example Explicit CPU, memory, and disk overrides
  * ```typescript
  * export class Heavy extends Cloudflare.Container<Heavy>()("Heavy", {
- *   main: import.meta.filename,
+ *   main: import.meta.url,
  *   vcpu: 2,
  *   memory: "4GB",
  *   disk: { size: "10GB" },
@@ -413,7 +419,7 @@ export type ContainerShape = Main<ContainerServices>;
  * @example Environment variables, secrets, and a command override
  * ```typescript
  * export class Api extends Cloudflare.Container<Api>()("Api", {
- *   main: import.meta.filename,
+ *   main: import.meta.url,
  *   environmentVariables: [{ name: "LOG_LEVEL", value: "info" }],
  *   secrets: [{ name: "API_KEY", type: "env", secret: "my-stored-secret" }],
  *   command: ["bun", "run", "start"],
@@ -429,7 +435,7 @@ export type ContainerShape = Main<ContainerServices>;
  * @example Passing env and selecting runtime exports
  * ```typescript
  * export class Job extends Cloudflare.Container<Job>()("Job", {
- *   main: import.meta.filename,
+ *   main: import.meta.url,
  *   env: { REGION: "wnam", FEATURE_FLAG: "on" },
  *   exports: ["default"],
  * }) {}
@@ -446,7 +452,7 @@ export type ContainerShape = Main<ContainerServices>;
  * @example Ports, network mode, DNS, and a health check
  * ```typescript
  * export class Web extends Cloudflare.Container<Web>()("Web", {
- *   main: import.meta.filename,
+ *   main: import.meta.url,
  *   ports: [{ name: "http", port: 8080 }],
  *   network: { assignIpv4: "predefined", mode: "public" },
  *   dns: { servers: ["1.1.1.1"], searches: ["internal"] },
@@ -466,7 +472,7 @@ export type ContainerShape = Main<ContainerServices>;
  * @example Enable logs and grant SSH access
  * ```typescript
  * export class Api extends Cloudflare.Container<Api>()("Api", {
- *   main: import.meta.filename,
+ *   main: import.meta.url,
  *   observability: { logs: { enabled: true } },
  *   sshPublicKeyIds: ["ssh-key-id-123"],
  * }) {}
@@ -484,7 +490,7 @@ export type ContainerShape = Main<ContainerServices>;
  * @example Pin scheduling policy and placement
  * ```typescript
  * export class Edge extends Cloudflare.Container<Edge>()("Edge", {
- *   main: import.meta.filename,
+ *   main: import.meta.url,
  *   schedulingPolicy: "regional",
  *   constraints: { tier: 1 },
  *   affinities: { colocation: "datacenter" },
@@ -503,7 +509,7 @@ export type ContainerShape = Main<ContainerServices>;
  * @example Progressive rollout on update
  * ```typescript
  * export class Api extends Cloudflare.Container<Api>()("Api", {
- *   main: import.meta.filename,
+ *   main: import.meta.url,
  *   instances: 4,
  *   maxInstances: 4,
  *   rollout: { strategy: "rolling", stepPercentage: 25 },

package/src/Cloudflare/Containers/ContainerBundle.ts

@@ -1,9 +1,8 @@
 import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
 import * as Redacted from "effect/Redacted";
 import type * as rolldown from "rolldown";
 import * as Bundle from "../../Bundle/Bundle.ts";
-import { findCwdForBundle } from "../../Bundle/TempRoot.ts";
+import { findCwdForBundle, resolveMainPath } from "../../Bundle/TempRoot.ts";
 import * as Output from "../../Output.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import { Self } from "../../Self.ts";
@@ -146,11 +145,10 @@ export const bundleContainerProgram = Effect.fn(function* ({
   external?: string[];
   outdir?: string;
 }) {
-  const fs = yield* FileSystem.FileSystem;
   const stack = yield* Stack;
   const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
 
-  const realMain = yield* fs.realPath(main);
+  const realMain = yield* resolveMainPath(main);
   const cwd = yield* findCwdForBundle(realMain);
 
   const buildBundle = Effect.fn(function* (

package/src/Cloudflare/Containers/ContainerPlatform.ts

@@ -5,7 +5,7 @@ import * as Redacted from "effect/Redacted";
 import { HttpServer, type HttpEffect } from "../../Http.ts";
 import * as Output from "../../Output.ts";
 import { Platform } from "../../Platform.ts";
-import { type Rpc, serveRpc } from "../../Rpc.ts";
+import { serveRpc, type Rpc } from "../../Rpc.ts";
 import * as Server from "../../Server/index.ts";
 import type { Fetcher } from "../Fetcher.ts";
 import { fromCloudflareFetcher, toCloudflareFetcher } from "../Fetcher.ts";
@@ -53,7 +53,7 @@ export const ContainerPlatform: Platform<
               );
               if (httpServer) {
                 yield* httpServer.serve(finalHandler);
-                yield* Effect.never;
+                return yield* Effect.never;
               } else {
                 // this should only happen at plantime, validate?
               }
@@ -192,7 +192,7 @@ export const ContainerPlatform: Platform<
               fromCloudflareFetcher(state.container!.getTcpPort(port)),
             ),
           setInactivityTimeout: (durationMs: number | bigint) =>
-            Effect.sync(() =>
+            Effect.promise(() =>
               state.container!.setInactivityTimeout(durationMs),
             ),
           interceptOutboundHttp: (addr: string, binding: Fetcher) =>

package/src/Cloudflare/Containers/ContainerProvider.ts

@@ -5,17 +5,10 @@ import * as Path from "effect/Path";
 import * as Schedule from "effect/Schedule";
 import { Unowned } from "../../AdoptPolicy.ts";
 import { AlchemyContext } from "../../AlchemyContext.ts";
-import { hashDirectory } from "../../Command/Memo.ts";
-import {
-  dockerBuild,
-  dockerTag,
-  materializeDockerfile,
-  pushImage,
-  runDockerCommand,
-  writeContextFiles,
-} from "../../Bundle/Docker.ts";
 import { getStableContextDir } from "../../Bundle/TempRoot.ts";
+import { hashDirectory } from "../../Command/Memo.ts";
 import { deepEqual, isResolved } from "../../Diff.ts";
+import { Docker } from "../../Docker/Docker.ts";
 import * as Provider from "../../Provider.ts";
 import { type ResourceBinding } from "../../Resource.ts";
 import { sha256Object } from "../../Util/sha256.ts";
@@ -65,6 +58,7 @@ export const LiveContainerProvider = () =>
       const { dotAlchemy } = yield* AlchemyContext;
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
+      const docker = yield* Docker;
 
       const telemetry = yield* CloudflareLogs;
 
@@ -116,7 +110,17 @@ export const LiveContainerProvider = () =>
       ) =>
         normalizeNulls({
           image: imageRef,
-          instanceType: props.instanceType,
+          // Default to wrangler's instance type ("lite") so containers schedule
+          // the same way out of the box. `instance_type` is mutually exclusive
+          // with explicit vcpu/memory/disk, so only default it when none are
+          // set. ("dev" is wrangler's deprecated alias for "lite".)
+          instanceType:
+            props.instanceType ??
+            (props.vcpu === undefined &&
+            props.memory === undefined &&
+            props.disk === undefined
+              ? "lite"
+              : undefined),
           observability: props.observability,
           sshPublicKeyIds: props.sshPublicKeyIds,
           secrets: props.secrets,
@@ -136,6 +140,28 @@ export const LiveContainerProvider = () =>
           checks: props.checks,
         }) as ContainerApplication.Configuration;
 
+      // Scaling/placement defaults mirror wrangler's container defaults
+      // (`wrangler-dist/cli.js`) so an Alchemy container behaves like a
+      // `wrangler deploy`d one without extra config:
+      //   - max_instances: 20            (`container.max_instances ?? 20`)
+      //   - instances: 0                 (wrangler forces 0 whenever
+      //                                    max_instances is set, which we always
+      //                                    do — pure scale-from-zero)
+      //   - scheduling_policy: "default"
+      // (wrangler also defaults `constraints.tiers` to `[1, 2]`, but the
+      // distilled SDK models constraints as singular `tier`, not the `tiers`
+      // array, so we leave constraints untouched — it's a minor placement hint
+      // next to the scaling defaults.)
+      // A maxInstances default of 1 (the previous value) silently serialised
+      // every Durable Object instance through a single container slot, which is
+      // the dominant cause of "containers are slow under load".
+      const scalingDefaults = (props: ContainerApplicationProps) => ({
+        instances: props.instances ?? 0,
+        maxInstances: props.maxInstances ?? 20,
+        schedulingPolicy: props.schedulingPolicy ?? "default",
+        constraints: props.constraints ?? {},
+      });
+
       const computeImage = Effect.fn(function* (
         id: string,
         props: ContainerApplicationProps,
@@ -226,13 +252,8 @@ export const LiveContainerProvider = () =>
           if (session) {
             yield* session.note(`Pulling container image ${build.image}...`);
           }
-          yield* runDockerCommand([
-            "pull",
-            "--platform",
-            platform,
-            build.image,
-          ]);
-          yield* dockerTag(build.image, imageRef);
+          yield* docker.image.pull(build.image, platform);
+          yield* docker.image.tag(build.image, imageRef);
         } else if (build.kind === "external") {
           // Build the user's Dockerfile directly against their context dir so
           // relative `COPY`/`ADD` paths resolve as the author intended.
@@ -242,11 +263,11 @@ export const LiveContainerProvider = () =>
           if (session) {
             yield* session.note(`Building container image ${imageRef}...`);
           }
-          yield* dockerBuild({
+          yield* docker.image.build({
             tag: imageRef,
             context: build.context,
             platform,
-            extraArgs: ["-f", build.dockerfile],
+            file: build.dockerfile,
           });
         } else {
           // Effect-native program: materialize the generated Dockerfile and
@@ -269,19 +290,15 @@ export const LiveContainerProvider = () =>
             props.external,
             props.autoInstallExternals,
           );
-          yield* materializeDockerfile(finalDockerfile, contextDir);
-          yield* writeContextFiles(
-            contextDir,
-            build.files.map((f, i) => ({
-              // Keep the entry rename to `index.mjs` so the Dockerfile
-              // ENTRYPOINT (`ENTRYPOINT ["bun", "/app/index.mjs"]`) stays
-              // valid; preserve rolldown-assigned fileNames for every other
-              // chunk so intra-bundle relative imports resolve at runtime.
+          yield* docker.materialize({
+            context: contextDir,
+            dockerfile: finalDockerfile,
+            files: build.files.map((f, i) => ({
               path: i === 0 ? "index.mjs" : f.path,
               content: f.content,
             })),
-          );
-          yield* dockerBuild({
+          });
+          yield* docker.image.build({
             tag: imageRef,
             context: contextDir,
             platform,
@@ -312,7 +329,7 @@ export const LiveContainerProvider = () =>
           );
         }
 
-        yield* pushImage(imageRef, {
+        yield* docker.image.push(imageRef, {
           username,
           password: credentials.password,
           server: registryId,
@@ -435,10 +452,7 @@ export const LiveContainerProvider = () =>
         const application = yield* Containers.createContainerApplication({
           accountId,
           name,
-          instances: news.instances ?? 1,
-          maxInstances: news.maxInstances ?? 1,
-          schedulingPolicy: news.schedulingPolicy ?? "default",
-          constraints: news.constraints ?? {},
+          ...scalingDefaults(news),
           affinities: news.affinities,
           configuration,
           durableObjects,
@@ -533,10 +547,7 @@ export const LiveContainerProvider = () =>
           Containers.updateContainerApplication({
             accountId,
             applicationId: existing.applicationId,
-            instances: news.instances ?? 1,
-            maxInstances: news.maxInstances ?? 1,
-            schedulingPolicy: news.schedulingPolicy ?? "default",
-            constraints: news.constraints ?? {},
+            ...scalingDefaults(news),
             affinities: news.affinities,
             configuration,
           }),
@@ -559,10 +570,7 @@ export const LiveContainerProvider = () =>
               return yield* Containers.createContainerApplication({
                 accountId,
                 name: existing.applicationName,
-                instances: news.instances ?? 1,
-                maxInstances: news.maxInstances ?? 1,
-                schedulingPolicy: news.schedulingPolicy ?? "default",
-                constraints: news.constraints ?? {},
+                ...scalingDefaults(news),
                 affinities: news.affinities,
                 configuration,
                 durableObjects,