@highstate/backend 0.10.0 → 0.11.3

package/dist/highstate.manifest.json

@@ -1,9 +1,9 @@
 {
   "sourceHashes": {
-    "./dist/index.js": 1787642973,
+    "./dist/index.js": 4290144902,
     "./dist/shared/index.js": 1121681166,
-    "./dist/library/worker/main.js": 3258859070,
-    "./dist/library/package-resolution-worker.js": 1783943420,
-    "./dist/database/local/prisma.config.js": 1834003006
+    "./dist/library/worker/main.js": 875302514,
+    "./dist/library/package-resolution-worker.js": 1596195914,
+    "./dist/database/local/prisma.config.js": 4014074705
   }
 }

package/dist/index.js

@@ -5,7 +5,7 @@ import { randomBytes, createHash } from 'node:crypto';
 import { createId } from '@paralleldrive/cuid2';
 import { hubModelSchema, instanceModelSchema, parseInstanceId, isUnitModel, HighstateConfigKey, unitArtifactSchema, unitArtifactId, unitWorkerSchema, unitTriggerSchema, unitPageSchema, unitTerminalSchema, instanceStatusFieldSchema, getInstanceId } from '@highstate/contract';
 import { omit, isNonNullish, groupBy, mapValues, unique, join as join$1, omitBy } from 'remeda';
-import z3, { z } from 'zod';
+import z4, { z } from 'zod';
 import * as os from 'node:os';
 import { tmpdir, hostname } from 'node:os';
 import { PrismaLibSQL } from '@prisma/adapter-libsql';
@@ -18,8 +18,8 @@ import { PrismaClientKnownRequestError } from '@prisma/client/runtime/client';
 import { execa } from 'execa';
 import { resolve } from 'import-meta-resolve';
 import { detectPackageManager, runScript, addDependency, ensureDependencyInstalled } from 'nypm';
+import { readFile, mkdir, writeFile, access, unlink, readdir, rm, mkdtemp } from 'node:fs/promises';
 import { findCredentialsAsync, AsyncEntry } from '@napi-rs/keyring';
-import { mkdir, readFile, writeFile, access, unlink, readdir, rm, mkdtemp } from 'node:fs/promises';
 import { stringify, parse } from 'yaml';
 import { LRUCache } from 'lru-cache';
 import { ulid } from 'ulid';
@@ -726,11 +726,33 @@ async function ensureWellKnownEntitiesCreated(database) {
 }
 var serviceName = "io.highstate.backend";
 var accountName = "identity";
-async function getOrCreateBackendIdentity(logger) {
+var backendIdentityConfig = z.object({
+  HIGHSTATE_BACKEND_DATABASE_IDENTITY: z.string().optional(),
+  HIGHSTATE_BACKEND_DATABASE_IDENTITY_PATH: z.string().optional()
+});
+async function getOrCreateBackendIdentity(config4, logger) {
+  if (config4.HIGHSTATE_BACKEND_DATABASE_IDENTITY) {
+    logger.info("using backend identity from HIGHSTATE_BACKEND_DATABASE_IDENTITY");
+    return config4.HIGHSTATE_BACKEND_DATABASE_IDENTITY;
+  }
+  if (config4.HIGHSTATE_BACKEND_DATABASE_IDENTITY_PATH) {
+    try {
+      const identity = await readFile(config4.HIGHSTATE_BACKEND_DATABASE_IDENTITY_PATH, "utf-8");
+      logger.info(
+        `using backend identity from path specified in HIGHSTATE_BACKEND_DATABASE_IDENTITY_PATH`
+      );
+      return identity.trim();
+    } catch (error) {
+      throw new Error(
+        `Failed to read backend identity from "${config4.HIGHSTATE_BACKEND_DATABASE_IDENTITY_PATH}"`,
+        { cause: error }
+      );
+    }
+  }
   const credentials = await findCredentialsAsync(serviceName);
   const entry = credentials.find((entry2) => entry2.account === accountName);
   if (entry) {
-    logger.debug("found existing backend identity in keyring");
+    logger.info("using backend identity from OS keyring");
     return entry.password;
   }
   const newIdentity = await generateIdentity();
@@ -772,12 +794,14 @@ async function writeMetaFile(databasePath, meta) {
 var localBackendDatabaseConfig = z.object({
   ...codebaseConfig.shape,
   HIGHSTATE_BACKEND_DATABASE_LOCAL_PATH: z.string().optional(),
+  ...backendIdentityConfig.shape,
   HIGHSTATE_ENCRYPTION_ENABLED: z.stringbool().default(true)
 });
 var LocalBackendDatabaseBackend = class {
-  constructor(database, databasePath, logger, isEncryptionEnabled) {
+  constructor(database, databasePath, config4, logger, isEncryptionEnabled) {
     this.database = database;
     this.databasePath = databasePath;
+    this.config = config4;
     this.logger = logger;
     this.isEncryptionEnabled = isEncryptionEnabled;
   }
@@ -798,7 +822,7 @@ var LocalBackendDatabaseBackend = class {
       );
       return;
     }
-    const identity = await getOrCreateBackendIdentity(this.logger);
+    const identity = await getOrCreateBackendIdentity(this.config, this.logger);
     const decrypter = new Decrypter();
     decrypter.addIdentity(identity);
     const plaintextMasterKey = await decrypter.decrypt(armor.decode(meta.masterKey), "text");
@@ -815,8 +839,8 @@ var LocalBackendDatabaseBackend = class {
     });
   }
 };
-async function createMasterKey(logger) {
-  const identity = await getOrCreateBackendIdentity(logger);
+async function createMasterKey(config4, logger) {
+  const identity = await getOrCreateBackendIdentity(config4, logger);
   const masterKey = randomBytes(32).toString("hex");
   const encrypter = new Encrypter();
   const recipient = await identityToRecipient(identity);
@@ -825,11 +849,11 @@ async function createMasterKey(logger) {
   const armoredMasterKey = armor.encode(encryptedMasterKey);
   return { armoredMasterKey, masterKey, recipient };
 }
-async function ensureDatabaseInitialized(databasePath, encryptionEnabled, logger) {
+async function ensureDatabaseInitialized(databasePath, encryptionEnabled, config4, logger) {
   const meta = await readMetaFile(databasePath);
   if (!meta) {
     logger.info("creating new database");
-    const masterKey2 = encryptionEnabled ? await createMasterKey(logger) : void 0;
+    const masterKey2 = encryptionEnabled ? await createMasterKey(config4, logger) : void 0;
     const metaFile = {
       version: backendDatabaseVersion,
       masterKey: masterKey2?.armoredMasterKey
@@ -860,12 +884,11 @@ async function ensureDatabaseInitialized(databasePath, encryptionEnabled, logger
       `Database meta file at "${databasePath}/backend.meta.yaml" does not contain a master key.`
     );
   }
-  const identity = await getOrCreateBackendIdentity(logger);
+  const identity = await getOrCreateBackendIdentity(config4, logger);
   const decrypter = new Decrypter();
   decrypter.addIdentity(identity);
   const encryptedMasterKey = armor.decode(meta.masterKey);
   const masterKey = await decrypter.decrypt(encryptedMasterKey, "text");
-  logger.info("loaded backend master key using OS keyring");
   return {
     shouldMigrate: meta.version < backendDatabaseVersion,
     masterKey,
@@ -879,7 +902,12 @@ async function createLocalBackendDatabaseBackend(config4, logger) {
   }
   let databasePath = config4.HIGHSTATE_BACKEND_DATABASE_LOCAL_PATH;
   databasePath ??= await getCodebaseHighstatePath(config4, logger);
-  const { shouldMigrate, masterKey, metaFile, created, initialRecipient } = await ensureDatabaseInitialized(databasePath, config4.HIGHSTATE_ENCRYPTION_ENABLED, logger);
+  const { shouldMigrate, masterKey, metaFile, created, initialRecipient } = await ensureDatabaseInitialized(
+    databasePath,
+    config4.HIGHSTATE_ENCRYPTION_ENABLED,
+    config4,
+    logger
+  );
   const databaseUrl = `file:${databasePath}/backend.db`;
   if (shouldMigrate) {
     await migrateDatabase(databaseUrl, "backend/sqlite", masterKey, logger);
@@ -900,6 +928,7 @@ async function createLocalBackendDatabaseBackend(config4, logger) {
   return new LocalBackendDatabaseBackend(
     database,
     databasePath,
+    config4,
     backendLogger,
     config4.HIGHSTATE_ENCRYPTION_ENABLED
   );
@@ -1139,8 +1168,8 @@ var LocalProjectDatabaseBackend = class _LocalProjectDatabaseBackend {
     return new _LocalProjectDatabaseBackend(highstatePath);
   }
 };
-var databaseManagerConfig = z3.object({
-  HIGHSTATE_ENCRYPTION_ENABLED: z3.stringbool().default(true)
+var databaseManagerConfig = z4.object({
+  HIGHSTATE_ENCRYPTION_ENABLED: z4.stringbool().default(true)
 });
 var DatabaseManagerImpl = class {
   constructor(backendBackend, projectUnlockBackend, projectDatabaseBackend, config4, logger) {