@highstate/backend 0.4.1 → 0.4.2

package/dist/index.mjs

@@ -1,108 +1,207 @@
-import { BetterLock } from 'better-lock';
 import { z } from 'zod';
-import { basename, relative, dirname } from 'node:path';
+import { pickBy, mapKeys, mapValues, funnel } from 'remeda';
+import { BetterLock } from 'better-lock';
+import { consola } from 'consola';
+import { basename, relative, dirname, resolve as resolve$1 } from 'node:path';
 import { findWorkspaceDir, readPackageJSON } from 'pkg-types';
-import { pickBy, mapValues, debounce } from 'remeda';
 import { fileURLToPath } from 'node:url';
 import { EventEmitter, on } from 'node:events';
 import { Worker } from 'node:worker_threads';
 import Watcher from 'watcher';
 import { resolve } from 'import-meta-resolve';
-import { consola } from 'consola';
-import { readFile, writeFile, mkdir } from 'fs/promises';
-import { isUnitModel } from '@highstate/contract';
-import { addDependency } from 'nypm';
+import { readdir, readFile, writeFile, mkdir } from 'node:fs/promises';
+import { getInstanceId, isUnitModel, parseInstanceId } from '@highstate/contract';
+import { b as instanceModelSchema, I as InputHashCalculator, l as createInstanceState, t as terminalFactorySchema, h as instanceRepresentationSchema, f as instanceStatusFieldMapSchema, c as compositeInstanceSchema, s as projectOperationSchema, k as instanceStateSchema, m as applyInstanceStatePatch, o as createInstanceStateFrontendPatch } from './input-hash-C8HEDMjz.mjs';
+import 'crypto-hash';
+import { Readable, PassThrough } from 'node:stream';
+import { tmpdir, homedir } from 'node:os';
+import spawn from 'nano-spawn';
+import { randomUUID } from 'node:crypto';
+import { ensureDependencyInstalled } from 'nypm';
+import { uuidv7 } from 'uuidv7';
+import { pino } from 'pino';
 
-class LocalPulumiProjectHost {
-  lock = new BetterLock();
-  password = process.env.PULUMI_CONFIG_PASSPHRASE ?? "";
-  hasPassword() {
-    return !!this.password;
+class SecretAccessDeniedError extends Error {
+  constructor(projectId, key) {
+    super(`Access to the secrets of component "${projectId}.${key}" is denied.`);
+  }
+}
+
+async function runWithRetryOnError(runner, tryHandleError, maxRetries = 1) {
+  let lastError;
+  for (let i = 0; i < maxRetries + 1; i++) {
+    try {
+      return await runner();
+    } catch (e) {
+      lastError = e;
+      if (await tryHandleError(e)) {
+        continue;
+      }
+      throw e;
+    }
+  }
+  throw lastError;
+}
+class AbortError extends Error {
+  constructor() {
+    super("Operation aborted");
+  }
+}
+function isAbortError(error) {
+  return error instanceof Error && error.name === "AbortError";
+}
+const stringArrayType = z.string().transform((args) => args.split(",").map((arg) => arg.trim()));
+function errorToString(error) {
+  if (error instanceof Error) {
+    return error.stack || error.message;
+  }
+  return JSON.stringify(error);
+}
+
+class LocalPulumiHost {
+  constructor(logger) {
+    this.logger = logger;
   }
-  setPassword(password) {
-    this.password = password;
+  lock = new BetterLock();
+  async getCurrentUser() {
+    const { LocalWorkspace } = await import('@pulumi/pulumi/automation/index.js');
+    const workspace = await LocalWorkspace.create({});
+    try {
+      return await workspace.whoAmI();
+    } catch (error) {
+      this.logger.error({ msg: "failed to get current user", error });
+      return null;
+    }
   }
-  async runInline(projectName, stackName, program, fn) {
-    return this.lock.acquire(`${projectName}.${stackName}`, async () => {
-      const { LocalWorkspace } = await import('@pulumi/pulumi/automation');
+  async runInline(projectId, pulumiProjectName, pulumiStackName, program, fn) {
+    return this.lock.acquire(`${pulumiProjectName}.${pulumiStackName}`, async () => {
+      const { LocalWorkspace } = await import('@pulumi/pulumi/automation/index.js');
       const stack = await LocalWorkspace.createOrSelectStack(
         {
-          projectName,
-          stackName,
+          projectName: pulumiProjectName,
+          stackName: pulumiStackName,
           program
         },
         {
           projectSettings: {
-            name: projectName,
+            name: pulumiProjectName,
             runtime: "nodejs"
           },
-          envVars: { PULUMI_CONFIG_PASSPHRASE: this.password }
+          envVars: { PULUMI_CONFIG_PASSPHRASE: this.getPassword(projectId) }
         }
       );
-      return await fn(stack);
+      try {
+        return await runWithRetryOnError(
+          () => fn(stack),
+          (error) => LocalPulumiHost.tryUnlockStack(stack, error)
+        );
+      } catch (e) {
+        if (e instanceof Error && e.message.includes("canceled")) {
+          throw new AbortError();
+        }
+        throw e;
+      }
     });
   }
-  async runLocal(projectName, stackName, programPathResolver, fn) {
-    return this.lock.acquire(`${projectName}.${stackName}`, async () => {
-      const { LocalWorkspace } = await import('@pulumi/pulumi/automation');
+  async runEmpty(projectId, pulumiProjectName, pulumiStackName, fn) {
+    return this.runInline(projectId, pulumiProjectName, pulumiStackName, async () => {
+    }, fn);
+  }
+  // TODO: extract args to options object
+  async runLocal(projectId, pulumiProjectName, pulumiStackName, programPathResolver, fn, stackConfig) {
+    return this.lock.acquire(`${pulumiProjectName}.${pulumiStackName}`, async () => {
+      const { LocalWorkspace } = await import('@pulumi/pulumi/automation/index.js');
       const stack = await LocalWorkspace.createOrSelectStack(
         {
-          stackName,
+          stackName: pulumiStackName,
           workDir: await programPathResolver()
         },
         {
-          envVars: { PULUMI_CONFIG_PASSPHRASE: this.password }
+          projectSettings: {
+            name: pulumiProjectName,
+            runtime: "nodejs"
+          },
+          stackSettings: stackConfig ? {
+            [pulumiStackName]: {
+              config: stackConfig
+            }
+          } : undefined,
+          envVars: { PULUMI_CONFIG_PASSPHRASE: this.getPassword(projectId) }
         }
       );
-      return await fn(stack);
+      try {
+        return await runWithRetryOnError(
+          () => fn(stack),
+          (error) => LocalPulumiHost.tryUnlockStack(stack, error)
+        );
+      } catch (e) {
+        if (e instanceof Error && e.message.includes("canceled")) {
+          throw new AbortError();
+        }
+        throw e;
+      }
     });
   }
+  sharedPassword = process.env.PULUMI_CONFIG_PASSPHRASE ?? "";
+  passwords = /* @__PURE__ */ new Map();
+  hasPassword(projectId) {
+    return !!this.sharedPassword || this.passwords.has(projectId);
+  }
+  setPassword(projectId, password) {
+    this.passwords.set(projectId, password);
+  }
+  getPassword(projectId) {
+    return this.sharedPassword || this.passwords.get(projectId) || "";
+  }
+  static async tryUnlockStack(stack, error) {
+    if (error instanceof Error && error.message.includes("the stack is currently locked")) {
+      consola.warn("Unlocking stack", stack.name);
+      await stack.cancel();
+      return true;
+    }
+    return false;
+  }
+  static create(logger) {
+    return new LocalPulumiHost(logger.child({ service: "LocalPulumiHost" }));
+  }
+}
+function valueToString(value) {
+  if (typeof value === "string") {
+    return value;
+  }
+  return JSON.stringify(value);
+}
+function stringToValue(value) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return value;
+  }
+}
+function updateResourceCount(opType, currentCount) {
+  switch (opType) {
+    case "same":
+    case "create":
+    case "update":
+    case "replace":
+    case "create-replacement":
+    case "import":
+    case "import-replacement":
+      return currentCount + 1;
+    case "delete":
+    case "delete-replaced":
+    case "discard":
+    case "discard-replaced":
+    case "remove-pending-replace":
+      return currentCount - 1;
+    case "refresh":
+    case "read-replacement":
+    case "read":
+      return currentCount;
+    default:
+      throw new Error(`Unknown operation type: ${opType}`);
+  }
 }
-
-const instanceStatusSchema = z.enum([
-  "not_created",
-  "updating",
-  "destroying",
-  "refreshing",
-  "created",
-  "error"
-]);
-const instanceStateSchema = z.object({
-  key: z.string(),
-  parentKey: z.string().optional(),
-  status: instanceStatusSchema,
-  resources: z.number(),
-  totalResources: z.number(),
-  error: z.string().optional(),
-  message: z.string().optional()
-});
-const operationType = z.enum(["update", "destroy", "recreate", "refresh"]);
-const projectOperation = z.object({
-  type: operationType,
-  instanceIds: z.array(z.string())
-});
-const projectStateSchema = z.object({
-  currentOperation: projectOperation.optional(),
-  instances: z.record(instanceStateSchema.optional())
-});
-const positionSchema = z.object({
-  x: z.number(),
-  y: z.number()
-});
-const outputRefSchema = z.object({
-  instanceId: z.string(),
-  output: z.string()
-});
-const instanceModelSchema = z.object({
-  id: z.string().nanoid(),
-  type: z.string(),
-  name: z.string(),
-  position: positionSchema,
-  args: z.record(z.any()),
-  inputs: z.record(z.union([outputRefSchema, z.array(outputRefSchema)]))
-});
-
-const stringArrayType = z.string().transform((args) => args.split(",").map((arg) => arg.trim()));
 
 async function resolveMainLocalProject(projectPath, projectName) {
   if (!projectPath) {
@@ -118,56 +217,96 @@ async function resolveMainLocalProject(projectPath, projectName) {
   return [projectPath, projectName];
 }
 
-class SecretAccessDeniedError extends Error {
-  constructor(projectId, key) {
-    super(`Access to the secrets of component "${projectId}.${key}" is denied.`);
-  }
-}
-
 const localSecretBackendConfig = z.object({
   HIGHSTATE_BACKEND_SECRET_PROJECT_PATH: z.string().optional(),
   HIGHSTATE_BACKEND_SECRET_PROJECT_NAME: z.string().optional()
 });
 class LocalSecretBackend {
-  constructor(projectPath, projectName, pulumiProjectHost) {
+  constructor(projectPath, projectName, pulumiProjectHost, logger) {
     this.projectPath = projectPath;
     this.projectName = projectName;
     this.pulumiProjectHost = pulumiProjectHost;
+    this.logger = logger;
+    this.logger.debug({ msg: "initialized", projectPath, projectName });
+  }
+  isLocked(projectId) {
+    return Promise.resolve(!this.pulumiProjectHost.hasPassword(projectId));
+  }
+  async unlock(projectId, password) {
+    this.pulumiProjectHost.setPassword(projectId, password);
+    try {
+      await this.pulumiProjectHost.runLocal(
+        projectId,
+        this.projectName,
+        projectId,
+        () => this.projectPath,
+        async (stack) => {
+          this.logger.debug("checking password", { projectId });
+          await stack.info(true);
+        }
+      );
+      return true;
+    } catch (error) {
+      if (error instanceof Error) {
+        if (error.message.includes("incorrect passphrase")) {
+          return false;
+        }
+      }
+      throw error;
+    }
   }
-  get(projectId, componentKey) {
+  get(projectId, instanceId) {
     return this.pulumiProjectHost.runLocal(
+      projectId,
       this.projectName,
       projectId,
       () => this.projectPath,
       async (stack) => {
+        this.logger.debug("getting secrets", { projectId, instanceId });
         const config = await stack.getAllConfig();
-        const componentSecrets = pickBy(config, (_, key) => key.startsWith(`${componentKey}.`));
-        return mapValues(componentSecrets, (value) => value.value);
+        const prefix = this.getPrefix(projectId, instanceId);
+        const secrets = pickBy(config, (_, key) => key.startsWith(prefix));
+        const trimmedSecrets = mapKeys(secrets, (key) => key.slice(prefix.length));
+        return mapValues(trimmedSecrets, (value) => stringToValue(value.value));
       }
     );
   }
-  set(projectId, componentKey, values) {
+  set(projectId, instanceId, values) {
     return this.pulumiProjectHost.runLocal(
+      projectId,
       this.projectName,
       projectId,
       () => this.projectPath,
       async (stack) => {
-        const componentSecrets = mapValues(values, (value, key) => ({
-          key: `${componentKey}.${key}`,
-          value
-        }));
+        this.logger.debug("setting secrets", { projectId, instanceId });
+        const componentSecrets = mapValues(
+          mapKeys(values, (key) => `${this.getPrefix(projectId, instanceId)}${key}`),
+          (value) => ({
+            value: valueToString(value),
+            secret: true
+          })
+        );
         const config = await stack.getAllConfig();
         Object.assign(config, componentSecrets);
         await stack.setAllConfig(config);
       }
     );
   }
-  static async create(config, pulumiProjectHost) {
+  getPrefix(projectId, instanceId) {
+    instanceId = instanceId.replace(/:/g, ".");
+    return `${this.projectName}:${projectId}/${instanceId}/`;
+  }
+  static async create(config, pulumiProjectHost, logger) {
     const [projectPath, projectName] = await resolveMainLocalProject(
       config.HIGHSTATE_BACKEND_SECRET_PROJECT_PATH,
       config.HIGHSTATE_BACKEND_SECRET_PROJECT_NAME
     );
-    return new LocalSecretBackend(projectPath, projectName, pulumiProjectHost);
+    return new LocalSecretBackend(
+      projectPath,
+      projectName,
+      pulumiProjectHost,
+      logger.child({ backend: "SecretBackend", service: "LocalSecretBackend" })
+    );
   }
 }
 
@@ -175,69 +314,106 @@ const secretBackendConfig = z.object({
   HIGHSTATE_BACKEND_SECRET_TYPE: z.enum(["local"]).default("local"),
   ...localSecretBackendConfig.shape
 });
-function createSecretBackend(config, pulumiProjectHost) {
-  return LocalSecretBackend.create(config, pulumiProjectHost);
+function createSecretBackend(config, localPulumiHost, logger) {
+  switch (config.HIGHSTATE_BACKEND_SECRET_TYPE) {
+    case "local": {
+      return LocalSecretBackend.create(config, localPulumiHost, logger);
+    }
+  }
 }
 
 const localLibraryBackendConfig = z.object({
   HIGHSTATE_BACKEND_LIBRARY_LOCAL_MODULES: stringArrayType.default("@highstate/library")
 });
 class LocalLibraryBackend {
-  constructor(modulePaths) {
+  constructor(modulePaths, logger) {
     this.modulePaths = modulePaths;
+    this.logger = logger;
     this.watcher = new Watcher(modulePaths, { recursive: true, ignoreInitial: true });
     this.watcher.on("all", (event, path) => {
       const prefixPath = modulePaths.find((modulePath) => path.startsWith(modulePath));
-      consola.info("Library event:", event, relative(prefixPath, path));
-      void this.updateLibrary();
+      this.logger.info({ msg: "library event", event, path: relative(prefixPath, path) });
+      void this.lock.acquire(() => this.updateLibrary());
     });
-    consola.info("Library watchers set to:", modulePaths);
+    this.logger.debug({ msg: "initialized", modulePaths });
   }
   watcher;
   lock = new BetterLock();
   eventEmitter = new EventEmitter();
   library = null;
+  worker = null;
   async loadLibrary() {
-    if (this.library) {
-      return this.library;
-    }
-    return await this.updateLibrary();
+    return await this.lock.acquire(async () => {
+      const [library] = await this.getLibrary();
+      return library;
+    });
   }
   async *watchLibrary(signal) {
     for await (const [library] of on(this.eventEmitter, "library", { signal })) {
       yield library;
     }
   }
-  async evaluateInstances(instances, instanceIds) {
-    const worker = this.createWorker("library-evaluator", {
-      modulePaths: this.modulePaths,
-      instances,
-      instanceIds
+  async evaluateCompositeInstances(allInstances, instanceIds) {
+    return await this.lock.acquire(async () => {
+      this.logger.info("evaluating composite instances", { instanceIds });
+      const [, worker] = await this.getLibrary();
+      worker.postMessage({ type: "evaluate-composite-instances", allInstances, instanceIds });
+      this.logger.debug("evaluation request sent");
+      return this.getInstances(worker);
     });
-    for await (const [registrations] of on(worker, "message")) {
-      return registrations;
-    }
-    throw new Error("Worker ended without sending registrations.");
   }
-  async updateLibrary() {
+  async evaluateModules(modulePaths) {
     return await this.lock.acquire(async () => {
-      const worker = this.createWorker("library-loader", { modulePaths: this.modulePaths });
-      for await (const [library] of on(worker, "message")) {
-        this.eventEmitter.emit("library", library);
-        this.library = library;
-        consola.success("Library reloaded");
-        return this.library;
-      }
-      throw new Error("Worker ended without sending library model.");
+      this.logger.info({ msg: "evaluating modules", modulePaths });
+      const [, worker] = await this.getLibrary();
+      worker.postMessage({ type: "evaluate-modules", modulePaths });
+      this.logger.debug("evaluation request sent");
+      return this.getInstances(worker);
     });
   }
-  createWorker(module, workerData) {
-    const workerPathUrl = resolve(`@highstate/backend/${module}`, import.meta.url);
+  async getInstances(worker) {
+    for await (const [event] of on(worker, "message")) {
+      const eventData = event;
+      if (eventData.type === "error") {
+        throw new Error(`Worker error: ${eventData.error}`);
+      }
+      if (eventData.type !== "instances") {
+        throw new Error(`Unexpected message type '${eventData.type}', expected 'instances'`);
+      }
+      return eventData.instances;
+    }
+    throw new Error("Worker ended without sending instances");
+  }
+  async getLibrary() {
+    if (this.library && this.worker) {
+      return [this.library, this.worker];
+    }
+    return await this.updateLibrary();
+  }
+  async updateLibrary() {
+    this.logger.info("creating library worker");
+    this.worker = this.createWorker({ modulePaths: this.modulePaths, logLevel: "silent" });
+    for await (const [event] of on(this.worker, "message")) {
+      const eventData = event;
+      if (eventData.type === "error") {
+        throw new Error(`Worker error: ${eventData.error}`);
+      }
+      if (eventData.type !== "library") {
+        throw new Error(`Unexpected message type '${eventData.type}', expected 'library'`);
+      }
+      this.eventEmitter.emit("library", eventData.library);
+      this.library = eventData.library;
+      this.logger.info("library reloaded");
+      return [this.library, this.worker];
+    }
+    throw new Error("Worker ended without sending library model");
+  }
+  createWorker(workerData) {
+    const workerPathUrl = resolve(`@highstate/backend/library-worker`, import.meta.url);
     const workerPath = fileURLToPath(workerPathUrl);
     return new Worker(workerPath, { workerData });
   }
-  // eslint-disable-next-line @typescript-eslint/require-await
-  static async create(config) {
+  static create(config, logger) {
     const modulePaths = [];
     for (const module of config.HIGHSTATE_BACKEND_LIBRARY_LOCAL_MODULES) {
       const url = resolve(module, import.meta.url);
@@ -247,7 +423,10 @@ class LocalLibraryBackend {
       }
       modulePaths.push(path);
     }
-    return new LocalLibraryBackend(modulePaths);
+    return new LocalLibraryBackend(
+      modulePaths,
+      logger.child({ backend: "LibraryBackend", service: "LocalLibraryBackend" })
+    );
   }
 }
 
@@ -255,59 +434,148 @@ const libraryBackendConfig = z.object({
   HIGHSTATE_BACKEND_LIBRARY_TYPE: z.enum(["local"]).default("local"),
   ...localLibraryBackendConfig.shape
 });
-function createLibraryBackend(config) {
+function createLibraryBackend(config, logger) {
   switch (config.HIGHSTATE_BACKEND_LIBRARY_TYPE) {
     case "local": {
-      return LocalLibraryBackend.create(config);
+      return LocalLibraryBackend.create(config, logger);
     }
   }
 }
 
 const localProjectBackendConfig = z.object({
-  HIGHSTATE_BACKEND_PROJECT_BLUEPRINTS_DIR: z.string().default("blueprints")
+  HIGHSTATE_BACKEND_PROJECT_PROJECTS_DIR: z.string().optional()
 });
-const blueprintModelSchema = z.object({
+const projectModelSchema = z.object({
   instances: z.record(instanceModelSchema)
 });
 class LocalProjectBackend {
-  constructor(blueprintsDir) {
-    this.blueprintsDir = blueprintsDir;
+  constructor(projectsDir) {
+    this.projectsDir = projectsDir;
+  }
+  async getProjectNames() {
+    try {
+      const files = await readdir(this.projectsDir);
+      return files.filter((file) => file.endsWith(".json")).map((file) => file.replace(/\.json$/, ""));
+    } catch (error) {
+      throw new Error("Failed to get project names", { cause: error });
+    }
   }
   async getInstances(projectId) {
     try {
-      const blueprint = await this.loadBlueprint(projectId);
-      return blueprint.instances;
+      const project = await this.loadProject(projectId);
+      return Object.values(project.instances);
+    } catch (error) {
+      throw new Error("Failed to get project instances", { cause: error });
+    }
+  }
+  async createInstance(projectId, instance) {
+    try {
+      return await this.withProject(projectId, (project) => {
+        if (project.instances[instance.id]) {
+          throw new Error(`Instance ${instance.id} already exists`);
+        }
+        project.instances[instance.id] = instance;
+        return instance;
+      });
+    } catch (error) {
+      throw new Error("Failed to create project instance", { cause: error });
+    }
+  }
+  async moveInstance(projectId, instanceId, position) {
+    try {
+      return await this.withInstance(projectId, instanceId, (instance) => {
+        instance.position = position;
+        return instance;
+      });
+    } catch (error) {
+      throw new Error("Failed to move project instance", { cause: error });
+    }
+  }
+  async updateInstanceArgs(projectId, instanceId, args) {
+    try {
+      return await this.withInstance(projectId, instanceId, (instance) => {
+        instance.args = args;
+        return instance;
+      });
     } catch (error) {
-      console.error("Failed to read blueprint", error);
-      return {};
+      throw new Error("Failed to update project instance arguments", { cause: error });
     }
   }
-  async updateInstance(projectId, instance) {
+  async updateInstanceInputs(projectId, instanceId, inputs) {
     try {
-      const blueprint = await this.loadBlueprint(projectId);
-      blueprint.instances[instance.id] = instance;
-      await this.writeBlueprint(projectId, blueprint);
+      return await this.withInstance(projectId, instanceId, (instance) => {
+        instance.inputs = inputs;
+        return instance;
+      });
     } catch (error) {
-      console.error("Failed to update blueprint instance", error);
+      throw new Error("Failed to update project instance inputs", { cause: error });
     }
   }
   async deleteInstance(projectId, instanceId) {
     try {
-      const blueprint = await this.loadBlueprint(projectId);
-      delete blueprint.instances[instanceId];
-      await this.writeBlueprint(projectId, blueprint);
+      await this.withProject(projectId, (project) => {
+        if (!project.instances[instanceId]) {
+          throw new Error(`Instance ${instanceId} not found`);
+        }
+        delete project.instances[instanceId];
+        for (const otherInstance of Object.values(project.instances)) {
+          for (const [inputKey, input] of Object.entries(otherInstance.inputs)) {
+            if (Array.isArray(input)) {
+              otherInstance.inputs[inputKey] = input.filter(
+                (inputItem) => inputItem.instanceId !== instanceId
+              );
+            } else if (input.instanceId === instanceId) {
+              delete otherInstance.inputs[inputKey];
+            }
+          }
+        }
+      });
+    } catch (error) {
+      throw new Error("Failed to delete project instance", { cause: error });
+    }
+  }
+  async renameInstance(projectId, instanceId, newName) {
+    try {
+      return await this.withProject(projectId, (project) => {
+        const instance = project.instances[instanceId];
+        if (!instance) {
+          throw new Error(`Instance ${instanceId} not found`);
+        }
+        const newInstanceId = getInstanceId(instance.type, newName);
+        if (project.instances[newInstanceId]) {
+          throw new Error(`Instance ${newInstanceId} already exists`);
+        }
+        delete project.instances[instanceId];
+        instance.id = newInstanceId;
+        instance.name = newName;
+        project.instances[newInstanceId] = instance;
+        for (const otherInstance of Object.values(project.instances)) {
+          for (const input of Object.values(otherInstance.inputs)) {
+            if (Array.isArray(input)) {
+              for (const inputItem of input) {
+                if (inputItem.instanceId === instanceId) {
+                  inputItem.instanceId = instance.id;
+                }
+              }
+            } else if (input.instanceId === instanceId) {
+              input.instanceId = instance.id;
+            }
+          }
+        }
+        return instance;
+      });
     } catch (error) {
-      console.error("Failed to delete blueprint instance", error);
+      throw new Error("Failed to rename project instance", { cause: error });
     }
   }
-  getBlueprintPath(projectId) {
-    return `${this.blueprintsDir}/${projectId}.json`;
+  getProjectPath(projectId) {
+    return `${this.projectsDir}/${projectId}.json`;
   }
-  async loadBlueprint(projectId) {
-    const blueprintPath = this.getBlueprintPath(projectId);
+  async loadProject(projectId) {
+    const projectPath = this.getProjectPath(projectId);
     try {
-      const content = await readFile(blueprintPath, "utf-8");
-      return blueprintModelSchema.parse(JSON.parse(content));
+      const content = await readFile(projectPath, "utf-8");
+      return projectModelSchema.parse(JSON.parse(content));
     } catch (error) {
       if (error instanceof Error && "code" in error && error.code === "ENOENT") {
         return { instances: {} };
@@ -315,14 +583,34 @@ class LocalProjectBackend {
       throw error;
     }
   }
-  async writeBlueprint(projectId, blueprint) {
-    const blueprintPath = this.getBlueprintPath(projectId);
-    const content = JSON.stringify(blueprint, void 0, 2);
-    await writeFile(blueprintPath, content);
+  async writeProject(projectId, project) {
+    const projectPath = this.getProjectPath(projectId);
+    const content = JSON.stringify(project, undefined, 2);
+    await writeFile(projectPath, content);
+  }
+  async withInstance(projectId, instanceId, callback) {
+    return await this.withProject(projectId, (project) => {
+      const instance = project.instances[instanceId];
+      if (!instance) {
+        throw new Error(`Instance ${instanceId} not found`);
+      }
+      return callback(instance);
+    });
+  }
+  async withProject(projectId, callback) {
+    const project = await this.loadProject(projectId);
+    const result = callback(project);
+    await this.writeProject(projectId, project);
+    return result;
   }
   static async create(config) {
-    await mkdir(config.HIGHSTATE_BACKEND_PROJECT_BLUEPRINTS_DIR, { recursive: true });
-    return new LocalProjectBackend(config.HIGHSTATE_BACKEND_PROJECT_BLUEPRINTS_DIR);
+    let projectsPath = config.HIGHSTATE_BACKEND_PROJECT_PROJECTS_DIR;
+    if (!projectsPath) {
+      const [mainProjectPath] = await resolveMainLocalProject();
+      projectsPath = resolve$1(mainProjectPath, "projects");
+    }
+    await mkdir(projectsPath, { recursive: true });
+    return new LocalProjectBackend(projectsPath);
   }
 }
 
@@ -334,260 +622,327 @@ function createProjectBackend(config) {
   return LocalProjectBackend.create(config);
 }
 
-const localStateBackendConfig = z.object({
-  HIGHSTATE_BACKEND_STATE_PROJECT_PATH: z.string().optional(),
-  HIGHSTATE_BACKEND_STATE_PROJECT_NAME: z.string().optional()
-});
-class LocalStateBackend {
-  constructor(projectName, pulumiProjectHost) {
-    this.projectName = projectName;
-    this.pulumiProjectHost = pulumiProjectHost;
-  }
-  get(projectId) {
-    return this.pulumiProjectHost.runInline(
-      this.projectName,
-      projectId,
-      () => Promise.resolve(),
-      (stack) => this.getAllState(stack)
-    );
-  }
-  set(projectId, state) {
-    return this.pulumiProjectHost.runInline(
-      this.projectName,
-      projectId,
-      () => Promise.resolve(),
-      async (stack) => {
-        await stack.setConfig("state", { value: JSON.stringify(state) });
-        await stack.up();
-      }
-    );
+class ProjectLock {
+  constructor(lock, projectId) {
+    this.lock = lock;
+    this.projectId = projectId;
   }
-  async getAllState(stack) {
-    const history = await stack.history(1);
-    if (!history.length) {
-      return { instances: {} };
-    }
-    if (!history[0].config["state"]) {
-      return { instances: {} };
-    }
-    const jsonValue = JSON.parse(history[0].config["state"].value);
-    return projectStateSchema.parse(jsonValue);
+  lockInstance(instanceId, fn) {
+    return this.lock.acquire(`${this.projectId}/${instanceId}`, fn);
   }
-  static async create(config, pulumiProjectHost) {
-    const [, projectName] = await resolveMainLocalProject(
-      config.HIGHSTATE_BACKEND_STATE_PROJECT_PATH,
-      config.HIGHSTATE_BACKEND_STATE_PROJECT_NAME
+  lockInstances(instanceIds, fn) {
+    return this.lock.acquire(
+      instanceIds.map((id) => `${this.projectId}/${id}`),
+      fn
     );
-    return new LocalStateBackend(projectName, pulumiProjectHost);
   }
 }
-
-const stateBackendConfig = z.object({
-  HIGHSTATE_BACKEND_STATE_TYPE: z.enum(["local"]).default("local"),
-  ...localStateBackendConfig.shape
-});
-function createStateBackend(config, pulumiProjectHost) {
-  return LocalStateBackend.create(config, pulumiProjectHost);
-}
-
-const configSchema = z.object({
-  ...libraryBackendConfig.shape,
-  ...projectBackendConfig.shape,
-  ...secretBackendConfig.shape,
-  ...stateBackendConfig.shape
-});
-async function loadConfig(env = process.env, useDotenv = true) {
-  if (useDotenv) {
-    await import('dotenv/config');
+class ProjectLockManager {
+  lock = new BetterLock();
+  getLock(projectId) {
+    return new ProjectLock(this.lock, projectId);
   }
-  return configSchema.parse(env);
 }
 
-class ProjectOperator {
-  constructor(projectId, state, runnerBackend, stateBackend, libraryBackend, projectBackend, secretBackend) {
-    this.projectId = projectId;
-    this.state = state;
-    this.runnerBackend = runnerBackend;
-    this.stateBackend = stateBackend;
-    this.libraryBackend = libraryBackend;
+class ProjectManager {
+  constructor(projectBackend, stateBackend, operationManager, library, logger) {
     this.projectBackend = projectBackend;
-    this.secretBackend = secretBackend;
+    this.stateBackend = stateBackend;
+    this.operationManager = operationManager;
+    this.library = library;
+    this.logger = logger;
   }
-  unitPromises = /* @__PURE__ */ new Map();
-  eventEmitter = new EventEmitter();
-  debouncedUpdateState = debounce(() => this.stateBackend.set(this.projectId, this.state), {
-    waitMs: 1e3,
-    maxWaitMs: 1e4
-  });
-  abortController = new AbortController();
-  async *watchInstanceStates(signal) {
-    for await (const [state] of on(this.eventEmitter, "state", { signal })) {
-      yield state;
+  async getCompositeInstance(projectId, instanceId) {
+    const instances = await this.projectBackend.getInstances(projectId);
+    const instance = instances.find((instance2) => instance2.id === instanceId);
+    const instanceMap = /* @__PURE__ */ new Map();
+    for (const instance2 of instances) {
+      instanceMap.set(instance2.id, instance2);
     }
-  }
-  async *watchCurrentOperation(signal) {
-    for await (const [operation] of on(this.eventEmitter, "operation", { signal })) {
-      yield operation;
+    if (!instance) {
+      throw new Error(`instance not found: ${instanceId}`);
     }
-  }
-  /**
-   * Launches the project operation.
-   * Throws an error if the operation is already running.
-   *
-   * @param operation The operation to launch.
-   */
-  launch(operation) {
-    if (this.state.currentOperation) {
-      throw new Error("An operation is already running.");
-    }
-    this.abortController = new AbortController();
-    this.updateCurrentOperation(operation);
-    void this.operate().finally(() => {
-      this.updateCurrentOperation(void 0);
-    });
-  }
-  /**
-   * Cancels the current operation.
-   * Does nothing if no operation is running.
-   */
-  cancel() {
-    if (!this.state.currentOperation) {
-      return;
+    const calculator = new InputHashCalculator(instanceMap);
+    const [compositeInstance, actualInputHash] = await Promise.all([
+      this.stateBackend.getCompositeInstance(projectId, instanceId),
+      calculator.calculate(instance)
+    ]);
+    if (compositeInstance && compositeInstance.inputHash === actualInputHash) {
+      return compositeInstance;
     }
-    this.abortController.abort();
-  }
-  async operate() {
-    await this.debouncedUpdateState.flush();
-    const operation = this.state.currentOperation;
-    const instances = await this.projectBackend.getInstances(this.projectId);
-    const library = await this.libraryBackend.loadLibrary();
-    const registrations = await this.libraryBackend.evaluateInstances(
-      instances,
-      operation.instanceIds
-    );
-    const promises = [];
-    for (const registration of Object.values(registrations)) {
-      const promise = this.upUnit(library, registrations, registration);
-      promises.push(promise);
-    }
-    await Promise.all(promises);
-  }
-  async upUnit(library, registrations, registration) {
-    const model = library.components[registration.type];
-    if (!isUnitModel(model)) {
-      throw new Error(`The component "${registration.type}" is not a unit.`);
-    }
-    const key = `${registration.type}.${registration.name}`;
-    const dependencyPromises = [];
-    for (const dependency of registration.dependencies) {
-      const state = this.state.instances[dependency];
-      if (state?.status === "created") {
-        continue;
-      }
-      const dependencyPromise = this.getOrCreateUnitPromise(
-        key,
-        () => this.upUnit(library, registrations, registrations[dependency])
-      );
-      dependencyPromises.push(dependencyPromise);
-    }
-    await Promise.all(dependencyPromises);
-    await this.runnerBackend.update({
-      projectName: registration.type,
-      stackName: registration.name,
-      config: await this.getUnitConfig(model, key, registration),
-      source: model.source
+    this.logger.info("re-evaluating instance since input hash has changed", {
+      projectId,
+      instanceId
     });
-    const stream = this.runnerBackend.watch({
-      projectName: registration.type,
-      stackName: registration.name,
-      finalStatuses: ["created", "error"]
+    const instancePromise = this.waitForCompositeInstance(
+      projectId,
+      instanceId,
+      actualInputHash,
+      instanceMap
+    );
+    await this.operationManager.launch({
+      type: "evaluate",
+      projectId,
+      instanceIds: [instanceId]
     });
-    await this.watchStateStream(stream);
+    return await instancePromise;
   }
-  async getUnitConfig(model, key, registration) {
-    const secrets = await this.secretBackend.get(this.projectId, `${model.type}.${key}`);
-    return {
-      ...registration.config,
-      ...secrets
-    };
+  async createInstance(projectId, instance) {
+    const createdInstance = await this.projectBackend.createInstance(projectId, instance);
+    await this.updateInstanceChildren(projectId, createdInstance);
+    return createdInstance;
   }
-  async watchStateStream(stream) {
-    let state;
-    for await (state of stream) {
-      this.updateInstanceState(state);
-    }
-    if (!state) {
-      throw new Error("The stream ended without emitting any state.");
-    }
-    if (state.status === "error") {
-      throw new Error(`The operation on unit "${state.key}" failed.`);
-    }
+  async updateInstanceArgs(projectId, instanceId, args) {
+    const instance = await this.projectBackend.updateInstanceArgs(projectId, instanceId, args);
+    await this.updateInstanceChildren(projectId, instance);
+    return instance;
+  }
+  async updateInstanceInputs(projectId, instanceId, inputs) {
+    const instance = await this.projectBackend.updateInstanceInputs(projectId, instanceId, inputs);
+    await this.updateInstanceChildren(projectId, instance);
+    return instance;
   }
-  updateCurrentOperation(operation) {
-    this.state.currentOperation = operation;
-    this.eventEmitter.emit("operation", operation);
-    void this.debouncedUpdateState.call();
+  async moveInstance(projectId, instanceId, position) {
+    const instance = await this.projectBackend.moveInstance(projectId, instanceId, position);
+    await this.updateInstanceChildren(projectId, instance);
+    return instance;
   }
-  updateInstanceState(state) {
-    this.state.instances[state.key] = state;
-    this.eventEmitter.emit("state", state);
-    void this.debouncedUpdateState.call();
+  async renameInstance(projectId, instanceId, newName) {
+    const instance = await this.projectBackend.renameInstance(projectId, instanceId, newName);
+    await this.updateInstanceChildren(projectId, instance);
+    return instance;
+  }
+  async deleteInstance(projectId, instanceId) {
+    await Promise.all([
+      this.projectBackend.deleteInstance(projectId, instanceId),
+      this.stateBackend.clearCompositeInstances(projectId, [instanceId])
+    ]);
   }
-  getOrCreateUnitPromise(unitKey, fn) {
-    let promise = this.unitPromises.get(unitKey);
-    if (!promise) {
-      promise = fn().then(() => {
-        this.unitPromises.delete(unitKey);
+  async updateInstanceChildren(projectId, instance) {
+    const library = await this.library.loadLibrary();
+    const component = library.components[instance.type];
+    if (!component) {
+      return;
+    }
+    if (isUnitModel(component)) {
+      return;
+    }
+    const instances = await this.projectBackend.getInstances(projectId);
+    const instanceMap = /* @__PURE__ */ new Map();
+    for (const instance2 of instances) {
+      instanceMap.set(instance2.id, instance2);
+    }
+    const inputHashCalculator = new InputHashCalculator(instanceMap);
+    const inputHash = await this.stateBackend.getCompositeInstanceInputHash(projectId, instance.id);
+    const expectedInputHash = await inputHashCalculator.calculate(instance);
+    if (inputHash !== expectedInputHash) {
+      this.logger.info("re-evaluating instance since input hash has changed", {
+        projectId,
+        instanceId: instance.id
+      });
+      await this.operationManager.launch({
+        type: "evaluate",
+        projectId,
+        instanceIds: [instance.id]
       });
-      this.unitPromises.set(unitKey, promise);
     }
-    return promise;
   }
-  static async create(projectId, runnerBackend, stateBackend, libraryBackend, projectBackend, secretBackend) {
-    const state = await stateBackend.get(projectId);
-    return new ProjectOperator(
+  async waitForCompositeInstance(projectId, instanceId, expectedInputHash, instanceMap) {
+    for await (const instance of this.operationManager.watchCompositeInstance(
       projectId,
-      state,
-      runnerBackend,
-      stateBackend,
-      libraryBackend,
+      instanceId
+    )) {
+      const calculator = new InputHashCalculator(instanceMap);
+      const actualInputHash = await calculator.calculate(instance.instance);
+      if (actualInputHash !== expectedInputHash) {
+        throw new Error("Composite instance input hash changed while waiting for evaluation");
+      }
+      return instance;
+    }
+    throw new Error("Composite instance stream ended without receiving the expected instance");
+  }
+  static create(projectBackend, stateBackend, operationManager, library, logger) {
+    return new ProjectManager(
       projectBackend,
-      secretBackend
+      stateBackend,
+      operationManager,
+      library,
+      logger.child({ service: "ProjectManager" })
     );
   }
 }
 
-class OperatorManager {
-  constructor(runnerBackend, stateBackend, libraryBackend, projectBackend, secretBackend) {
-    this.runnerBackend = runnerBackend;
-    this.stateBackend = stateBackend;
-    this.libraryBackend = libraryBackend;
-    this.projectBackend = projectBackend;
-    this.secretBackend = secretBackend;
-  }
-  operators = /* @__PURE__ */ new Map();
-  lock = new BetterLock();
-  async get(projectId) {
-    return await this.lock.acquire(projectId, async () => {
-      let orchestrator = this.operators.get(projectId);
-      if (!orchestrator) {
-        orchestrator = await ProjectOperator.create(
-          projectId,
-          this.runnerBackend,
-          this.stateBackend,
-          this.libraryBackend,
-          this.projectBackend,
-          this.secretBackend
-        );
-        this.operators.set(projectId, orchestrator);
-      }
-      return orchestrator;
-    });
-  }
-}
+const runScript = `set -e -o pipefail
+read -r data
 
-class InvalidInstanceStatusError extends Error {
-  constructor(currentStatus, expectedStatuses) {
+# Extract env and files as key-value pairs, and command as an array
+envKeys=($(jq -r '.env | keys[]' <<<"$data"))
+filesKeys=($(jq -r '.files | keys[]' <<<"$data"))
+commandArr=($(jq -r '.command[]' <<<"$data"))
+
+# Set environment variables
+for key in "\${envKeys[@]}"; do
+  value=$(jq -r ".env[\\"$key\\"]" <<<"$data")
+  export "$key=$value"
+done
+
+# Create files
+for key in "\${filesKeys[@]}"; do
+  content=$(jq -r ".files[\\"$key\\"]" <<<"$data")
+  echo -n "$content" > "$key"
+done
+
+# Execute the command, keeping stdin/stdout open
+exec "\${commandArr[@]}"`;
+
+const dockerTerminalBackendConfig = z.object({
+  HIGHSTATE_BACKEND_TERMINAL_DOCKER_BINARY: z.string().default("docker"),
+  HIGHSTATE_BACKEND_TERMINAL_DOCKER_HOST: z.string().optional()
+});
+class DockerTerminalBackend {
+  constructor(binary, host, logger) {
+    this.binary = binary;
+    this.host = host;
+    this.logger = logger;
+  }
+  async run({ factory, stdin, stdout, signal }) {
+    const hsTempDir = resolve$1(tmpdir(), "highstate");
+    await mkdir(hsTempDir, { recursive: true });
+    const runScriptPath = resolve$1(hsTempDir, "run.sh");
+    await writeFile(runScriptPath, runScript, { mode: 493 });
+    const args = [
+      "run",
+      "-i",
+      "-v",
+      `${runScriptPath}:/run.sh:ro`,
+      factory.image,
+      "/bin/bash",
+      "/run.sh"
+    ];
+    const initData = {
+      command: factory.command,
+      cwd: factory.cwd,
+      env: factory.env ?? {},
+      files: factory.files ?? {}
+    };
+    const initDataStream = Readable.from(JSON.stringify(initData) + "\n");
+    const process = spawn(this.binary, args, {
+      env: {
+        DOCKER_HOST: this.host
+      },
+      signal
+    });
+    const childProcess = await process.nodeChildProcess;
+    initDataStream.pipe(childProcess.stdin, { end: false });
+    initDataStream.on("end", () => stdin.pipe(childProcess.stdin));
+    childProcess.stdout.pipe(stdout);
+    childProcess.stderr.pipe(stdout);
+    this.logger.info("process started", { pid: childProcess.pid });
+    await process;
+  }
+  static create(config, logger) {
+    return new DockerTerminalBackend(
+      config.HIGHSTATE_BACKEND_TERMINAL_DOCKER_BINARY,
+      config.HIGHSTATE_BACKEND_TERMINAL_DOCKER_HOST,
+      logger.child({ backend: "TerminalBackend", service: "DockerTerminalBackend" })
+    );
+  }
+}
+
+const terminalBackendConfig = z.object({
+  HIGHSTATE_BACKEND_TERMINAL_TYPE: z.enum(["docker"]).default("docker"),
+  ...dockerTerminalBackendConfig.shape
+});
+function createTerminalBackend(config, logger) {
+  switch (config.HIGHSTATE_BACKEND_TERMINAL_TYPE) {
+    case "docker": {
+      return DockerTerminalBackend.create(config, logger);
+    }
+  }
+}
+
+const notAttachedTerminalLifetime = 30 * 1e3;
+class TerminalManager {
+  constructor(terminalBackend, logger) {
+    this.terminalBackend = terminalBackend;
+    this.logger = logger;
+  }
+  terminals = /* @__PURE__ */ new Map();
+  create(factory) {
+    const terminal = {
+      id: randomUUID(),
+      abortController: new AbortController(),
+      attached: false,
+      stdin: new PassThrough(),
+      stdout: new PassThrough(),
+      history: []
+    };
+    terminal.stdout.on("data", (data) => {
+      terminal.history.push(String(data));
+    });
+    this.terminals.set(terminal.id, terminal);
+    void this.terminalBackend.run({
+      factory,
+      stdin: terminal.stdin,
+      stdout: terminal.stdout,
+      signal: terminal.abortController.signal
+    }).catch((error) => {
+      this.logger.error("terminal failed", { id: terminal.id, error });
+      console.error(error);
+    }).finally(() => {
+      this.logger.info("terminal finished", { id: terminal.id });
+      this.terminals.delete(terminal.id);
+    });
+    setTimeout(() => this.closeTerminalIfNotAttached(terminal), notAttachedTerminalLifetime);
+    this.logger.info("terminal created", { id: terminal.id });
+    return terminal;
+  }
+  close(id) {
+    const terminal = this.terminals.get(id);
+    if (!terminal) {
+      return;
+    }
+    terminal.abortController.abort();
+    this.terminals.delete(id);
+    this.logger.info("terminal closed", { id });
+  }
+  attach(id, stdin, stdout, signal) {
+    const terminal = this.terminals.get(id);
+    if (!terminal) {
+      throw new Error("Terminal not found");
+    }
+    terminal.attached = true;
+    for (const line of terminal.history) {
+      stdout.write(line + "\n");
+    }
+    this.logger.info("history replayed", { id });
+    stdin.pipe(terminal.stdin);
+    terminal.stdout.pipe(stdout);
+    this.logger.info("terminal attached", { id });
+    signal.addEventListener("abort", () => {
+      terminal.attached = false;
+      this.logger.info("terminal detached", { id });
+    });
+  }
+  closeTerminalIfNotAttached(terminal) {
+    if (!this.terminals.has(terminal.id)) {
+      return;
+    }
+    if (!terminal.attached) {
+      this.logger.info("terminal not attached for too long, closing", { id: terminal.id });
+      terminal.abortController.abort();
+      this.terminals.delete(terminal.id);
+      return;
+    }
+    setTimeout(() => this.closeTerminalIfNotAttached(terminal), notAttachedTerminalLifetime);
+  }
+  static create(terminalBackend, logger) {
+    return new TerminalManager(terminalBackend, logger.child({ service: "TerminalManager" }));
+  }
+}
+
+class InvalidInstanceStatusError extends Error {
+  constructor(currentStatus, expectedStatuses) {
     const expectedString = expectedStatuses.join(", ");
     super(`The current state is "${currentStatus}", but it should be one of "${expectedString}".`);
     this.currentStatus = currentStatus;
@@ -595,27 +950,94 @@ class InvalidInstanceStatusError extends Error {
   }
 }
 
+const localRunnerBackendConfig = z.object({
+  HIGHSTATE_BACKEND_RUNNER_LOCAL_SKIP_SOURCE_CHECK: z.boolean({ coerce: true }).default(false),
+  HIGHSTATE_BACKEND_RUNNER_LOCAL_SKIP_STATE_CHECK: z.boolean({ coerce: true }).default(false),
+  HIGHSTATE_BACKEND_RUNNER_LOCAL_PRINT_OUTPUT: z.boolean({ coerce: true }).default(true),
+  HIGHSTATE_BACKEND_RUNNER_LOCAL_SOURCE_BASE_PATH: z.string().optional()
+});
 class LocalRunnerBackend {
-  host = new LocalPulumiProjectHost();
+  constructor(skipSourceCheck, skipStateCheck, printOutput, sourceBasePath, pulumiProjectHost) {
+    this.skipSourceCheck = skipSourceCheck;
+    this.skipStateCheck = skipStateCheck;
+    this.printOutput = printOutput;
+    this.sourceBasePath = sourceBasePath;
+    this.pulumiProjectHost = pulumiProjectHost;
+  }
   events = new EventEmitter();
-  states = /* @__PURE__ */ new Map();
   async *watch(options) {
     const stream = on(
       //
       this.events,
-      `state:${LocalRunnerBackend.getInstanceKey(options)}`,
+      `state:${LocalRunnerBackend.getInstanceId(options)}`,
       { signal: options.signal }
     );
-    for await (const [state] of stream) {
-      yield state;
-      if (options.finalStatuses.includes(state.status)) {
+    for await (const [statePatch] of stream) {
+      yield statePatch;
+      if (statePatch.status && options.finalStatuses?.includes(statePatch.status)) {
         return;
       }
     }
   }
-  // eslint-disable-next-line @typescript-eslint/require-await
+  getState(options) {
+    return this.pulumiProjectHost.runEmpty(
+      options.projectId,
+      options.instanceType,
+      options.instanceName,
+      async (stack) => {
+        const info = await stack.info();
+        const instanceId = getInstanceId(options.instanceType, options.instanceName);
+        if (!info) {
+          return createInstanceState(instanceId);
+        }
+        if (info.result === "failed") {
+          return createInstanceState(instanceId, "error");
+        }
+        if (info.result !== "succeeded") {
+          return createInstanceState(instanceId, "unknown");
+        }
+        const summary = await stack.workspace.stack();
+        const resourceCount = summary?.resourceCount;
+        if (!resourceCount) {
+          return createInstanceState(instanceId, "not_created");
+        }
+        return createInstanceState(instanceId, "created", {
+          currentResourceCount: resourceCount,
+          totalResourceCount: resourceCount
+        });
+      }
+    );
+  }
+  getTerminalFactory(options) {
+    return this.pulumiProjectHost.runEmpty(
+      options.projectId,
+      options.instanceType,
+      options.instanceName,
+      async (stack) => {
+        const outputs = await stack.outputs();
+        if (!outputs["$terminal"]) {
+          return null;
+        }
+        return terminalFactorySchema.parse(outputs["$terminal"].value);
+      }
+    );
+  }
+  getRepresentationContent(options) {
+    return this.pulumiProjectHost.runEmpty(
+      options.projectId,
+      options.instanceType,
+      options.instanceName,
+      async (stack) => {
+        const outputs = await stack.outputs();
+        if (!outputs["$representation"]) {
+          return null;
+        }
+        return instanceRepresentationSchema.parse(outputs["$representation"].value).content;
+      }
+    );
+  }
   async update(options) {
-    const currentStatus = this.validateStatus(options, [
+    const currentStatus = await this.validateStatus(options, [
       "not_created",
       "updating",
       "created",
@@ -624,53 +1046,79 @@ class LocalRunnerBackend {
     if (currentStatus === "updating") {
       return;
     }
-    void this.host.runLocal(
-      options.projectName,
-      options.stackName,
-      () => LocalRunnerBackend.resolveProjectPath(options.source),
+    const configMap = {
+      ...mapValues(options.config, (value) => ({ value })),
+      ...mapValues(options.secrets, (value) => ({ value, secret: true }))
+    };
+    void this.pulumiProjectHost.runLocal(
+      options.projectId,
+      options.instanceType,
+      options.instanceName,
+      () => this.resolveProjectPath(options.source),
       async (stack) => {
-        const configMap = mapValues(options.config, (value) => ({ value }));
         await stack.setAllConfig(configMap);
-        const state = {
-          key: LocalRunnerBackend.getInstanceKey(options),
+        const instanceId = LocalRunnerBackend.getInstanceId(options);
+        this.updateState({
+          id: instanceId,
           status: "updating",
-          resources: 0,
-          totalResources: 0
-        };
-        this.updateState(state);
+          currentResourceCount: 0,
+          totalResourceCount: 0
+        });
+        let currentResourceCount = 0;
+        let totalResourceCount = 0;
         try {
-          await stack.up({
-            onEvent: (event) => {
-              if (event.resourcePreEvent) {
-                state.totalResources++;
-                this.updateState(state);
-                return;
-              }
-              if (event.resOutputsEvent) {
-                state.resources++;
-                this.updateState(state);
-                return;
-              }
+          await runWithRetryOnError(
+            async () => {
+              await stack.up({
+                color: "always",
+                onEvent: (event) => {
+                  if (event.resourcePreEvent) {
+                    totalResourceCount = updateResourceCount(
+                      event.resourcePreEvent.metadata.op,
+                      totalResourceCount
+                    );
+                    this.updateState({ id: instanceId, totalResourceCount });
+                    return;
+                  }
+                  if (event.resOutputsEvent) {
+                    currentResourceCount = updateResourceCount(
+                      event.resOutputsEvent.metadata.op,
+                      currentResourceCount
+                    );
+                    this.updateState({ id: instanceId, currentResourceCount });
+                    return;
+                  }
+                },
+                onOutput: (message) => {
+                  this.updateState({ id: instanceId, message });
+                  if (this.printOutput) {
+                    console.log(message);
+                  }
+                },
+                signal: options.signal
+              });
+              const extraOutputs = await this.getExtraOutputsStatePatch(stack);
+              this.updateState({
+                id: instanceId,
+                status: "created",
+                ...extraOutputs
+              });
             },
-            onOutput: (message) => {
-              state.message = message;
-              this.updateState(state);
-            },
-            signal: options.signal
-          });
-          state.status = "created";
-          this.updateState(state);
+            (error) => LocalPulumiHost.tryUnlockStack(stack, error)
+          );
         } catch (e) {
-          state.status = "error";
-          state.error = e instanceof Error ? e.message : String(e);
-          this.updateState(state);
+          this.updateState({
+            id: instanceId,
+            status: "error",
+            error: e instanceof Error ? e.message : String(e)
+          });
         }
-      }
+      },
+      configMap
     );
   }
-  // eslint-disable-next-line @typescript-eslint/require-await
   async destroy(options) {
-    const currentStatus = this.validateStatus(options, [
+    const currentStatus = await this.validateStatus(options, [
       "not_created",
       "destroying",
       "created",
@@ -679,44 +1127,64 @@ class LocalRunnerBackend {
     if (currentStatus === "destroying" || currentStatus === "not_created") {
       return;
     }
-    void this.host.runLocal(
-      options.projectName,
-      options.stackName,
-      () => LocalRunnerBackend.resolveProjectPath(options.source),
+    void this.pulumiProjectHost.runEmpty(
+      options.projectId,
+      options.instanceType,
+      options.instanceName,
       async (stack) => {
-        const stackSumary = await stack.workspace.stack();
-        const resources = stackSumary?.resourceCount ?? 0;
-        const state = {
-          key: LocalRunnerBackend.getInstanceKey(options),
+        const summary = await stack.workspace.stack();
+        let currentResourceCount = summary?.resourceCount ?? 0;
+        const instanceId = LocalRunnerBackend.getInstanceId(options);
+        this.updateState({
+          id: instanceId,
           status: "destroying",
-          resources,
-          totalResources: resources
-        };
-        this.updateState(state);
+          currentResourceCount,
+          totalResourceCount: currentResourceCount
+        });
         try {
-          await stack.destroy({
-            onEvent: (event) => {
-              if (event.resOutputsEvent) {
-                state.resources--;
-                this.updateState(state);
-                return;
-              }
+          await runWithRetryOnError(
+            async () => {
+              await stack.destroy({
+                color: "always",
+                onEvent: (event) => {
+                  if (event.resOutputsEvent) {
+                    currentResourceCount = updateResourceCount(
+                      event.resOutputsEvent.metadata.op,
+                      currentResourceCount
+                    );
+                    this.updateState({ id: instanceId, currentResourceCount });
+                    return;
+                  }
+                },
+                onOutput: (message) => {
+                  this.updateState({ id: instanceId, message });
+                  if (this.printOutput) {
+                    console.log(message);
+                  }
+                },
+                signal: options.signal
+              });
+              const extraOutputs = await this.getExtraOutputsStatePatch(stack);
+              this.updateState({
+                id: instanceId,
+                status: "not_created",
+                ...extraOutputs
+              });
             },
-            signal: options.signal
-          });
-          state.status = "not_created";
-          this.updateState(state);
+            (error) => LocalPulumiHost.tryUnlockStack(stack, error)
+          );
         } catch (e) {
-          state.status = "error";
-          state.error = e instanceof Error ? e.message : String(e);
-          this.updateState(state);
+          this.updateState({
+            id: instanceId,
+            status: "error",
+            error: e instanceof Error ? e.message : String(e)
+          });
         }
       }
     );
   }
-  // eslint-disable-next-line @typescript-eslint/require-await
   async refresh(options) {
-    const currentStatus = this.validateStatus(options, [
+    const currentStatus = await this.validateStatus(options, [
       "not_created",
       "created",
       "refreshing",
@@ -725,56 +1193,103 @@ class LocalRunnerBackend {
     if (currentStatus === "refreshing") {
       return;
     }
-    void this.host.runLocal(
-      options.projectName,
-      options.stackName,
-      () => LocalRunnerBackend.resolveProjectPath(options.source),
+    void this.pulumiProjectHost.runEmpty(
+      options.projectId,
+      options.instanceType,
+      options.instanceName,
       async (stack) => {
-        const stackSumary = await stack.workspace.stack();
-        const resources = stackSumary?.resourceCount ?? 0;
-        const state = {
-          key: LocalRunnerBackend.getInstanceKey(options),
+        const summary = await stack.workspace.stack();
+        let currentResourceCount = summary?.resourceCount ?? 0;
+        const instanceId = LocalRunnerBackend.getInstanceId(options);
+        this.updateState({
+          id: instanceId,
           status: "refreshing",
-          resources,
-          totalResources: resources
-        };
-        this.updateState(state);
+          currentResourceCount,
+          totalResourceCount: currentResourceCount
+        });
         try {
-          await stack.refresh({
-            onEvent: (event) => {
-              if (event.resOutputsEvent) {
-                if (event.resOutputsEvent.metadata.op === "create") {
-                  state.resources++;
-                  this.updateState(state);
-                  return;
-                }
-                if (event.resOutputsEvent.metadata.op === "delete") {
-                  state.totalResources--;
-                  this.updateState(state);
-                  return;
-                }
-                return;
-              }
+          await runWithRetryOnError(
+            async () => {
+              await stack.refresh({
+                color: "always",
+                onEvent: (event) => {
+                  if (event.resOutputsEvent) {
+                    currentResourceCount = updateResourceCount(
+                      event.resOutputsEvent.metadata.op,
+                      currentResourceCount
+                    );
+                    this.updateState({ id: instanceId, currentResourceCount });
+                    return;
+                  }
+                },
+                onOutput: (message) => {
+                  this.updateState({ id: instanceId, message });
+                  if (this.printOutput) {
+                    console.log(message);
+                  }
+                },
+                signal: options.signal
+              });
+              const extraOutputs = await this.getExtraOutputsStatePatch(stack);
+              this.updateState({
+                id: instanceId,
+                status: "created",
+                ...extraOutputs
+              });
             },
-            signal: options.signal
-          });
-          state.status = "created";
-          this.updateState(state);
+            (error) => LocalPulumiHost.tryUnlockStack(stack, error)
+          );
         } catch (e) {
-          state.status = "error";
-          state.error = e instanceof Error ? e.message : String(e);
-          this.updateState(state);
+          this.updateState({
+            id: instanceId,
+            status: "error",
+            error: e instanceof Error ? e.message : String(e)
+          });
         }
       }
     );
   }
-  updateState(state) {
-    this.states.set(state.key, state);
-    this.events.emit(`state:${state.key}`, state);
+  async getExtraOutputsStatePatch(stack) {
+    const outputs = await stack.outputs();
+    const patch = {};
+    if (outputs["$status"]) {
+      patch.statusFields = instanceStatusFieldMapSchema.parse(outputs["$status"].value);
+    } else {
+      patch.statusFields = null;
+    }
+    if (outputs["$representation"]) {
+      const instanceRepresentation = instanceRepresentationSchema.parse(
+        outputs["$representation"].value
+      );
+      patch.representationMeta = {
+        contentType: instanceRepresentation.contentType,
+        fileName: instanceRepresentation.fileName,
+        showQRCode: instanceRepresentation.showQRCode
+      };
+    } else {
+      patch.representationMeta = null;
+    }
+    if (outputs["$terminal"]) {
+      terminalFactorySchema.parse(outputs["$terminal"].value);
+      patch.hasTerminal = true;
+    } else {
+      patch.hasTerminal = false;
+    }
+    if (outputs["$secrets"]) {
+      patch.secrets = z.record(z.string()).parse(outputs["$secrets"].value);
+    } else {
+      patch.secrets = null;
+    }
+    return patch;
   }
-  validateStatus(options, expectedStatuses) {
-    const key = LocalRunnerBackend.getInstanceKey(options);
-    const existingState = this.states.get(key);
+  updateState(patch) {
+    this.events.emit(`state:${patch.id}`, patch);
+  }
+  async validateStatus(options, expectedStatuses) {
+    if (this.skipStateCheck) {
+      return;
+    }
+    const existingState = await this.getState(options);
     if (!existingState) {
       return;
     }
@@ -783,50 +1298,1177 @@ class LocalRunnerBackend {
     }
     return existingState.status;
   }
-  static getInstanceKey(options) {
-    return `${options.projectName}.${options.stackName}`;
+  static getInstanceId(options) {
+    return getInstanceId(options.instanceType, options.instanceName);
   }
-  static async resolveProjectPath(source) {
-    await addDependency(source.package);
-    const url = resolve(source.package, import.meta.url);
+  async resolveProjectPath(source) {
+    if (source.type === "local") {
+      if (!source.path) {
+        throw new Error("Source path is required for local units");
+      }
+      return resolve(this.sourceBasePath, source.type);
+    }
+    if (!this.skipSourceCheck) {
+      const packageName = source.version ? `${source.package}@${source.version}` : source.package;
+      await ensureDependencyInstalled(packageName);
+    }
+    if (!source.path) {
+      throw new Error("Source path is required for npm units");
+    }
+    const fullPath = `${source.package}/${source.path}`;
+    const url = resolve(fullPath, import.meta.url);
     const path = fileURLToPath(url);
     const projectPath = dirname(path);
     return projectPath;
   }
-  // eslint-disable-next-line @typescript-eslint/require-await
-  static async create() {
-    return new LocalRunnerBackend();
+  static async create(config, pulumiProjectHost) {
+    let sourceBasePath = config.HIGHSTATE_BACKEND_RUNNER_LOCAL_SOURCE_BASE_PATH;
+    if (!sourceBasePath) {
+      const [projectPath] = await resolveMainLocalProject();
+      sourceBasePath = resolve(projectPath, "units");
+    }
+    return new LocalRunnerBackend(
+      config.HIGHSTATE_BACKEND_RUNNER_LOCAL_SKIP_SOURCE_CHECK,
+      config.HIGHSTATE_BACKEND_RUNNER_LOCAL_SKIP_STATE_CHECK,
+      config.HIGHSTATE_BACKEND_RUNNER_LOCAL_PRINT_OUTPUT,
+      sourceBasePath,
+      pulumiProjectHost
+    );
+  }
+}
+
+const runnerBackendConfig = z.object({
+  HIGHSTATE_BACKEND_RUNNER_TYPE: z.enum(["local"]).default("local"),
+  ...localRunnerBackendConfig.shape
+});
+function createRunnerBackend(config, pulumiProjectHost) {
+  switch (config.HIGHSTATE_BACKEND_RUNNER_TYPE) {
+    case "local": {
+      return LocalRunnerBackend.create(config, pulumiProjectHost);
+    }
+  }
+}
+
+const evaluatedCompositeInstanceSchema = compositeInstanceSchema.extend({
+  inputHash: z.string()
+});
+
+const localStateBackendConfig = z.object({
+  HIGHSTATE_BACKEND_STATE_LOCAL_DIR: z.string().optional()
+});
+class LocalStateBackend {
+  constructor(db, logger) {
+    this.db = db;
+    this.logger = logger;
+    this.logger.debug({ msg: "initialized", dbLocation: db.location });
+  }
+  async getActiveOperations() {
+    const sublevel = this.getJsonSublevel("activeOperations");
+    const result = [];
+    for await (const operation of sublevel.values()) {
+      result.push(projectOperationSchema.parse(operation));
+    }
+    return result;
+  }
+  async getOperations(projectId, beforeOperationId) {
+    const sublevel = this.getJsonSublevel(`projects/${projectId}/operations`);
+    const result = [];
+    const pageSize = 10;
+    for await (const operation of sublevel.values({ lt: beforeOperationId, reverse: true })) {
+      result.push(projectOperationSchema.parse(operation));
+      if (result.length >= pageSize) {
+        break;
+      }
+    }
+    return result;
+  }
+  async getInstanceStates(projectId) {
+    const sublevel = this.getJsonSublevel(`projects/${projectId}/instances`);
+    const result = [];
+    for await (const state of sublevel.values()) {
+      result.push(instanceStateSchema.parse(state));
+    }
+    return result;
+  }
+  async getInstanceState(projectId, instanceID) {
+    const sublevel = this.getJsonSublevel(`projects/${projectId}/instances`);
+    const state = await sublevel.get(instanceID);
+    if (!state) {
+      return undefined;
+    }
+    return instanceStateSchema.parse(state);
+  }
+  async getAffectedInstanceStates(operationId) {
+    const sublevel = this.getJsonSublevel(`operations/${operationId}/instances`);
+    const result = [];
+    for await (const state of sublevel.values()) {
+      result.push(instanceStateSchema.parse(state));
+    }
+    return result;
+  }
+  async getInstanceLogs(operationId, instanceId) {
+    const sublevel = this.db.sublevel(`operations/${operationId}/instanceLogs/${instanceId}`);
+    const result = [];
+    for await (const line of sublevel.values()) {
+      result.push(line);
+    }
+    return result;
+  }
+  async putOperation(operation) {
+    const sublevel = this.getJsonSublevel(`projects/${operation.projectId}/operations`);
+    const activeOperationsSublevel = this.getJsonSublevel("activeOperations");
+    if (operation.status !== "completed" && operation.status !== "failed") {
+      await this.db.batch([
+        { type: "put", key: operation.id, value: operation, sublevel },
+        { type: "put", key: operation.id, value: operation, sublevel: activeOperationsSublevel }
+      ]);
+    } else {
+      await this.db.batch([
+        { type: "put", key: operation.id, value: operation, sublevel },
+        { type: "del", key: operation.id, sublevel: activeOperationsSublevel }
+      ]);
+    }
+  }
+  async putAffectedInstanceStates(projectId, operationId, states) {
+    const sublevel = this.getJsonSublevel(`operations/${operationId}/instances`);
+    const projectSublevel = this.getJsonSublevel(`projects/${projectId}/instances`);
+    await this.db.batch(
+      // put the states to both the operation and project sublevels
+      // denormalization is cool
+      // this separation is also necessary because the instance states can be updated without operations
+      states.flatMap((state) => [
+        {
+          type: "put",
+          key: state.id,
+          value: state,
+          sublevel
+        },
+        {
+          type: "put",
+          key: state.id,
+          value: state,
+          sublevel: projectSublevel
+        }
+      ])
+    );
+  }
+  async putInstanceStates(projectId, states) {
+    const sublevel = this.getJsonSublevel(`projects/${projectId}/instances`);
+    await sublevel.batch(
+      // as i told before, we update the instance states without operations
+      // this method is used when upstream instance state changes are detected
+      states.map((state) => ({
+        type: "put",
+        key: state.id,
+        value: state
+      }))
+    );
+  }
+  async appendInstanceLogs(operationId, logs) {
+    const sublevels = /* @__PURE__ */ new Map();
+    for (const [instanceId] of logs) {
+      if (sublevels.has(instanceId)) {
+        continue;
+      }
+      const sublevel = this.db.sublevel(`operations/${operationId}/instanceLogs/${instanceId}`);
+      sublevels.set(instanceId, sublevel);
+    }
+    await this.db.batch(
+      logs.map(([instanceID, line]) => ({
+        type: "put",
+        key: uuidv7(),
+        value: line,
+        sublevel: sublevels.get(instanceID)
+      }))
+    );
+  }
+  async getCompositeInstance(projectId, instanceId) {
+    const sublevel = this.getJsonSublevel(`projects/${projectId}/compositeInstances`);
+    const instance = await sublevel.get(instanceId);
+    if (!instance) {
+      return null;
+    }
+    return evaluatedCompositeInstanceSchema.parse(instance);
+  }
+  async getCompositeInstanceInputHash(projectId, instanceId) {
+    const sublevel = this.db.sublevel(`projects/${projectId}/compositeInstanceInputHashes`);
+    return await sublevel.get(instanceId) ?? null;
+  }
+  async putCompositeInstances(projectId, instances) {
+    const sublevel = this.getJsonSublevel(`projects/${projectId}/compositeInstances`);
+    const inputHashesSublevel = this.db.sublevel(
+      `projects/${projectId}/compositeInstanceInputHashes`
+    );
+    await this.db.batch(
+      instances.flatMap((instance) => [
+        {
+          type: "put",
+          key: instance.instance.id,
+          value: evaluatedCompositeInstanceSchema.parse(instance),
+          sublevel
+        },
+        {
+          type: "put",
+          key: instance.instance.id,
+          value: instance.inputHash,
+          sublevel: inputHashesSublevel
+        }
+      ])
+    );
+  }
+  async clearCompositeInstances(projectId, instanceIds) {
+    const sublevel = this.getJsonSublevel(`projects/${projectId}/compositeInstances`);
+    const inputHashesSublevel = this.db.sublevel(
+      `projects/${projectId}/compositeInstanceInputHashes`
+    );
+    await this.db.batch(
+      instanceIds.flatMap((instanceId) => [
+        { type: "del", key: instanceId, sublevel },
+        { type: "del", key: instanceId, sublevel: inputHashesSublevel }
+      ])
+    );
+  }
+  getJsonSublevel(path) {
+    return this.db.sublevel(path, { valueEncoding: "json" });
+  }
+  static async create(config, localPulumiHost, logger) {
+    const childLogger = logger.child({ backend: "StateBackend", service: "LocalStateBackend" });
+    let location = config.HIGHSTATE_BACKEND_STATE_LOCAL_DIR;
+    if (!location) {
+      const currentUser = await localPulumiHost.getCurrentUser();
+      if (!currentUser) {
+        throw new Error(
+          "The pulumi is not authenticated, please login first or specify the state location manually"
+        );
+      }
+      if (!currentUser.url) {
+        throw new Error(
+          "The pulumi user does not have a URL, please specify the state location manually"
+        );
+      }
+      const path = currentUser.url.replace("file://", "").replace("~", process.env.HOME);
+      location = resolve$1(path, ".pulumi", ".highstate");
+      childLogger.debug({
+        msg: "auto-detected state location",
+        pulumiStateUrl: currentUser.url,
+        location
+      });
+    }
+    const { ClassicLevel } = await import('classic-level');
+    const db = new ClassicLevel(location);
+    return new LocalStateBackend(db, childLogger);
+  }
+}
+
+const stateBackendConfig = z.object({
+  HIGHSTATE_BACKEND_STATE_TYPE: z.enum(["local"]).default("local"),
+  ...localStateBackendConfig.shape
+});
+function createStateBackend(config, localPulumiHost, logger) {
+  switch (config.HIGHSTATE_BACKEND_STATE_TYPE) {
+    case "local": {
+      return LocalStateBackend.create(config, localPulumiHost, logger);
+    }
+  }
+}
+
+const localWorkspaceBackendConfig = z.object({
+  HIGHSTATE_BACKEND_WORKSPACE_LOCAL_DIR: z.string().optional()
+});
+class LocalWorkspaceBackend {
+  constructor(db) {
+    this.db = db;
+  }
+  async getWorkspaceLayout() {
+    return await this.db.get("layout");
+  }
+  async setWorkspaceLayout(layout) {
+    await this.db.put("layout", layout);
+  }
+  async getProjectViewport(projectId) {
+    return await this.db.get(`viewports/projects/${projectId}`);
+  }
+  async setProjectViewport(projectId, viewport) {
+    await this.db.put(`viewports/projects/${projectId}`, viewport);
+  }
+  async getInstanceViewport(projectId, instanceId) {
+    return await this.db.get(`viewports/instances/${projectId}/${instanceId}`);
+  }
+  async setInstanceViewport(projectId, instanceId, viewport) {
+    await this.db.put(`viewports/instances/${projectId}/${instanceId}`, viewport);
+  }
+  static async create(config) {
+    let location = config.HIGHSTATE_BACKEND_WORKSPACE_LOCAL_DIR;
+    if (!location) {
+      const home = homedir();
+      location = resolve$1(home, ".highstate/workspace");
+    }
+    const { ClassicLevel } = await import('classic-level');
+    const db = new ClassicLevel(location, { valueEncoding: "json" });
+    return new LocalWorkspaceBackend(db);
+  }
+}
+
+const workspaceBackendConfig = z.object({
+  HIGHSTATE_BACKEND_WORKSPACE_TYPE: z.enum(["local"]).default("local"),
+  ...localWorkspaceBackendConfig.shape
+});
+function createWorkspaceBackend(config) {
+  return LocalWorkspaceBackend.create(config);
+}
+
+const loggerConfig = z.object({
+  HIGHSTATE_BACKEND_LOGGER_NAME: z.string().default("highstate-backend"),
+  HIGHSTATE_BACKEND_LOGGER_LEVEL: z.enum(["fatal", "error", "warn", "info", "debug", "trace"]).default("info")
+});
+const configSchema = z.object({
+  ...libraryBackendConfig.shape,
+  ...projectBackendConfig.shape,
+  ...secretBackendConfig.shape,
+  ...stateBackendConfig.shape,
+  ...runnerBackendConfig.shape,
+  ...terminalBackendConfig.shape,
+  ...workspaceBackendConfig.shape,
+  ...loggerConfig.shape
+});
+async function loadConfig(env = process.env, useDotenv = true) {
+  if (useDotenv) {
+    await import('dotenv/config');
+  }
+  return configSchema.parse(env);
+}
+
+class RuntimeOperation {
+  constructor(operation, runnerBackend, stateBackend, libraryBackend, projectBackend, secretBackend, projectLock, operationEE, stateEE, compositeInstanceEE, instanceLogsEE, logger) {
+    this.operation = operation;
+    this.runnerBackend = runnerBackend;
+    this.stateBackend = stateBackend;
+    this.libraryBackend = libraryBackend;
+    this.projectBackend = projectBackend;
+    this.secretBackend = secretBackend;
+    this.projectLock = projectLock;
+    this.operationEE = operationEE;
+    this.stateEE = stateEE;
+    this.compositeInstanceEE = compositeInstanceEE;
+    this.instanceLogsEE = instanceLogsEE;
+    this.logger = logger;
+  }
+  abortController = new AbortController();
+  instanceMap = /* @__PURE__ */ new Map();
+  compositeInstanceLock = new BetterLock();
+  compositeInstanceMap = /* @__PURE__ */ new Map();
+  initialStatusMap = /* @__PURE__ */ new Map();
+  stateMap = /* @__PURE__ */ new Map();
+  instancePromiseMap = /* @__PURE__ */ new Map();
+  childrenStateMap = /* @__PURE__ */ new Map();
+  library;
+  inputHashCalculator;
+  async operateSafe() {
+    try {
+      await this.operate();
+    } catch (error) {
+      if (isAbortError(error)) {
+        this.logger.info("the operation was cancelled");
+        this.operation.status = "cancelled";
+        await this.updateOperation();
+        return;
+      }
+      this.logger.error({ msg: "an error occurred while running the operation", error });
+      this.operation.status = "failed";
+      this.operation.error = errorToString(error);
+      await this.updateOperation();
+    } finally {
+      this.resetPendingStateStatuses();
+      await Promise.all([
+        this.persistStates.flush(),
+        this.persistLogs.flush(),
+        this.persistSecrets.flush()
+      ]);
+      this.logger.debug("operation finished, all entries persisted");
+    }
+  }
+  resetPendingStateStatuses() {
+    for (const state of this.stateMap.values()) {
+      if (state.status !== "pending") {
+        continue;
+      }
+      const initialStatus = this.initialStatusMap.get(state.id);
+      if (initialStatus) {
+        this.updateInstanceState({ id: state.id, status: initialStatus });
+      }
+    }
+  }
+  async operate() {
+    this.logger.info("starting operation");
+    const allInstances = await this.projectBackend.getInstances(this.operation.projectId);
+    this.abortController.signal.throwIfAborted();
+    const states = await this.stateBackend.getInstanceStates(this.operation.projectId);
+    this.abortController.signal.throwIfAborted();
+    for (const instance of allInstances) {
+      this.instanceMap.set(instance.id, instance);
+    }
+    this.inputHashCalculator = new InputHashCalculator(this.instanceMap);
+    for (const state of states) {
+      this.stateMap.set(state.id, state);
+      this.initialStatusMap.set(state.id, state.status);
+      this.tryAddStateToParent(state);
+    }
+    if (this.operation.type === "update") {
+      await this.extendWithNotCreatedDependencies();
+      await this.updateOperation();
+    } else if (this.operation.type === "destroy") {
+      this.extendWithCreatedDependents();
+      await this.updateOperation();
+    }
+    this.logger.info("all instances loaded", {
+      count: allInstances.length,
+      affectedCount: this.operation.instanceIds.length
+    });
+    if (this.operation.type === "evaluate") {
+      this.logger.info("evaluating instances");
+      await this.evaluateCompositeInstances(allInstances);
+    } else {
+      this.library = await this.libraryBackend.loadLibrary();
+      this.logger.info("library ready");
+      this.abortController.signal.throwIfAborted();
+      const promises = [];
+      for (const instanceId of this.operation.instanceIds) {
+        promises.push(this.getInstancePromiseForOperation(instanceId));
+      }
+      this.logger.info("all units started");
+      this.operation.status = "running";
+      await this.updateOperation();
+      await Promise.all(promises);
+      this.logger.info("all units completed");
+    }
+    this.operation.status = "completed";
+    await this.updateOperation();
+    this.logger.info("operation completed");
+  }
+  cancel() {
+    this.abortController.abort();
+  }
+  getInstancePromiseForOperation(instanceId) {
+    const instance = this.instanceMap.get(instanceId);
+    if (!instance) {
+      throw new Error(`Instance not found: ${instanceId}`);
+    }
+    const component = this.library.components[instance.type];
+    if (!component) {
+      throw new Error(`Component not found: ${instance.type}`);
+    }
+    if (isUnitModel(component)) {
+      return this.getUnitPromise(instance, component);
+    }
+    return this.getCompositePromise(instance);
+  }
+  async getUnitPromise(instance, component) {
+    switch (this.operation.type) {
+      case "update": {
+        return this.updateUnit(instance, component);
+      }
+      case "recreate": {
+        return this.recreateUnit(instance, component);
+      }
+      case "destroy": {
+        return this.destroyUnit(instance.id);
+      }
+      case "refresh": {
+        return this.refreshUnit(instance.id);
+      }
+    }
+  }
+  async getCompositePromise(instance) {
+    const logger = this.logger.child({ instanceId: instance.id });
+    return this.getInstancePromise(instance.id, async () => {
+      const initialStatus = this.stateMap.get(instance.id)?.status ?? "not_created";
+      this.updateInstanceState({
+        id: instance.id,
+        latestOperationId: this.operation.id,
+        status: this.getStatusByOperationType(),
+        currentResourceCount: 0,
+        totalResourceCount: 0
+      });
+      const { children } = await this.loadCompositeInstance(instance.id);
+      const childPromises = [];
+      if (!children.length) {
+        logger.warn("no children found for composite component");
+      }
+      for (const child of children) {
+        logger.info("waiting for child", { childId: child.id });
+        childPromises.push(this.getInstancePromiseForOperation(child.id));
+      }
+      try {
+        await Promise.all(childPromises);
+        this.abortController.signal.throwIfAborted();
+        if (children.length > 0) {
+          logger.info("all children completed", { count: children.length });
+        }
+        this.updateInstanceState({
+          id: instance.id,
+          status: "created"
+        });
+      } catch (error) {
+        if (isAbortError(error)) {
+          this.updateInstanceState({
+            id: instance.id,
+            status: initialStatus
+          });
+          return;
+        }
+        this.updateInstanceState({
+          id: instance.id,
+          status: "error",
+          error: errorToString(error)
+        });
+      }
+    });
+  }
+  updateUnit(instance, component) {
+    const logger = this.logger.child({ instanceId: instance.id });
+    return this.getInstancePromise(instance.id, async () => {
+      this.updateInstanceState({
+        id: instance.id,
+        latestOperationId: this.operation.id,
+        status: "pending",
+        currentResourceCount: 0,
+        totalResourceCount: 0
+      });
+      const dependencies = this.getInstanceDependencies(instance);
+      const dependencyPromises = [];
+      for (const dependency of dependencies) {
+        if (!this.operation.instanceIds.includes(dependency.id)) {
+          continue;
+        }
+        logger.info("waiting for dependency", { dependencyId: dependency.id });
+        dependencyPromises.push(this.updateUnit(dependency, component));
+      }
+      await Promise.all(dependencyPromises);
+      this.abortController.signal.throwIfAborted();
+      if (dependencies.length > 0) {
+        logger.info("all dependencies completed", { count: dependencies.length });
+      }
+      logger.info("updating unit...");
+      const secrets = await this.secretBackend.get(this.operation.projectId, instance.id);
+      this.abortController.signal.throwIfAborted();
+      logger.debug("secrets loaded", { count: Object.keys(secrets).length });
+      await this.runnerBackend.update({
+        projectId: this.operation.projectId,
+        instanceType: instance.type,
+        instanceName: instance.name,
+        config: await this.prepareUnitConfig(instance),
+        secrets: mapValues(secrets, (value) => valueToString(value)),
+        source: this.resolveUnitSource(component),
+        signal: this.abortController.signal
+      });
+      logger.debug("unit update requested");
+      const stream = this.runnerBackend.watch({
+        projectId: this.operation.projectId,
+        instanceType: instance.type,
+        instanceName: instance.name,
+        finalStatuses: ["created", "error"]
+      });
+      await this.watchStateStream(stream);
+      const inputHash = await this.inputHashCalculator.calculate(instance);
+      this.updateInstanceState({ id: instance.id, inputHash });
+      logger.debug("input hash after update", { inputHash });
+      logger.info("unit updated");
+    });
+  }
+  async destroyUnit(instanceId) {
+    const logger = this.logger.child({ instanceId });
+    return this.getInstancePromise(instanceId, async () => {
+      this.updateInstanceState({
+        id: instanceId,
+        latestOperationId: this.operation.id,
+        status: "pending",
+        currentResourceCount: 0,
+        totalResourceCount: 0
+      });
+      const state = this.stateMap.get(instanceId);
+      if (!state) {
+        logger.warn("state not found for unit, but destroy was requested");
+        return;
+      }
+      const dependentPromises = [];
+      for (const dependentKey of state.dependentKeys ?? []) {
+        logger.info("destroying dependent unit", { dependentKey });
+        dependentPromises.push(this.destroyUnit(dependentKey));
+      }
+      await Promise.all(dependentPromises);
+      this.abortController.signal.throwIfAborted();
+      logger.info("destroying unit...");
+      const [type, name] = parseInstanceId(instanceId);
+      await this.runnerBackend.destroy({
+        projectId: this.operation.projectId,
+        instanceType: type,
+        instanceName: name,
+        signal: this.abortController.signal
+      });
+      this.logger.debug("destroy request sent");
+      const stream = this.runnerBackend.watch({
+        projectId: this.operation.projectId,
+        instanceType: type,
+        instanceName: name,
+        finalStatuses: ["not_created", "error"]
+      });
+      await this.watchStateStream(stream);
+      this.logger.info("unit destroyed");
+    });
+  }
+  async recreateUnit(instance, component) {
+    const logger = this.logger.child({ instanceId: instance.id });
+    return this.getInstancePromise(instance.id, async () => {
+      this.updateInstanceState({
+        id: instance.id,
+        latestOperationId: this.operation.id,
+        status: "pending",
+        currentResourceCount: 0,
+        totalResourceCount: 0
+      });
+      logger.info("destroying unit...");
+      await this.runnerBackend.destroy({
+        projectId: this.operation.projectId,
+        instanceType: instance.type,
+        instanceName: instance.name,
+        signal: this.abortController.signal
+      });
+      logger.debug("destroy request sent");
+      const destroyStream = this.runnerBackend.watch({
+        projectId: this.operation.projectId,
+        instanceType: instance.type,
+        instanceName: instance.name,
+        finalStatuses: ["not_created", "error"]
+      });
+      await this.watchStateStream(destroyStream);
+      this.abortController.signal.throwIfAborted();
+      logger.info("unit destroyed");
+      logger.info("updating unit...");
+      const secrets = await this.secretBackend.get(this.operation.projectId, instance.id);
+      this.abortController.signal.throwIfAborted();
+      logger.debug("secrets loaded", { count: Object.keys(secrets).length });
+      await this.runnerBackend.update({
+        projectId: this.operation.projectId,
+        instanceType: instance.type,
+        instanceName: instance.name,
+        config: await this.prepareUnitConfig(instance),
+        secrets: mapValues(secrets, (value) => valueToString(value)),
+        source: this.resolveUnitSource(component),
+        signal: this.abortController.signal
+      });
+      logger.debug("unit update requested");
+      const updateStream = this.runnerBackend.watch({
+        projectId: this.operation.projectId,
+        instanceType: instance.type,
+        instanceName: instance.name,
+        finalStatuses: ["created", "error"]
+      });
+      this.updateInstanceState({ id: instance.id, inputHash: null });
+      await this.watchStateStream(updateStream);
+      logger.info("unit recreated");
+    });
+  }
+  async refreshUnit(instanceId) {
+    const logger = this.logger.child({ instanceId });
+    return this.getInstancePromise(instanceId, async () => {
+      this.updateInstanceState({
+        id: instanceId,
+        latestOperationId: this.operation.id,
+        status: "refreshing",
+        currentResourceCount: 0,
+        totalResourceCount: 0
+      });
+      logger.info("refreshing unit...");
+      const [type, name] = parseInstanceId(instanceId);
+      await this.runnerBackend.refresh({
+        projectId: this.operation.projectId,
+        instanceType: type,
+        instanceName: name,
+        signal: this.abortController.signal
+      });
+      logger.debug("unit refresh requested");
+      const stream = this.runnerBackend.watch({
+        projectId: this.operation.projectId,
+        instanceType: type,
+        instanceName: name,
+        finalStatuses: ["created", "error"]
+      });
+      await this.watchStateStream(stream);
+      logger.info("unit refreshed");
+    });
+  }
+  async watchStateStream(stream) {
+    let statePatch;
+    for await (statePatch of stream) {
+      if (statePatch.status === "not_created" && this.operation.type === "recreate") {
+        continue;
+      }
+      this.updateInstanceState(statePatch);
+    }
+    if (!statePatch) {
+      throw new Error("The stream ended without emitting any state.");
+    }
+    if (statePatch.status === "error") {
+      throw new Error(`The operation on unit "${statePatch.id}" failed: ${statePatch.error}`);
+    }
+  }
+  async prepareUnitConfig(instance) {
+    const config = {};
+    for (const [key, value] of Object.entries(instance.args)) {
+      config[key] = valueToString(value);
+    }
+    for (const [key, value] of Object.entries(instance.inputs)) {
+      config[`input.${key}`] = JSON.stringify(await this.resolveInstanceInput(value));
+    }
+    return config;
+  }
+  async resolveInstanceInput(input) {
+    if (Array.isArray(input)) {
+      return (await Promise.all(input.map((x) => this.resolveInstanceInput(x)))).flat();
+    }
+    return await this.resolveSingleInstanceInput(input);
+  }
+  async resolveSingleInstanceInput(input) {
+    const loadedInstance = this.instanceMap.get(input.instanceId);
+    if (loadedInstance && !loadedInstance.parentId) {
+      return input;
+    }
+    const parentInstance = await this.loadCompositeInstance(input.instanceId);
+    const parentOutput = parentInstance.instance.outputs?.[input.output];
+    if (!parentOutput) {
+      throw new Error(`Output "${input.output}" not found in "${input.instanceId}"`);
+    }
+    return await this.resolveInstanceInput(parentOutput);
+  }
+  async loadCompositeInstance(instanceId) {
+    return await this.compositeInstanceLock.acquire(instanceId, async () => {
+      const existingInstance = this.compositeInstanceMap.get(instanceId);
+      if (existingInstance) {
+        return existingInstance;
+      }
+      const compositeInstance = await this.stateBackend.getCompositeInstance(
+        this.operation.projectId,
+        instanceId
+      );
+      if (!compositeInstance) {
+        throw new Error(`Composite instance not found: ${instanceId}`);
+      }
+      this.abortController.signal.throwIfAborted();
+      for (const child of compositeInstance.children) {
+        this.instanceMap.set(child.id, child);
+      }
+      this.compositeInstanceMap.set(instanceId, compositeInstance);
+      return compositeInstance;
+    });
+  }
+  async evaluateCompositeInstances(allInstances) {
+    await this.projectLock.lockInstances(this.operation.instanceIds, async () => {
+      const compositeInstances = await this.libraryBackend.evaluateCompositeInstances(
+        allInstances,
+        this.operation.instanceIds
+      );
+      this.abortController.signal.throwIfAborted();
+      for (const instance of compositeInstances) {
+        this.compositeInstanceEE.emit(
+          `${this.operation.projectId}/${instance.instance.id}`,
+          instance
+        );
+      }
+      await this.stateBackend.putCompositeInstances(
+        this.operation.projectId,
+        await Promise.all(
+          compositeInstances.map(async (instance) => ({
+            ...instance,
+            inputHash: await this.inputHashCalculator.calculate(instance.instance)
+          }))
+        )
+      );
+    });
+  }
+  async updateOperation() {
+    this.operationEE.emit(this.operation.projectId, this.operation);
+    await this.stateBackend.putOperation(this.operation);
+  }
+  updateInstanceState(patch) {
+    if (patch.message) {
+      this.persistLogs.call([patch.id, patch.message]);
+      this.instanceLogsEE.emit(`${this.operation.id}/${patch.id}`, patch.message);
+      return;
+    }
+    const state = applyInstanceStatePatch(this.stateMap, patch);
+    this.persistStates.call(state);
+    if (patch.secrets) {
+      this.persistSecrets.call([patch.id, patch.secrets]);
+    }
+    this.stateEE.emit(this.operation.projectId, createInstanceStateFrontendPatch(patch));
+  }
+  tryAddStateToParent(state) {
+    if (!state.parentId) {
+      return;
+    }
+    const children = this.childrenStateMap.get(state.parentId) ?? [];
+    children.push(state);
+    this.childrenStateMap.set(state.parentId, children);
+  }
+  async extendWithNotCreatedDependencies() {
+    const instanceIdsSet = /* @__PURE__ */ new Set();
+    const traverse = async (instanceId) => {
+      if (instanceIdsSet.has(instanceId)) {
+        return;
+      }
+      const instance = this.instanceMap.get(instanceId);
+      if (!instance) {
+        return;
+      }
+      for (const input of Object.values(instance.inputs)) {
+        if (Array.isArray(input)) {
+          for (const { instanceId: instanceId2 } of input) {
+            await traverse(instanceId2);
+          }
+        } else {
+          await traverse(input.instanceId);
+        }
+      }
+      const state = this.stateMap.get(instance.id);
+      const expectedInputHash = await this.inputHashCalculator.calculate(instance);
+      if (state?.status !== "created" || state.inputHash !== expectedInputHash) {
+        instanceIdsSet.add(instanceId);
+      }
+    };
+    for (const instanceId of this.operation.instanceIds) {
+      await traverse(instanceId);
+      instanceIdsSet.add(instanceId);
+    }
+    this.operation.instanceIds = Array.from(instanceIdsSet);
+  }
+  extendWithCreatedDependents() {
+    const instanceIdsSet = /* @__PURE__ */ new Set();
+    const traverse = (instanceKey) => {
+      if (instanceIdsSet.has(instanceKey)) {
+        return;
+      }
+      const state = this.stateMap.get(instanceKey);
+      if (!state || state.status === "not_created") {
+        return;
+      }
+      for (const dependent of state.dependentKeys ?? []) {
+        traverse(dependent);
+        instanceIdsSet.add(instanceKey);
+      }
+    };
+    for (const instanceId of this.operation.instanceIds) {
+      const instance = this.instanceMap.get(instanceId);
+      if (!instance) {
+        throw new Error(`Instance not found: ${instanceId}`);
+      }
+      traverse(instance.id);
+      instanceIdsSet.add(instanceId);
+    }
+    this.operation.instanceIds = Array.from(instanceIdsSet);
+  }
+  getInstancePromise(instanceId, fn) {
+    let instancePromise = this.instancePromiseMap.get(instanceId);
+    if (instancePromise) {
+      return instancePromise;
+    }
+    instancePromise = this.projectLock.lockInstance(instanceId, fn);
+    instancePromise = instancePromise.finally(() => this.instancePromiseMap.delete(instanceId));
+    this.instancePromiseMap.set(instanceId, instancePromise);
+    return instancePromise;
+  }
+  getStatusByOperationType() {
+    switch (this.operation.type) {
+      case "update":
+        return "updating";
+      case "recreate":
+        return "updating";
+      case "destroy":
+        return "destroying";
+      case "refresh":
+        return "refreshing";
+      default:
+        throw new Error(`Unexpected operation type: ${this.operation.type}`);
+    }
+  }
+  getInstanceDependencies(instance) {
+    const dependencies = [];
+    for (const input of Object.values(instance.inputs)) {
+      if (Array.isArray(input)) {
+        for (const { instanceId } of input) {
+          const dependency = this.instanceMap.get(instanceId);
+          if (dependency) {
+            dependencies.push(dependency);
+          }
+        }
+      } else {
+        const dependency = this.instanceMap.get(input.instanceId);
+        if (dependency) {
+          dependencies.push(dependency);
+        }
+      }
+    }
+    return dependencies;
+  }
+  resolveUnitSource(component) {
+    if (!component.source) {
+      return {
+        type: "local",
+        path: component.type.replaceAll(".", "/")
+      };
+    }
+    return {
+      ...component.source,
+      path: component.source.path ?? component.type.replaceAll(".", "/")
+    };
+  }
+  static accumulator(values, value) {
+    if (!values) {
+      return [value];
+    }
+    return [...values, value];
   }
+  persistStates = funnel(
+    (states) => {
+      this.logger.debug({ msg: "persisting states", count: states.length });
+      void this.stateBackend.putAffectedInstanceStates(
+        this.operation.projectId,
+        this.operation.id,
+        states
+      );
+    },
+    {
+      minQuietPeriodMs: 100,
+      maxBurstDurationMs: 1e3,
+      triggerAt: "end",
+      reducer: RuntimeOperation.accumulator
+    }
+  );
+  persistLogs = funnel(
+    (entries) => {
+      this.logger.debug({ msg: "persisting logs", count: entries.length });
+      void this.stateBackend.appendInstanceLogs(this.operation.id, entries);
+    },
+    {
+      minQuietPeriodMs: 100,
+      maxBurstDurationMs: 200,
+      reducer: RuntimeOperation.accumulator
+    }
+  );
+  persistSecrets = funnel(
+    (entries) => {
+      this.logger.debug({ msg: "persisting secrets", count: entries.length });
+      for (const [instanceId, secrets] of entries) {
+        void this.secretBackend.get(this.operation.projectId, instanceId).then((existingSecrets) => {
+          Object.assign(existingSecrets, secrets);
+          return this.secretBackend.set(this.operation.projectId, instanceId, existingSecrets);
+        });
+      }
+    },
+    {
+      minQuietPeriodMs: 100,
+      maxBurstDurationMs: 200,
+      reducer: RuntimeOperation.accumulator
+    }
+  );
 }
 
-function createRunnerBackend() {
-  return LocalRunnerBackend.create();
+class OperationManager {
+  constructor(runnerBackend, stateBackend, libraryBackend, projectBackend, secretBackend, projectLockManager, logger) {
+    this.runnerBackend = runnerBackend;
+    this.stateBackend = stateBackend;
+    this.libraryBackend = libraryBackend;
+    this.projectBackend = projectBackend;
+    this.secretBackend = secretBackend;
+    this.projectLockManager = projectLockManager;
+    this.logger = logger;
+  }
+  operationEE = new EventEmitter();
+  stateEE = new EventEmitter();
+  compositeInstanceEE = new EventEmitter();
+  instanceLogsEE = new EventEmitter();
+  runtimeOperations = /* @__PURE__ */ new Map();
+  /**
+   * Watches for all instance state changes in the project.
+   *
+   * @param projectId The project ID to watch.
+   * @param signal The signal to abort the operation.
+   */
+  async *watchInstanceStates(projectId, signal) {
+    for await (const [state] of on(this.stateEE, projectId, { signal })) {
+      yield state;
+    }
+  }
+  /**
+   * Watches for all project operations in the project.
+   *
+   * @param projectId The project ID to watch.
+   * @param signal The signal to abort the operation.
+   */
+  async *watchOperations(projectId, signal) {
+    for await (const [operation] of on(this.operationEE, projectId, { signal })) {
+      yield operation;
+    }
+  }
+  /**
+   * Watches for changes in the composite instance.
+   *
+   * @param projectId The project ID to watch.
+   * @param instanceId The instance ID to watch.
+   * @param signal The signal to abort the operation.
+   */
+  async *watchCompositeInstance(projectId, instanceId, signal) {
+    const eventKey = `${projectId}/${instanceId}`;
+    for await (const [instance] of on(this.compositeInstanceEE, eventKey, { signal })) {
+      yield instance;
+    }
+  }
+  /**
+   * Watches for logs of the instance in the operation.
+   *
+   * @param operationId The operation ID to watch.
+   * @param instanceId The instance ID to watch.
+   * @param signal The signal to abort the operation.
+   */
+  async *watchInstanceLogs(operationId, instanceId, signal) {
+    const eventKey = `${operationId}/${instanceId}`;
+    for await (const [log] of on(this.instanceLogsEE, eventKey, { signal })) {
+      yield log;
+    }
+  }
+  /**
+   * Launches the project operation.
+   *
+   * @param request The operation request to launch.
+   */
+  async launch(request) {
+    const operation = {
+      id: uuidv7(),
+      projectId: request.projectId,
+      type: request.type,
+      instanceIds: request.instanceIds,
+      status: "pending",
+      error: null,
+      startedAt: Date.now(),
+      completedAt: null
+    };
+    await this.stateBackend.putOperation(operation);
+    this.startOperation(operation);
+  }
+  /**
+   * Cancels the current operation.
+   * Does nothing if no operation is running.
+   */
+  cancel(operationId) {
+    const runtimeOperation = this.runtimeOperations.get(operationId);
+    if (runtimeOperation) {
+      runtimeOperation.cancel();
+    }
+  }
+  startOperation(operation) {
+    const runtimeOperation = new RuntimeOperation(
+      operation,
+      this.runnerBackend,
+      this.stateBackend,
+      this.libraryBackend,
+      this.projectBackend,
+      this.secretBackend,
+      this.projectLockManager.getLock(operation.projectId),
+      this.operationEE,
+      this.stateEE,
+      this.compositeInstanceEE,
+      this.instanceLogsEE,
+      this.logger.child({ service: "RuntimeOperation", operationId: operation.id })
+    );
+    this.runtimeOperations.set(operation.id, runtimeOperation);
+    void runtimeOperation.operateSafe().finally(() => this.runtimeOperations.delete(operation.id));
+  }
+  static async create(runnerBackend, stateBackend, libraryBackend, projectBackend, secretBackend, projectLockManager, logger) {
+    const operator = new OperationManager(
+      runnerBackend,
+      stateBackend,
+      libraryBackend,
+      projectBackend,
+      secretBackend,
+      projectLockManager,
+      logger.child({ service: "OperationManager" })
+    );
+    const activeOperations = await stateBackend.getActiveOperations();
+    for (const operation of activeOperations) {
+      logger.info({ msg: "relaunching operation", operationId: operation.id });
+      operator.startOperation(operation);
+    }
+    return operator;
+  }
 }
 
-async function createServices(config) {
+async function createServices({
+  config,
+  services: {
+    logger,
+    libraryBackend,
+    secretBackend,
+    runnerBackend,
+    projectBackend,
+    projectManager,
+    stateBackend,
+    operationManager,
+    terminalBackend,
+    terminalManager,
+    workspaceBackend
+  } = {}
+} = {}) {
   config ??= await loadConfig();
-  const pulumiProjectHost = new LocalPulumiProjectHost();
-  const libraryBackend = await createLibraryBackend(config);
-  const secretBackend = await createSecretBackend(config, pulumiProjectHost);
-  const runnerBackend = await createRunnerBackend();
-  const projectBackend = await createProjectBackend(config);
-  const stateBackend = await createStateBackend(config, pulumiProjectHost);
-  const operatorManager = new OperatorManager(
+  logger ??= pino({
+    name: config.HIGHSTATE_BACKEND_LOGGER_NAME,
+    level: config.HIGHSTATE_BACKEND_LOGGER_LEVEL
+  });
+  const localPulumiHost = LocalPulumiHost.create(logger);
+  const projectLockManager = new ProjectLockManager();
+  libraryBackend ??= createLibraryBackend(config, logger);
+  secretBackend ??= await createSecretBackend(config, localPulumiHost, logger);
+  stateBackend ??= await createStateBackend(config, localPulumiHost, logger);
+  runnerBackend ??= await createRunnerBackend(config, localPulumiHost);
+  projectBackend ??= await createProjectBackend(config);
+  terminalBackend ??= createTerminalBackend(config, logger);
+  terminalManager ??= TerminalManager.create(terminalBackend, logger);
+  operationManager ??= await OperationManager.create(
     runnerBackend,
     stateBackend,
     libraryBackend,
     projectBackend,
-    secretBackend
+    secretBackend,
+    projectLockManager,
+    logger
+  );
+  projectManager ??= ProjectManager.create(
+    projectBackend,
+    stateBackend,
+    operationManager,
+    libraryBackend,
+    logger
   );
-  consola.success("Backend services initialized");
+  workspaceBackend ??= await createWorkspaceBackend(config);
+  logger.info("services created");
   return {
+    logger,
     libraryBackend,
     secretBackend,
     runnerBackend,
     projectBackend,
+    projectManager,
     stateBackend,
-    operatorManager
+    operationManager,
+    terminalBackend,
+    terminalManager,
+    workspaceBackend
   };
 }
+let sharedServicesPromise;
+function getSharedServices(options = {}) {
+  if (!sharedServicesPromise) {
+    sharedServicesPromise = createServices(options);
+  }
+  return sharedServicesPromise;
+}
 
-export { LocalPulumiProjectHost, OperatorManager, ProjectOperator, SecretAccessDeniedError, createLibraryBackend, createSecretBackend, createServices, createStateBackend, instanceModelSchema, instanceStateSchema, instanceStatusSchema, libraryBackendConfig, loadConfig, operationType, outputRefSchema, positionSchema, projectOperation, projectStateSchema, resolveMainLocalProject, secretBackendConfig, stateBackendConfig, stringArrayType };
+export { OperationManager, SecretAccessDeniedError, TerminalManager, createLibraryBackend, createSecretBackend, createServices, createTerminalBackend, getSharedServices, libraryBackendConfig, loadConfig, secretBackendConfig, terminalBackendConfig };