@highstate/backend-api 0.26.0 → 0.28.0

package/dist/index.js

@@ -1,74 +1,1018 @@
 // @bun
 // src/index.ts
 import { rm } from "fs/promises";
-import { InstanceServiceDefinition } from "@highstate/api/instance.v1";
-import { PanelServiceDefinition } from "@highstate/api/panel.v1";
-import { SecretServiceDefinition } from "@highstate/api/secret.v1";
-import { WorkerServiceDefinition } from "@highstate/api/worker.v1";
-import { createServer } from "nice-grpc";
+import { createServer } from "http";
+import { connectNodeAdapter } from "@connectrpc/connect-node";
+import {
+  InstanceStateService,
+  LibraryService,
+  OperationService,
+  PanelService,
+  ProjectModelService,
+  ProjectService,
+  SecretService
+} from "@highstate/api/v1";
+import { WorkerService } from "@highstate/api/worker.v1";
 
-// src/handlers/instance.ts
-import { instanceCustomStatusInputSchema } from "@highstate/backend/shared";
-import { z } from "@highstate/contract";
+// src/handlers/instance-state.ts
+import { instanceCustomStatusInputSchema as instanceCustomStatusInputSchema2 } from "@highstate/backend/shared";
+import { z as z2 } from "@highstate/contract";
 
+// src/shared/api-error.ts
+import { create } from "@bufbuild/protobuf";
+import { ConnectError } from "@connectrpc/connect";
+import { BadRequestSchema, ErrorInfoSchema } from "@highstate/api/v1";
+function createApiError(options) {
+  const details = [
+    {
+      desc: ErrorInfoSchema,
+      value: create(ErrorInfoSchema, {
+        reason: options.reason,
+        domain: "highstate.io",
+        metadata: options.metadata
+      })
+    }
+  ];
+  if (options.fieldViolations?.length) {
+    details.push({
+      desc: BadRequestSchema,
+      value: create(BadRequestSchema, {
+        fieldViolations: options.fieldViolations.map((violation) => ({ ...violation }))
+      })
+    });
+  }
+  return new ConnectError(options.message, options.code, undefined, details);
+}
 // src/shared/authentication.ts
-import { ServerError, Status } from "nice-grpc-common";
-async function authenticate(services, context) {
-  const token = context.metadata.get("api-key");
-  if (!token) {
-    throw new ServerError(Status.UNAUTHENTICATED, "No API key provided");
+import { Code as Code2 } from "@connectrpc/connect";
+import { ProjectLockedError, ProjectNotFoundError } from "@highstate/backend/shared";
+
+// src/shared/authorization-header.ts
+import { Code } from "@connectrpc/connect";
+function parseBearerToken(authorization) {
+  const match = /^Bearer ([^\s]+)$/i.exec(authorization ?? "");
+  if (!match || [...match[1]].some((character) => character.charCodeAt(0) <= 31 || character === "\x7F")) {
+    throw createApiError({
+      message: "Invalid authorization header",
+      code: Code.Unauthenticated,
+      reason: "AUTHORIZATION_HEADER_INVALID"
+    });
   }
-  const projectId = context.metadata.get("project-id");
+  return match[1];
+}
+
+// src/shared/authentication.ts
+async function authenticateBackend(services, context) {
+  const token = getBearerToken(context);
+  const apiKey = await services.apiKeyService.getBackendApiKeyByToken(token);
+  const roleBindings = await services.database.backend.serviceAccountBackendRoleBinding.findMany({
+    where: { serviceAccountId: apiKey.serviceAccountId },
+    include: { role: { select: { rules: true } } }
+  });
+  return {
+    realm: "backend",
+    subject: {
+      type: "service-account",
+      serviceAccountId: apiKey.serviceAccountId,
+      apiKeyId: apiKey.id
+    },
+    permissions: resolveBackendPermissions(roleBindings.flatMap((binding) => binding.role.rules.map((rule) => ({
+      permissions: rule.permissions,
+      restrictions: rule.restrictions ?? []
+    }))), apiKey.restrictionRules)
+  };
+}
+async function authenticateProject(services, request, context) {
+  const projectId = request.projectId;
   if (!projectId) {
-    throw new ServerError(Status.UNAUTHENTICATED, "No project ID provided");
+    throw createApiError({
+      message: "No project ID provided",
+      code: Code2.InvalidArgument,
+      reason: "PROJECT_ID_REQUIRED",
+      fieldViolations: [
+        {
+          field: "project_id",
+          reason: "REQUIRED",
+          description: "The project ID is required"
+        }
+      ]
+    });
+  }
+  const project = await services.database.backend.project.findUnique({
+    where: { id: projectId },
+    select: { id: true }
+  });
+  if (!project) {
+    throw new ProjectNotFoundError(projectId);
+  }
+  if (!await services.projectUnlockService.checkProjectUnlocked(projectId)) {
+    throw new ProjectLockedError(projectId);
+  }
+  const token = getBearerToken(context);
+  const apiKey = await services.apiKeyService.getProjectCredentialByToken(projectId, token);
+  const projectDatabase = await services.database.forProject(projectId);
+  const roleBindings = await projectDatabase.serviceAccountRoleBinding.findMany({
+    where: { serviceAccountId: apiKey.serviceAccountId },
+    include: { role: { select: { rules: true } } }
+  });
+  return {
+    realm: "project",
+    projectId,
+    subject: {
+      type: "service-account",
+      serviceAccountId: apiKey.serviceAccountId,
+      apiKeyId: apiKey.id
+    },
+    permissions: resolveProjectPermissions(roleBindings.flatMap((binding) => binding.role.rules.map((rule) => ({
+      permissions: rule.permissions,
+      restrictions: rule.restrictions ?? []
+    }))), apiKey.restrictionRules)
+  };
+}
+function getBearerToken(context) {
+  return parseBearerToken(context.requestHeader.get("authorization"));
+}
+function resolveBackendPermissions(grants, restrictions) {
+  return resolvePermissions(grants, restrictions);
+}
+function resolveProjectPermissions(grants, restrictions) {
+  return resolvePermissions(grants, restrictions);
+}
+function resolvePermissions(grants, restrictions) {
+  const restrictionByPermission = new Map(restrictions.flatMap((rule) => rule.permissions.map((permission) => [permission, rule.restrictions ?? []])));
+  const permissions = new Map;
+  for (const grant of grants) {
+    for (const permission of grant.permissions) {
+      const keyRestrictions = restrictionByPermission.get(permission);
+      if (restrictions.length > 0 && !keyRestrictions) {
+        continue;
+      }
+      const permissionGrants = permissions.get(permission) ?? [];
+      permissionGrants.push({ restrictions: [...grant.restrictions, ...keyRestrictions ?? []] });
+      permissions.set(permission, permissionGrants);
+    }
+  }
+  return permissions;
+}
+// src/shared/conversion.ts
+import { create as create2, fromJson, toJson } from "@bufbuild/protobuf";
+import { timestampFromDate, ValueSchema } from "@bufbuild/protobuf/wkt";
+import {
+  ComponentKind,
+  ComponentSchema,
+  EntitySchema,
+  EvaluationStatus,
+  HubSchema,
+  InstanceCustomStatusSchema,
+  InstanceOperationStatus,
+  InstanceSchema,
+  InstanceSource,
+  InstanceStateSchema,
+  InstanceStatus,
+  LibrarySchema,
+  OperationLogSchema,
+  OperationPhaseSchema,
+  OperationPhaseType,
+  OperationSchema,
+  OperationStatus,
+  OperationType,
+  ProjectModelSchema,
+  ProjectSchema
+} from "@highstate/api/v1";
+import {
+  instanceCustomStatusInputSchema,
+  operationMetaSchema,
+  operationOptionsSchema,
+  operationPhaseSchema
+} from "@highstate/backend/shared";
+import {
+  instanceInputSchema,
+  instanceModelSchema,
+  z
+} from "@highstate/contract";
+var jsonValueSchema = z.lazy(() => z.union([
+  z.string(),
+  z.number(),
+  z.boolean(),
+  z.null(),
+  z.array(jsonValueSchema),
+  z.record(z.string(), jsonValueSchema)
+]));
+var jsonObjectSchema = z.record(z.string(), jsonValueSchema);
+function toProject(project) {
+  return create2(ProjectSchema, {
+    id: project.id,
+    name: project.name,
+    meta: project.meta,
+    spaceId: project.spaceId,
+    modelStorageId: project.modelStorageId,
+    libraryId: project.libraryId,
+    pulumiBackendId: project.pulumiBackendId,
+    createdAt: toTimestamp(project.createdAt),
+    updatedAt: toTimestamp(project.updatedAt)
+  });
+}
+function toProjectModel(model) {
+  return create2(ProjectModelSchema, {
+    instances: [...model.instances, ...model.virtualInstances, ...model.ghostInstances].map(toInstance),
+    hubs: model.hubs.map(toHub)
+  });
+}
+function toInstance(instance) {
+  return create2(InstanceSchema, {
+    id: instance.id,
+    kind: toComponentKind(instance.kind),
+    type: instance.type,
+    name: instance.name,
+    arguments: Object.entries(instance.args ?? {}).map(([key, value]) => ({
+      key,
+      value: fromJson(ValueSchema, value)
+    })),
+    inputs: toInstanceReferenceMap(instance.inputs),
+    hubInputs: Object.fromEntries(Object.entries(instance.hubInputs ?? {}).map(([key, values]) => [
+      key,
+      { values: values.map((value) => ({ hubId: value.hubId })) }
+    ])),
+    injectionInputs: (instance.injectionInputs ?? []).map((value) => ({ hubId: value.hubId })),
+    position: instance.position ?? undefined,
+    resolvedInputs: toInstanceReferenceMap(instance.resolvedInputs),
+    parentId: instance.parentId,
+    outputs: toInstanceReferenceMap(instance.outputs),
+    resolvedOutputs: toInstanceReferenceMap(instance.resolvedOutputs)
+  });
+}
+function fromInstance(instance) {
+  return instanceModelSchema.parse({
+    id: instance.id,
+    kind: fromComponentKind(instance.kind),
+    type: instance.type,
+    name: instance.name,
+    args: Object.fromEntries(instance.arguments.map((argument) => [
+      argument.key,
+      argument.value ? toJson(ValueSchema, argument.value) : null
+    ])),
+    inputs: fromInstanceReferenceMap(instance.inputs),
+    hubInputs: Object.fromEntries(Object.entries(instance.hubInputs).map(([key, list]) => [
+      key,
+      list.values.map((value) => ({ hubId: value.hubId }))
+    ])),
+    injectionInputs: instance.injectionInputs.map((value) => ({ hubId: value.hubId })),
+    position: instance.position
+  });
+}
+function toHub(hub) {
+  return create2(HubSchema, {
+    id: hub.id,
+    position: hub.position ?? undefined,
+    inputs: hub.inputs ?? [],
+    injectionInputs: (hub.injectionInputs ?? []).map((value) => ({ hubId: value.hubId }))
+  });
+}
+function fromHub(hub) {
+  return {
+    id: hub.id,
+    position: hub.position,
+    inputs: hub.inputs.map(fromInstanceReference),
+    injectionInputs: hub.injectionInputs.map((value) => ({ hubId: value.hubId }))
+  };
+}
+function toInstancePatch(instance, paths) {
+  const patch = {};
+  for (const path of paths) {
+    switch (path) {
+      case "arguments":
+        patch.args = Object.fromEntries(instance.arguments.map((argument) => [
+          argument.key,
+          argument.value ? toJson(ValueSchema, argument.value) : null
+        ]));
+        break;
+      case "inputs":
+        patch.inputs = fromInstanceReferenceMap(instance.inputs);
+        break;
+      case "hub_inputs":
+        patch.hubInputs = Object.fromEntries(Object.entries(instance.hubInputs).map(([key, list]) => [
+          key,
+          list.values.map((value) => ({ hubId: value.hubId }))
+        ]));
+        break;
+      case "injection_inputs":
+        patch.injectionInputs = instance.injectionInputs.map((value) => ({ hubId: value.hubId }));
+        break;
+      case "position":
+        patch.position = instance.position ? { x: instance.position.x, y: instance.position.y } : null;
+        break;
+      case "position.x":
+        patch.position = { x: instance.position?.x ?? 0 };
+        break;
+      case "position.y":
+        patch.position = { y: instance.position?.y ?? 0 };
+        break;
+    }
+  }
+  return patch;
+}
+function toHubPatch(hub, paths) {
+  const patch = {};
+  for (const path of paths) {
+    switch (path) {
+      case "position":
+        patch.position = hub.position ? { x: hub.position.x, y: hub.position.y } : null;
+        break;
+      case "position.x":
+        patch.position = { x: hub.position?.x ?? 0 };
+        break;
+      case "position.y":
+        patch.position = { y: hub.position?.y ?? 0 };
+        break;
+      case "inputs":
+        patch.inputs = hub.inputs.map(fromInstanceReference);
+        break;
+      case "injection_inputs":
+        patch.injectionInputs = hub.injectionInputs.map((value) => ({ hubId: value.hubId }));
+        break;
+    }
+  }
+  return patch;
+}
+function toInstanceState(state) {
+  const model = state.model ? instanceModelSchema.parse(state.model) : undefined;
+  const resolvedInputs = state.resolvedInputs ? fromUnknownInstanceReferenceMap(state.resolvedInputs) : undefined;
+  return create2(InstanceStateSchema, {
+    id: state.id,
+    instanceId: state.instanceId,
+    status: toInstanceStatus(state.status),
+    source: toInstanceSource(state.source),
+    kind: toComponentKind(state.kind),
+    parentInstanceId: state.parentInstanceId ?? undefined,
+    evaluationState: state.evaluationState ? {
+      status: toEvaluationStatus(state.evaluationState.status),
+      message: state.evaluationState.message ?? undefined,
+      model: state.evaluationState.model ? toInstance(instanceModelSchema.parse(state.evaluationState.model)) : undefined,
+      evaluatedAt: toTimestamp(state.evaluationState.evaluatedAt)
+    } : undefined,
+    lastOperationState: state.lastOperationState ? {
+      operationId: state.lastOperationState.operationId,
+      stateId: state.lastOperationState.stateId,
+      status: toInstanceOperationStatus(state.lastOperationState.status),
+      currentResourceCount: state.lastOperationState.currentResourceCount ?? undefined,
+      totalResourceCount: state.lastOperationState.totalResourceCount ?? undefined,
+      model: toInstance(instanceModelSchema.parse(state.lastOperationState.model)),
+      resolvedInputs: toInstanceReferenceMap(fromUnknownInstanceReferenceMap(state.lastOperationState.resolvedInputs)),
+      startedAt: toNullableTimestamp(state.lastOperationState.startedAt),
+      finishedAt: toNullableTimestamp(state.lastOperationState.finishedAt)
+    } : undefined,
+    terminalIds: state.terminalIds ?? [],
+    pageIds: state.pageIds ?? [],
+    panelIds: state.panelIds ?? [],
+    secretNames: state.secretNames ?? [],
+    customStatuses: (state.customStatuses ?? []).map(toInstanceCustomStatus),
+    currentResourceCount: state.currentResourceCount ?? undefined,
+    hasResourceHooks: state.hasResourceHooks,
+    statusFields: state.statusFields ? fromJson(ValueSchema, jsonValueSchema.parse(state.statusFields)) : undefined,
+    model: model ? toInstance(model) : undefined,
+    resolvedInputs: toInstanceReferenceMap(resolvedInputs)
+  });
+}
+function toInstanceCustomStatus(status) {
+  const meta = instanceCustomStatusInputSchema.shape.meta.parse(status.meta);
+  return create2(InstanceCustomStatusSchema, {
+    name: status.name,
+    meta: {
+      title: meta.title ?? status.name,
+      description: meta.description,
+      icon: meta.icon,
+      iconColor: meta.iconColor
+    },
+    value: status.value,
+    message: status.message ?? undefined,
+    order: status.order,
+    serviceAccountId: status.serviceAccountId,
+    createdAt: toTimestamp(status.createdAt),
+    updatedAt: toTimestamp(status.updatedAt)
+  });
+}
+function toOperation(operation) {
+  const meta = operationMetaSchema.parse(operation.meta);
+  const options = operationOptionsSchema.partial().parse(operation.options);
+  const phases = operation.phases ? operationPhaseSchema.array().parse(operation.phases) : [];
+  return create2(OperationSchema, {
+    id: operation.id,
+    meta,
+    type: toOperationType(operation.type),
+    status: toOperationStatus(operation.status),
+    options: {
+      forceUpdateDependencies: options.forceUpdateDependencies ?? false,
+      ignoreChangedDependencies: options.ignoreChangedDependencies ?? false,
+      ignoreDependencies: options.ignoreDependencies ?? false,
+      forceUpdateChildren: options.forceUpdateChildren ?? false,
+      onlyDestroyGhosts: options.onlyDestroyGhosts ?? false,
+      firstDestroyGhosts: options.firstDestroyGhosts ?? false,
+      ignoreGhosts: options.ignoreGhosts ?? false,
+      destroyDependentInstances: options.destroyDependentInstances ?? false,
+      invokeDestroyTriggers: options.invokeDestroyTriggers ?? false,
+      deleteUnreachableResources: options.deleteUnreachableResources ?? false,
+      forceDeleteState: options.forceDeleteState ?? false,
+      allowPartialCompositeInstanceUpdate: options.allowPartialCompositeInstanceUpdate ?? false,
+      allowPartialCompositeInstanceDestruction: options.allowPartialCompositeInstanceDestruction ?? false,
+      refresh: options.refresh ?? false,
+      debug: options.debug ?? false
+    },
+    requestedInstanceIds: z.string().array().parse(operation.requestedInstanceIds),
+    phases: phases.map(toOperationPhase),
+    startedAt: toTimestamp(operation.startedAt),
+    updatedAt: toTimestamp(operation.updatedAt),
+    finishedAt: toNullableTimestamp(operation.finishedAt)
+  });
+}
+function toOperationPhase(phase) {
+  return create2(OperationPhaseSchema, {
+    type: toOperationPhaseType(phase.type),
+    instances: phase.instances
+  });
+}
+function toOperationLog(operationId, log) {
+  return create2(OperationLogSchema, {
+    id: log.id,
+    operationId,
+    stateId: log.stateId ?? undefined,
+    isSystem: log.isSystem ?? false,
+    content: log.content
+  });
+}
+function toLibrary(library) {
+  return create2(LibrarySchema, {
+    components: Object.fromEntries(Object.entries(library.components).map(([type, component]) => [type, toComponent(component)])),
+    entities: Object.fromEntries(Object.entries(library.entities).map(([type, entity]) => [type, toEntity(entity)]))
+  });
+}
+function toComponent(component) {
+  return create2(ComponentSchema, {
+    type: component.type,
+    kind: toComponentKind(component.kind),
+    arguments: Object.fromEntries(Object.entries(component.args).map(([name, argument]) => [
+      name,
+      {
+        schema: jsonObjectSchema.parse(argument.schema),
+        required: argument.required,
+        meta: argument.meta
+      }
+    ])),
+    inputs: Object.fromEntries(Object.entries(component.inputs).map(([name, port]) => [name, toComponentPort(port)])),
+    outputs: Object.fromEntries(Object.entries(component.outputs).map(([name, port]) => [name, toComponentPort(port)])),
+    meta: component.meta,
+    definitionHash: component.definitionHash
+  });
+}
+function toEntity(entity) {
+  return create2(EntitySchema, {
+    type: entity.type,
+    extensions: entity.extensions ?? [],
+    directExtensions: entity.directExtensions ?? [],
+    inclusions: entity.inclusions ?? [],
+    directInclusions: entity.directInclusions ?? [],
+    schema: jsonObjectSchema.parse(entity.schema),
+    meta: entity.meta,
+    definitionHash: entity.definitionHash
+  });
+}
+function toTimestamp(value) {
+  if (!Number.isFinite(value.getTime())) {
+    throw new Error("Cannot convert invalid date to timestamp");
   }
-  const apiKey = await services.apiKeyService.getApiKeyByToken(projectId, token);
-  return [projectId, apiKey];
+  return timestampFromDate(value);
+}
+function toNullableTimestamp(value) {
+  return value ? toTimestamp(value) : undefined;
+}
+function toComponentPort(port) {
+  return {
+    entityType: port.type,
+    fromInput: port.fromInput,
+    required: port.required,
+    multiple: port.multiple,
+    meta: port.meta
+  };
+}
+function toInstanceReferenceMap(values) {
+  return Object.fromEntries(Object.entries(values ?? {}).map(([key, references]) => [
+    key,
+    {
+      values: references
+    }
+  ]));
+}
+function fromInstanceReferenceMap(values) {
+  return Object.fromEntries(Object.entries(values).map(([key, list]) => [key, list.values.map(fromInstanceReference)]));
+}
+function fromUnknownInstanceReferenceMap(value) {
+  return instanceModelSchema.shape.inputs.unwrap().parse(value);
+}
+function fromInstanceReference(value) {
+  return instanceInputSchema.parse({
+    instanceId: value.instanceId,
+    output: value.output,
+    path: value.path
+  });
+}
+function toComponentKind(value) {
+  if (value === "unit")
+    return ComponentKind.UNIT;
+  if (value === "composite")
+    return ComponentKind.COMPOSITE;
+  throw new Error(`Unknown component kind "${value}"`);
+}
+function fromComponentKind(value) {
+  if (value === ComponentKind.UNIT)
+    return "unit";
+  if (value === ComponentKind.COMPOSITE)
+    return "composite";
+  throw new Error("Component kind must be specified");
+}
+function toInstanceStatus(value) {
+  const statuses = {
+    undeployed: InstanceStatus.UNDEPLOYED,
+    attempted: InstanceStatus.ATTEMPTED,
+    deployed: InstanceStatus.DEPLOYED,
+    failed: InstanceStatus.FAILED
+  };
+  const status = statuses[value];
+  if (status === undefined)
+    throw new Error(`Unknown instance status "${value}"`);
+  return status;
+}
+function toInstanceSource(value) {
+  if (value === "resident")
+    return InstanceSource.RESIDENT;
+  if (value === "virtual")
+    return InstanceSource.VIRTUAL;
+  throw new Error(`Unknown instance source "${value}"`);
+}
+function toEvaluationStatus(value) {
+  if (value === "evaluating")
+    return EvaluationStatus.EVALUATING;
+  if (value === "evaluated")
+    return EvaluationStatus.EVALUATED;
+  if (value === "error")
+    return EvaluationStatus.ERROR;
+  throw new Error(`Unknown evaluation status "${value}"`);
+}
+function toInstanceOperationStatus(value) {
+  const statuses = {
+    updating: InstanceOperationStatus.UPDATING,
+    processing_triggers: InstanceOperationStatus.PROCESSING_TRIGGERS,
+    previewing: InstanceOperationStatus.PREVIEWING,
+    destroying: InstanceOperationStatus.DESTROYING,
+    refreshing: InstanceOperationStatus.REFRESHING,
+    pending: InstanceOperationStatus.PENDING,
+    cancelling: InstanceOperationStatus.CANCELLING,
+    updated: InstanceOperationStatus.UPDATED,
+    previewed: InstanceOperationStatus.PREVIEWED,
+    skipped: InstanceOperationStatus.SKIPPED,
+    destroyed: InstanceOperationStatus.DESTROYED,
+    refreshed: InstanceOperationStatus.REFRESHED,
+    cancelled: InstanceOperationStatus.CANCELLED,
+    failed: InstanceOperationStatus.FAILED
+  };
+  const status = statuses[value];
+  if (status === undefined)
+    throw new Error(`Unknown instance operation status "${value}"`);
+  return status;
+}
+function fromOperationType(value) {
+  if (value === OperationType.UPDATE)
+    return "update";
+  if (value === OperationType.PREVIEW)
+    return "preview";
+  if (value === OperationType.DESTROY)
+    return "destroy";
+  if (value === OperationType.RECREATE)
+    return "recreate";
+  if (value === OperationType.REFRESH)
+    return "refresh";
+  throw new Error("Operation type must be specified");
+}
+function fromOperationPhase(phase) {
+  return operationPhaseSchema.parse({
+    type: fromOperationPhaseType(phase.type),
+    instances: phase.instances.map((instance) => ({
+      id: instance.id,
+      parentId: instance.parentId,
+      message: instance.message
+    }))
+  });
+}
+function toOperationType(value) {
+  const types = {
+    update: OperationType.UPDATE,
+    preview: OperationType.PREVIEW,
+    destroy: OperationType.DESTROY,
+    recreate: OperationType.RECREATE,
+    refresh: OperationType.REFRESH
+  };
+  const type = types[value];
+  if (type === undefined)
+    throw new Error(`Unknown operation type "${value}"`);
+  return type;
+}
+function toOperationStatus(value) {
+  const statuses = {
+    pending: OperationStatus.PENDING,
+    running: OperationStatus.RUNNING,
+    failing: OperationStatus.FAILING,
+    cancelling: OperationStatus.CANCELLING,
+    completed: OperationStatus.COMPLETED,
+    failed: OperationStatus.FAILED,
+    cancelled: OperationStatus.CANCELLED
+  };
+  const status = statuses[value];
+  if (status === undefined)
+    throw new Error(`Unknown operation status "${value}"`);
+  return status;
+}
+function toOperationPhaseType(value) {
+  const types = {
+    destroy: OperationPhaseType.DESTROY,
+    preview: OperationPhaseType.PREVIEW,
+    update: OperationPhaseType.UPDATE,
+    refresh: OperationPhaseType.REFRESH
+  };
+  const type = types[value];
+  if (type === undefined)
+    throw new Error(`Unknown operation phase type "${value}"`);
+  return type;
+}
+function fromOperationPhaseType(value) {
+  const types = {
+    [OperationPhaseType.DESTROY]: "destroy",
+    [OperationPhaseType.PREVIEW]: "preview",
+    [OperationPhaseType.UPDATE]: "update",
+    [OperationPhaseType.REFRESH]: "refresh"
+  };
+  const type = types[value];
+  if (!type)
+    throw new Error("Operation phase type must be specified");
+  return type;
 }
 // src/shared/error-handling.ts
-import { AccessError } from "@highstate/backend/shared";
+import { create as create3 } from "@bufbuild/protobuf";
+import { durationFromMs } from "@bufbuild/protobuf/wkt";
+import { Code as Code3, ConnectError as ConnectError2 } from "@connectrpc/connect";
+import {
+  BadRequestSchema as BadRequestSchema2,
+  ErrorInfoSchema as ErrorInfoSchema2,
+  PreconditionFailureSchema,
+  RequestInfoSchema,
+  RetryInfoSchema
+} from "@highstate/api/v1";
+import { BackendError, BackendErrorCategory } from "@highstate/backend/shared";
 import { isAbortError } from "abort-controller-x";
-import { ServerError as ServerError2, Status as Status2 } from "nice-grpc-common";
-function createErrorHandlingMiddleware(services) {
-  return async function* errorHandlingMiddleware(call, context) {
+var sensitiveMetadataKey = /credential|token|secret|encrypted|cause|stack|path/i;
+function createErrorHandlingInterceptor(services) {
+  return (next) => async (request) => {
     try {
-      return yield* call.next(call.request, context);
+      return await next(request);
     } catch (error) {
-      if (error instanceof ServerError2 || isAbortError(error)) {
+      if (isAbortError(error) || error instanceof ConnectError2 && error.code === Code3.Canceled) {
         throw error;
       }
-      if (error instanceof AccessError) {
-        services.logger.info({ error }, "access denied");
-        throw new ServerError2(Status2.UNAUTHENTICATED, "Access denied");
+      if (error instanceof BackendError) {
+        const code = categoryToCode(error.category);
+        if (code === Code3.Internal) {
+          services.logger.error({ error, method: request.method.name }, "unexpected backend error");
+          throw new ConnectError2("An unexpected error occurred", Code3.Internal);
+        }
+        throw new ConnectError2(error.message, code, undefined, backendErrorDetails(error, request));
+      }
+      if (error instanceof ConnectError2) {
+        throw error;
       }
-      services.logger.error({ error }, "unexpected error");
-      throw new ServerError2(Status2.INTERNAL, "An unexpected error occurred");
+      services.logger.error({ error, method: request.method.name }, "unexpected error");
+      throw new ConnectError2("An unexpected error occurred", Code3.Internal);
     }
   };
 }
+function backendErrorDetails(error, request) {
+  const details = [
+    {
+      desc: ErrorInfoSchema2,
+      value: create3(ErrorInfoSchema2, {
+        reason: error.reason,
+        domain: "highstate.io",
+        metadata: Object.fromEntries(Object.entries(error.metadata).filter(([key]) => !sensitiveMetadataKey.test(key)))
+      })
+    }
+  ];
+  if (error.fieldViolations.length > 0) {
+    details.push({
+      desc: BadRequestSchema2,
+      value: create3(BadRequestSchema2, {
+        fieldViolations: error.fieldViolations.map((violation) => ({
+          field: toProtobufPath(violation.field),
+          reason: violation.reason,
+          description: violation.description
+        }))
+      })
+    });
+  }
+  if (error.preconditionViolations.length > 0) {
+    details.push({
+      desc: PreconditionFailureSchema,
+      value: create3(PreconditionFailureSchema, {
+        violations: error.preconditionViolations.map((violation) => ({ ...violation }))
+      })
+    });
+  }
+  if (error.retry && Number.isFinite(error.retry.delayMs) && error.retry.delayMs >= 0) {
+    details.push({
+      desc: RetryInfoSchema,
+      value: create3(RetryInfoSchema, { retryDelay: durationFromMs(error.retry.delayMs) })
+    });
+  }
+  const requestId = request.header.get("x-request-id")?.trim();
+  if (requestId) {
+    details.push({
+      desc: RequestInfoSchema,
+      value: create3(RequestInfoSchema, { requestId })
+    });
+  }
+  return details;
+}
+function toProtobufPath(path) {
+  return path.split(".").map((segment) => segment.replace(/[A-Z]/g, (character) => `_${character.toLowerCase()}`)).join(".");
+}
+function categoryToCode(category) {
+  switch (category) {
+    case BackendErrorCategory.InvalidArgument:
+      return Code3.InvalidArgument;
+    case BackendErrorCategory.Unauthenticated:
+      return Code3.Unauthenticated;
+    case BackendErrorCategory.PermissionDenied:
+      return Code3.PermissionDenied;
+    case BackendErrorCategory.NotFound:
+      return Code3.NotFound;
+    case BackendErrorCategory.AlreadyExists:
+      return Code3.AlreadyExists;
+    case BackendErrorCategory.FailedPrecondition:
+      return Code3.FailedPrecondition;
+    case BackendErrorCategory.Aborted:
+      return Code3.Aborted;
+    case BackendErrorCategory.Unavailable:
+      return Code3.Unavailable;
+    case BackendErrorCategory.Internal:
+      return Code3.Internal;
+  }
+}
+// src/shared/field-mask.ts
+import { Code as Code4 } from "@connectrpc/connect";
+function validateUpdateMask(mask, schema, mutablePaths) {
+  if (!mask || mask.paths.length === 0) {
+    throw fieldMaskError("update_mask", "REQUIRED", "The update mask must not be empty");
+  }
+  const paths = new Set;
+  for (const path of mask.paths) {
+    const normalized = normalizePath(schema, path);
+    if (!mutablePaths.has(normalized)) {
+      throw fieldMaskError(`update_mask.paths`, "IMMUTABLE_OR_UNKNOWN", `The path "${path}" is unknown, immutable, output-only, or traverses a collection`);
+    }
+    paths.add(normalized);
+  }
+  return [...paths];
+}
+function normalizePath(schema, path) {
+  if (!path || path === "*")
+    return path;
+  let descriptor = schema;
+  const normalized = [];
+  const segments = path.split(".");
+  for (const [index, segment] of segments.entries()) {
+    const field = descriptor.fields.find((candidate) => candidate.name === segment || candidate.localName === segment || candidate.jsonName === segment);
+    if (!field)
+      return path;
+    normalized.push(field.name);
+    if (index === segments.length - 1)
+      break;
+    if (field.fieldKind !== "message" || !field.message)
+      return path;
+    descriptor = field.message;
+  }
+  return normalized.join(".");
+}
+function fieldMaskError(field, reason, description) {
+  return createApiError({
+    message: "Invalid update mask",
+    code: Code4.InvalidArgument,
+    reason: "UPDATE_MASK_INVALID",
+    fieldViolations: [{ field, reason, description }]
+  });
+}
+// src/shared/serialization.ts
+function toJsonObject(value) {
+  return normalizeJsonValue(value);
+}
+function normalizeJsonValue(value) {
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  if (Array.isArray(value)) {
+    return value.map(normalizeJsonValue);
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).flatMap(([key, entry]) => {
+      if (entry === undefined) {
+        return [];
+      }
+      return [[key, normalizeJsonValue(entry)]];
+    }));
+  }
+  return value;
+}
 // src/shared/validation.ts
-import { ServerError as ServerError3, Status as Status3 } from "nice-grpc-common";
+import { Code as Code5 } from "@connectrpc/connect";
 function parseArgument(request, argumentName, schema) {
   const result = schema.safeParse(request[argumentName]);
   if (!result.success) {
-    throw new ServerError3(Status3.INVALID_ARGUMENT, `Invalid argument "${argumentName}": ${result.error.message}`);
+    throw validationError(`Invalid argument "${argumentName}"`, argumentName, result.error);
+  }
+  return result.data;
+}
+function parseValue(value, name, schema) {
+  const result = schema.safeParse(value);
+  if (!result.success) {
+    throw validationError(`Invalid ${name}`, name, result.error);
   }
   return result.data;
 }
-// src/handlers/instance.ts
-function createInstanceService(services) {
+function validationError(message, field, error) {
+  return createApiError({
+    message,
+    code: Code5.InvalidArgument,
+    reason: "REQUEST_INVALID",
+    fieldViolations: error.issues.map((issue) => ({
+      field: [field, ...issue.path.map(String)].join("."),
+      reason: issue.code.toUpperCase(),
+      description: issue.message
+    }))
+  });
+}
+// src/handlers/instance-state.ts
+function createInstanceStateService(services) {
   return {
+    async listInstanceStates(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const page = await services.instanceStateService.getInstanceStates(requestContext, {
+        includeEvaluationState: request.includeEvaluationState,
+        includeLastOperationState: request.includeLastOperationState,
+        includeParentInstanceId: request.includeParentInstanceId,
+        includeExtra: request.includeExtra,
+        loadCustomStatuses: request.includeCustomStatuses
+      }, { pageSize: request.pageSize, pageToken: request.pageToken });
+      return { states: page.items.map(toInstanceState), nextPageToken: page.nextPageToken };
+    },
+    async getInstanceState(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const stateId = parseArgument(request, "stateId", z2.cuid2());
+      const state = await services.instanceStateService.getInstanceStateOrThrow(requestContext, stateId, {
+        includeEvaluationState: request.includeEvaluationState,
+        includeLastOperationState: request.includeLastOperationState,
+        includeParentInstanceId: request.includeParentInstanceId,
+        includeExtra: request.includeExtra,
+        loadCustomStatuses: request.includeCustomStatuses
+      });
+      return { state: toInstanceState(state) };
+    },
     async updateCustomStatus(request, context) {
-      const [projectId, apiKey] = await authenticate(services, context);
-      const stateId = parseArgument(request, "stateId", z.cuid2());
-      const customStatus = parseArgument(request, "status", instanceCustomStatusInputSchema);
-      await services.instanceStateService.updateCustomStatus(projectId, stateId, apiKey.serviceAccountId, customStatus);
-      return {};
+      const requestContext = await authenticateProject(services, request, context);
+      const stateId = parseArgument(request, "stateId", z2.cuid2());
+      const customStatus = parseArgument(request, "status", instanceCustomStatusInputSchema2);
+      await services.instanceStateService.updateCustomStatus(requestContext, stateId, requestContext.subject.serviceAccountId, customStatus);
+      const state = await services.instanceStateService.getInstanceStateOrThrow(requestContext, stateId, { loadCustomStatuses: true });
+      const status = state.customStatuses?.find((value) => value.name === customStatus.name && value.serviceAccountId === requestContext.subject.serviceAccountId);
+      if (!status) {
+        throw new Error("Updated custom status was not returned by the backend");
+      }
+      return { status: toInstanceCustomStatus(status) };
     },
     async removeCustomStatus(request, context) {
-      const [projectId, apiKey] = await authenticate(services, context);
-      const stateId = parseArgument(request, "stateId", z.cuid2());
-      await services.instanceStateService.removeCustomStatus(projectId, stateId, apiKey.serviceAccountId, request.statusName);
+      const requestContext = await authenticateProject(services, request, context);
+      const stateId = parseArgument(request, "stateId", z2.cuid2());
+      const statusName = parseArgument(request, "statusName", z2.string().min(1));
+      await services.instanceStateService.removeCustomStatus(requestContext, stateId, requestContext.subject.serviceAccountId, statusName);
+      return {};
+    }
+  };
+}
+
+// src/handlers/library.ts
+import { ComponentKind as ComponentKind2 } from "@highstate/api/v1";
+import { ComponentNotFoundError } from "@highstate/backend/shared";
+import { z as z3 } from "@highstate/contract";
+function createLibraryService(services) {
+  return {
+    async getLibrary(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const library = await services.libraryService.getLibraryModel(requestContext, context.signal);
+      return {
+        library: toLibrary({
+          components: { ...library.components },
+          entities: { ...library.entities }
+        })
+      };
+    },
+    async listComponents(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const page = await services.libraryService.getComponents(requestContext, { pageSize: request.pageSize, pageToken: request.pageToken }, context.signal);
+      return {
+        components: page.items.map((component) => ({
+          type: component.type,
+          kind: component.kind === "unit" ? ComponentKind2.UNIT : ComponentKind2.COMPOSITE,
+          meta: {
+            title: component.meta.title,
+            description: component.meta.description,
+            color: component.meta.color,
+            icon: component.meta.icon,
+            iconColor: component.meta.iconColor,
+            secondaryIcon: component.meta.secondaryIcon,
+            secondaryIconColor: component.meta.secondaryIconColor,
+            category: component.meta.category,
+            defaultNamePrefix: component.meta.defaultNamePrefix
+          }
+        })),
+        nextPageToken: page.nextPageToken
+      };
+    },
+    async getComponent(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const type = parseArgument(request, "type", z3.string().min(1));
+      const library = await services.libraryService.getLibraryModel(requestContext, context.signal);
+      const component = library.components[type];
+      if (!component) {
+        throw new ComponentNotFoundError(requestContext.projectId, type);
+      }
+      return { component: toComponent(component) };
+    }
+  };
+}
+
+// src/handlers/operation.ts
+import { operationLaunchInputSchema, operationPlanInputSchema } from "@highstate/backend/shared";
+import { instanceIdSchema, z as z4 } from "@highstate/contract";
+function createOperationService(services) {
+  return {
+    async planOperation(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const input = parseValue({ ...request, projectId: requestContext.projectId, type: fromOperationType(request.type) }, "request", operationPlanInputSchema);
+      const phases = await services.operationManager.plan(input);
+      return { phases: phases.map(toOperationPhase) };
+    },
+    async launchOperation(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const input = parseValue({
+        ...request,
+        projectId: requestContext.projectId,
+        type: fromOperationType(request.type),
+        plan: request.plan.length > 0 ? request.plan.map(fromOperationPhase) : undefined
+      }, "request", operationLaunchInputSchema);
+      const operation = await services.operationManager.launch(input);
+      return { operation: toOperation(operation) };
+    },
+    async getOperation(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const operationId = parseValue(request.operationId, "operationId", z4.string().min(1));
+      const operation = await services.operationService.getOperationOrThrow(requestContext, operationId);
+      return { operation: toOperation(operation) };
+    },
+    async listOperations(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const page = await services.operationService.getOperations(requestContext, {
+        pageSize: request.pageSize,
+        pageToken: request.pageToken
+      });
+      return { operations: page.items.map(toOperation), nextPageToken: page.nextPageToken };
+    },
+    async listOperationLogs(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const operationId = parseValue(request.operationId, "operationId", z4.string().min(1));
+      const stateId = parseValue(request.stateId, "stateId", z4.cuid2().optional());
+      await services.operationService.getOperationOrThrow(requestContext, operationId);
+      const page = await services.operationService.getOperationLogs(requestContext, operationId, stateId, { pageSize: request.pageSize, pageToken: request.pageToken });
+      return {
+        logs: page.items.map((log) => toOperationLog(operationId, log)),
+        nextPageToken: page.nextPageToken
+      };
+    },
+    async cancelOperation(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const operationId = parseValue(request.operationId, "operationId", z4.string().min(1));
+      await services.operationService.getOperationOrThrow(requestContext, operationId);
+      services.operationManager.cancel(operationId);
+      return {};
+    },
+    async cancelInstanceOperation(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const operationId = parseValue(request.operationId, "operationId", z4.string().min(1));
+      const instanceId = parseValue(request.instanceId, "instanceId", instanceIdSchema);
+      await services.operationService.getOperationOrThrow(requestContext, operationId);
+      services.operationManager.cancelInstance(operationId, instanceId);
       return {};
     }
   };
@@ -76,54 +1020,166 @@ function createInstanceService(services) {
 
 // src/handlers/panel.ts
 import { panelInputSchema } from "@highstate/backend/shared";
-import { z as z2 } from "@highstate/contract";
+import { z as z5 } from "@highstate/contract";
 function createPanelService(services) {
   return {
     async setUnitPanels(request, context) {
-      const [projectId, apiKey] = await authenticate(services, context);
-      const workerVersionId = parseArgument(request, "workerVersionId", z2.cuid2());
-      const workerInstanceId = parseArgument(request, "workerInstanceId", z2.cuid2());
-      const stateId = parseArgument(request, "stateId", z2.cuid2());
-      const panels = parseArgument(request, "panels", z2.array(panelInputSchema));
-      const panelIds = await services.panelService.setUnitPanels(projectId, stateId, apiKey.id, workerVersionId, panels, workerInstanceId);
+      const requestContext = await authenticateProject(services, request, context);
+      const workerVersionId = parseArgument(request, "workerVersionId", z5.cuid2());
+      const workerInstanceId = parseArgument(request, "workerInstanceId", z5.cuid2());
+      const stateId = parseArgument(request, "stateId", z5.cuid2());
+      const panels = parseArgument(request, "panels", z5.array(panelInputSchema));
+      const panelIds = await services.panelService.setUnitPanels(requestContext, stateId, requestContext.subject.apiKeyId, workerVersionId, panels, workerInstanceId);
       return { panelIds };
     }
   };
 }
 
+// src/handlers/project.ts
+function createProjectService(services) {
+  return {
+    async getProject(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const [project, unlockState] = await Promise.all([
+        services.projectService.getProjectOrThrowCore(requestContext.projectId),
+        services.projectUnlockService.getProjectUnlockStateCore(requestContext.projectId)
+      ]);
+      return {
+        project: toProject(project),
+        isLocked: unlockState.type === "locked"
+      };
+    },
+    async listProjects(request, context) {
+      const requestContext = await authenticateBackend(services, context);
+      const result = await services.projectService.getProjects(requestContext, {
+        pageSize: request.pageSize,
+        pageToken: request.pageToken
+      });
+      const projects = await Promise.all(result.items.map(async (project) => {
+        const unlockState = await services.projectUnlockService.getProjectUnlockStateCore(project.id);
+        return {
+          project: toProject(project),
+          isLocked: unlockState.type === "locked"
+        };
+      }));
+      return {
+        projects,
+        nextPageToken: result.nextPageToken
+      };
+    }
+  };
+}
+
+// src/handlers/project-model.ts
+import {
+  HubSchema as HubSchema2,
+  InstanceSchema as InstanceSchema2
+} from "@highstate/api/v1";
+import { projectModelInstanceSchema } from "@highstate/backend/shared";
+import { hubModelSchema, instanceIdSchema as instanceIdSchema2, z as z6 } from "@highstate/contract";
+var instanceMutablePaths = new Set([
+  "arguments",
+  "inputs",
+  "hub_inputs",
+  "injection_inputs",
+  "position",
+  "position.x",
+  "position.y"
+]);
+var hubMutablePaths = new Set([
+  "position",
+  "position.x",
+  "position.y",
+  "inputs",
+  "injection_inputs"
+]);
+function createProjectModelService(services) {
+  return {
+    async getProjectModel(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const [model] = await services.projectModelService.getProjectModel(requestContext, {
+        includeVirtualInstances: request.includeVirtualInstances,
+        includeGhostInstances: request.includeGhostInstances
+      });
+      return { model: toProjectModel(model) };
+    },
+    async createNodes(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const instances = parseValue(request.instances.map(fromInstance), "instances", projectModelInstanceSchema.array());
+      const hubs = parseValue(request.hubs.map(fromHub), "hubs", hubModelSchema.array());
+      await services.projectService.createNodes(requestContext, instances, hubs);
+      return {};
+    },
+    async updateInstance(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const requestInstance = parseArgument(request, "instance", z6.custom());
+      const instanceId = parseArgument(requestInstance, "id", instanceIdSchema2);
+      const paths = validateUpdateMask(request.updateMask, InstanceSchema2, instanceMutablePaths);
+      const patch = toInstancePatch(requestInstance, paths);
+      const instance = await services.projectService.updateInstance(requestContext, instanceId, patch);
+      return { instance: toInstance(instance) };
+    },
+    async renameInstance(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const instanceId = parseArgument(request, "instanceId", instanceIdSchema2);
+      const newName = parseArgument(request, "newName", z6.string().min(1));
+      const instance = await services.projectService.renameInstance(requestContext, instanceId, newName);
+      return { instance: toInstance(instance) };
+    },
+    async deleteInstance(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const instanceId = parseArgument(request, "instanceId", instanceIdSchema2);
+      await services.projectService.deleteInstance(requestContext, instanceId);
+      return {};
+    },
+    async updateHub(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const requestHub = parseArgument(request, "hub", z6.custom());
+      const hubId = parseArgument(requestHub, "id", z6.cuid2());
+      const paths = validateUpdateMask(request.updateMask, HubSchema2, hubMutablePaths);
+      const patch = toHubPatch(requestHub, paths);
+      const hub = await services.projectService.updateHub(requestContext, hubId, patch);
+      return { hub: toHub(hub) };
+    },
+    async deleteHub(request, context) {
+      const requestContext = await authenticateProject(services, request, context);
+      const hubId = parseArgument(request, "hubId", z6.cuid2());
+      await services.projectService.deleteHub(requestContext, hubId);
+      return {};
+    }
+  };
+}
+
 // src/handlers/secret.ts
 function createSecretService(services) {
   return {
-    async getSecretContent(_request, context) {
-      const [_projectId] = await authenticate(services, context);
+    async getSecretContent(request, context) {
+      await authenticateProject(services, request, context);
       throw new Error("Not implemented");
     }
   };
 }
 
 // src/handlers/worker.ts
-import { commonObjectMetaSchema, serviceAccountMetaSchema, z as z3 } from "@highstate/contract";
-var workerMetaUpdatePayloadSchema = z3.union([
-  commonObjectMetaSchema,
-  z3.object({
-    workerMeta: commonObjectMetaSchema,
-    serviceAccountMeta: serviceAccountMetaSchema
-  })
-]);
+import { create as create4 } from "@bufbuild/protobuf";
+import { ConnectResponseSchema } from "@highstate/api/worker.v1";
+import { WorkerOwnershipError } from "@highstate/backend/shared";
+import { commonObjectMetaSchema, serviceAccountMetaSchema, z as z7 } from "@highstate/contract";
 function createWorkerService(services) {
   return {
     async* connect(request, context) {
-      const [projectId, apiKey] = await authenticate(services, context);
-      const workerVersionId = parseArgument(request, "workerVersionId", z3.cuid2());
-      const workerInstanceId = parseArgument(request, "workerInstanceId", z3.cuid2());
-      const dataEndpoint = parseArgument(request, "dataEndpoint", z3.string().min(1));
+      const requestContext = await authenticateProject(services, request, context);
+      const { projectId } = requestContext;
+      const workerVersionId = parseArgument(request, "workerVersionId", z7.cuid2());
+      const workerInstanceId = parseArgument(request, "workerInstanceId", z7.cuid2());
+      const dataEndpoint = parseArgument(request, "dataEndpoint", z7.string().min(1));
       const database = await services.database.forProject(projectId);
       const workerVersion = await database.workerVersion.findFirst({
-        where: { id: workerVersionId, apiKeyId: apiKey.id },
+        where: { id: workerVersionId, apiKeyId: requestContext.subject.apiKeyId },
         select: { id: true }
       });
       if (!workerVersion) {
-        throw new Error(`Worker version "${workerVersionId}" is not owned by the API key`);
+        throw new WorkerOwnershipError(projectId, workerVersionId);
       }
       services.workerManager.assertWorkerInstance(projectId, workerVersionId, workerInstanceId);
       services.panelEndpointManager.connect(projectId, workerVersionId, workerInstanceId, dataEndpoint);
@@ -134,15 +1190,15 @@ function createWorkerService(services) {
           select: { stateId: true, params: true }
         });
         for (const registration of existingRegistrations) {
-          yield {
+          yield create4(ConnectResponseSchema, {
             event: {
-              $case: "unitRegistration",
+              case: "unitRegistration",
               value: {
                 stateId: registration.stateId,
-                params: registration.params
+                params: toJsonObject(registration.params)
               }
             }
-          };
+          });
         }
         const registrationStream = await services.pubsubManager.subscribe([
           "worker-unit-registration",
@@ -151,19 +1207,19 @@ function createWorkerService(services) {
         ]);
         for await (const event of registrationStream) {
           if (event.type === "registered") {
-            yield {
+            yield create4(ConnectResponseSchema, {
               event: {
-                $case: "unitRegistration",
-                value: { stateId: event.stateId, params: event.params }
+                case: "unitRegistration",
+                value: { stateId: event.stateId, params: toJsonObject(event.params) }
               }
-            };
+            });
           } else if (event.type === "deregistered") {
-            yield {
+            yield create4(ConnectResponseSchema, {
               event: {
-                $case: "unitDeregistration",
+                case: "unitDeregistration",
                 value: { stateId: event.stateId }
               }
-            };
+            });
           }
         }
       } finally {
@@ -171,38 +1227,93 @@ function createWorkerService(services) {
       }
     },
     async updateWorkerVersionMeta(request, context) {
-      const [projectId] = await authenticate(services, context);
-      const workerVersionId = parseArgument(request, "workerVersionId", z3.string());
-      const payload = parseArgument(request, "meta", workerMetaUpdatePayloadSchema);
-      const workerMeta = "workerMeta" in payload ? payload.workerMeta : payload;
-      const serviceAccountMeta = "serviceAccountMeta" in payload ? payload.serviceAccountMeta : undefined;
-      await services.workerService.updateWorkerVersionMeta(projectId, workerVersionId, workerMeta, serviceAccountMeta);
+      const requestContext = await authenticateProject(services, request, context);
+      const workerVersionId = parseArgument(request, "workerVersionId", z7.string());
+      const workerMeta = parseArgument(request, "workerMeta", commonObjectMetaSchema);
+      const serviceAccountMeta = parseArgument(request, "serviceAccountMeta", serviceAccountMetaSchema.optional());
+      await services.workerService.updateWorkerVersionMeta(requestContext, workerVersionId, workerMeta, serviceAccountMeta);
       return {};
     }
   };
 }
 
 // src/index.ts
-async function startBackedApi(services) {
-  const server = createServer();
-  server.use(createErrorHandlingMiddleware(services));
-  server.add(InstanceServiceDefinition, createInstanceService(services));
-  server.add(PanelServiceDefinition, createPanelService(services));
-  server.add(SecretServiceDefinition, createSecretService(services));
-  server.add(WorkerServiceDefinition, createWorkerService(services));
+function createBackendApiHandler(services, options = {}) {
+  return connectNodeAdapter({
+    interceptors: [createErrorHandlingInterceptor(services)],
+    requestPathPrefix: options.requestPathPrefix,
+    routes(router) {
+      router.service(InstanceStateService, createInstanceStateService(services));
+      router.service(LibraryService, createLibraryService(services));
+      router.service(OperationService, createOperationService(services));
+      router.service(PanelService, createPanelService(services));
+      router.service(ProjectModelService, createProjectModelService(services));
+      router.service(ProjectService, createProjectService(services));
+      router.service(SecretService, createSecretService(services));
+      router.service(WorkerService, createWorkerService(services));
+    }
+  });
+}
+async function startBackendApi(services, options = {}) {
   const uid = process.geteuid?.();
-  const sockPath = `/run/user/${uid}/highstate.sock`;
+  const workerSocketPath = options.workerSocketPath ?? `/run/user/${uid}/highstate.sock`;
+  const workerAddress = `unix:${workerSocketPath}`;
+  const address = options.address ?? workerAddress;
+  const addresses = address === workerAddress ? [workerAddress] : [workerAddress, address];
+  const handler = createBackendApiHandler(services);
+  const servers = addresses.map(() => createServer(handler));
   try {
-    await rm(sockPath, { force: true });
+    await rm(workerSocketPath, { force: true });
   } catch (error) {
     if (!(error instanceof Error && ("code" in error) && error.code === "ENOENT")) {
       services.logger.error({ error }, "failed to remove existing socket file");
     }
   }
-  await server.listen(`unix:${sockPath}`);
-  services.workerManager.config.HIGHSTATE_WORKER_API_PATH = sockPath;
-  services.logger.info(`api listening at %s`, sockPath);
+  try {
+    for (const [index, server] of servers.entries()) {
+      const serverAddress = addresses[index];
+      await listen(server, serverAddress);
+      services.logger.info(`api listening at "%s"`, serverAddress);
+    }
+  } catch (error) {
+    await Promise.allSettled(servers.map(close));
+    await rm(workerSocketPath, { force: true });
+    throw new Error("Failed to start backend api", { cause: error });
+  }
+  services.workerManager.config.HIGHSTATE_WORKER_API_PATH = workerSocketPath;
+  return {
+    address,
+    async shutdown() {
+      await Promise.all(servers.map(close));
+      await rm(workerSocketPath, { force: true });
+    }
+  };
+}
+async function listen(server, address) {
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.once("listening", resolve);
+    if (address.startsWith("unix:")) {
+      server.listen(address.slice("unix:".length));
+      return;
+    }
+    const url = new URL(address.includes("://") ? address : `http://${address}`);
+    server.listen(Number(url.port), url.hostname);
+  });
+}
+async function close(server) {
+  await new Promise((resolve, reject) => {
+    server.close((error) => {
+      if (error) {
+        reject(error);
+        return;
+      }
+      resolve();
+    });
+    server.closeAllConnections();
+  });
 }
 export {
-  startBackedApi
+  startBackendApi,
+  createBackendApiHandler
 };