alchemy 2.0.0-beta.82 → 2.0.0-beta.83

package/lib/State/HttpStateApi.d.ts

@@ -107,37 +107,37 @@ export declare const VersionResponse: Schema.Struct<{
 export declare const GetVersion: HttpApiEndpoint.HttpApiEndpoint<"getVersion", "GET", "/version", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
     readonly version: Schema.Number;
 }>>, never, never, never>;
-declare const StateGroup_base: HttpApiGroup.HttpApiGroup<"state", HttpApiEndpoint.HttpApiEndpoint<"listStacks", "GET", "/state/stacks", never, never, never, never, Schema.toCodecJson<Schema.$Array<Schema.String>>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"listStages", "GET", "/state/stacks/:stack/stages", Schema.toCodecStringTree<Schema.Struct<{
-    readonly stack: Schema.String;
-}>>, never, never, never, Schema.toCodecJson<Schema.$Array<Schema.String>>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"deleteStack", "DELETE", "/state/stacks/:stack", Schema.toCodecStringTree<Schema.Struct<{
+declare const StateGroup_base: HttpApiGroup.HttpApiGroup<"state", HttpApiEndpoint.HttpApiEndpoint<"deleteStack", "DELETE", "/state/stacks/:stack", Schema.toCodecStringTree<Schema.Struct<{
     readonly stack: Schema.String;
 }>>, Schema.toCodecStringTree<Schema.Struct<{
     readonly stage: Schema.optional<Schema.String>;
-}>>, never, never, Schema.toCodecJson<HttpApiSchema.NoContent>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"getReplacedResources", "GET", "/state/stacks/:stack/stages/:stage/replaced-resources", Schema.toCodecStringTree<Schema.Struct<{
+}>>, never, never, Schema.toCodecJson<HttpApiSchema.NoContent>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"deleteState", "DELETE", "/state/stacks/:stack/stages/:stage/resources/:fqn", Schema.toCodecStringTree<Schema.Struct<{
     readonly stack: Schema.String;
     readonly stage: Schema.String;
-}>>, never, never, never, Schema.toCodecJson<Schema.$Array<Schema.Any>>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"listResources", "GET", "/state/stacks/:stack/stages/:stage/resources", Schema.toCodecStringTree<Schema.Struct<{
+    readonly fqn: Schema.String;
+}>>, never, never, never, Schema.toCodecJson<HttpApiSchema.NoContent>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"getReplacedResources", "GET", "/state/stacks/:stack/stages/:stage/replaced-resources", Schema.toCodecStringTree<Schema.Struct<{
     readonly stack: Schema.String;
     readonly stage: Schema.String;
-}>>, never, never, never, Schema.toCodecJson<Schema.$Array<Schema.String>>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"setStackOutput", "PUT", "/state/stacks/:stack/stages/:stage/output", Schema.toCodecStringTree<Schema.Struct<{
+}>>, never, never, never, Schema.toCodecJson<Schema.$Array<Schema.Any>>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"getStackOutput", "GET", "/state/stacks/:stack/stages/:stage/output", Schema.toCodecStringTree<Schema.Struct<{
     readonly stack: Schema.String;
     readonly stage: Schema.String;
-}>>, never, Schema.toCodecJson<Schema.Any>, never, Schema.toCodecJson<Schema.Any>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"getStackOutput", "GET", "/state/stacks/:stack/stages/:stage/output", Schema.toCodecStringTree<Schema.Struct<{
+}>>, never, never, never, Schema.toCodecJson<Schema.UndefinedOr<Schema.Any>>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"getState", "GET", "/state/stacks/:stack/stages/:stage/resources/:fqn", Schema.toCodecStringTree<Schema.Struct<{
     readonly stack: Schema.String;
     readonly stage: Schema.String;
-}>>, never, never, never, Schema.toCodecJson<Schema.UndefinedOr<Schema.Any>>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"setState", "PUT", "/state/stacks/:stack/stages/:stage/resources/:fqn", Schema.toCodecStringTree<Schema.Struct<{
+    readonly fqn: Schema.String;
+}>>, never, never, never, Schema.toCodecJson<Schema.UndefinedOr<Schema.Any>>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"listResources", "GET", "/state/stacks/:stack/stages/:stage/resources", Schema.toCodecStringTree<Schema.Struct<{
     readonly stack: Schema.String;
     readonly stage: Schema.String;
-    readonly fqn: Schema.String;
-}>>, never, Schema.toCodecJson<Schema.Any>, never, Schema.toCodecJson<Schema.Any>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"deleteState", "DELETE", "/state/stacks/:stack/stages/:stage/resources/:fqn", Schema.toCodecStringTree<Schema.Struct<{
+}>>, never, never, never, Schema.toCodecJson<Schema.$Array<Schema.String>>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"listStacks", "GET", "/state/stacks", never, never, never, never, Schema.toCodecJson<Schema.$Array<Schema.String>>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"listStages", "GET", "/state/stacks/:stack/stages", Schema.toCodecStringTree<Schema.Struct<{
+    readonly stack: Schema.String;
+}>>, never, never, never, Schema.toCodecJson<Schema.$Array<Schema.String>>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"setStackOutput", "PUT", "/state/stacks/:stack/stages/:stage/output", Schema.toCodecStringTree<Schema.Struct<{
     readonly stack: Schema.String;
     readonly stage: Schema.String;
-    readonly fqn: Schema.String;
-}>>, never, never, never, Schema.toCodecJson<HttpApiSchema.NoContent>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"getState", "GET", "/state/stacks/:stack/stages/:stage/resources/:fqn", Schema.toCodecStringTree<Schema.Struct<{
+}>>, never, Schema.toCodecJson<Schema.Any>, never, Schema.toCodecJson<Schema.Any>, never, StateAuth, BearerTokenValidator> | HttpApiEndpoint.HttpApiEndpoint<"setState", "PUT", "/state/stacks/:stack/stages/:stage/resources/:fqn", Schema.toCodecStringTree<Schema.Struct<{
     readonly stack: Schema.String;
     readonly stage: Schema.String;
     readonly fqn: Schema.String;
-}>>, never, never, never, Schema.toCodecJson<Schema.UndefinedOr<Schema.Any>>, never, StateAuth, BearerTokenValidator>, false>;
+}>>, never, Schema.toCodecJson<Schema.Any>, never, Schema.toCodecJson<Schema.Any>, never, StateAuth, BearerTokenValidator>, false>;
 export declare class StateGroup extends StateGroup_base {
 }
 declare const VersionGroup_base: HttpApiGroup.HttpApiGroup<"version", HttpApiEndpoint.HttpApiEndpoint<"getVersion", "GET", "/version", never, never, never, never, Schema.toCodecJson<Schema.Struct<{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alchemy",
-  "version": "2.0.0-beta.82",
+  "version": "2.0.0-beta.83",
   "description": "Infrastructure as Effects for TypeScript.",
   "keywords": [
     "alchemy",
@@ -333,9 +333,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@alchemy.run/cloudflare-runtime": "2.0.0-beta.82",
-    "@alchemy.run/floci": "2.0.0-beta.82",
-    "@alchemy.run/node-utils": "2.0.0-beta.82",
+    "@alchemy.run/cloudflare-runtime": "2.0.0-beta.83",
+    "@alchemy.run/floci": "2.0.0-beta.83",
+    "@alchemy.run/node-utils": "2.0.0-beta.83",
     "@alchemy.run/sigil": "0.1.0-alpha.1",
     "@distilled.cloud/acme": "1.0.0-rc.15",
     "@distilled.cloud/aws": "1.0.0-rc.15",
@@ -373,7 +373,7 @@
     "yaml": "^2.9.0"
   },
   "devDependencies": {
-    "@alchemy.run/frontend-frameworks": "2.0.0-beta.82",
+    "@alchemy.run/frontend-frameworks": "2.0.0-beta.83",
     "@aws/durable-execution-sdk-js": "^2.1.0",
     "@cloudflare/containers": "^0.3.7",
     "@cloudflare/puppeteer": "^1.1.0",
@@ -447,7 +447,7 @@
     "ws": "^8.21.0"
   },
   "peerDependencies": {
-    "@alchemy.run/frontend-frameworks": "2.0.0-beta.82",
+    "@alchemy.run/frontend-frameworks": "2.0.0-beta.83",
     "@aws/durable-execution-sdk-js": "^2.1.0",
     "@effect/platform-bun": "^4.0.0",
     "@effect/platform-node": "^4.0.0",

package/src/Cloudflare/Containers/Container.ts

@@ -76,7 +76,6 @@ export class ContainerNotRunningError extends Data.TaggedError("ContainerNotRunn
 export type ContainerStartupOptions = cf.ContainerStartupOptions;
 
 import type {
-  ContainerImageProps,
   DurableObjectContainerProps,
   EffectfulContainerProps,
   ExternalContainerProps,
@@ -129,24 +128,11 @@ export type ImageContainerProps<Req = never> =
       Req
     >;
 
-/**
- * Durable Object container props with statically known image names, so the
- * native client can type `images.<name>` as present.
- */
-type NamedImageProps<ImageName extends string> = Omit<DurableObjectContainerProps, "images"> & {
-  images: Record<ImageName, ContainerImageProps>;
-};
-
-type NamedImageContainerProps<ImageName extends string, Req> =
-  | InputProps<NamedImageProps<ImageName>>
-  | Effect.Effect<InputProps<NamedImageProps<ImageName>>, Config.ConfigError, Req>;
-
 /**
  * The handle `yield* MyContainer` returns inside a Durable Object. See
  * {@link ContainerClient}.
  */
-export type Container<Id extends string = string, ImageName extends string = string> = Named<Id> &
-  ContainerClient<ImageName>;
+export type Container<Id extends string = string> = Named<Id> & ContainerClient;
 
 /** An RPC shape may not redeclare the container handle's own methods. */
 type ContainerShape<Shape> = {
@@ -283,39 +269,37 @@ type ContainerShape<Shape> = {
  * ```
  *
  * ### Native Durable Object Containers
- * Use `schedulingPolicy: "durable_object"` to choose an image and instance
- * size for each container at runtime. Named images are built or copied into
- * Cloudflare's registry, pinned to a digest, and prepared before the Worker
- * is uploaded. Omit `images` to use `cloudflare/debian-trixie` or restore a
- * snapshot without publishing an image.
+ * Use `schedulingPolicy: "durable_object"` to let a Durable Object pick its
+ * image and instance size at runtime. One Container is one image: `image`
+ * copies a registry image, `context`/`dockerfile` builds one. Alchemy pins the
+ * image to a digest and prepares it before the Worker is uploaded.
  *
- * `yield* Sandbox` returns the container's handle without starting it. Its
- * `exec` takes an argument vector and returns a scoped process with streams,
- * an exit code, and an `output()` collector.
+ * `yield* Node` returns the container's handle without starting it.
+ * `start()` starts the Container's own image. Its `exec` takes an argument
+ * vector and returns a scoped process with streams, an exit code, and an
+ * `output()` collector.
  *
- * **Example:** Execute a command in a named image
+ * **Example:** Execute a command in a Container's image
  * ```typescript
- * export class Sandbox extends Cloudflare.Container<Sandbox>()("Sandbox", {
+ * export class Node extends Cloudflare.Container<Node>()("Node", {
  *   schedulingPolicy: "durable_object",
- *   images: { node: { image: "node:24-slim" } },
+ *   image: "node:24-slim",
  * }) {}
  *
  * export class Agent extends Cloudflare.DurableObject<Agent>()(
  *   "Agent",
  *   Effect.gen(function* () {
- *     const sandbox = yield* Sandbox;
+ *     const node = yield* Node;
  *     return Effect.succeed({
  *       exec: (args: string[]) =>
  *         Effect.gen(function* () {
- *           const images = yield* sandbox.images;
- *           // A no-op when the container is already running.
- *           yield* sandbox.start({
- *             image: images.node,
+ *           // Starts the Node image; a no-op when the container is running.
+ *           yield* node.start({
  *             instance: "lite",
  *             entrypoint: ["sleep", "infinity"],
  *             enableInternet: false,
  *           });
- *           const process = yield* sandbox.exec(args);
+ *           const process = yield* node.exec(args);
  *           const result = yield* process.output();
  *           return { text: new TextDecoder().decode(result.stdout), exitCode: result.exitCode };
  *         }).pipe(Effect.scoped),
@@ -324,13 +308,62 @@ type ContainerShape<Shape> = {
  * ) {}
  * ```
  *
+ * ### Several Images in One Durable Object
+ * Cloudflare gives each Durable Object class one container application and
+ * each object one container instance. Bind several Containers to choose
+ * between their images. Every binding adds its image to the class's
+ * application under the Container's id. Each handle's `start()` starts its
+ * own image; start one at a time and `destroy()` before switching.
+ *
+ * **Example:** A Durable Object with Node and Python images
+ * ```typescript
+ * export class Node extends Cloudflare.Container<Node>()("Node", {
+ *   schedulingPolicy: "durable_object",
+ *   image: "node:24-slim",
+ * }) {}
+ *
+ * export class Python extends Cloudflare.Container<Python>()("Python", {
+ *   schedulingPolicy: "durable_object",
+ *   context: "./python",
+ * }) {}
+ *
+ * export class Agent extends Cloudflare.DurableObject<Agent>()(
+ *   "Agent",
+ *   Effect.gen(function* () {
+ *     const node = yield* Node;
+ *     const python = yield* Python;
+ *     const run = (cmd: string[]) =>
+ *       Effect.scoped(Effect.flatMap(node.exec(cmd), (process) => process.output()));
+ *     return Effect.succeed({
+ *       node: (cmd: string[]) =>
+ *         node
+ *           .start({ entrypoint: ["sleep", "infinity"], enableInternet: false })
+ *           .pipe(Effect.andThen(run(cmd))),
+ *       python: (cmd: string[]) =>
+ *         Effect.gen(function* () {
+ *           // Every handle controls the same instance: switch images explicitly.
+ *           if (yield* node.running) yield* node.destroy();
+ *           yield* python.start({ entrypoint: ["sleep", "infinity"], enableInternet: false });
+ *           return yield* Effect.scoped(
+ *             Effect.flatMap(python.exec(cmd), (process) => process.output()),
+ *           );
+ *         }),
+ *     });
+ *   }),
+ * ) {}
+ * ```
+ *
+ * Application-wide settings (`ssh`, `authorizedKeys`, `observability`) may be
+ * declared on any of the class's Containers. Two Containers declaring
+ * different values fail the deploy with `ContainerApplicationSettingsConflict`.
+ *
  * **Example:** Save and restore the writable filesystem
  * ```typescript
- * const snapshot = yield* sandbox.snapshotContainer({ name: "workspace" });
+ * const snapshot = yield* node.snapshotContainer({ name: "workspace" });
  * // Persist this handle in Durable Object storage before stopping the instance.
  * yield* state.storage.put("snapshot", snapshot);
- * yield* sandbox.destroy();
- * yield* sandbox.start({
+ * yield* node.destroy();
+ * yield* node.start({
  *   containerSnapshot: snapshot,
  *   entrypoint: ["sleep", "infinity"],
  *   enableInternet: false,
@@ -344,9 +377,62 @@ type ContainerShape<Shape> = {
  * when needed. Scope closure kills an unfinished exec process, but does not
  * signal its descendants. Use an Effect timeout to bound a command's lifetime.
  *
- * Native async Durable Objects use the same declaration on a Worker's `env`
- * and call `this.ctx.container` directly. Local development exposes the named
- * images through workerd and Docker.
+ * ### Native Durable Objects on Async Workers
+ * A plain Durable Object class on an async Worker attaches its Containers
+ * through its Durable Object binding:
+ * `Cloudflare.DurableObject(className, { containers })`. Each Container adds
+ * its image to the class's application, and the class reads it from
+ * `ctx.container.images` under the Container's id. A Container may be listed
+ * by several classes; each class gets its own copy of the image key.
+ *
+ * **Example:** Two classes sharing the Node image
+ * ```typescript
+ * // alchemy.run.ts
+ * const Node = Cloudflare.Container("Node", {
+ *   schedulingPolicy: "durable_object",
+ *   image: "node:24-slim",
+ * });
+ * const Python = Cloudflare.Container("Python", {
+ *   schedulingPolicy: "durable_object",
+ *   image: "python:3.13-slim",
+ * });
+ * const Rust = Cloudflare.Container("Rust", {
+ *   schedulingPolicy: "durable_object",
+ *   image: "rust:1.90-slim",
+ * });
+ * export const Worker = Cloudflare.Worker("App", {
+ *   main: "./src/worker.ts",
+ *   env: {
+ *     AGENT: Cloudflare.DurableObject("Agent", { containers: [Node, Python] }),
+ *     REVIEWER: Cloudflare.DurableObject("Reviewer", { containers: [Node, Rust] }),
+ *   },
+ * });
+ * ```
+ *
+ * A Durable Object-managed Container placed directly in `env` fails with
+ * `DurableObjectContainerBindingError`; only fleet Containers bind that way.
+ *
+ * **Example:** Starting an image from the class
+ * ```typescript
+ * // src/worker.ts
+ * import { DurableObject } from "cloudflare:workers";
+ *
+ * export class Agent extends DurableObject {
+ *   async run(cmd: string[]) {
+ *     const container = this.ctx.container!;
+ *     if (!container.running) {
+ *       container.start({
+ *         image: container.images.Node,
+ *         entrypoint: ["sleep", "infinity"],
+ *         enableInternet: false,
+ *       });
+ *     }
+ *     return (await container.exec(cmd)).output();
+ *   }
+ * }
+ * ```
+ *
+ * Local development runs every image through workerd and Docker.
  *
  * Switching an existing application to this scheduling policy requires a new
  * application and a new Durable Object class/namespace. Alchemy rejects an
@@ -683,7 +769,7 @@ type ContainerShape<Shape> = {
  * ```
  *
  * A container's shape cannot declare a method the handle already has
- * (`start`, `exec`, `images`, `getTcpPort`, …); declaring one is a type
+ * (`start`, `exec`, `image`, `getTcpPort`, …); declaring one is a type
  * error, because the handle's method would shadow the RPC call.
  *
  * ### Using a Container from a Layer
@@ -742,24 +828,11 @@ type ContainerShape<Shape> = {
  */
 export const Container: ResourceClassLike<ContainerApplication> &
   Pick<ResourceClass<ContainerApplication>, "ref"> & {
-    <
-      DOShape = unknown,
-      const Id extends string = string,
-      PropsReq = never,
-      ImageName extends string = string,
-    >(
-      id: Id,
-      props: NamedImageContainerProps<ImageName, PropsReq>,
-    ): Container.Decl<Container<Id, ImageName>, {}, Id, PropsReq, DOShape, ImageName>;
     <DOShape = unknown, const Id extends string = string, PropsReq = never>(
       id: Id,
       props: ImageContainerProps<PropsReq>,
     ): Container.Decl<Container<Id>, {}, Id, PropsReq, DOShape>;
     <Self>(): {
-      <const Id extends string, ImageName extends string, PropsReq = never>(
-        id: Id,
-        props: NamedImageContainerProps<ImageName, PropsReq>,
-      ): Container.Decl<Self, {}, Id, PropsReq, unknown, ImageName>;
       <const Id extends string, PropsReq = never>(
         id: Id,
         props: ImageContainerProps<PropsReq>,
@@ -837,18 +910,15 @@ export declare namespace Container {
     Id extends string = string,
     Req = never,
     DOShape = unknown,
-    ImageName extends string = string,
   >
     extends Effect.Effect<Self, never, Providers | Req>, Rpc<Shape>, Named<Id> {
-    new (): Container<Id, ImageName> & Shape;
+    new (): Container<Id> & Shape;
     /**
      * @internal phantom — the Durable Object class type backing this
      * container when it is bound on an async Worker's `env`. Drives
      * `InferEnv` (`env.NAME` becomes `DurableObjectNamespace<DOShape>`).
      */
     readonly "~alchemy/Container/Shape": DOShape;
-    /** @internal phantom — required image names available to the native client. */
-    readonly "~alchemy/Container/Images": ImageName;
     /**
      * @internal — the explicit `className` from props (`undefined` defaults
      * to the binding name at bind time). Doubles as the runtime marker that

package/src/Cloudflare/Containers/ContainerApplication.ts

@@ -384,70 +384,73 @@ export interface ContainerSshConfiguration {
   port?: number;
 }
 
-/** An image published for a Durable Object to select when starting a container. */
-export type ContainerImageProps = {
-  /** Image publication and build-cache configuration. */
-  publish?: ContainerApplicationPropsBase["publish"];
-} & (
-  | {
-      /** Registry image to copy into Cloudflare's managed registry. */
-      image: string;
-      context?: never;
-      dockerfile?: never;
-    }
-  | {
-      image?: never;
-      /** Docker build context. Defaults to the current directory. */
-      context?: string;
-      /** Dockerfile path or inline content. Defaults to the context's Dockerfile. */
-      dockerfile?: string | InlineDockerfile;
-    }
-);
+/**
+ * Application-wide settings of a Durable Object class's container application.
+ * Every Container bound to the class may declare them; declarations must agree.
+ */
+export interface DurableObjectApplicationSettings {
+  /**
+   * SSH access to every instance of the application. Removing a previously
+   * declared value disables SSH.
+   */
+  ssh?: ContainerSshConfiguration;
+  /** SSH public keys allowed to access instances. Removing this property clears previously managed keys. */
+  authorizedKeys?: Containers.UserSSHPublicKeyList;
+  /** Application-wide logging. Removing a previously declared value disables logs. Changes do not restart running containers. */
+  observability?: Containers.ContainerApplicationObservability;
+}
 
 /**
- * A container whose image and compute size are chosen by its Durable Object
- * at runtime. The policy is immutable: migrating an existing application
- * requires a new application and Durable Object namespace.
+ * One image a Durable Object starts with `ctx.container.start()`.
+ *
+ * Cloudflare allows one container application per Durable Object class. Every
+ * `durable_object` Container bound to the class adds its image to that
+ * application, under the Container's id. Bind several Containers to start
+ * different images from the same class, one at a time. One Container may be
+ * bound to several classes.
+ *
+ * An Effect-native Durable Object binds a Container with `yield*`. An async
+ * Worker attaches it to a class with
+ * `Cloudflare.DurableObject(className, { containers })`.
+ *
+ * The policy is immutable: migrating an existing fleet application requires a
+ * new application and Durable Object namespace.
  */
-export interface DurableObjectContainerProps extends PlatformProps {
-  /** Application name. Alchemy generates a name when omitted. */
-  name?: string;
-  /** Exported Durable Object class, when bound on an async Worker's env. */
-  className?: string;
+export interface DurableObjectContainerProps
+  extends DurableObjectApplicationSettings, PlatformProps {
   /** Select images and instance sizes in `ctx.container.start()`. */
   schedulingPolicy: "durable_object";
   /**
-   * Images exposed by name through `ctx.container.images`. Alchemy builds or
-   * copies each image into Cloudflare's registry and prepares its immutable
-   * digest before uploading the Worker. Omit to use the managed
-   * `cloudflare/debian-trixie` image or restore a filesystem snapshot.
-   * Supports up to 100 images, with names between 1 and 128 characters.
+   * Registry image to copy into Cloudflare's managed registry, e.g.
+   * `"node:24-slim"`. Exclusive with {@link context} and {@link dockerfile}.
+   * Omit every image source to contribute no image: `start()` then uses the
+   * managed `cloudflare/debian-trixie` image unless given another.
    */
-  images?: Record<string, ContainerImageProps>;
+  image?: string;
+  /**
+   * Docker build context. Setting `context` or `dockerfile` builds the image;
+   * `context` defaults to the current directory.
+   */
+  context?: string;
+  /** Dockerfile path or inline content. Defaults to the context's Dockerfile. */
+  dockerfile?: string | InlineDockerfile;
+  /** Image publication and build-cache configuration. */
+  publish?: ContainerApplicationPropsBase["publish"];
   /**
-   * Maximum wait for Cloudflare to prepare each published image, including API calls.
+   * Maximum wait for Cloudflare to prepare the published image, including API calls.
    * Accepts an Effect duration such as "45 minutes". Must be finite and positive.
    * Cancellation stops waiting; another deployment reuses the published registry image.
-   * Use an immutable source digest or change the image reference to refresh a named image.
+   * Use an immutable source digest or change the image reference to refresh the image.
    * @default "30 minutes"
    */
   imagePreparationTimeout?: Duration.Input;
-  /**
-   * SSH access to every instance of the application. Removing a previously
-   * declared value disables SSH.
-   */
-  ssh?: ContainerSshConfiguration;
-  /** SSH public keys allowed to access instances. Removing this property clears previously managed keys. */
-  authorizedKeys?: Containers.UserSSHPublicKeyList;
-  /** Application-wide logging. Removing a previously declared value disables logs. Changes do not restart running containers. */
-  observability?: Containers.ContainerApplicationObservability;
 }
 
 /**
  * Fleet-scheduled applications select a deployment image through `main`
  * (bundled Effect program), `context`/`dockerfile`, or a pre-built `image`.
- * Durable Object-managed applications select images at runtime and can
- * publish named image sources through `images`.
+ * A Durable Object-managed Container publishes one image that its Durable
+ * Object selects at runtime.
  */
 export type ContainerApplicationProps =
   | EffectfulContainerProps
@@ -468,7 +471,6 @@ export interface AnyContainerApplicationProps extends Omit<
   schedulingPolicy?: ContainerApplication.SchedulingPolicy;
   ssh?: ContainerSshConfiguration;
   authorizedKeys?: Containers.UserSSHPublicKeyList;
-  images?: Record<string, ContainerImageProps>;
   imagePreparationTimeout?: Duration.Input;
   main?: string;
   image?: string;
@@ -801,11 +803,15 @@ export interface ContainerApplication<Shape = unknown> extends Resource<
   {
     /**
      * Cloudflare-assigned unique identifier of the container application.
+     * Empty for a Durable Object-managed Container: the application belongs
+     * to the Durable Object class that binds it.
      */
     applicationId: string;
     /**
      * The resolved application name (either the provided `name` or the
      * deterministic physical name derived from the stack, stage, and logical ID).
+     * For a Durable Object-managed Container, the name of its default image
+     * repository.
      */
     applicationName: string;
     /**
@@ -840,12 +846,14 @@ export interface ContainerApplication<Shape = unknown> extends Resource<
      */
     configuration: Partial<ContainerApplication.Configuration> &
       Containers.DurableObjectContainerConfiguration;
-    /** Application-wide logging for Durable Object-managed containers. */
+    /** Application-wide logging declared by a Durable Object-managed Container. */
     observability?: Containers.ContainerApplicationObservability;
-    /** Prepared, digest-pinned images keyed by their runtime names. */
-    images?: Record<string, string>;
-    /** Local image sources keyed by their runtime names. */
-    devImages?: Record<string, DevContainerImage>;
+    /**
+     * The prepared, digest-pinned image of a Durable Object-managed Container,
+     * or its local image key in `alchemy dev`. Unset when the Container
+     * declares no image source.
+     */
+    image?: string;
     /**
      * The Durable Object namespace attached to the application, if it is bound
      * to one.
@@ -872,7 +880,6 @@ export interface ContainerApplication<Shape = unknown> extends Resource<
       image: string;
       digest?: string;
       configuration?: string;
-      images?: Record<string, string>;
     };
     dev: DevContainerImage | undefined;
   },