@highstate/backend 0.7.1 → 0.7.3

package/dist/{index.mjs → index.js}

@@ -1,25 +1,26 @@
 import { z } from 'zod';
 import { pickBy, mapKeys, mapValues, omit, pick } from 'remeda';
+import { r as runWithRetryOnError, A as AbortError, s as stringArrayType, c as createAsyncBatcher, i as isAbortErrorLike, e as errorToString, a as isAbortError, t as tryWrapAbortErrorLike } from './utils-ByadNcv4.js';
 import { BetterLock } from 'better-lock';
-import { basename, relative, dirname, resolve as resolve$1 } from 'node:path';
-import { findWorkspaceDir, readPackageJSON } from 'pkg-types';
+import { basename, relative, resolve as resolve$1, dirname } from 'node:path';
+import { findWorkspaceDir, readPackageJSON, resolvePackageJSON } from 'pkg-types';
 import { fileURLToPath } from 'node:url';
-import { EventEmitter, on } from 'node:events';
+import EventEmitter$1, { EventEmitter, on } from 'node:events';
 import { Worker } from 'node:worker_threads';
+import { readFile, readdir, writeFile, mkdir } from 'node:fs/promises';
+import { isUnitModel, getInstanceId, parseInstanceId } from '@highstate/contract';
 import Watcher from 'watcher';
 import { resolve } from 'import-meta-resolve';
-import { readdir, readFile, writeFile, mkdir } from 'node:fs/promises';
-import { getInstanceId, isUnitModel, parseInstanceId } from '@highstate/contract';
-import { h as hubModelSchema, i as instanceModelSchema, c as createInputResolver, a as createInputHashResolver, b as createInstanceState, d as instanceTerminalSchema, e as instancePageSchema, f as instanceFileSchema, g as instanceStatusFieldSchema, j as instanceTriggerSchema, k as compositeInstanceSchema, p as projectOperationSchema, l as instanceStateSchema, m as isFinalOperationStatus, t as terminalSessionSchema, n as createInstanceStateFrontendPatch, o as applyPartialInstanceState } from './terminal-CqIsctlZ.mjs';
-import { sha256 } from 'crypto-hash';
-import 'ajv';
+import { U as diffLibraries, e as hubModelSchema, b as instanceModelSchema, x as createInstanceState, M as createInputResolver, R as createInputHashResolver, r as instanceTerminalSchema, n as instancePageSchema, k as instanceFileSchema, g as instanceStatusFieldSchema, t as instanceTriggerSchema, G as projectOperationSchema, v as instanceStateSchema, H as isFinalOperationStatus, c as compositeInstanceSchema, T as terminalSessionSchema, y as applyPartialInstanceState, z as createInstanceStatePatch } from './library-BW5oPM7V.js';
 import { Readable, PassThrough } from 'node:stream';
 import { tmpdir, homedir } from 'node:os';
 import spawn from 'nano-spawn';
-import { randomUUID } from 'node:crypto';
 import { ensureDependencyInstalled } from 'nypm';
+import { sha256 } from 'crypto-hash';
 import { uuidv7 } from 'uuidv7';
+import { webcrypto } from 'node:crypto';
 import { pino } from 'pino';
+import 'ajv';
 
 class SecretAccessDeniedError extends Error {
   constructor(projectId, key) {
@@ -27,92 +28,6 @@ class SecretAccessDeniedError extends Error {
   }
 }
 
-async function runWithRetryOnError(runner, tryHandleError, maxRetries = 1) {
-  let lastError;
-  for (let i = 0; i < maxRetries + 1; i++) {
-    try {
-      return await runner();
-    } catch (e) {
-      lastError = e;
-      if (await tryHandleError(e)) {
-        continue;
-      }
-      throw e;
-    }
-  }
-  throw lastError;
-}
-class AbortError extends Error {
-  constructor() {
-    super("Operation aborted");
-  }
-}
-function isAbortError(error) {
-  return error instanceof Error && error.name === "AbortError";
-}
-const stringArrayType = z.string().transform((args) => args.split(",").map((arg) => arg.trim()));
-function errorToString(error) {
-  if (error instanceof Error) {
-    return error.stack || error.message;
-  }
-  return JSON.stringify(error);
-}
-function createAsyncBatcher(fn, { waitMs = 100, maxWaitTimeMs = 1e3 } = {}) {
-  let batch = [];
-  let activeTimeout = null;
-  let maxWaitTimeout = null;
-  let firstCallTimestamp = null;
-  async function processBatch() {
-    if (batch.length === 0) return;
-    const currentBatch = batch;
-    batch = [];
-    await fn(currentBatch);
-    if (maxWaitTimeout) {
-      clearTimeout(maxWaitTimeout);
-      maxWaitTimeout = null;
-    }
-    firstCallTimestamp = null;
-  }
-  function schedule() {
-    if (activeTimeout) clearTimeout(activeTimeout);
-    activeTimeout = setTimeout(() => {
-      activeTimeout = null;
-      void processBatch();
-    }, waitMs);
-    if (!firstCallTimestamp) {
-      firstCallTimestamp = Date.now();
-      maxWaitTimeout = setTimeout(() => {
-        if (activeTimeout) clearTimeout(activeTimeout);
-        activeTimeout = null;
-        void processBatch();
-      }, maxWaitTimeMs);
-    }
-  }
-  return {
-    /**
-     * Add an item to the batch.
-     */
-    call(item) {
-      batch.push(item);
-      schedule();
-    },
-    /**
-     * Immediately flush the pending batch (if any).
-     */
-    async flush() {
-      if (activeTimeout) {
-        clearTimeout(activeTimeout);
-        activeTimeout = null;
-      }
-      if (maxWaitTimeout) {
-        clearTimeout(maxWaitTimeout);
-        maxWaitTimeout = null;
-      }
-      await processBatch();
-    }
-  };
-}
-
 class LocalPulumiHost {
   constructor(logger) {
     this.logger = logger;
@@ -128,7 +43,7 @@ class LocalPulumiHost {
       return null;
     }
   }
-  async runEmpty(options, fn) {
+  async runEmpty(options, fn, signal) {
     const { projectId, pulumiProjectName, pulumiStackName, envVars } = options;
     return await this.lock.acquire(`${pulumiProjectName}.${pulumiStackName}`, async () => {
       const { LocalWorkspace } = await import('@pulumi/pulumi/automation/index.js');
@@ -150,6 +65,7 @@ class LocalPulumiHost {
           }
         }
       );
+      signal?.throwIfAborted();
       try {
         return await runWithRetryOnError(
           () => fn(stack),
@@ -163,7 +79,7 @@ class LocalPulumiHost {
       }
     });
   }
-  async runLocal(options, fn) {
+  async runLocal(options, fn, signal) {
     const { projectId, pulumiProjectName, pulumiStackName, projectPath, stackConfig, envVars } = options;
     return await this.lock.acquire(`${pulumiProjectName}.${pulumiStackName}`, async () => {
       const { LocalWorkspace } = await import('@pulumi/pulumi/automation/index.js');
@@ -189,6 +105,7 @@ class LocalPulumiHost {
           }
         }
       );
+      signal?.throwIfAborted();
       try {
         return await runWithRetryOnError(
           () => fn(stack),
@@ -295,7 +212,7 @@ class LocalSecretBackend {
   isLocked(projectId) {
     return Promise.resolve(!this.pulumiProjectHost.hasPassword(projectId));
   }
-  async unlock(projectId, password) {
+  async unlock(projectId, password, signal) {
     this.pulumiProjectHost.setPassword(projectId, password);
     try {
       await this.pulumiProjectHost.runLocal(
@@ -308,7 +225,8 @@ class LocalSecretBackend {
         async (stack) => {
           this.logger.debug({ projectId }, "checking password");
           await stack.info(true);
-        }
+        },
+        signal
       );
       return true;
     } catch (error) {
@@ -322,7 +240,7 @@ class LocalSecretBackend {
       throw error;
     }
   }
-  get(projectId, instanceId) {
+  get(projectId, instanceId, signal) {
     return this.pulumiProjectHost.runLocal(
       {
         projectId,
@@ -333,14 +251,16 @@ class LocalSecretBackend {
       async (stack) => {
         this.logger.debug({ projectId, instanceId }, "getting secrets");
         const config = await stack.getAllConfig();
+        signal?.throwIfAborted();
         const prefix = this.getPrefix(projectId, instanceId);
         const secrets = pickBy(config, (_, key) => key.startsWith(prefix));
         const trimmedSecrets = mapKeys(secrets, (key) => key.slice(prefix.length));
         return mapValues(trimmedSecrets, (value) => stringToValue(value.value));
-      }
+      },
+      signal
     );
   }
-  set(projectId, instanceId, values) {
+  set(projectId, instanceId, values, signal) {
     return this.pulumiProjectHost.runLocal(
       {
         projectId,
@@ -358,9 +278,11 @@ class LocalSecretBackend {
           })
         );
         const config = await stack.getAllConfig();
+        signal?.throwIfAborted();
         Object.assign(config, componentSecrets);
         await stack.setAllConfig(config);
-      }
+      },
+      signal
     );
   }
   getPrefix(projectId, instanceId) {
@@ -394,25 +316,41 @@ function createSecretBackend(config, localPulumiHost, logger) {
 }
 
 const localLibraryBackendConfig = z.object({
-  HIGHSTATE_BACKEND_LIBRARY_LOCAL_MODULES: stringArrayType.default("@highstate/library")
+  HIGHSTATE_BACKEND_LIBRARY_LOCAL_MODULES: stringArrayType.default("@highstate/library"),
+  HIGHSTATE_BACKEND_LIBRARY_LOCAL_SOURCE_BASE_PATH: z.string().optional(),
+  HIGHSTATE_BACKEND_LIBRARY_LOCAL_EXTRA_SOURCE_WATCH_PATHS: stringArrayType.default("")
 });
 class LocalLibraryBackend {
-  constructor(modulePaths, logger) {
+  constructor(modulePaths, sourceBasePath, extraSourceWatchPaths, logger) {
     this.modulePaths = modulePaths;
+    this.sourceBasePath = sourceBasePath;
     this.logger = logger;
-    this.watcher = new Watcher(modulePaths, { recursive: true, ignoreInitial: true });
-    this.watcher.on("all", (event, path) => {
+    this.libraryWatcher = new Watcher(modulePaths, { recursive: true, ignoreInitial: true });
+    this.libraryWatcher.on("all", (event, path) => {
       const prefixPath = modulePaths.find((modulePath) => path.startsWith(modulePath));
       this.logger.info({ msg: "library event", event, path: relative(prefixPath, path) });
       void this.lock.acquire(() => this.updateLibrary());
     });
+    this.sourceWatcher = new Watcher([sourceBasePath, ...extraSourceWatchPaths], {
+      recursive: true,
+      ignoreInitial: true,
+      ignore: /\.git|node_modules/
+    });
+    this.sourceWatcher.on("all", (_, path) => {
+      if (!path.endsWith("highstate.manifest.json")) {
+        return;
+      }
+      void this.updateUnitSourceHashes(path);
+    });
     this.logger.debug({ msg: "initialized", modulePaths });
   }
-  watcher;
+  libraryWatcher;
+  sourceWatcher;
   lock = new BetterLock();
   eventEmitter = new EventEmitter();
   library = null;
   worker = null;
+  resolvedUnitSources = /* @__PURE__ */ new Map();
   async loadLibrary() {
     return await this.lock.acquire(async () => {
       const [library] = await this.getLibrary();
@@ -424,36 +362,130 @@ class LocalLibraryBackend {
       yield library;
     }
   }
-  async evaluateCompositeInstances(allInstances, instanceIds) {
+  async getResolvedUnitSources() {
+    return await this.lock.acquire(async () => {
+      const [library] = await this.getLibrary();
+      if (!this.resolvedUnitSources.size) {
+        await this.syncUnitSources(library);
+      }
+      return Array.from(this.resolvedUnitSources.values());
+    });
+  }
+  async getResolvedUnitSource(unitType) {
+    return await this.lock.acquire(async () => {
+      const [library] = await this.getLibrary();
+      if (!this.resolvedUnitSources.size) {
+        await this.syncUnitSources(library);
+      }
+      return this.resolvedUnitSources.get(unitType) ?? null;
+    });
+  }
+  async *watchResolvedUnitSources(signal) {
+    for await (const [resolvedUnitSource] of on(this.eventEmitter, "resolvedUnitSource", {
+      signal
+    })) {
+      yield resolvedUnitSource;
+    }
+  }
+  async syncUnitSources(library) {
+    const unitsToResolve = /* @__PURE__ */ new Map();
+    for (const component of Object.values(library.components)) {
+      if (!isUnitModel(component)) {
+        continue;
+      }
+      const existingResolvedSource = this.resolvedUnitSources.get(component.type);
+      const expectedSource = JSON.stringify(component.source);
+      if (existingResolvedSource?.serializedSource !== expectedSource) {
+        unitsToResolve.set(component.type, component);
+      }
+    }
+    await this.runSourceResolution(unitsToResolve);
+  }
+  async runSourceResolution(units) {
+    const workerPathUrl = resolve(
+      `@highstate/backend/source-resolution-worker`,
+      import.meta.url
+    );
+    const workerPath = fileURLToPath(workerPathUrl);
+    const worker = new Worker(workerPath, {
+      workerData: {
+        requests: Array.from(units.values()).map((unit) => ({
+          unitType: unit.type,
+          source: unit.source
+        })),
+        sourceBasePath: this.sourceBasePath,
+        logLevel: "error"
+      }
+    });
+    for await (const [event] of on(worker, "message")) {
+      const eventData = event;
+      if (eventData.type !== "result") {
+        throw new Error(`Unexpected message type '${eventData.type}', expected 'result'`);
+      }
+      for (const result of eventData.results) {
+        const unit = units.get(result.unitType);
+        if (!unit) {
+          this.logger.warn("unit not found for resolved source", { unitType: result.unitType });
+          continue;
+        }
+        const resolvedSource = {
+          unitType: result.unitType,
+          serializedSource: JSON.stringify(unit.source),
+          projectPath: result.projectPath,
+          packageJsonPath: result.packageJsonPath,
+          allowedDependencies: result.allowedDependencies,
+          sourceHash: result.sourceHash
+        };
+        this.resolvedUnitSources.set(result.unitType, resolvedSource);
+        this.eventEmitter.emit("resolvedUnitSource", resolvedSource);
+      }
+      this.logger.info("unit sources synced");
+      return;
+    }
+    throw new Error("Worker ended without sending the result");
+  }
+  async evaluateCompositeInstances(allInstances, resolvedInputs, instanceIds) {
     return await this.lock.acquire(async () => {
-      this.logger.info("evaluating composite instances", { instanceIds });
+      this.logger.info("evaluating %d composite instances", instanceIds.length);
       const [, worker] = await this.getLibrary();
-      worker.postMessage({ type: "evaluate-composite-instances", allInstances, instanceIds });
+      worker.postMessage({
+        type: "evaluate-composite-instances",
+        allInstances,
+        resolvedInputs,
+        instanceIds
+      });
       this.logger.debug("evaluation request sent");
-      return this.getInstances(worker);
+      const { results } = await this.getResult(worker, "instance-evaluation-results");
+      return results;
     });
   }
   async evaluateModules(modulePaths) {
     return await this.lock.acquire(async () => {
       this.logger.info({ msg: "evaluating modules", modulePaths });
       const [, worker] = await this.getLibrary();
-      worker.postMessage({ type: "evaluate-modules", modulePaths });
+      worker.postMessage({
+        type: "evaluate-modules",
+        modulePaths
+      });
       this.logger.debug("evaluation request sent");
-      return this.getInstances(worker);
+      const { result } = await this.getResult(worker, "module-evaluation-result");
+      return result;
     });
   }
-  async getInstances(worker) {
+  async getResult(worker, expectedType) {
     for await (const [event] of on(worker, "message")) {
       const eventData = event;
       if (eventData.type === "error") {
         throw new Error(`Worker error: ${eventData.error}`);
       }
-      if (eventData.type !== "instances") {
-        throw new Error(`Unexpected message type '${eventData.type}', expected 'instances'`);
+      if (eventData.type !== expectedType) {
+        throw new Error(
+          `Unexpected response message type "${eventData.type}", expected "${expectedType}"`
+        );
       }
-      return eventData.instances;
+      return eventData;
     }
-    throw new Error("Worker ended without sending instances");
+    throw new Error("Worker ended without sending any response");
   }
   async getLibrary() {
     if (this.library && this.worker) {
@@ -472,9 +504,14 @@ class LocalLibraryBackend {
       if (eventData.type !== "library") {
         throw new Error(`Unexpected message type '${eventData.type}', expected 'library'`);
       }
-      this.eventEmitter.emit("library", eventData.library);
+      const updates = diffLibraries(
+        this.library ?? { components: {}, entities: {} },
+        eventData.library
+      );
+      this.eventEmitter.emit("library", updates);
       this.library = eventData.library;
       this.logger.info("library reloaded");
+      await this.syncUnitSources(eventData.library);
       return [this.library, this.worker];
     }
     throw new Error("Worker ended without sending library model");
@@ -484,7 +521,49 @@ class LocalLibraryBackend {
     const workerPath = fileURLToPath(workerPathUrl);
     return new Worker(workerPath, { workerData });
   }
-  static create(config, logger) {
+  async updateUnitSourceHashes(path) {
+    const packageJsonPath = await resolvePackageJSON(path);
+    const packageJson = await readPackageJSON(path);
+    const library = await this.loadLibrary();
+    const manifestPath = resolve$1(dirname(packageJsonPath), "dist", "highstate.manifest.json");
+    let manifest;
+    try {
+      manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+    } catch (error) {
+      this.logger.debug(
+        { error },
+        `failed to read highstate manifest for package "%s"`,
+        packageJson.name
+      );
+    }
+    for (const unit of Object.values(library.components)) {
+      if (!isUnitModel(unit)) {
+        continue;
+      }
+      if (unit.source.package !== packageJson.name) {
+        continue;
+      }
+      const relativePath = unit.source.path ? `./dist/${unit.source.path}/index.js` : `./dist/index.js`;
+      const sourceHash = manifest?.sourceHashes?.[relativePath];
+      if (!sourceHash) {
+        this.logger.warn(`source hash not found for unit: "%s"`, unit.type);
+        continue;
+      }
+      const resolvedSource = this.resolvedUnitSources.get(unit.type);
+      if (!resolvedSource) {
+        this.logger.warn(`resolved source not found for unit: "%s"`, unit.type);
+        continue;
+      }
+      const newResolvedSource = {
+        ...resolvedSource,
+        sourceHash
+      };
+      this.resolvedUnitSources.set(unit.type, newResolvedSource);
+      this.eventEmitter.emit("resolvedUnitSource", newResolvedSource);
+      this.logger.info(`updated source hash for unit: "%s"`, unit.type);
+    }
+  }
+  static async create(config, logger) {
     const modulePaths = [];
     for (const module of config.HIGHSTATE_BACKEND_LIBRARY_LOCAL_MODULES) {
       const url = resolve(module, import.meta.url);
@@ -494,8 +573,17 @@ class LocalLibraryBackend {
       }
       modulePaths.push(path);
     }
+    let sourceBasePath = config.HIGHSTATE_BACKEND_LIBRARY_LOCAL_SOURCE_BASE_PATH;
+    const extraSourceWatchPaths = config.HIGHSTATE_BACKEND_LIBRARY_LOCAL_EXTRA_SOURCE_WATCH_PATHS;
+    if (!sourceBasePath) {
+      const [projectPath] = await resolveMainLocalProject();
+      sourceBasePath = resolve$1(projectPath, "units");
+      extraSourceWatchPaths.push(projectPath);
+    }
     return new LocalLibraryBackend(
       modulePaths,
+      sourceBasePath,
+      extraSourceWatchPaths,
       logger.child({ backend: "LibraryBackend", service: "LocalLibraryBackend" })
     );
   }
@@ -505,10 +593,10 @@ const libraryBackendConfig = z.object({
   HIGHSTATE_BACKEND_LIBRARY_TYPE: z.enum(["local"]).default("local"),
   ...localLibraryBackendConfig.shape
 });
-function createLibraryBackend(config, logger) {
+async function createLibraryBackend(config, logger) {
   switch (config.HIGHSTATE_BACKEND_LIBRARY_TYPE) {
     case "local": {
-      return LocalLibraryBackend.create(config, logger);
+      return await LocalLibraryBackend.create(config, logger);
     }
   }
 }
@@ -524,7 +612,7 @@ class LocalProjectBackend {
   constructor(projectsDir) {
     this.projectsDir = projectsDir;
   }
-  async getProjectNames() {
+  async getProjectIds() {
     try {
       const files = await readdir(this.projectsDir);
       return files.filter((file) => file.endsWith(".json")).map((file) => file.replace(/\.json$/, ""));
@@ -825,6 +913,14 @@ class ProjectLock {
   canImmediatelyAcquireLock(instanceId) {
     return this.lock.canAcquire(`${this.projectId}/${instanceId}`);
   }
+  canImmediatelyAcquireLocks(instanceIds) {
+    for (const instanceId of instanceIds) {
+      if (!this.canImmediatelyAcquireLock(instanceId)) {
+        return false;
+      }
+    }
+    return true;
+  }
   lockInstance(instanceId, fn) {
     return this.lock.acquire(`${this.projectId}/${instanceId}`, fn);
   }
@@ -843,52 +939,36 @@ class ProjectLockManager {
 }
 
 class ProjectManager {
-  constructor(projectBackend, stateBackend, operationManager, library, logger) {
+  constructor(projectBackend, stateBackend, libraryBackend, projectLockManager, stateManager, logger) {
     this.projectBackend = projectBackend;
     this.stateBackend = stateBackend;
-    this.operationManager = operationManager;
-    this.library = library;
+    this.libraryBackend = libraryBackend;
+    this.projectLockManager = projectLockManager;
+    this.stateManager = stateManager;
     this.logger = logger;
+    void this.watchLibraryChanges();
   }
-  async getCompositeInstance(projectId, instanceId) {
-    const { resolveInputHash } = await this.prepareInputHashResolver(projectId, instanceId);
-    const [compositeInstance, actualInputHash] = await Promise.all([
-      this.stateBackend.getCompositeInstance(projectId, instanceId),
-      resolveInputHash(instanceId)
-    ]);
-    if (compositeInstance && compositeInstance.inputHash === actualInputHash) {
-      return compositeInstance;
+  compositeInstanceEE = new EventEmitter();
+  async *watchCompositeInstances(projectId, signal) {
+    for await (const [children] of on(this.compositeInstanceEE, projectId, {
+      signal
+    })) {
+      yield children;
     }
-    this.logger.info("re-evaluating instance since input hash has changed", {
-      projectId,
-      instanceId
-    });
-    const instancePromise = this.waitForCompositeInstance(
-      projectId,
-      instanceId,
-      actualInputHash,
-      resolveInputHash
-    );
-    await this.operationManager.launch({
-      type: "evaluate",
-      projectId,
-      instanceIds: [instanceId]
-    });
-    return await instancePromise;
   }
   async createInstance(projectId, instance) {
     const createdInstance = await this.projectBackend.createInstance(projectId, instance);
-    await this.updateInstanceChildren(projectId, createdInstance);
+    await this.updateCompositeInstance(projectId, createdInstance);
     return createdInstance;
   }
   async updateInstance(projectId, instanceId, patch) {
     const instance = await this.projectBackend.updateInstance(projectId, instanceId, patch);
-    await this.updateInstanceChildren(projectId, instance);
+    await this.updateCompositeInstance(projectId, instance);
     return instance;
   }
   async renameInstance(projectId, instanceId, newName) {
     const instance = await this.projectBackend.renameInstance(projectId, instanceId, newName);
-    await this.updateInstanceChildren(projectId, instance);
+    await this.updateCompositeInstance(projectId, instance);
     return instance;
   }
   async deleteInstance(projectId, instanceId) {
@@ -897,11 +977,8 @@ class ProjectManager {
       this.stateBackend.clearCompositeInstances(projectId, [instanceId])
     ]);
   }
-  async updateInstanceChildren(projectId, instance) {
-    const { resolveInputHash, library } = await this.prepareInputHashResolver(
-      projectId,
-      instance.id
-    );
+  async updateCompositeInstance(projectId, instance) {
+    const { resolveInputHash, library } = await this.prepareInputHashResolver(projectId);
     const component = library.components[instance.type];
     if (!component) {
       return;
@@ -909,87 +986,205 @@ class ProjectManager {
     if (isUnitModel(component)) {
       return;
     }
-    const expectedInputHash = await resolveInputHash(instance.id);
+    const { inputHash: expectedInputHash } = await resolveInputHash(instance.id);
     const inputHash = await this.stateBackend.getCompositeInstanceInputHash(projectId, instance.id);
     if (inputHash !== expectedInputHash) {
       this.logger.info("re-evaluating instance since input hash has changed", {
         projectId,
         instanceId: instance.id
       });
-      await this.operationManager.launch({
-        type: "evaluate",
-        projectId,
-        instanceIds: [instance.id]
-      });
+      await this.evaluateCompositeInstances(projectId, [instance.id]);
     }
   }
-  async waitForCompositeInstance(projectId, instanceId, expectedInputHash, resolveInputHash) {
-    for await (const instance of this.operationManager.watchCompositeInstance(
-      projectId,
-      instanceId
-    )) {
-      const actualInputHash = await resolveInputHash(instanceId);
-      if (actualInputHash !== expectedInputHash) {
-        throw new Error("Composite instance input hash changed while waiting for evaluation");
+  async evaluateCompositeInstances(projectId, instanceIds) {
+    await this.projectLockManager.getLock(projectId).lockInstances(instanceIds, async () => {
+      const [
+        { instances, resolvedInputs, stateMap, resolveInputHash },
+        topLevelCompositeChildrenIds
+      ] = await Promise.all([
+        this.prepareInputHashResolver(projectId),
+        this.stateBackend.getTopLevelCompositeChildrenIds(projectId, instanceIds)
+      ]);
+      const results = await this.libraryBackend.evaluateCompositeInstances(
+        instances,
+        resolvedInputs,
+        instanceIds
+      );
+      const newStates = results.map((result) => {
+        const existingState = stateMap.get(result.instanceId);
+        const newState = existingState ?? createInstanceState(result.instanceId);
+        newState.evaluationError = result.success ? null : result.error;
+        return newState;
+      });
+      const inputHashes = /* @__PURE__ */ new Map();
+      for (const instanceId of instanceIds) {
+        const { inputHash } = await resolveInputHash(instanceId);
+        inputHashes.set(instanceId, inputHash);
+      }
+      const compositeInstances = results.filter((result) => result.success).flatMap(
+        (result) => result.compositeInstances.map((instance) => ({
+          ...instance,
+          inputHash: inputHashes.get(instance.instance.id)
+        }))
+      );
+      const newTopLevelCompositeChildrenIds = Object.fromEntries(
+        results.filter((result) => result.success).map((result) => [
+          result.instanceId,
+          result.compositeInstances.filter((instance) => instance.instance.id !== result.instanceId).map((instance) => instance.instance.id)
+        ])
+      );
+      const deletedCompositeInstanceIds = new Set(
+        Object.values(topLevelCompositeChildrenIds).flat()
+      );
+      for (const childInstanceId of Object.values(newTopLevelCompositeChildrenIds).flat()) {
+        deletedCompositeInstanceIds.delete(childInstanceId);
       }
-      return instance;
-    }
-    throw new Error("Composite instance stream ended without receiving the expected instance");
+      await Promise.all([
+        this.stateBackend.clearCompositeInstances(
+          projectId,
+          Array.from(deletedCompositeInstanceIds)
+        ),
+        this.stateBackend.putTopLevelCompositeChildrenIds(
+          projectId,
+          newTopLevelCompositeChildrenIds
+        )
+      ]);
+      for (const state of newStates) {
+        this.stateManager.emitStatePatch(projectId, state);
+      }
+      for (const instance of compositeInstances) {
+        this.compositeInstanceEE.emit(projectId, { type: "updated", instance });
+      }
+      for (const instanceId of deletedCompositeInstanceIds) {
+        this.compositeInstanceEE.emit(projectId, { type: "deleted", instanceId });
+      }
+      const promises = [];
+      if (newStates.length > 0) {
+        promises.push(this.stateBackend.putInstanceStates(projectId, newStates));
+      }
+      if (compositeInstances.length > 0) {
+        promises.push(this.stateBackend.putCompositeInstances(projectId, compositeInstances));
+      }
+      this.logger.info(
+        { projectId },
+        "instance evaluation completed, %d instances persisted",
+        compositeInstances.length
+      );
+      await Promise.all(promises);
+    });
   }
-  async prepareInputHashResolver(projectId, instanceId) {
+  async prepareInputHashResolver(projectId) {
     const { instances, hubs } = await this.projectBackend.getProject(projectId);
-    const library = await this.library.loadLibrary();
-    const filteredInstances = instances.filter((instance2) => instance2.type in library.components);
-    const states = await this.stateBackend.getInstanceStates(projectId);
+    const library = await this.libraryBackend.loadLibrary();
+    const filteredInstances = instances.filter((instance) => instance.type in library.components);
+    const states = await this.stateBackend.getAllInstanceStates(projectId);
     const stateMap = new Map(states.map((state) => [state.id, state]));
-    const instance = filteredInstances.find((instance2) => instance2.id === instanceId);
-    if (!instance) {
-      throw new Error(`Instance not found: ${instanceId}`);
-    }
     const inputResolverNodes = /* @__PURE__ */ new Map();
-    for (const instance2 of filteredInstances) {
-      inputResolverNodes.set(`instance:${instance2.id}`, {
+    for (const instance of filteredInstances) {
+      inputResolverNodes.set(`instance:${instance.id}`, {
         kind: "instance",
-        instance: instance2,
-        component: library.components[instance2.type]
+        instance,
+        component: library.components[instance.type]
       });
     }
     for (const hub of hubs) {
       inputResolverNodes.set(`hub:${hub.id}`, { kind: "hub", hub });
     }
-    const resolveInputs = createInputResolver(
-      inputResolverNodes,
-      this.logger.child({ resolver: "input-resolver" })
-    );
-    const inputHashNodes = /* @__PURE__ */ new Map();
-    for (const instance2 of filteredInstances) {
-      const output = await resolveInputs(`instance:${instance2.id}`);
+    const resolveInputs = createInputResolver(inputResolverNodes, this.logger);
+    const inputHashInputs = /* @__PURE__ */ new Map();
+    const resolvedInputs = {};
+    for (const instance of filteredInstances) {
+      const output = await resolveInputs(`instance:${instance.id}`);
       if (output.kind !== "instance") {
         throw new Error("Expected instance node");
       }
-      inputHashNodes.set(instance2.id, {
-        instance: instance2,
+      let sourceHash;
+      if (isUnitModel(library.components[instance.type])) {
+        const resolvedUnit = await this.libraryBackend.getResolvedUnitSource(instance.type);
+        if (!resolvedUnit) {
+          throw new Error(`Resolved unit not found: ${instance.type}`);
+        }
+        sourceHash = resolvedUnit.sourceHash;
+      }
+      inputHashInputs.set(instance.id, {
+        instance,
+        component: library.components[instance.type],
         resolvedInputs: output.resolvedInputs,
-        state: stateMap.get(instance2.id),
-        sourceHash: void 0
-        // implement source hash
+        state: stateMap.get(instance.id),
+        sourceHash
       });
+      resolvedInputs[instance.id] = output.resolvedInputs;
     }
-    const resolveInputHash = createInputHashResolver(
-      inputHashNodes,
-      this.logger.child({ resolver: "input-hash-resolver" })
-    );
+    const resolveInputHash = createInputHashResolver(inputHashInputs, this.logger);
     return {
       resolveInputHash,
-      library
+      library,
+      instances,
+      stateMap,
+      resolvedInputs
     };
   }
-  static create(projectBackend, stateBackend, operationManager, library, logger) {
+  async watchLibraryChanges() {
+    for await (const updates of this.libraryBackend.watchLibrary()) {
+      try {
+        await this.handleLibraryUpdates(updates);
+      } catch (error) {
+        this.logger.error({ error }, "failed to handle library updates");
+      }
+    }
+  }
+  async handleLibraryUpdates(updates) {
+    const changedComponents = /* @__PURE__ */ new Set();
+    const library = await this.libraryBackend.loadLibrary();
+    for (const update of updates) {
+      switch (update.type) {
+        case "component-updated":
+          changedComponents.add(update.component.type);
+          break;
+        case "component-removed":
+          changedComponents.add(update.componentType);
+          break;
+      }
+    }
+    if (changedComponents.size === 0) {
+      return;
+    }
+    this.logger.info(
+      { changedComponents },
+      "library components changed, updating composite instances"
+    );
+    const projects = await this.projectBackend.getProjectIds();
+    for (const projectId of projects) {
+      const { resolveInputHash, instances } = await this.prepareInputHashResolver(projectId);
+      const filteredInstances = instances.filter(
+        (instance) => changedComponents.has(instance.type) && library.components[instance.type] && !isUnitModel(library.components[instance.type])
+      );
+      this.logger.info(
+        { projectId, filteredInstanceIds: filteredInstances.map((instance) => instance.id) },
+        "updating composite instances for project"
+      );
+      const inputHashMap = /* @__PURE__ */ new Map();
+      for (const instance of filteredInstances) {
+        const { inputHash } = await resolveInputHash(instance.id);
+        inputHashMap.set(instance.id, inputHash);
+      }
+      try {
+        await this.evaluateCompositeInstances(
+          projectId,
+          filteredInstances.map((instance) => instance.id)
+        );
+      } catch (error) {
+        this.logger.error({ error }, "failed to evaluate composite instances");
+      }
+    }
+  }
+  static create(projectBackend, stateBackend, libraryBackend, projectLockManager, stateManager, logger) {
     return new ProjectManager(
       projectBackend,
       stateBackend,
-      operationManager,
-      library,
+      libraryBackend,
+      projectLockManager,
+      stateManager,
       logger.child({ service: "ProjectManager" })
     );
   }
@@ -1002,6 +1197,8 @@ read -r data
 envKeys=($(jq -r '.env | keys[]' <<<"$data"))
 filesKeys=($(jq -r '.files | keys[]' <<<"$data"))
 commandArr=($(jq -r '.command[]' <<<"$data"))
+cols=$(jq -r '.screenSize.cols' <<<"$data")
+rows=$(jq -r '.screenSize.rows' <<<"$data")
 
 # Set environment variables
 for key in "\${envKeys[@]}"; do
@@ -1026,20 +1223,24 @@ for key in "\${filesKeys[@]}"; do
   fi
 done
 
-# Execute the command, keeping stdin/stdout open
-exec "\${commandArr[@]}"`;
+# Execute the command, keeping stdin/stdout open and spawnin a new TTY
+cmd=$(printf "%q " "\${commandArr[@]}")
+exec script -q -c "stty cols $cols rows $rows; $cmd" /dev/null
+`;
 
 const dockerTerminalBackendConfig = z.object({
   HIGHSTATE_BACKEND_TERMINAL_DOCKER_BINARY: z.string().default("docker"),
+  HIGHSTATE_BACKEND_TERMINAL_DOCKER_USE_SUDO: z.coerce.boolean().default(false),
   HIGHSTATE_BACKEND_TERMINAL_DOCKER_HOST: z.string().optional()
 });
 class DockerTerminalBackend {
-  constructor(binary, host, logger) {
+  constructor(binary, useSudo, host, logger) {
     this.binary = binary;
+    this.useSudo = useSudo;
     this.host = host;
     this.logger = logger;
   }
-  async run({ factory, stdin, stdout, signal }) {
+  async run({ factory, stdin, stdout, screenSize, signal }) {
     const hsTempDir = resolve$1(tmpdir(), "highstate");
     await mkdir(hsTempDir, { recursive: true });
     const runScriptPath = resolve$1(hsTempDir, "run.sh");
@@ -1056,11 +1257,18 @@ class DockerTerminalBackend {
     const initData = {
       command: factory.command,
       cwd: factory.cwd,
-      env: factory.env ?? {},
-      files: factory.files ?? {}
+      env: {
+        ...factory.env,
+        TERM: "xterm-256color"
+      },
+      files: factory.files ?? {},
+      screenSize
     };
     const initDataStream = Readable.from(JSON.stringify(initData) + "\n");
-    const process = spawn(this.binary, args, {
+    if (this.useSudo) {
+      args.unshift(this.binary);
+    }
+    const process = spawn(this.useSudo ? "sudo" : this.binary, args, {
       env: {
         DOCKER_HOST: this.host
       },
@@ -1071,12 +1279,13 @@ class DockerTerminalBackend {
     initDataStream.on("end", () => stdin.pipe(childProcess.stdin));
     childProcess.stdout.pipe(stdout);
     childProcess.stderr.pipe(stdout);
-    this.logger.info("process started", { pid: childProcess.pid });
+    this.logger.info({ pid: childProcess.pid }, "process started");
     await process;
   }
   static create(config, logger) {
     return new DockerTerminalBackend(
       config.HIGHSTATE_BACKEND_TERMINAL_DOCKER_BINARY,
+      config.HIGHSTATE_BACKEND_TERMINAL_DOCKER_USE_SUDO,
       config.HIGHSTATE_BACKEND_TERMINAL_DOCKER_HOST,
       logger.child({ backend: "TerminalBackend", service: "DockerTerminalBackend" })
     );
@@ -1095,39 +1304,95 @@ function createTerminalBackend(config, logger) {
   }
 }
 
-const notAttachedTerminalLifetime = 30 * 1e3;
+const urlAlphabet = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict";
+
+const POOL_SIZE_MULTIPLIER = 128;
+let pool, poolOffset;
+function fillPool(bytes) {
+  if (!pool || pool.length < bytes) {
+    pool = Buffer.allocUnsafe(bytes * POOL_SIZE_MULTIPLIER);
+    webcrypto.getRandomValues(pool);
+    poolOffset = 0;
+  } else if (poolOffset + bytes > pool.length) {
+    webcrypto.getRandomValues(pool);
+    poolOffset = 0;
+  }
+  poolOffset += bytes;
+}
+function nanoid(size = 21) {
+  fillPool(size |= 0);
+  let id = "";
+  for (let i = poolOffset - size; i < poolOffset; i++) {
+    id += urlAlphabet[pool[i] & 63];
+  }
+  return id;
+}
+
+const notAttachedTerminalLifetime = 5 * 60 * 1e3;
 class TerminalManager {
   constructor(terminalBackend, stateBackend, runnerBackend, logger) {
     this.terminalBackend = terminalBackend;
     this.stateBackend = stateBackend;
     this.runnerBackend = runnerBackend;
     this.logger = logger;
+    void this.markFinishedSessions();
   }
   managedTerminals = /* @__PURE__ */ new Map();
+  existingSessions = /* @__PURE__ */ new Map();
+  terminalEE = new EventEmitter();
+  isSessionActive(sessionId) {
+    return this.managedTerminals.has(sessionId);
+  }
+  async *watchSession(projectId, instanceId, sessionId, signal) {
+    const managedTerminal = this.managedTerminals.get(sessionId);
+    if (!managedTerminal) {
+      const session = await this.stateBackend.getTerminalSession(projectId, instanceId, sessionId);
+      if (!session) {
+        throw new Error(`Terminal session "${sessionId}" not found`);
+      }
+      yield session;
+      return;
+    }
+    yield managedTerminal.session;
+    for await (const [terminalSession] of on(this.terminalEE, sessionId, {
+      signal
+    })) {
+      yield terminalSession;
+      if (terminalSession.finishedAt) {
+        return;
+      }
+    }
+  }
   async createSession(projectId, instanceId, terminalName) {
-    const terminalSession = {
-      id: randomUUID(),
+    const [instanceType, instanceName] = parseInstanceId(instanceId);
+    const factory = await this.runnerBackend.getTerminalFactory(
+      { projectId, instanceType, instanceName },
       terminalName
+    );
+    if (!factory) {
+      throw new Error(
+        `Terminal factory for instance "${instanceId}" with name "${terminalName}" not found`
+      );
+    }
+    const terminalSession = {
+      id: nanoid(),
+      projectId,
+      instanceId,
+      terminalName,
+      terminalTitle: factory.title,
+      createdAt: /* @__PURE__ */ new Date()
     };
     await this.stateBackend.putTerminalSession(projectId, instanceId, terminalSession);
     this.logger.info({ msg: "terminal session created", id: terminalSession.id });
-    await this.createManagedTerminal(projectId, instanceId, terminalSession, true);
+    this.createManagedTerminal(factory, terminalSession);
     return terminalSession;
   }
-  async ensureSessionCreated(projectId, instanceId, terminalName) {
-    const terminalSessions = await this.stateBackend.getTerminalSessions(projectId, instanceId);
-    let session = terminalSessions.find((session2) => session2.terminalName === terminalName);
-    if (session) {
-      this.logger.info({ msg: "reusing existing terminal session", id: session.id });
-    } else {
-      this.logger.info("creating new terminal session");
-      session = await this.createSession(projectId, instanceId, terminalName);
-    }
-    if (!this.managedTerminals.has(session.id)) {
-      this.logger.info({ msg: "no managed terminal found, creating new one", id: session.id });
-      await this.createManagedTerminal(projectId, instanceId, session, false);
+  async getOrCreateSession(projectId, instanceId, terminalName) {
+    const existingSession = this.existingSessions.get(`${projectId}:${instanceId}.${terminalName}`);
+    if (existingSession) {
+      return existingSession;
     }
-    return session;
+    return await this.createSession(projectId, instanceId, terminalName);
   }
   close(sessionId) {
     this.logger.info({ msg: "closing terminal session", id: sessionId });
@@ -1136,95 +1401,117 @@ class TerminalManager {
       managedTerminal.abortController.abort();
     }
   }
-  async attach(projectId, instanceId, sessionId, stdin, stdout, signal) {
-    this.logger.info({ msg: "attaching terminal", projectId, instanceId, sessionId });
-    let terminal = this.managedTerminals.get(sessionId);
+  attach(sessionId, stdin, stdout, screenSize, signal) {
+    const terminal = this.managedTerminals.get(sessionId);
     if (!terminal) {
-      this.logger.info({ msg: "no managed terminal found, creating new one", sessionId });
-      const session = await this.stateBackend.getTerminalSession(projectId, instanceId, sessionId);
-      if (!session) {
-        throw new Error(`Terminal session "${sessionId}" not found`);
-      }
-      terminal = await this.createManagedTerminal(projectId, instanceId, session, false);
-      terminal.history = await this.stateBackend.getTerminalSessionHistory(sessionId);
-    }
-    if (terminal.attached) {
-      throw new Error(`Terminal session "${sessionId}" is already attached`);
-    }
-    terminal.attached = true;
-    for (const line of terminal.history) {
-      stdout.write(line);
+      throw new Error(`Terminal session "${sessionId}" not found, check if it's still active`);
     }
-    this.logger.info({ msg: "history replayed", count: terminal.history.length, sessionId });
-    stdin.pipe(terminal.stdin);
-    terminal.stdout.pipe(stdout);
-    this.logger.info({ msg: "terminal attached", id: sessionId });
+    const handleStdin = (data) => {
+      terminal.stdin.write(data);
+    };
+    const handleStdout = (data) => {
+      stdout.write(data);
+    };
+    terminal.stdout.on("data", handleStdout);
+    stdin.on("data", handleStdin);
+    terminal.refCount += 1;
+    this.logger.info(
+      "terminal attached (sessionId: %s, refCount: %d)",
+      sessionId,
+      terminal.refCount
+    );
     signal.addEventListener("abort", () => {
-      terminal.attached = false;
-      this.logger.info({ msg: "terminal detached", id: sessionId });
+      terminal.refCount -= 1;
+      terminal.stdout.off("data", handleStdout);
+      stdin.off("data", handleStdin);
+      this.logger.info(
+        "terminal detached (sessionId: %s, refCount: %d)",
+        sessionId,
+        terminal.refCount
+      );
     });
+    if (!terminal.started) {
+      terminal.start(screenSize);
+      terminal.started = true;
+    }
   }
-  async createManagedTerminal(projectId, instanceId, terminalSession, firstLaunch) {
-    const [instanceType, instanceName] = parseInstanceId(instanceId);
-    const factory = await this.runnerBackend.getTerminalFactory(
-      { projectId, instanceType, instanceName },
-      terminalSession.terminalName
+  async updateActiveTerminalSessions() {
+    await this.stateBackend.putActiveTerminalSessions(
+      Array.from(this.managedTerminals.values()).map((t) => t.session)
     );
-    if (!factory) {
-      throw new Error(
-        `Terminal factory for instance "${instanceId}" with name "${terminalSession.terminalName}" not found`
-      );
-    }
+  }
+  createManagedTerminal(factory, terminalSession) {
     const managedTerminal = {
-      sessionId: terminalSession.id,
+      session: terminalSession,
       abortController: new AbortController(),
-      attached: false,
       stdin: new PassThrough(),
       stdout: new PassThrough(),
-      history: []
+      refCount: 0,
+      started: false,
+      start: (screenSize) => {
+        void this.terminalBackend.run({
+          factory,
+          stdin: managedTerminal.stdin,
+          stdout: managedTerminal.stdout,
+          screenSize,
+          signal: managedTerminal.abortController.signal
+        }).catch((error) => {
+          if (isAbortErrorLike(error)) {
+            return;
+          }
+          this.logger.error({
+            msg: "managed terminal failed",
+            id: managedTerminal.session.id,
+            error
+          });
+        }).finally(() => {
+          this.logger.info({ msg: "managed terminal closed", id: managedTerminal.session.id });
+          this.managedTerminals.delete(managedTerminal.session.id);
+          this.existingSessions.delete(
+            `${managedTerminal.session.projectId}:${managedTerminal.session.instanceId}.${managedTerminal.session.terminalName}`
+          );
+          managedTerminal.session.finishedAt = /* @__PURE__ */ new Date();
+          this.terminalEE.emit(managedTerminal.session.id, managedTerminal.session);
+          void this.stateBackend.putTerminalSession(
+            managedTerminal.session.projectId,
+            managedTerminal.session.instanceId,
+            managedTerminal.session
+          );
+          void this.updateActiveTerminalSessions();
+        });
+        setTimeout(
+          () => this.closeTerminalIfNotAttached(managedTerminal),
+          notAttachedTerminalLifetime
+        );
+        this.logger.info({ msg: "managed terminal created", id: managedTerminal.session.id });
+      }
     };
     managedTerminal.stdout.on("data", (data) => {
-      const line = String(data);
-      managedTerminal.history.push(String(data));
-      void this.persistHistory.call([terminalSession.id, line]);
-    });
-    this.managedTerminals.set(managedTerminal.sessionId, managedTerminal);
-    void this.terminalBackend.run({
-      factory: {
-        ...factory,
-        env: {
-          ...factory.env,
-          HIGHSTATE_TERMINAL_FIRST_LAUNCH: firstLaunch ? "1" : "0"
-        }
-      },
-      stdin: managedTerminal.stdin,
-      stdout: managedTerminal.stdout,
-      signal: managedTerminal.abortController.signal
-    }).catch((error) => {
-      this.logger.error({
-        msg: "managed terminal failed",
-        id: managedTerminal.sessionId,
-        error
-      });
-    }).finally(() => {
-      this.logger.info({ msg: "managed terminal closed", id: managedTerminal.sessionId });
-      this.managedTerminals.delete(managedTerminal.sessionId);
+      const entry = String(data);
+      void this.persistHistory.call([terminalSession.id, entry]);
     });
-    setTimeout(() => this.closeTerminalIfNotAttached(managedTerminal), notAttachedTerminalLifetime);
-    this.logger.info({ msg: "managed terminal created", id: managedTerminal.sessionId });
+    this.managedTerminals.set(managedTerminal.session.id, managedTerminal);
+    this.existingSessions.set(
+      `${managedTerminal.session.projectId}:${managedTerminal.session.instanceId}.${managedTerminal.session.terminalName}`,
+      managedTerminal.session
+    );
+    void this.updateActiveTerminalSessions();
     return managedTerminal;
   }
   closeTerminalIfNotAttached(terminal) {
-    if (!this.managedTerminals.has(terminal.sessionId)) {
+    if (!this.managedTerminals.has(terminal.session.id)) {
       return;
     }
-    if (!terminal.attached) {
+    if (terminal.refCount <= 0) {
       this.logger.info({
         msg: "terminal not attached for too long, closing",
-        id: terminal.sessionId
+        id: terminal.session.id
       });
       terminal.abortController.abort();
-      this.managedTerminals.delete(terminal.sessionId);
+      this.managedTerminals.delete(terminal.session.id);
+      this.existingSessions.delete(
+        `${terminal.session.projectId}:${terminal.session.instanceId}.${terminal.session.terminalName}`
+      );
       return;
     }
     setTimeout(() => this.closeTerminalIfNotAttached(terminal), notAttachedTerminalLifetime);
@@ -1238,9 +1525,19 @@ class TerminalManager {
     );
   }
   persistHistory = createAsyncBatcher(async (entries) => {
-    this.logger.trace({ msg: "persisting history lines", count: entries.length });
+    this.logger.trace({ msg: "persisting history entries", count: entries.length });
     await this.stateBackend.appendTerminalSessionHistory(entries);
   });
+  async markFinishedSessions() {
+    const sessions = await this.stateBackend.getActiveTerminalSessions();
+    for (const session of sessions) {
+      await this.stateBackend.putTerminalSession(session.projectId, session.instanceId, {
+        ...session,
+        finishedAt: /* @__PURE__ */ new Date()
+      });
+    }
+    await this.updateActiveTerminalSessions();
+  }
 }
 
 class InvalidInstanceStatusError extends Error {
@@ -1253,20 +1550,17 @@ class InvalidInstanceStatusError extends Error {
 }
 
 const localRunnerBackendConfig = z.object({
-  HIGHSTATE_BACKEND_RUNNER_LOCAL_SKIP_SOURCE_CHECK: z.boolean({ coerce: true }).default(false),
   HIGHSTATE_BACKEND_RUNNER_LOCAL_SKIP_STATE_CHECK: z.boolean({ coerce: true }).default(false),
   HIGHSTATE_BACKEND_RUNNER_LOCAL_PRINT_OUTPUT: z.boolean({ coerce: true }).default(true),
-  HIGHSTATE_BACKEND_RUNNER_LOCAL_SOURCE_BASE_PATH: z.string().optional(),
   HIGHSTATE_BACKEND_RUNNER_LOCAL_CACHE_DIR: z.string().optional()
 });
 class LocalRunnerBackend {
-  constructor(skipSourceCheck, skipStateCheck, printOutput, sourceBasePath, cacheDir, pulumiProjectHost) {
-    this.skipSourceCheck = skipSourceCheck;
+  constructor(skipStateCheck, printOutput, cacheDir, pulumiProjectHost, libraryBackend) {
     this.skipStateCheck = skipStateCheck;
     this.printOutput = printOutput;
-    this.sourceBasePath = sourceBasePath;
     this.cacheDir = cacheDir;
     this.pulumiProjectHost = pulumiProjectHost;
+    this.libraryBackend = libraryBackend;
   }
   events = new EventEmitter();
   async *watch(options) {
@@ -1369,7 +1663,7 @@ class LocalRunnerBackend {
           return null;
         }
         const files = z.array(instanceFileSchema).parse(outputs["$files"].value);
-        const file = files.find((f) => f.name === fileName);
+        const file = files.find((f) => f.meta.name === fileName);
         if (!file) {
           return null;
         }
@@ -1412,16 +1706,16 @@ class LocalRunnerBackend {
   async updateWorker(options, configMap, preview) {
     const instanceId = LocalRunnerBackend.getInstanceId(options);
     try {
-      const [projectPath, allowedDependencies] = await this.resolveProjectPath(
-        options.instanceName,
-        options.source
-      );
+      const resolvedSource = await this.libraryBackend.getResolvedUnitSource(options.instanceType);
+      if (!resolvedSource) {
+        throw new Error(`Resolved unit source not found for ${options.instanceType}`);
+      }
       await this.pulumiProjectHost.runLocal(
         {
           projectId: options.projectId,
           pulumiProjectName: options.instanceType,
           pulumiStackName: LocalRunnerBackend.getStackName(options),
-          projectPath,
+          projectPath: resolvedSource.projectPath,
           stackConfig: configMap,
           envVars: {
             HIGHSTATE_CACHE_DIR: this.cacheDir
@@ -1482,7 +1776,7 @@ class LocalRunnerBackend {
               if (isUnlocked) return true;
               const isResolved = await this.tryInstallMissingDependencies(
                 error,
-                allowedDependencies
+                resolvedSource.allowedDependencies
               );
               if (isResolved) return true;
               return false;
@@ -1519,13 +1813,16 @@ class LocalRunnerBackend {
   async destroyWorker(options) {
     const instanceId = LocalRunnerBackend.getInstanceId(options);
     try {
-      const [projectPath] = await this.resolveProjectPath(options.instanceName, options.source);
+      const resolvedSource = await this.libraryBackend.getResolvedUnitSource(options.instanceType);
+      if (!resolvedSource) {
+        throw new Error(`Resolved unit source not found for ${options.instanceType}`);
+      }
       await this.pulumiProjectHost.runLocal(
         {
           projectId: options.projectId,
           pulumiProjectName: options.instanceType,
           pulumiStackName: LocalRunnerBackend.getStackName(options),
-          projectPath,
+          projectPath: resolvedSource.projectPath,
           envVars: {
             HIGHSTATE_CACHE_DIR: this.cacheDir,
             PULUMI_K8S_DELETE_UNREACHABLE: options.deleteUnreachable ? "true" : ""
@@ -1577,13 +1874,18 @@ class LocalRunnerBackend {
         }
       );
     } catch (error) {
-      const { StackNotFoundError } = await import('@pulumi/pulumi/automation');
+      const { StackNotFoundError } = await import('@pulumi/pulumi/automation/index.js');
       if (error instanceof StackNotFoundError) {
         this.updateState({
           id: instanceId,
           status: "not_created",
           totalResourceCount: 0,
-          currentResourceCount: 0
+          currentResourceCount: 0,
+          statusFields: [],
+          pages: [],
+          files: [],
+          terminals: [],
+          triggers: []
         });
         return;
       }
@@ -1691,7 +1993,7 @@ class LocalRunnerBackend {
     }
     if (outputs["$files"]) {
       const files = z.array(instanceFileSchema).parse(outputs["$files"].value);
-      patch.files = files.map((file) => omit(file, ["content"]));
+      patch.files = files.map((file) => file.meta);
     } else {
       patch.files = [];
     }
@@ -1736,35 +2038,9 @@ class LocalRunnerBackend {
   static getInstanceId(options) {
     return getInstanceId(options.instanceType, options.instanceName);
   }
-  async resolveProjectPath(instanceType, source) {
-    if (source.type === "local") {
-      const path = source.path ?? instanceType.replace(/\./g, "/");
-      const projectPath = resolve$1(this.sourceBasePath, path);
-      return [projectPath, []];
-    }
-    if (!this.skipSourceCheck) {
-      const packageName = source.version ? `${source.package}@${source.version}` : source.package;
-      await ensureDependencyInstalled(packageName);
-    }
-    const workerPathUrl = resolve(
-      `@highstate/backend/source-resolution-worker`,
-      import.meta.url
-    );
-    const workerPath = fileURLToPath(workerPathUrl);
-    const worker = new Worker(workerPath, {
-      workerData: { source, skipSourceCheck: this.skipSourceCheck }
-    });
-    for await (const [event] of on(worker, "message")) {
-      const eventData = event;
-      if (eventData.type === "result") {
-        return [eventData.projectPath, eventData.allowedDependencies];
-      }
-    }
-    throw new Error("Worker ended without sending the result");
-  }
-  async tryInstallMissingDependencies(error, allowedDependencies) {
-    if (!(error instanceof Error)) {
-      return false;
+  async tryInstallMissingDependencies(error, allowedDependencies) {
+    if (!(error instanceof Error)) {
+      return false;
     }
     const pattern = /Cannot find module '(.*)'/;
     const match = error.message.match(pattern);
@@ -1783,12 +2059,7 @@ class LocalRunnerBackend {
   static getStackName(options) {
     return `${options.projectId}_${options.instanceName}`;
   }
-  static async create(config, pulumiProjectHost) {
-    let sourceBasePath = config.HIGHSTATE_BACKEND_RUNNER_LOCAL_SOURCE_BASE_PATH;
-    if (!sourceBasePath) {
-      const [projectPath] = await resolveMainLocalProject();
-      sourceBasePath = resolve$1(projectPath, "units");
-    }
+  static create(config, pulumiProjectHost, libraryBackend) {
     let cacheDir = config.HIGHSTATE_BACKEND_RUNNER_LOCAL_CACHE_DIR;
     if (!cacheDir) {
       const homeDir = process.env.HOME ?? process.env.USERPROFILE;
@@ -1800,12 +2071,11 @@ class LocalRunnerBackend {
       cacheDir = resolve$1(homeDir, ".cache", "highstate");
     }
     return new LocalRunnerBackend(
-      config.HIGHSTATE_BACKEND_RUNNER_LOCAL_SKIP_SOURCE_CHECK,
       config.HIGHSTATE_BACKEND_RUNNER_LOCAL_SKIP_STATE_CHECK,
       config.HIGHSTATE_BACKEND_RUNNER_LOCAL_PRINT_OUTPUT,
-      sourceBasePath,
       cacheDir,
-      pulumiProjectHost
+      pulumiProjectHost,
+      libraryBackend
     );
   }
 }
@@ -1814,18 +2084,14 @@ const runnerBackendConfig = z.object({
   HIGHSTATE_BACKEND_RUNNER_TYPE: z.enum(["local"]).default("local"),
   ...localRunnerBackendConfig.shape
 });
-function createRunnerBackend(config, pulumiProjectHost) {
+function createRunnerBackend(config, pulumiProjectHost, libraryBackend) {
   switch (config.HIGHSTATE_BACKEND_RUNNER_TYPE) {
     case "local": {
-      return LocalRunnerBackend.create(config, pulumiProjectHost);
+      return LocalRunnerBackend.create(config, pulumiProjectHost, libraryBackend);
     }
   }
 }
 
-const evaluatedCompositeInstanceSchema = compositeInstanceSchema.extend({
-  inputHash: z.string()
-});
-
 const localStateBackendConfig = z.object({
   HIGHSTATE_BACKEND_STATE_LOCAL_DIR: z.string().optional()
 });
@@ -1837,27 +2103,31 @@ class LocalStateBackend {
   }
   async getActiveOperations() {
     const sublevel = this.getActiveOperationsSublevel();
-    return this.getSublevelItems(sublevel, projectOperationSchema);
+    return this.getAllSublevelItems(sublevel, projectOperationSchema);
   }
   async getOperations(projectId, beforeOperationId) {
     const sublevel = this.getProjectOperationsSublevel(projectId);
     const pageSize = 10;
-    return await this.getSublevelItems(sublevel, projectOperationSchema, pageSize, {
+    return await this.getAllSublevelItems(sublevel, projectOperationSchema, pageSize, {
       lt: beforeOperationId,
       reverse: true
     });
   }
-  async getInstanceStates(projectId) {
+  async getAllInstanceStates(projectId) {
     const sublevel = this.getProjectInstanceStatesSublevel(projectId);
-    return await this.getSublevelItems(sublevel, instanceStateSchema);
+    return await this.getAllSublevelItems(sublevel, instanceStateSchema);
   }
   async getInstanceState(projectId, instanceID) {
     const sublevel = this.getProjectInstanceStatesSublevel(projectId);
     return await this.getSublevelItem(sublevel, instanceStateSchema, instanceID);
   }
+  async getInstanceStates(projectId, instanceIds) {
+    const sublevel = this.getProjectInstanceStatesSublevel(projectId);
+    return await this.getSublevelItems(sublevel, instanceStateSchema, instanceIds);
+  }
   async getAffectedInstanceStates(operationId) {
     const sublevel = this.getOperationInstanceStatesSublevel(operationId);
-    return await this.getSublevelItems(sublevel, instanceStateSchema);
+    return await this.getAllSublevelItems(sublevel, instanceStateSchema);
   }
   async getInstanceLogs(operationId, instanceId) {
     const sublevel = this.getOperationInstanceLogsSublevel(operationId, instanceId);
@@ -1889,13 +2159,14 @@ class LocalStateBackend {
       // this separation is also necessary because the instance states can be updated without operations
       states.flatMap((state) => [
         {
+          // always put the state to the operation sublevel for history
           type: "put",
           key: state.id,
           value: state,
           sublevel: operationInstanceStatesSublevel
         },
         {
-          type: "put",
+          type: state.status === "not_created" ? "del" : "put",
           key: state.id,
           value: state,
           sublevel: projectInstanceStatesSublevel
@@ -1910,7 +2181,7 @@ class LocalStateBackend {
       // as i told before, we update the instance states without operations
       // this method is used when upstream instance state changes are detected
       states.map((state) => ({
-        type: "put",
+        type: state.status === "not_created" ? "del" : "put",
         key: state.id,
         value: state
       }))
@@ -1934,9 +2205,19 @@ class LocalStateBackend {
       }))
     );
   }
+  async getCompositeInstances(projectId, signal) {
+    const sublevel = this.getProjectCompositeInstancesSublevel(projectId);
+    return await this.getAllSublevelItems(
+      //
+      sublevel,
+      compositeInstanceSchema,
+      void 0,
+      { signal }
+    );
+  }
   async getCompositeInstance(projectId, instanceId) {
     const sublevel = this.getProjectCompositeInstancesSublevel(projectId);
-    return this.getSublevelItem(sublevel, evaluatedCompositeInstanceSchema, instanceId);
+    return this.getSublevelItem(sublevel, compositeInstanceSchema, instanceId);
   }
   async getCompositeInstanceInputHash(projectId, instanceId) {
     const sublevel = this.getProjectCompositeInstanceInputHashesSublevel(projectId);
@@ -1944,22 +2225,16 @@ class LocalStateBackend {
     return inputHash ?? null;
   }
   async putCompositeInstances(projectId, instances) {
-    this.validateArray(evaluatedCompositeInstanceSchema, instances);
+    this.validateArray(compositeInstanceSchema, instances);
     const sublevel = this.getProjectCompositeInstancesSublevel(projectId);
-    const inputHashesSublevel = this.getProjectCompositeInstanceInputHashesSublevel(projectId);
+    this.getProjectCompositeInstanceInputHashesSublevel(projectId);
     await this.db.batch(
       instances.flatMap((instance) => [
         {
           type: "put",
           key: instance.instance.id,
-          value: evaluatedCompositeInstanceSchema.parse(instance),
+          value: compositeInstanceSchema.parse(instance),
           sublevel
-        },
-        {
-          type: "put",
-          key: instance.instance.id,
-          value: instance.inputHash,
-          sublevel: inputHashesSublevel
         }
       ])
     );
@@ -1974,11 +2249,46 @@ class LocalStateBackend {
       ])
     );
   }
+  async getTopLevelCompositeChildrenIds(projectId, instanceIds) {
+    const sublevel = this.getProjectCompositeChildrenIdsSublevel(projectId);
+    const items = await sublevel.getMany(instanceIds);
+    const schema = z.array(z.string()).optional();
+    const result = {};
+    for (let i = 0; i < items.length; i++) {
+      const instanceId = instanceIds[i];
+      const childrenIds = schema.parse(items[i]);
+      result[instanceId] = childrenIds ?? [];
+    }
+    return result;
+  }
+  async putTopLevelCompositeChildrenIds(projectId, childrenIds) {
+    const sublevel = this.getProjectCompositeChildrenIdsSublevel(projectId);
+    const schema = z.array(z.string()).optional();
+    await sublevel.batch(
+      Object.entries(childrenIds).map(([instanceId, ids]) => ({
+        type: "put",
+        key: instanceId,
+        value: schema.parse(ids)
+      }))
+    );
+  }
+  async getActiveTerminalSessions() {
+    const data = await this.db.get("activeTerminalSessionIds", { valueEncoding: "json" });
+    return data ? z.array(terminalSessionSchema).parse(data) : [];
+  }
+  putActiveTerminalSessions(sessions) {
+    this.validateArray(terminalSessionSchema, sessions);
+    return this.db.put("activeTerminalSessionIds", sessions, { valueEncoding: "json" });
+  }
+  async getTerminalSession(projectId, instanceId, sessionId) {
+    const sublevel = this.getTerminalSessionsSublevel(projectId, instanceId);
+    return await this.getSublevelItem(sublevel, terminalSessionSchema, sessionId);
+  }
   async getTerminalSessions(projectId, instanceId) {
     const sublevel = this.getTerminalSessionsSublevel(projectId, instanceId);
-    return await this.getSublevelItems(sublevel, terminalSessionSchema);
+    return await this.getAllSublevelItems(sublevel, terminalSessionSchema);
   }
-  async getTerminalSession(projectId, instanceId, sessionId) {
+  async getLastTerminalSession(projectId, instanceId, sessionId) {
     const sublevel = this.getTerminalSessionsSublevel(projectId, instanceId);
     return await this.getSublevelItem(sublevel, terminalSessionSchema, sessionId);
   }
@@ -2009,7 +2319,7 @@ class LocalStateBackend {
       }))
     );
   }
-  async getSublevelItems(sublevel, schema, limit, options) {
+  async getAllSublevelItems(sublevel, schema, limit, options) {
     const result = [];
     const iterator = options ? sublevel.iterator(options) : sublevel.iterator();
     const invalidKeys = [];
@@ -2058,6 +2368,37 @@ class LocalStateBackend {
     }
     return parseResult.data;
   }
+  async getSublevelItems(sublevel, schema, keys) {
+    const result = [];
+    const invalidKeys = [];
+    for (const key of keys) {
+      const value = await sublevel.get(key);
+      if (!value) {
+        continue;
+      }
+      const parseResult = schema.safeParse(value);
+      if (!parseResult.success) {
+        this.logger.warn({
+          msg: "failed to parse item, it will be deleted",
+          error: parseResult.error,
+          sublevel: sublevel.prefix,
+          key
+        });
+        invalidKeys.push(key);
+        continue;
+      }
+      result.push(parseResult.data);
+    }
+    if (invalidKeys.length > 0) {
+      this.logger.info({
+        msg: "deleting invalid items",
+        sublevel: sublevel.prefix,
+        keyCount: invalidKeys.length
+      });
+      await sublevel.batch(invalidKeys.map((key) => ({ type: "del", key })));
+    }
+    return result;
+  }
   validateItem(schema, item) {
     const parseResult = schema.safeParse(item);
     if (!parseResult.success) {
@@ -2088,6 +2429,9 @@ class LocalStateBackend {
   getProjectCompositeInstanceInputHashesSublevel(projectId) {
     return this.getStringSublevel(`projects/${projectId}/compositeInstanceInputHashes`);
   }
+  getProjectCompositeChildrenIdsSublevel(projectId) {
+    return this.getJsonSublevel(`projects/${projectId}/topLevelCompositeChildrenIds`);
+  }
   getProjectInstanceStatesSublevel(projectId) {
     return this.getJsonSublevel(`projects/${projectId}/instanceStates`);
   }
@@ -2150,6 +2494,30 @@ function createStateBackend(config, localPulumiHost, logger) {
   }
 }
 
+class StateManager {
+  stateEE = new EventEmitter$1();
+  /**
+   * Watches for all instance state changes in the project.
+   *
+   * @param projectId The project ID to watch.
+   * @param signal The signal to abort the operation.
+   */
+  async *watchInstanceStates(projectId, signal) {
+    for await (const [state] of on(this.stateEE, projectId, { signal })) {
+      yield state;
+    }
+  }
+  /**
+   * Emits a state patch for the instance in the project.
+   *
+   * @param projectId The project ID to emit the state patch for.
+   * @param patch The state patch to emit.
+   */
+  emitStatePatch(projectId, patch) {
+    this.stateEE.emit(projectId, patch);
+  }
+}
+
 const localWorkspaceBackendConfig = z.object({
   HIGHSTATE_BACKEND_WORKSPACE_LOCAL_DIR: z.string().optional()
 });
@@ -2216,8 +2584,352 @@ async function loadConfig(env = process.env, useDotenv = true) {
   return configSchema.parse(env);
 }
 
+class OperationWorkset {
+  constructor(operation, library, stateManager, logger) {
+    this.operation = operation;
+    this.library = library;
+    this.stateManager = stateManager;
+    this.logger = logger;
+  }
+  affectedInstanceIdSet = /* @__PURE__ */ new Set();
+  instanceMap = /* @__PURE__ */ new Map();
+  instanceChildrenMap = /* @__PURE__ */ new Map();
+  initialStateMap = /* @__PURE__ */ new Map();
+  stateMap = /* @__PURE__ */ new Map();
+  dependentStateMap = /* @__PURE__ */ new Map();
+  stateChildIdMap = /* @__PURE__ */ new Map();
+  unitSourceHashMap = /* @__PURE__ */ new Map();
+  inputResolver;
+  inputResolverInputs = /* @__PURE__ */ new Map();
+  inputResolverPromiseCache = /* @__PURE__ */ new Map();
+  inputHashResolver;
+  inputHashResolverInputs = /* @__PURE__ */ new Map();
+  inputHashResolverPromiseCache = /* @__PURE__ */ new Map();
+  resolvedInstanceInputs = /* @__PURE__ */ new Map();
+  getInstance(instanceId) {
+    const instance = this.instanceMap.get(instanceId);
+    if (!instance) {
+      throw new Error(`Instance with ID ${instanceId} not found in the operation workset`);
+    }
+    return instance;
+  }
+  isAffected(instanceId) {
+    return this.affectedInstanceIdSet.has(instanceId);
+  }
+  updateState(update) {
+    const finalState = applyPartialInstanceState(this.stateMap, update);
+    this.stateManager.emitStatePatch(this.operation.projectId, createInstanceStatePatch(update));
+    if (finalState.parentId) {
+      this.recalculateCompositeState(finalState.parentId);
+    }
+    return finalState;
+  }
+  setState(state) {
+    this.stateMap.set(state.id, state);
+    this.initialStateMap.set(state.id, state);
+    if (state.parentId) {
+      let children = this.stateChildIdMap.get(state.parentId);
+      if (!children) {
+        children = [];
+        this.stateChildIdMap.set(state.parentId, children);
+      }
+      children.push(state.id);
+    }
+  }
+  restoreInitialStatus(instanceId) {
+    const state = this.stateMap.get(instanceId);
+    const initialState = this.initialStateMap.get(instanceId);
+    if (!state || !initialState) {
+      this.logger.warn(
+        `cannot reset status for instance "${instanceId}" because it is not in the state map`
+      );
+      return;
+    }
+    this.stateMap.set(instanceId, { ...initialState, status: initialState.status });
+  }
+  emitAffectedInitialStates() {
+    for (const state of this.initialStateMap.values()) {
+      if (this.affectedInstanceIdSet.has(state.id)) {
+        this.stateManager.emitStatePatch(this.operation.projectId, state);
+      }
+    }
+  }
+  getAffectedCompositeChildren(instanceId) {
+    const children = this.instanceChildrenMap.get(instanceId);
+    if (!children) {
+      return [];
+    }
+    return children.filter((child) => this.affectedInstanceIdSet.has(child.id));
+  }
+  getState(instanceId) {
+    return this.stateMap.get(instanceId);
+  }
+  getDependentStates(instanceId) {
+    return this.dependentStateMap.get(instanceId) ?? [];
+  }
+  recalculateCompositeState(instanceId) {
+    const state = this.stateMap.get(instanceId) ?? createInstanceState(instanceId);
+    let currentResourceCount = 0;
+    let totalResourceCount = 0;
+    const children = this.stateChildIdMap.get(instanceId) ?? [];
+    for (const childId of children) {
+      const child = this.stateMap.get(childId);
+      if (child?.currentResourceCount) {
+        currentResourceCount += child.currentResourceCount;
+      }
+      if (child?.totalResourceCount) {
+        totalResourceCount += child.totalResourceCount;
+      }
+    }
+    const updatedState = {
+      ...state,
+      currentResourceCount,
+      totalResourceCount
+    };
+    this.stateMap.set(instanceId, updatedState);
+    this.stateManager.emitStatePatch(this.operation.projectId, updatedState);
+    if (state.parentId) {
+      this.recalculateCompositeState(state.parentId);
+    }
+  }
+  addInstance(instance) {
+    if (this.instanceMap.has(instance.id)) {
+      throw new Error(`Found multiple instances with the same ID: ${instance.id}`);
+    }
+    if (!(instance.type in this.library.components)) {
+      this.logger.warn(
+        `ignoring instance "${instance.id}" because its type "${instance.type}" is not in the library`
+      );
+      return;
+    }
+    this.instanceMap.set(instance.id, instance);
+    if (instance.parentId) {
+      let children = this.instanceChildrenMap.get(instance.parentId);
+      if (!children) {
+        children = [];
+        this.instanceChildrenMap.set(instance.parentId, children);
+      }
+      children.push(instance);
+    }
+  }
+  async extendForUpdate() {
+    const traverse = async (instanceId) => {
+      if (this.affectedInstanceIdSet.has(instanceId)) {
+        return;
+      }
+      const instance = this.instanceMap.get(instanceId);
+      if (!instance) {
+        return;
+      }
+      const instanceInputs = this.resolvedInstanceInputs.get(instance.id) ?? {};
+      for (const inputs of Object.values(instanceInputs)) {
+        for (const input of inputs) {
+          await traverse(input.input.instanceId);
+        }
+      }
+      const state = this.stateMap.get(instance.id);
+      const { inputHash: expectedInputHash } = await this.inputHashResolver(instance.id);
+      if (this.operation.options.forceUpdateDependencies) {
+        this.affectedInstanceIdSet.add(instanceId);
+        return;
+      }
+      if (state?.status !== "created" || state.inputHash !== expectedInputHash) {
+        this.affectedInstanceIdSet.add(instanceId);
+      }
+    };
+    for (const instanceId of this.operation.instanceIds) {
+      if (this.operation.type === "update") {
+        await traverse(instanceId);
+      }
+      this.affectedInstanceIdSet.add(instanceId);
+    }
+    const compositeInstanceQueue = Array.from(this.affectedInstanceIdSet);
+    while (compositeInstanceQueue.length > 0) {
+      const childId = compositeInstanceQueue.pop();
+      const children = this.instanceChildrenMap.get(childId) ?? [];
+      for (const child of children) {
+        compositeInstanceQueue.push(child.id);
+        this.affectedInstanceIdSet.add(child.id);
+      }
+    }
+    for (const instanceId of this.affectedInstanceIdSet) {
+      let instance = this.instanceMap.get(instanceId);
+      while (instance?.parentId) {
+        this.affectedInstanceIdSet.add(instance.parentId);
+        instance = this.instanceMap.get(instance.parentId);
+      }
+    }
+    this.operation.affectedInstanceIds = Array.from(this.affectedInstanceIdSet);
+  }
+  extendForDestroy() {
+    const traverse = (instanceKey) => {
+      if (this.affectedInstanceIdSet.has(instanceKey)) {
+        return;
+      }
+      const state = this.stateMap.get(instanceKey);
+      if (!state || state.status === "not_created") {
+        return;
+      }
+      const dependents = this.dependentStateMap.get(instanceKey) ?? [];
+      for (const dependent of dependents) {
+        traverse(dependent.id);
+        this.affectedInstanceIdSet.add(instanceKey);
+      }
+    };
+    for (const instanceId of this.operation.instanceIds) {
+      const instance = this.instanceMap.get(instanceId);
+      if (!instance) {
+        throw new Error(`Instance not found: ${instanceId}`);
+      }
+      if (this.operation.options.destroyDependentInstances) {
+        traverse(instance.id);
+      }
+      this.affectedInstanceIdSet.add(instanceId);
+    }
+    const compositeInstanceQueue = Array.from(this.affectedInstanceIdSet);
+    while (compositeInstanceQueue.length > 0) {
+      const childId = compositeInstanceQueue.pop();
+      const children = this.stateChildIdMap.get(childId) ?? [];
+      for (const child of children) {
+        compositeInstanceQueue.push(child);
+        this.affectedInstanceIdSet.add(child);
+      }
+    }
+    for (const instanceId of this.affectedInstanceIdSet) {
+      let state = this.stateMap.get(instanceId);
+      while (state?.parentId) {
+        this.affectedInstanceIdSet.add(state.parentId);
+        state = this.stateMap.get(state.parentId);
+      }
+    }
+    this.operation.affectedInstanceIds = Array.from(this.affectedInstanceIdSet);
+  }
+  getSourceHashIfApplicable(instance, component) {
+    if (isUnitModel(component)) {
+      return this.unitSourceHashMap.get(instance.type);
+    }
+    return void 0;
+  }
+  async getUpToDateInputHash(instance) {
+    const component = this.library.components[instance.type];
+    this.inputHashResolverInputs.set(instance.id, {
+      instance,
+      component,
+      resolvedInputs: this.resolvedInstanceInputs.get(instance.id),
+      state: this.stateMap.get(instance.id),
+      sourceHash: this.getSourceHashIfApplicable(instance, component)
+    });
+    this.inputHashResolverPromiseCache.delete(instance.id);
+    const { inputHash } = await this.inputHashResolver(instance.id);
+    return inputHash;
+  }
+  getLockInstanceIds() {
+    const instanceIds = new Set(this.operation.affectedInstanceIds);
+    for (const instanceId of this.operation.affectedInstanceIds) {
+      const instance = this.getInstance(instanceId);
+      if (instance.parentId) {
+        instanceIds.add(instance.parentId);
+      }
+    }
+    return Array.from(instanceIds);
+  }
+  static async load(operation, projectBackend, libraryBackend, stateBackend, stateManager, logger, signal) {
+    const [library, unitSources, project, compositeInstances, states] = await Promise.all([
+      libraryBackend.loadLibrary(signal),
+      libraryBackend.getResolvedUnitSources(),
+      projectBackend.getProject(operation.projectId, signal),
+      stateBackend.getCompositeInstances(operation.projectId, signal),
+      stateBackend.getAllInstanceStates(operation.projectId, signal)
+    ]);
+    const workset = new OperationWorkset(
+      operation,
+      library,
+      stateManager,
+      logger.child({ operationId: operation.id, service: "OperationWorkset" })
+    );
+    for (const unitSource of unitSources) {
+      workset.unitSourceHashMap.set(unitSource.unitType, unitSource.sourceHash);
+    }
+    for (const instance of project.instances) {
+      workset.addInstance(instance);
+    }
+    for (const instance of compositeInstances) {
+      const worksetInstance = workset.instanceMap.get(instance.instance.id);
+      if (worksetInstance) {
+        worksetInstance.outputs = instance.instance.outputs;
+        worksetInstance.resolvedOutputs = instance.instance.resolvedOutputs;
+      } else {
+        workset.addInstance(instance.instance);
+      }
+      for (const child of instance.children) {
+        workset.addInstance(child);
+      }
+    }
+    for (const state of states) {
+      if (!workset.instanceMap.has(state.id)) {
+        workset.logger.warn(
+          `ignoring instance "${state.id}" from state because it is not in the project or is not a part of a composite instance`
+        );
+        continue;
+      }
+      workset.setState(state);
+    }
+    for (const instance of workset.instanceMap.values()) {
+      workset.inputResolverInputs.set(`instance:${instance.id}`, {
+        kind: "instance",
+        instance,
+        component: library.components[instance.type]
+      });
+    }
+    for (const hub of project.hubs) {
+      workset.inputResolverInputs.set(`hub:${hub.id}`, { kind: "hub", hub });
+    }
+    workset.inputResolver = createInputResolver(
+      //
+      workset.inputResolverInputs,
+      logger,
+      { promiseCache: workset.inputResolverPromiseCache }
+    );
+    for (const instance of workset.instanceMap.values()) {
+      const output = await workset.inputResolver(`instance:${instance.id}`);
+      if (output.kind !== "instance") {
+        throw new Error("Unexpected output kind");
+      }
+      workset.resolvedInstanceInputs.set(instance.id, output.resolvedInputs);
+      const component = workset.library.components[instance.type];
+      workset.inputHashResolverInputs.set(instance.id, {
+        instance,
+        component,
+        resolvedInputs: output.resolvedInputs,
+        state: workset.stateMap.get(instance.id),
+        sourceHash: workset.getSourceHashIfApplicable(instance, component)
+      });
+    }
+    workset.inputHashResolver = createInputHashResolver(
+      //
+      workset.inputHashResolverInputs,
+      logger,
+      { promiseCache: workset.inputHashResolverPromiseCache }
+    );
+    switch (operation.type) {
+      case "update":
+      case "preview":
+      case "refresh":
+        await workset.extendForUpdate();
+        break;
+      case "recreate":
+        workset.extendForDestroy();
+        break;
+      case "destroy":
+        workset.extendForDestroy();
+        break;
+    }
+    return workset;
+  }
+}
+
 class RuntimeOperation {
-  constructor(operation, runnerBackend, stateBackend, libraryBackend, projectBackend, secretBackend, projectLock, operationEE, stateEE, compositeInstanceEE, instanceLogsEE, logger) {
+  constructor(operation, runnerBackend, stateBackend, libraryBackend, projectBackend, secretBackend, projectLock, stateManager, operationEE, instanceLogsEE, logger) {
     this.operation = operation;
     this.runnerBackend = runnerBackend;
     this.stateBackend = stateBackend;
@@ -2225,33 +2937,20 @@ class RuntimeOperation {
     this.projectBackend = projectBackend;
     this.secretBackend = secretBackend;
     this.projectLock = projectLock;
+    this.stateManager = stateManager;
     this.operationEE = operationEE;
-    this.stateEE = stateEE;
-    this.compositeInstanceEE = compositeInstanceEE;
     this.instanceLogsEE = instanceLogsEE;
     this.logger = logger;
   }
   abortController = new AbortController();
-  instanceMap = /* @__PURE__ */ new Map();
-  hubMap = /* @__PURE__ */ new Map();
-  resolvedInstanceInputs = /* @__PURE__ */ new Map();
-  compositeInstanceLock = new BetterLock();
-  compositeInstanceMap = /* @__PURE__ */ new Map();
-  initialStatusMap = /* @__PURE__ */ new Map();
-  stateMap = /* @__PURE__ */ new Map();
   instancePromiseMap = /* @__PURE__ */ new Map();
-  childrenStateMap = /* @__PURE__ */ new Map();
-  dependentStateMap = /* @__PURE__ */ new Map();
-  library;
-  inputHashLock = new BetterLock();
-  inputHashPromiseCache = /* @__PURE__ */ new Map();
-  inputHashNodes = /* @__PURE__ */ new Map();
-  resolveInputHash;
+  workset;
+  currentPhase;
   async operateSafe() {
     try {
       await this.operate();
     } catch (error) {
-      if (RuntimeOperation.isAbortError(error)) {
+      if (isAbortError(error)) {
         this.logger.info("the operation was cancelled");
         this.operation.status = "cancelled";
         await this.updateOperation();
@@ -2262,121 +2961,64 @@ class RuntimeOperation {
       this.operation.error = errorToString(error);
       await this.updateOperation();
     } finally {
-      this.resetPendingStateStatuses();
       await Promise.all([
         this.persistStates.flush(),
         this.persistLogs.flush(),
         this.persistSecrets.flush()
       ]);
       this.logger.debug("operation finished, all entries persisted");
-      if (this.operation.type === "preview") {
-        const states = await this.stateBackend.getInstanceStates(this.operation.projectId);
-        for (const state of states) {
-          if (this.operation.instanceIds.includes(state.id)) {
-            this.stateEE.emit(this.operation.projectId, createInstanceStateFrontendPatch(state));
-          }
-        }
-      }
-    }
-  }
-  resetPendingStateStatuses() {
-    for (const state of this.stateMap.values()) {
-      if (state.status !== "pending") {
-        continue;
-      }
-      let initialStatus = this.initialStatusMap.get(state.id);
-      let error = state.error;
-      if (initialStatus === "destroying" || initialStatus === "pending" || initialStatus === "refreshing" || initialStatus === "updating") {
-        initialStatus = "error";
-        error ??= "unexpected progressing instance status";
-      }
-      if (initialStatus) {
-        this.updateInstanceState({ id: state.id, status: initialStatus, error });
-      }
     }
   }
   async operate() {
     this.logger.info("starting operation");
-    const { instances: projectInstances, hubs } = await this.projectBackend.getProject(
-      this.operation.projectId
-    );
-    this.abortController.signal.throwIfAborted();
-    const states = await this.stateBackend.getInstanceStates(this.operation.projectId);
-    this.abortController.signal.throwIfAborted();
-    this.library = await this.libraryBackend.loadLibrary();
-    this.logger.info("library ready");
-    this.abortController.signal.throwIfAborted();
-    const allInstances = projectInstances.filter((instance) => {
-      return instance.type in this.library.components;
-    });
-    const inputResolverNodes = /* @__PURE__ */ new Map();
-    for (const hub of hubs) {
-      this.hubMap.set(hub.id, hub);
-      inputResolverNodes.set(`hub:${hub.id}`, { kind: "hub", hub });
-    }
-    for (const instance of allInstances) {
-      this.instanceMap.set(instance.id, instance);
-      inputResolverNodes.set(`instance:${instance.id}`, {
-        kind: "instance",
-        instance,
-        component: this.library.components[instance.type]
-      });
-    }
-    const resolveInputs = createInputResolver(
-      inputResolverNodes,
-      this.logger.child({ resolver: "input-resolver" })
-    );
-    for (const instance of allInstances) {
-      const output = await resolveInputs(`instance:${instance.id}`);
-      if (output.kind !== "instance") {
-        throw new Error("Unexpected output kind, expected instance");
+    let lockInstanceIds;
+    while (true) {
+      this.workset = await OperationWorkset.load(
+        this.operation,
+        this.projectBackend,
+        this.libraryBackend,
+        this.stateBackend,
+        this.stateManager,
+        this.logger,
+        this.abortController.signal
+      );
+      lockInstanceIds = this.workset.getLockInstanceIds();
+      if (this.projectLock.canImmediatelyAcquireLocks(lockInstanceIds)) {
+        break;
       }
-      this.resolvedInstanceInputs.set(instance.id, output.resolvedInputs);
-    }
-    for (const state of states) {
-      this.stateMap.set(state.id, state);
-      this.initialStatusMap.set(state.id, state.status);
-      this.tryAddStateToParent(state);
-      this.addDependentState(state);
+      this.logger.info("waiting for locks to be available");
+      await this.projectLock.lockInstances(lockInstanceIds, () => Promise.resolve());
     }
-    for (const instance of allInstances) {
-      this.inputHashNodes.set(instance.id, {
-        instance,
-        resolvedInputs: this.resolvedInstanceInputs.get(instance.id),
-        state: this.stateMap.get(instance.id),
-        sourceHash: void 0
-        // TODO: implement source hash
-      });
+    try {
+      await this.projectLock.lockInstances(lockInstanceIds, () => this.processOperation());
+    } finally {
+      if (this.operation.type === "preview") {
+        this.workset.emitAffectedInitialStates();
+      }
     }
-    this.resolveInputHash = createInputHashResolver(
-      this.inputHashNodes,
-      this.logger.child({ resolver: "input-hash-resolver" }),
-      { promiseCache: this.inputHashPromiseCache }
+  }
+  async processOperation() {
+    this.operation.affectedInstanceIds = this.workset.operation.affectedInstanceIds;
+    this.logger.info(
+      { affectedInstanceIds: this.operation.affectedInstanceIds },
+      "operation started"
     );
-    if (this.operation.type === "update") {
-      await this.extendWithDependencies();
-      await this.updateOperation();
-    } else if (this.operation.type === "destroy" && this.operation.options.destroyDependentInstances !== false) {
-      this.extendWithCreatedDependents();
-      await this.updateOperation();
-    }
-    this.logger.info("all instances loaded", {
-      count: allInstances.length,
-      affectedCount: this.operation.instanceIds.length
-    });
-    if (this.operation.type === "evaluate") {
-      this.logger.info("evaluating instances");
-      await this.evaluateCompositeInstances();
-    } else {
+    const phases = this.getOperationPhases();
+    for (const phase of phases) {
+      this.currentPhase = phase;
       const promises = [];
-      for (const instanceId of this.operation.instanceIds) {
+      for (const instanceId of this.operation.affectedInstanceIds) {
+        const instance = this.workset.getInstance(instanceId);
+        if (instance.parentId && this.workset.isAffected(instance.parentId)) {
+          continue;
+        }
         promises.push(this.getInstancePromiseForOperation(instanceId));
       }
-      this.logger.info("all units operations started");
+      this.logger.info(`all operations for phase "%s" started`, phase);
       this.operation.status = "running";
       await this.updateOperation();
       await Promise.all(promises);
-      this.logger.info("all units completed");
+      this.logger.info(`all operations for phase "%s" completed`, phase);
     }
     this.operation.status = "completed";
     this.operation.error = null;
@@ -2388,30 +3030,33 @@ class RuntimeOperation {
     this.abortController.abort();
   }
   getInstancePromiseForOperation(instanceId) {
-    const instance = this.instanceMap.get(instanceId);
-    if (!instance) {
-      throw new Error(`Instance not found: ${instanceId}`);
-    }
-    const component = this.library.components[instance.type];
-    if (!component) {
-      throw new Error(`Component not found: ${instance.type}`);
-    }
+    const instance = this.workset.getInstance(instanceId);
+    const component = this.workset.library.components[instance.type];
     if (isUnitModel(component)) {
-      return this.getUnitPromise(instance, component);
+      return this.getUnitPromise(instance);
     }
     return this.getCompositePromise(instance);
   }
-  async getUnitPromise(instance, component) {
+  getOperationPhases() {
     switch (this.operation.type) {
       case "update":
-      case "preview": {
-        return this.updateUnit(instance, component);
-      }
-      case "recreate": {
-        return this.recreateUnit(instance, component);
+      case "preview":
+        return ["update"];
+      case "recreate":
+        return ["destroy", "update"];
+      case "destroy":
+        return ["destroy"];
+      case "refresh":
+        return ["refresh"];
+    }
+  }
+  async getUnitPromise(instance) {
+    switch (this.currentPhase) {
+      case "update": {
+        return this.updateUnit(instance);
       }
       case "destroy": {
-        return this.destroyUnit(instance.id, component);
+        return this.destroyUnit(instance.id);
       }
       case "refresh": {
         return this.refreshUnit(instance.id);
@@ -2421,39 +3066,38 @@ class RuntimeOperation {
   async getCompositePromise(instance) {
     const logger = this.logger.child({ instanceId: instance.id });
     return this.getInstancePromise(instance.id, async () => {
-      const initialStatus = this.stateMap.get(instance.id)?.status ?? "not_created";
+      const state = this.workset.getState(instance.id) ?? createInstanceState(instance.id);
       this.updateInstanceState({
-        id: instance.id,
+        ...state,
+        parentId: instance.parentId,
         latestOperationId: this.operation.id,
         status: this.getStatusByOperationType(),
-        currentResourceCount: 0,
-        totalResourceCount: 0
+        error: null
       });
-      const { children } = await this.loadCompositeInstance(instance.id);
+      const children = this.workset.getAffectedCompositeChildren(instance.id);
       const childPromises = [];
-      if (!children.length) {
-        logger.warn("no children found for composite component");
+      if (children.length) {
+        logger.info("running %s children", children.length);
+      } else {
+        logger.warn("no affected children found for composite component");
       }
       for (const child of children) {
-        logger.info("waiting for child", { childId: child.id });
+        logger.debug(`waiting for child: "%s"`, child.id);
         childPromises.push(this.getInstancePromiseForOperation(child.id));
       }
       try {
         await Promise.all(childPromises);
-        this.abortController.signal.throwIfAborted();
         if (children.length > 0) {
-          logger.info("all children completed", { count: children.length });
+          logger.info("all children completed");
         }
         this.updateInstanceState({
           id: instance.id,
-          status: "created"
+          status: this.operation.type === "destroy" ? "not_created" : "created",
+          inputHash: await this.workset.getUpToDateInputHash(instance)
         });
       } catch (error) {
-        if (RuntimeOperation.isAbortError(error)) {
-          this.updateInstanceState({
-            id: instance.id,
-            status: initialStatus
-          });
+        if (isAbortErrorLike(error)) {
+          this.workset.restoreInitialStatus(instance.id);
           return;
         }
         this.updateInstanceState({
@@ -2464,31 +3108,24 @@ class RuntimeOperation {
       }
     });
   }
-  updateUnit(instance, component) {
-    const logger = this.logger.child({ instanceId: instance.id });
-    return this.getInstancePromise(instance.id, async () => {
+  updateUnit(instance) {
+    return this.getInstancePromise(instance.id, async (logger) => {
       this.updateInstanceState({
         id: instance.id,
+        parentId: instance.parentId,
         latestOperationId: this.operation.id,
         status: "pending",
-        currentResourceCount: 0,
-        totalResourceCount: 0
+        error: null,
+        currentResourceCount: 0
       });
-      const dependencies = this.getInstanceDependencies(instance);
-      const dependencyPromises = [];
-      for (const dependency of dependencies) {
-        if (!this.operation.instanceIds.includes(dependency.id)) {
-          continue;
-        }
-        logger.info("waiting for dependency", { dependencyId: dependency.id });
-        dependencyPromises.push(this.getInstancePromiseForOperation(dependency.id));
-      }
-      await Promise.all(dependencyPromises);
-      this.abortController.signal.throwIfAborted();
-      if (dependencies.length > 0) {
-        logger.info("all dependencies completed", { count: dependencies.length });
+      let dependencyIds = [];
+      try {
+        dependencyIds = await this.updateUnitDependencies(instance, logger);
+      } catch (error) {
+        this.workset.restoreInitialStatus(instance.id);
+        throw error;
       }
-      logger.info("updating unit...");
+      logger.info("updating unit");
       const secrets = await this.secretBackend.get(this.operation.projectId, instance.id);
       this.abortController.signal.throwIfAborted();
       logger.debug("secrets loaded", { count: Object.keys(secrets).length });
@@ -2496,10 +3133,9 @@ class RuntimeOperation {
         projectId: this.operation.projectId,
         instanceType: instance.type,
         instanceName: instance.name,
-        config: await this.prepareUnitConfig(instance),
+        config: this.prepareUnitConfig(instance),
         refresh: this.operation.options.refresh,
         secrets: mapValues(secrets, (value) => valueToString(value)),
-        source: this.resolveUnitSource(component),
         signal: this.abortController.signal
       });
       logger.debug("unit update requested");
@@ -2510,55 +3146,61 @@ class RuntimeOperation {
         finalStatuses: ["created", "error"]
       });
       await this.watchStateStream(stream);
-      const inputHash = await this.getUpToDateInputHash(instance);
+      const inputHash = await this.workset.getUpToDateInputHash(instance);
       this.updateInstanceState({
         id: instance.id,
         inputHash,
-        dependencyIds: dependencies.map((dependency) => dependency.id)
+        dependencyIds
       });
       logger.debug("input hash after update", { inputHash });
       logger.info("unit updated");
     });
   }
-  async getUpToDateInputHash(instance) {
-    return await this.inputHashLock.acquire(async () => {
-      this.inputHashNodes.set(instance.id, {
-        instance,
-        resolvedInputs: this.resolvedInstanceInputs.get(instance.id),
-        state: this.stateMap.get(instance.id),
-        sourceHash: void 0
-        // TODO: implement source hash
-      });
-      this.inputHashPromiseCache.clear();
-      return await this.resolveInputHash(instance.id);
-    });
+  async updateUnitDependencies(instance, logger) {
+    try {
+      const dependencies = this.getInstanceDependencies(instance);
+      const dependencyPromises = [];
+      for (const dependency of dependencies) {
+        if (!this.operation.affectedInstanceIds.includes(dependency.id)) {
+          continue;
+        }
+        logger.debug(`waiting for dependency: ${dependency.id}`);
+        dependencyPromises.push(this.getInstancePromiseForOperation(dependency.id));
+      }
+      await Promise.all(dependencyPromises);
+      if (dependencies.length > 0) {
+        logger.info("all dependencies completed");
+      }
+      return dependencies.map((dependency) => dependency.id);
+    } catch (error) {
+      this.workset.restoreInitialStatus(instance.id);
+      throw error;
+    }
   }
-  async processBeforeDestroyTriggers(state, component, logger) {
+  async processBeforeDestroyTriggers(state, logger) {
     if (!this.operation.options.invokeDestroyTriggers) {
       logger.debug("destroy triggers are disabled for the operation");
       return;
     }
-    const instance = this.instanceMap.get(state.id);
-    if (!instance) {
-      throw new Error(`Instance not found: ${state.id}`);
-    }
+    const instance = this.workset.getInstance(state.id);
     const triggers = state.triggers.filter((trigger) => trigger.spec.type === "before-destroy");
     if (triggers.length === 0) {
       return;
     }
     const invokedTriggers = triggers.map((trigger) => ({ name: trigger.name }));
     logger.info("updating unit to process before-destroy triggers...");
-    const secrets = await this.secretBackend.get(this.operation.projectId, instance.id);
-    this.abortController.signal.throwIfAborted();
-    logger.debug({ count: Object.keys(secrets).length }, "secrets loaded");
+    const secrets = await this.secretBackend.get(
+      this.operation.projectId,
+      instance.id,
+      this.abortController.signal
+    );
     await this.runnerBackend.update({
       projectId: this.operation.projectId,
       instanceType: instance.type,
       instanceName: instance.name,
-      config: await this.prepareUnitConfig(instance, invokedTriggers),
+      config: this.prepareUnitConfig(instance, invokedTriggers),
       refresh: this.operation.options.refresh,
       secrets: mapValues(secrets, (value) => valueToString(value)),
-      source: this.resolveUnitSource(component),
       signal: this.abortController.signal
     });
     logger.debug("unit update requested");
@@ -2571,29 +3213,27 @@ class RuntimeOperation {
     await this.watchStateStream(stream);
     logger.debug("before-destroy triggers processed");
   }
-  async destroyUnit(instanceId, component) {
-    const logger = this.logger.child({ instanceId });
-    return this.getInstancePromise(instanceId, async () => {
+  async destroyUnit(instanceId) {
+    return this.getInstancePromise(instanceId, async (logger) => {
       this.updateInstanceState({
         id: instanceId,
         latestOperationId: this.operation.id,
         status: "pending",
-        currentResourceCount: 0,
-        totalResourceCount: 0
+        error: null
       });
-      const state = this.stateMap.get(instanceId);
+      const state = this.workset.getState(instanceId);
       if (!state) {
         logger.warn("state not found for unit, but destroy was requested");
         return;
       }
       const dependentPromises = [];
-      const dependents = this.dependentStateMap.get(instanceId) ?? [];
+      const dependents = this.workset.getDependentStates(state.id);
       for (const dependent of dependents) {
         dependentPromises.push(this.getInstancePromiseForOperation(dependent.id));
       }
       await Promise.all(dependentPromises);
       this.abortController.signal.throwIfAborted();
-      await this.processBeforeDestroyTriggers(state, component, logger);
+      await this.processBeforeDestroyTriggers(state, logger);
       logger.info("destroying unit...");
       const [type, name] = parseInstanceId(instanceId);
       await this.runnerBackend.destroy({
@@ -2602,7 +3242,6 @@ class RuntimeOperation {
         instanceName: name,
         refresh: this.operation.options.refresh,
         signal: this.abortController.signal,
-        source: this.resolveUnitSource(component),
         deleteUnreachable: this.operation.options.deleteUnreachableResources
       });
       this.logger.debug("destroy request sent");
@@ -2616,74 +3255,6 @@ class RuntimeOperation {
       this.logger.info("unit destroyed");
     });
   }
-  async recreateUnit(instance, component) {
-    const logger = this.logger.child({ instanceId: instance.id });
-    return this.getInstancePromise(instance.id, async () => {
-      this.updateInstanceState({
-        id: instance.id,
-        latestOperationId: this.operation.id,
-        status: "pending",
-        currentResourceCount: 0,
-        totalResourceCount: 0
-      });
-      const state = this.stateMap.get(instance.id);
-      if (!state) {
-        logger.warn("state not found for unit, but recreate was requested");
-        return;
-      }
-      await this.processBeforeDestroyTriggers(state, component, logger);
-      logger.info("destroying unit...");
-      await this.runnerBackend.destroy({
-        projectId: this.operation.projectId,
-        instanceType: instance.type,
-        instanceName: instance.name,
-        refresh: this.operation.options.refresh,
-        signal: this.abortController.signal,
-        source: this.resolveUnitSource(component),
-        deleteUnreachable: this.operation.options.deleteUnreachableResources
-      });
-      logger.debug("destroy request sent");
-      const destroyStream = this.runnerBackend.watch({
-        projectId: this.operation.projectId,
-        instanceType: instance.type,
-        instanceName: instance.name,
-        finalStatuses: ["not_created", "error"]
-      });
-      await this.watchStateStream(destroyStream);
-      this.abortController.signal.throwIfAborted();
-      logger.info("unit destroyed");
-      logger.info("updating unit...");
-      const secrets = await this.secretBackend.get(this.operation.projectId, instance.id);
-      this.abortController.signal.throwIfAborted();
-      logger.debug("secrets loaded", { count: Object.keys(secrets).length });
-      await this.runnerBackend.update({
-        projectId: this.operation.projectId,
-        instanceType: instance.type,
-        instanceName: instance.name,
-        config: await this.prepareUnitConfig(instance),
-        refresh: this.operation.options.refresh,
-        secrets: mapValues(secrets, (value) => valueToString(value)),
-        source: this.resolveUnitSource(component),
-        signal: this.abortController.signal
-      });
-      logger.debug("unit update requested");
-      const updateStream = this.runnerBackend.watch({
-        projectId: this.operation.projectId,
-        instanceType: instance.type,
-        instanceName: instance.name,
-        finalStatuses: ["created", "error"]
-      });
-      const inputHash = await this.getUpToDateInputHash(instance);
-      const dependencies = this.getInstanceDependencies(instance);
-      this.updateInstanceState({
-        id: instance.id,
-        inputHash,
-        dependencyIds: dependencies.map((dependency) => dependency.id)
-      });
-      await this.watchStateStream(updateStream);
-      logger.info("unit recreated");
-    });
-  }
   async refreshUnit(instanceId) {
     const logger = this.logger.child({ instanceId });
     return this.getInstancePromise(instanceId, async () => {
@@ -2725,84 +3296,23 @@ class RuntimeOperation {
       throw new Error("The stream ended without emitting any state.");
     }
     if (statePatch.status === "error") {
-      throw new Error(`The operation on unit "${statePatch.id}" failed: ${statePatch.error}`);
+      throw tryWrapAbortErrorLike(
+        new Error(`The operation on unit "${statePatch.id}" failed: ${statePatch.error}`)
+      );
     }
   }
-  async prepareUnitConfig(instance, invokedTriggers = []) {
+  prepareUnitConfig(instance, invokedTriggers = []) {
     const config = {};
     for (const [key, value] of Object.entries(instance.args ?? {})) {
       config[key] = valueToString(value);
     }
-    const instanceInputs = this.resolvedInstanceInputs.get(instance.id) ?? {};
+    const instanceInputs = this.workset.resolvedInstanceInputs.get(instance.id) ?? {};
     for (const [key, value] of Object.entries(instanceInputs)) {
-      const resolvedInput = await this.resolveInstanceInput(value.map((input) => input.input));
-      config[`input.${key}`] = JSON.stringify(resolvedInput);
+      config[`input.${key}`] = JSON.stringify(value.map((input) => input.input));
     }
     config["$invokedTriggers"] = JSON.stringify(invokedTriggers);
     return config;
   }
-  async resolveInstanceInput(input) {
-    const promises = input.map((input2) => this.resolveSingleInstanceInput(input2));
-    const results = await Promise.all(promises);
-    return results.flat();
-  }
-  async resolveSingleInstanceInput(input) {
-    const loadedInstance = this.instanceMap.get(input.instanceId);
-    if (loadedInstance && !loadedInstance.parentId) {
-      return [input];
-    }
-    const parentInstance = await this.loadCompositeInstance(input.instanceId);
-    const parentOutput = parentInstance.instance.outputs?.[input.output];
-    if (!parentOutput) {
-      throw new Error(`Output "${input.output}" not found in "${input.instanceId}"`);
-    }
-    return await this.resolveInstanceInput(parentOutput);
-  }
-  async loadCompositeInstance(instanceId) {
-    return await this.compositeInstanceLock.acquire(instanceId, async () => {
-      const existingInstance = this.compositeInstanceMap.get(instanceId);
-      if (existingInstance) {
-        return existingInstance;
-      }
-      const compositeInstance = await this.stateBackend.getCompositeInstance(
-        this.operation.projectId,
-        instanceId
-      );
-      if (!compositeInstance) {
-        throw new Error(`Composite instance not found: ${instanceId}`);
-      }
-      this.abortController.signal.throwIfAborted();
-      for (const child of compositeInstance.children) {
-        this.instanceMap.set(child.id, child);
-      }
-      this.compositeInstanceMap.set(instanceId, compositeInstance);
-      return compositeInstance;
-    });
-  }
-  async evaluateCompositeInstances() {
-    await this.projectLock.lockInstances(this.operation.instanceIds, async () => {
-      const compositeInstances = await this.libraryBackend.evaluateCompositeInstances(
-        Array.from(this.instanceMap.values()),
-        this.operation.instanceIds
-      );
-      this.abortController.signal.throwIfAborted();
-      for (const instance of compositeInstances) {
-        this.compositeInstanceEE.emit(
-          `${this.operation.projectId}/${instance.instance.id}`,
-          instance
-        );
-      }
-      await this.stateBackend.putCompositeInstances(
-        this.operation.projectId,
-        await Promise.all(
-          compositeInstances.map(async (instance) => ({
-            ...instance,
-            inputHash: await this.resolveInputHash(instance.instance.id)
-          }))
-        )
-      );
-    });
-  }
   async updateOperation() {
     this.operationEE.emit(this.operation.projectId, this.operation);
     await this.stateBackend.putOperation(this.operation);
@@ -2812,139 +3322,32 @@ class RuntimeOperation {
       throw new Error("The ID of the instance state is required.");
     }
     if (patch.logLine) {
-      this.persistLogs.call([patch.id, patch.logLine]);
-      this.instanceLogsEE.emit(`${this.operation.id}/${patch.id}`, patch.logLine);
+      let instance = this.workset.getInstance(patch.id);
+      for (; ; ) {
+        this.persistLogs.call([instance.id, patch.logLine]);
+        this.instanceLogsEE.emit(`${this.operation.id}/${instance.id}`, patch.logLine);
+        if (!instance.parentId) {
+          break;
+        }
+        instance = this.workset.getInstance(instance.parentId);
+      }
       return;
     }
-    const state = applyPartialInstanceState(this.stateMap, patch);
+    const state = this.workset.updateState(patch);
     if (this.operation.type !== "preview") {
       this.persistStates.call(state);
       if (patch.secrets) {
         this.persistSecrets.call([patch.id, patch.secrets]);
       }
     }
-    this.stateEE.emit(this.operation.projectId, createInstanceStateFrontendPatch(patch));
-  }
-  tryAddStateToParent(state) {
-    if (!state.parentId) {
-      return;
-    }
-    const children = this.childrenStateMap.get(state.parentId) ?? [];
-    children.push(state);
-    this.childrenStateMap.set(state.parentId, children);
-  }
-  removeStateFromParent(state) {
-    if (!state.parentId) {
-      return;
-    }
-    const children = this.childrenStateMap.get(state.parentId) ?? [];
-    const index = children.findIndex((child) => child.id === state.id);
-    if (index !== -1) {
-      children.splice(index, 1);
-      this.childrenStateMap.set(state.parentId, children);
-    }
-  }
-  addDependentState(state) {
-    const instance = this.instanceMap.get(state.id);
-    if (!instance) {
-      return;
-    }
-    for (const dependency of state.dependencyIds) {
-      const dependents = this.dependentStateMap.get(dependency) ?? [];
-      dependents.push(state);
-      this.dependentStateMap.set(dependency, dependents);
-    }
-  }
-  removeDependentState(state) {
-    const instance = this.instanceMap.get(state.id);
-    if (!instance) {
-      return;
-    }
-    const instanceInputs = this.resolvedInstanceInputs.get(state.id) ?? {};
-    for (const inputs of Object.values(instanceInputs)) {
-      for (const input of inputs) {
-        const dependents = this.dependentStateMap.get(input.input.instanceId) ?? [];
-        const index = dependents.findIndex((dependent) => dependent.id === state.id);
-        if (index !== -1) {
-          dependents.splice(index, 1);
-          this.dependentStateMap.set(input.input.instanceId, dependents);
-        }
-      }
-    }
-  }
-  async extendWithDependencies() {
-    const instanceIdsSet = /* @__PURE__ */ new Set();
-    const traverse = async (instanceId) => {
-      if (instanceIdsSet.has(instanceId)) {
-        return;
-      }
-      const instance = this.instanceMap.get(instanceId);
-      if (!instance) {
-        return;
-      }
-      const instanceInputs = this.resolvedInstanceInputs.get(instance.id) ?? {};
-      for (const inputs of Object.values(instanceInputs)) {
-        for (const input of inputs) {
-          await traverse(input.input.instanceId);
-        }
-      }
-      const state = this.stateMap.get(instance.id);
-      const expectedInputHash = await this.resolveInputHash(instance.id);
-      if (this.operation.options.forceUpdateDependencies) {
-        instanceIdsSet.add(instanceId);
-        return;
-      }
-      if (state?.status !== "created" || state.inputHash !== expectedInputHash) {
-        instanceIdsSet.add(instanceId);
-      }
-    };
-    for (const instanceId of this.operation.instanceIds) {
-      await traverse(instanceId);
-      instanceIdsSet.add(instanceId);
-    }
-    this.operation.instanceIds = Array.from(instanceIdsSet);
-  }
-  extendWithCreatedDependents() {
-    const instanceIdsSet = /* @__PURE__ */ new Set();
-    const traverse = (instanceKey) => {
-      if (instanceIdsSet.has(instanceKey)) {
-        return;
-      }
-      const state = this.stateMap.get(instanceKey);
-      if (!state || state.status === "not_created") {
-        return;
-      }
-      const dependents = this.dependentStateMap.get(instanceKey) ?? [];
-      for (const dependent of dependents) {
-        traverse(dependent.id);
-        instanceIdsSet.add(instanceKey);
-      }
-    };
-    for (const instanceId of this.operation.instanceIds) {
-      const instance = this.instanceMap.get(instanceId);
-      if (!instance) {
-        throw new Error(`Instance not found: ${instanceId}`);
-      }
-      traverse(instance.id);
-      instanceIdsSet.add(instanceId);
-    }
-    this.operation.instanceIds = Array.from(instanceIdsSet);
   }
   getInstancePromise(instanceId, fn) {
     let instancePromise = this.instancePromiseMap.get(instanceId);
     if (instancePromise) {
       return instancePromise;
     }
-    instancePromise = (async () => {
-      const wasImmediatelyAcquired = this.projectLock.canImmediatelyAcquireLock(instanceId);
-      await this.projectLock.lockInstance(instanceId, async () => {
-        if (!wasImmediatelyAcquired) {
-          await this.refetchState(instanceId);
-        }
-        return await fn();
-      });
-    })();
-    instancePromise = instancePromise.finally(() => this.instancePromiseMap.delete(instanceId));
+    const logger = this.logger.child({ instanceId }, { msgPrefix: `[${instanceId}] ` });
+    instancePromise = fn(logger).finally(() => this.instancePromiseMap.delete(instanceId));
     this.instancePromiseMap.set(instanceId, instancePromise);
     return instancePromise;
   }
@@ -2960,51 +3363,19 @@ class RuntimeOperation {
         return "destroying";
       case "refresh":
         return "refreshing";
-      default:
-        throw new Error(`Unexpected operation type: ${this.operation.type}`);
     }
   }
   getInstanceDependencies(instance) {
     const dependencies = [];
-    const instanceInputs = this.resolvedInstanceInputs.get(instance.id) ?? {};
+    const instanceInputs = this.workset.resolvedInstanceInputs.get(instance.id) ?? {};
     for (const inputs of Object.values(instanceInputs)) {
       for (const input of inputs) {
-        const dependency = this.instanceMap.get(input.input.instanceId);
-        if (dependency) {
-          dependencies.push(dependency);
-        }
+        const dependency = this.workset.getInstance(input.input.instanceId);
+        dependencies.push(dependency);
       }
     }
     return dependencies;
   }
-  resolveUnitSource(component) {
-    if (!component.source || component.source.type === "local") {
-      return {
-        type: "local",
-        // auto-generate path for local units
-        path: component.source?.path ?? component.type.split(".").join("/")
-      };
-    }
-    return component.source;
-  }
-  async refetchState(instanceId) {
-    this.logger.info({ instanceId }, "refetching state since the lock was not immediately acquired");
-    const state = await this.stateBackend.getInstanceState(this.operation.projectId, instanceId);
-    const oldState = this.stateMap.get(instanceId);
-    if (oldState) {
-      this.removeStateFromParent(oldState);
-      this.removeDependentState(oldState);
-    }
-    if (state) {
-      this.stateMap.set(instanceId, state);
-      this.initialStatusMap.set(instanceId, state.status);
-      this.tryAddStateToParent(state);
-      this.addDependentState(state);
-    } else {
-      this.stateMap.delete(instanceId);
-      this.initialStatusMap.delete(instanceId);
-    }
-  }
   persistStates = createAsyncBatcher(async (states) => {
     this.logger.debug({ msg: "persisting states", count: states.length });
     await this.stateBackend.putAffectedInstanceStates(
@@ -3027,47 +3398,22 @@ class RuntimeOperation {
       }
     }
   );
-  static abortMessagePatterns = [
-    "Operation aborted",
-    "Command was killed with SIGINT"
-  ];
-  static isAbortError(err) {
-    if (isAbortError(err)) {
-      return true;
-    }
-    if (err instanceof Error) {
-      return RuntimeOperation.abortMessagePatterns.some((pattern) => err.message.includes(pattern));
-    }
-    return false;
-  }
 }
 
 class OperationManager {
-  constructor(runnerBackend, stateBackend, libraryBackend, projectBackend, secretBackend, projectLockManager, logger) {
+  constructor(runnerBackend, stateBackend, libraryBackend, projectBackend, secretBackend, projectLockManager, stateManager, logger) {
     this.runnerBackend = runnerBackend;
     this.stateBackend = stateBackend;
     this.libraryBackend = libraryBackend;
     this.projectBackend = projectBackend;
     this.secretBackend = secretBackend;
     this.projectLockManager = projectLockManager;
+    this.stateManager = stateManager;
     this.logger = logger;
   }
   operationEE = new EventEmitter();
-  stateEE = new EventEmitter();
-  compositeInstanceEE = new EventEmitter();
   instanceLogsEE = new EventEmitter();
   runtimeOperations = /* @__PURE__ */ new Map();
-  /**
-   * Watches for all instance state changes in the project.
-   *
-   * @param projectId The project ID to watch.
-   * @param signal The signal to abort the operation.
-   */
-  async *watchInstanceStates(projectId, signal) {
-    for await (const [state] of on(this.stateEE, projectId, { signal })) {
-      yield state;
-    }
-  }
   /**
    * Watches for all project operations in the project.
    *
@@ -3079,19 +3425,6 @@ class OperationManager {
       yield operation;
     }
   }
-  /**
-   * Watches for changes in the composite instance.
-   *
-   * @param projectId The project ID to watch.
-   * @param instanceId The instance ID to watch.
-   * @param signal The signal to abort the operation.
-   */
-  async *watchCompositeInstance(projectId, instanceId, signal) {
-    const eventKey = `${projectId}/${instanceId}`;
-    for await (const [instance] of on(this.compositeInstanceEE, eventKey, { signal })) {
-      yield instance;
-    }
-  }
   /**
    * Watches for logs of the instance in the operation.
    *
@@ -3116,6 +3449,7 @@ class OperationManager {
       projectId: request.projectId,
       type: request.type,
       instanceIds: request.instanceIds,
+      affectedInstanceIds: request.instanceIds,
       status: "pending",
       options: {
         forceUpdateDependencies: request.options?.forceUpdateDependencies ?? false,
@@ -3152,16 +3486,15 @@ class OperationManager {
       this.projectBackend,
       this.secretBackend,
       this.projectLockManager.getLock(operation.projectId),
+      this.stateManager,
       this.operationEE,
-      this.stateEE,
-      this.compositeInstanceEE,
       this.instanceLogsEE,
       this.logger.child({ service: "RuntimeOperation", operationId: operation.id })
     );
     this.runtimeOperations.set(operation.id, runtimeOperation);
     void runtimeOperation.operateSafe().finally(() => this.runtimeOperations.delete(operation.id));
   }
-  static async create(runnerBackend, stateBackend, libraryBackend, projectBackend, secretBackend, projectLockManager, logger) {
+  static async create(runnerBackend, stateBackend, libraryBackend, projectBackend, secretBackend, projectLockManager, stateManager, logger) {
     const operator = new OperationManager(
       runnerBackend,
       stateBackend,
@@ -3169,6 +3502,7 @@ class OperationManager {
       projectBackend,
       secretBackend,
       projectLockManager,
+      stateManager,
       logger.child({ service: "OperationManager" })
     );
     const activeOperations = await stateBackend.getActiveOperations();
@@ -3191,6 +3525,7 @@ async function createServices({
     projectBackend,
     projectManager,
     stateBackend,
+    stateManager,
     operationManager,
     terminalBackend,
     terminalManager,
@@ -3205,10 +3540,11 @@ async function createServices({
   });
   const localPulumiHost = LocalPulumiHost.create(logger);
   const projectLockManager = new ProjectLockManager();
-  libraryBackend ??= createLibraryBackend(config, logger);
+  stateManager ??= new StateManager();
+  libraryBackend ??= await createLibraryBackend(config, logger);
   secretBackend ??= await createSecretBackend(config, localPulumiHost, logger);
   stateBackend ??= await createStateBackend(config, localPulumiHost, logger);
-  runnerBackend ??= await createRunnerBackend(config, localPulumiHost);
+  runnerBackend ??= createRunnerBackend(config, localPulumiHost, libraryBackend);
   projectBackend ??= await createProjectBackend(config);
   terminalBackend ??= createTerminalBackend(config, logger);
   terminalManager ??= TerminalManager.create(terminalBackend, stateBackend, runnerBackend, logger);
@@ -3219,13 +3555,15 @@ async function createServices({
     projectBackend,
     secretBackend,
     projectLockManager,
+    stateManager,
     logger
   );
   projectManager ??= ProjectManager.create(
     projectBackend,
     stateBackend,
-    operationManager,
     libraryBackend,
+    projectLockManager,
+    stateManager,
     logger
   );
   workspaceBackend ??= await createWorkspaceBackend(config);
@@ -3238,6 +3576,7 @@ async function createServices({
     projectBackend,
     projectManager,
     stateBackend,
+    stateManager,
     operationManager,
     terminalBackend,
     terminalManager,