@highstate/backend 0.9.14 → 0.9.16

package/dist/chunk-WHALQHEZ.js

@@ -0,0 +1,2017 @@
+// src/shared/models/base.ts
+import { z } from "zod";
+var userObjectMetaSchema = z.object({
+  /**
+   * Human-readable name of the object.
+   *
+   * Used in UI components for better user experience.
+   */
+  title: z.string().optional(),
+  /**
+   * The title used globally for the object.
+   *
+   * For example, the title of an instance secret is "Password" which is okay
+   * to display in the instance secret list, but when the secret is displayed in a
+   * global secret list the name should be more descriptive, like "Proxmox Password".
+   */
+  globalTitle: z.string().optional(),
+  /**
+   * Description of the object.
+   *
+   * Provides additional context for users and developers.
+   */
+  description: z.string().optional(),
+  /**
+   * The color of the object.
+   *
+   * Used in UI components to visually distinguish objects.
+   */
+  color: z.string().optional(),
+  /**
+   * Primary icon identifier.
+   *
+   * Should reference a iconify icon name, like "mdi:server" or "gg:remote".
+   */
+  icon: z.string().optional(),
+  /**
+   * The color of the primary icon.
+   */
+  iconColor: z.string().optional(),
+  /**
+   * The secondary icon identifier.
+   *
+   * Used to provide additional context or actions related to the object.
+   *
+   * Should reference a iconify icon name, like "mdi:edit" or "mdi:delete".
+   */
+  secondaryIcon: z.string().optional(),
+  /**
+   * The color of the secondary icon.
+   */
+  secondaryIconColor: z.string().optional()
+});
+var objectMetaSchema = userObjectMetaSchema.extend({
+  /**
+   * Creation timestamp in milliseconds.
+   *
+   * Managed automatically by the system.
+   */
+  createdAt: z.number().optional(),
+  /**
+   * Last update timestamp in milliseconds.
+   *
+   * Managed automatically by the system.
+   */
+  updatedAt: z.number().optional(),
+  /**
+   * The optional version of the document to support optimistic concurrency control.
+   *
+   * Managed automatically by the system.
+   */
+  version: z.number().optional()
+});
+function hasObjectMeta(value) {
+  return typeof value === "object" && value !== null && "meta" in value;
+}
+var collectionQuerySchema = z.object({
+  /**
+   * The search string to filter documents by display name, description, or other text fields.
+   *
+   * Not implemented yet.
+   */
+  search: z.string().optional(),
+  /**
+   * The skip count for pagination.
+   *
+   * Cannot be used with `cursor`.
+   */
+  skip: z.number().int().nonnegative().optional(),
+  /**
+   * The sorting order for the results.
+   *
+   * By default, "asc" is used.
+   */
+  sort: z.enum(["asc", "desc"]).default("asc"),
+  /**
+   * The ID of the document to start the query from.
+   *
+   * If "asc" sorting is used, this will return results after this ID.
+   * Otherwise, it will return results before this ID.
+   *
+   * Cannot be used with `skip`.
+   */
+  cursor: z.string().optional(),
+  /**
+   * The count of documents to return.
+   *
+   * Defaults to 20 if not specified.
+   * Maximum value is 100.
+   */
+  count: z.number().int().nonnegative().max(100).optional()
+});
+
+// src/shared/models/backend/project.ts
+import { z as z16 } from "zod";
+
+// src/shared/models/project/instance.ts
+import { z as z2 } from "zod";
+var positionSchema = z2.object({
+  x: z2.number(),
+  y: z2.number()
+});
+var instanceInputSchema = z2.object({
+  instanceId: z2.string(),
+  output: z2.string()
+});
+var hubInstanceInputSchema = z2.object({
+  hubId: z2.string()
+});
+var instanceModelPatchSchema = z2.object({
+  args: z2.record(z2.unknown()).optional(),
+  inputs: z2.record(z2.array(instanceInputSchema)).optional(),
+  hubInputs: z2.record(z2.array(hubInstanceInputSchema)).optional(),
+  injectionInputs: z2.array(hubInstanceInputSchema).optional(),
+  position: positionSchema.optional()
+});
+var instanceModelSchema = z2.object({
+  id: z2.string(),
+  type: z2.string(),
+  name: z2.string(),
+  ...instanceModelPatchSchema.shape,
+  resolvedInputs: z2.record(z2.array(instanceInputSchema)).optional(),
+  parentId: z2.string().optional(),
+  outputs: z2.record(z2.array(instanceInputSchema)).optional(),
+  resolvedOutputs: z2.record(z2.array(instanceInputSchema)).optional()
+});
+var compositeInstanceSchema = z2.object({
+  instance: instanceModelSchema,
+  children: z2.array(instanceModelSchema),
+  childCompositeInstanceIds: z2.array(z2.string()).optional(),
+  inputHash: z2.string().optional()
+});
+var compositeInstanceEventSchema = z2.discriminatedUnion("type", [
+  z2.object({
+    type: z2.literal("updated"),
+    instance: compositeInstanceSchema
+  }),
+  z2.object({
+    type: z2.literal("deleted"),
+    instanceId: z2.string()
+  })
+]);
+var hubModelPatchSchema = z2.object({
+  position: positionSchema.optional(),
+  inputs: z2.array(instanceInputSchema).optional(),
+  injectionInputs: z2.array(hubInstanceInputSchema).optional()
+});
+var hubModelSchema = z2.object({
+  id: z2.string().nanoid(),
+  position: positionSchema,
+  inputs: z2.array(instanceInputSchema).optional(),
+  injectionInputs: z2.array(hubInstanceInputSchema).optional()
+});
+
+// src/shared/models/project/state.ts
+import { z as z3 } from "zod";
+var instanceOperationStatusEnumSchema = z3.enum([
+  // transient statuses
+  "updating",
+  "processing-triggers",
+  "previewing",
+  "destroying",
+  "refreshing",
+  "pending",
+  "cancelling",
+  // stable statuses
+  "created",
+  "error"
+]);
+var instanceOperationStatusSchema = z3.object({
+  /**
+   * The enum representing the current status of the instance from the operation perspective.
+   */
+  status: instanceOperationStatusEnumSchema,
+  /**
+   * The ID of the latest operation that this instance is associated with.
+   */
+  latestOperationId: z3.string(),
+  /**
+   * The IDs of the instances that this instance depends on at the moment of latest operation.
+   */
+  dependencyIds: z3.array(z3.string()),
+  /**
+   * The some human-readable message describing the current status.
+   * Typically used to show the error message if the status is "error".
+   */
+  message: z3.string().optional(),
+  /**
+   * The current count of the Pulumi resources being managed by this instance.
+   */
+  currentResourceCount: z3.number().optional(),
+  /**
+   * The total count of the Pulumi resources that this instance is expected to manage.
+   */
+  totalResourceCount: z3.number().optional(),
+  /**
+   * The calculated instance CRC32 input hash at the moment of latest operation completion.
+   *
+   * This hash covers:
+   * - the instance's configuration (name, args, secret hashes);
+   * - the component definition hash;
+   * - the unit's source hash (if applicable);
+   * - the input hashes and output hashes of all input instances.
+   */
+  inputHash: z3.number().optional(),
+  /**
+   * The random 32-bit nonce used in input hash calculation.
+   *
+   * It is changed every time the instance secrets are updated,
+   * to invalidate the input hash and force running the instance again.
+   */
+  inputHashNonce: z3.number().optional(),
+  /**
+   * The sha256 of the output produced by the instance at the moment of latest operation completion.
+   *
+   * Does not depend on anything except the instance's output.
+   */
+  outputHash: z3.string().optional(),
+  /**
+   * The calculated sha256 dependency output hash at the moment of latest operation completion.
+   *
+   * This hash is calculated as combination of output hashes of all input instances and nothing else.
+   *
+   * The primary use case of this hash is to "short-circuit" execution:
+   * if the outputs of input instances have not changed, dependent instances can skip execution,
+   * even if their input hashes changed due to upstream config changes.
+   * This prevents unnecessary re-execution of the entire dependency graph when only non-output-affecting inputs are modified.
+   */
+  dependencyOutputHash: z3.string().optional(),
+  /**
+   * The arguments of the instances at the moment of latest operation start.
+   */
+  args: z3.record(z3.unknown()).optional()
+});
+var instanceEvaludationStatusEnumSchema = z3.enum([
+  // transient statuses
+  "evaluating",
+  // stable statuses
+  "evaluated",
+  "error"
+]);
+var instanceEvaluationStatusSchema = z3.object({
+  /**
+   * The enum representing the current status of the instance from the evaluation perspective.
+   *
+   * The stable status when instance is not evaludated is forbidden.
+   */
+  status: instanceEvaludationStatusEnumSchema,
+  /**
+   * The message describing the evaluation status.
+   * Typically used to show the error message if the status is "error".
+   */
+  message: z3.string().optional()
+});
+var WellKnownInstanceCustomStatus = /* @__PURE__ */ ((WellKnownInstanceCustomStatus2) => {
+  WellKnownInstanceCustomStatus2["Healthy"] = "healthy";
+  WellKnownInstanceCustomStatus2["Degraded"] = "degraded";
+  WellKnownInstanceCustomStatus2["Down"] = "down";
+  WellKnownInstanceCustomStatus2["Warning"] = "warning";
+  WellKnownInstanceCustomStatus2["Progressing"] = "progressing";
+  WellKnownInstanceCustomStatus2["Error"] = "error";
+  return WellKnownInstanceCustomStatus2;
+})(WellKnownInstanceCustomStatus || {});
+var instanceCustomStatusSchema = z3.object({
+  /**
+   * The name of the instance's extra status.
+   *
+   * Must be unique within the instance state.
+   */
+  name: z3.string(),
+  /**
+   * The enum value of the instance's extra status.
+   *
+   * May be on of the `WellKnownExtraInstanceStatus` values or a custom value.
+   */
+  status: z3.string(),
+  /**
+   * The display name of the instance's extra status.
+   */
+  displayName: z3.string(),
+  /**
+   * The `iconify` icon representing the instance's extra status.
+   *
+   * If not provided and status is a well-known value, the icon will be derived from the status.
+   */
+  icon: z3.string().optional(),
+  /**
+   * The HEX color of the status badge.
+   *
+   * If not provided and status is a well-known value, the color will be derived from the status.
+   */
+  color: z3.string().optional(),
+  /**
+   * The message describing the instance's extra status.
+   *
+   * Can be used to provide additional context or information about the status.
+   *
+   * The message will be displayed in the 800x600 ANSI terminal in the UI,
+   * so differenet TUI elements should be drawn within this area.
+   */
+  message: z3.string().optional(),
+  /**
+   * The order of the status in the list of statuses.
+   *
+   * Must be in the range from `0` to `100`, lower values are displayed first.
+   *
+   * If not provided, the default is `50`.
+   */
+  order: z3.number().min(0).max(100).optional()
+});
+var instanceStatusFieldValueSchema = z3.union([
+  z3.string(),
+  z3.number(),
+  z3.boolean(),
+  z3.array(z3.string())
+]);
+var instanceStatusFieldSchema = z3.object({
+  name: z3.string(),
+  meta: objectMetaSchema,
+  complementaryTo: z3.string().optional(),
+  value: instanceStatusFieldValueSchema.optional()
+});
+var unitInstanceStatusFieldSchema = instanceStatusFieldSchema.omit({ meta: true }).extend({
+  meta: userObjectMetaSchema
+});
+var instanceStateExtraSchema = z3.object({
+  /**
+   * The status fields reported by the unit or attached via the API.
+   *
+   * Do not confuse with `customStatuses`.
+   *
+   * These fields are used to store additional information about the instance,
+   * such as URLs, display names, and other metadata.
+   */
+  statusFields: z3.array(instanceStatusFieldSchema).optional(),
+  /**
+   * The extra statuses of the instance reported by the unit or attached via the API.
+   *
+   * Do not confuse with `statusFields.
+   */
+  customStatuses: z3.array(instanceCustomStatusSchema).optional(),
+  /**
+   * The IDs of the pages that are owned by this instance.
+   *
+   * The keys are the local page names, and the values are the page IDs.
+   */
+  pageIds: z3.record(z3.string()).optional(),
+  /**
+   * The IDs of the terminals that are owned by this instance.
+   *
+   * The keys are the local terminal names, and the values are the terminal IDs.
+   */
+  terminalIds: z3.record(z3.string()).optional(),
+  /**
+   * The IDs of the triggers that are owned by this instance.
+   *
+   * The keys are the local trigger names, and the values are the trigger IDs.
+   */
+  triggerIds: z3.record(z3.string()).optional(),
+  /**
+   * The IDs of the artifacts that are owned by this instance.
+   *
+   * The keys are the output keys, and the values are the artifact IDs.
+   */
+  ownedArtifactIds: z3.record(z3.array(z3.string())).optional(),
+  /**
+   * The IDs of the artifacts that are used by this instance.
+   *
+   * This is a flat list of artifact IDs, not grouped by output keys.
+   */
+  usedArtifactIds: z3.array(z3.string()).optional(),
+  /**
+   * The IDs of the worker registrations that are associated with this instance.
+   */
+  workerRegistrationIds: z3.array(z3.string()).optional()
+});
+var instanceStateSchema = z3.object({
+  /**
+   * The unique identifier of the instance.
+   * The format is `{componentType}:{instanceName}`, so each instance must have a unique name within its component type.
+   */
+  id: z3.string(),
+  /**
+   * The ID of the parent instance, if this instance is a child of another composite instance.
+   */
+  parentId: z3.string().optional(),
+  /**
+   * The names of the secrets that has values in this instance.
+   */
+  secretNames: z3.array(z3.string()).optional(),
+  /**
+   * The current status of the instance from the operation perspective.
+   *
+   * This status persists in the storage only when the operation is completed.
+   *
+   * If the operation was interrupted, the status will be "error" with corresponding error message.
+   *
+   * If the instance was not created or was successfully destroyed, the whole "operationStatus" field will be undefined.
+   */
+  operationStatus: instanceOperationStatusSchema.optional(),
+  /**
+   * The current status of the instance from the evaluation perspective.
+   *
+   * Only applies to composite instances, will always be `undefined` for unit instances.
+   */
+  evaluationStatus: instanceEvaluationStatusSchema.optional(),
+  /**
+   * The extra components of the instance.
+   *
+   * Applies to both unit and composite instances.
+   */
+  extra: instanceStateExtraSchema.optional()
+});
+var instanceStatePatchSchema = z3.object({
+  id: z3.string(),
+  parentId: z3.string().nullish(),
+  secretNames: z3.array(z3.string()).nullish(),
+  operationStatus: instanceOperationStatusSchema.partial().nullish(),
+  evaluationStatus: instanceEvaluationStatusSchema.partial().nullish(),
+  extra: instanceStateExtraSchema.partial().nullish()
+});
+function applyStatePatch(existingState, patch) {
+  const state = existingState ? { ...existingState } : { id: patch.id };
+  const anyPatch = patch;
+  for (const key of Object.keys(patch)) {
+    if (typeof anyPatch[key] === "undefined") {
+      continue;
+    }
+    if (typeof anyPatch[key] !== "object" || anyPatch[key] === null || Array.isArray(anyPatch[key])) {
+      state[key] = anyPatch[key] === null ? void 0 : anyPatch[key];
+      continue;
+    }
+    const existingValue = state[key] ? { ...state[key] } : {};
+    for (const subKey of Object.keys(anyPatch[key])) {
+      existingValue[subKey] = anyPatch[key][subKey];
+    }
+    state[key] = existingValue;
+  }
+  return state;
+}
+function isStateEmpty(state) {
+  return !state.operationStatus && !state.evaluationStatus && (!state.extra || Object.keys(state.extra).length === 0) && (!state.secretNames || state.secretNames.length === 0);
+}
+function isTransientOperationStatus(status) {
+  return status !== "created" && status !== "error";
+}
+function isStableOperationStatus(status) {
+  return status === "created" || status === "error";
+}
+var instanceStateEventSchema = z3.discriminatedUnion("type", [
+  z3.object({
+    type: z3.literal("patched"),
+    patch: instanceStatePatchSchema
+  }),
+  z3.object({
+    type: z3.literal("updated"),
+    state: instanceStateSchema
+  }),
+  z3.object({
+    type: z3.literal("deleted"),
+    instanceId: z3.string()
+  })
+]);
+
+// src/shared/models/project/operation.ts
+import { z as z4 } from "zod";
+var operationTypeSchema = z4.enum(["update", "preview", "destroy", "recreate", "refresh"]);
+var operationStatusSchema = z4.enum([
+  "pending",
+  "running",
+  "completed",
+  "failed",
+  "cancelled",
+  "failing"
+]);
+var operationOptionsSchema = z4.object({
+  /**
+   * Whether to force update all dependencies of the instances even if they are not changed.
+   *
+   * Only applicable for `update`, `preview`, `recreate`, and `refresh` operations.
+   *
+   * By default, `false`.
+   */
+  forceUpdateDependencies: z4.boolean().default(false),
+  /**
+   * Whether to force update all children of the composite instances even if they are not changed.
+   *
+   * Only applicable for `update`, `preview`, `recreate`, and `refresh` operations.
+   *
+   * By default, `false`.
+   */
+  forceUpdateChildren: z4.boolean().default(false),
+  /**
+   * Whether to destroy all dependents of the instances when destroying them.
+   *
+   * Only applicable for `destroy` and `recreate` operations.
+   *
+   * By default, `true`.
+   */
+  destroyDependentInstances: z4.boolean().default(true),
+  /**
+   * Whether to invoke destroy triggers when destroying the instances.
+   *
+   * Only applicable for `destroy`.
+   *
+   * By default, `true`.
+   */
+  invokeDestroyTriggers: z4.boolean().default(true),
+  /**
+   * Whether to delete unreachable resources when updating or destroying the instances.
+   * This is potentially dangerous and should be used with caution.
+   *
+   * By default, `false`.
+   */
+  deleteUnreachableResources: z4.boolean().default(false),
+  /**
+   * Whether to delete the stack state even if the destroy operation fails.
+   * This is very dangerous and should be used only when the stack is unrecoverable.
+   *
+   * By default, `false`.
+   */
+  forceDeleteState: z4.boolean().default(false),
+  /**
+   * Whether to allow partial updates of composite instances when updating, destroying or recreating them.
+   *
+   * If `true`, the operation will only update/destroy composite instance children that are directly referenced by other affected instances.
+   * If `false`, the operation will update/destroy all children at of the composite instances at all levels if at least one of them is referenced by affected instances.
+   *
+   * By default, `false`.
+   */
+  allowPartialCompositeInstanceUpdates: z4.boolean().default(false),
+  /**
+   * Whether to refresh the state before running the operation.
+   *
+   * By default, `false`.
+   */
+  refresh: z4.boolean().default(false)
+});
+var operationRequestSchema = z4.object({
+  projectId: z4.string(),
+  type: operationTypeSchema,
+  instanceIds: z4.array(z4.string()),
+  options: operationOptionsSchema.partial().optional()
+});
+var operationSchema = z4.object({
+  id: z4.string().uuid(),
+  meta: objectMetaSchema,
+  status: operationStatusSchema,
+  error: z4.string().nullable(),
+  type: operationTypeSchema,
+  requestedInstanceIds: z4.array(z4.string()),
+  instanceIdsToUpdate: z4.array(z4.string()).default(() => []),
+  instanceIdsToDestroy: z4.array(z4.string()).default(() => []),
+  options: operationOptionsSchema,
+  startedAt: z4.number(),
+  completedAt: z4.number().nullable()
+});
+function isFinalOperationStatus(status) {
+  return status === "completed" || status === "failed" || status === "cancelled";
+}
+var operationLogEntrySchema = z4.tuple([
+  z4.string().uuid(),
+  // UUIDv7
+  z4.string()
+  // The log message
+]);
+var operationEventSchema = z4.discriminatedUnion("type", [
+  z4.object({
+    type: z4.literal("updated"),
+    operation: operationSchema
+  }),
+  z4.object({
+    type: z4.literal("deleted"),
+    operationId: z4.string()
+  })
+]);
+
+// src/shared/models/project/terminal.ts
+import { z as z6 } from "zod";
+
+// src/shared/models/project/artifact.ts
+import { z as z5 } from "zod";
+import {
+  HighstateSignature
+} from "@highstate/contract";
+var artifactUsageSchema = z5.discriminatedUnion("type", [
+  z5.object({
+    type: z5.literal("instance"),
+    instanceId: z5.string()
+  }),
+  z5.object({
+    type: z5.literal("terminal"),
+    terminalId: z5.string()
+  }),
+  z5.object({
+    type: z5.literal("service-account"),
+    serviceAccountId: z5.string()
+  })
+]);
+function compareArtifactUsage(a, b) {
+  if (a.type === "instance" && b.type === "instance") {
+    return a.instanceId === b.instanceId;
+  }
+  if (a.type === "terminal" && b.type === "terminal") {
+    return a.terminalId === b.terminalId;
+  }
+  if (a.type === "service-account" && b.type === "service-account") {
+    return a.serviceAccountId === b.serviceAccountId;
+  }
+  return false;
+}
+var fileMetaSchema = z5.object({
+  name: z5.string(),
+  size: z5.number().optional(),
+  isBinary: z5.boolean().optional(),
+  mode: z5.number().optional()
+});
+var artifactSchema = z5.object({
+  /**
+   * The UUIDv7 of the artifact generated when the artifact with unique content is first stored.
+   */
+  id: z5.string().uuid(),
+  meta: objectMetaSchema,
+  /**
+   * The SHA-256 hash of the artifact content before encryption.
+   */
+  hash: z5.string(),
+  /**
+   * The list of usages of this artifact.
+   *
+   * When became empty, the artifact is garbage collected.
+   */
+  usages: artifactUsageSchema.array(),
+  /**
+   * The size of the unencrypted artifact archive in bytes.
+   */
+  size: z5.number(),
+  /**
+   * The size of each chunk of the artifact which independently encrypted.
+   */
+  chunkSize: z5.number()
+});
+var unitArtifactSchema = z5.object({
+  hash: z5.string(),
+  meta: userObjectMetaSchema.optional()
+});
+var fileContentSchema = z5.union([
+  z5.object({
+    type: z5.literal("embedded"),
+    value: z5.string()
+  }),
+  z5.object({
+    type: z5.literal("artifact"),
+    [HighstateSignature.Artifact]: unitArtifactSchema
+  })
+]);
+var fileSchema = z5.object({
+  meta: fileMetaSchema,
+  content: fileContentSchema
+});
+
+// src/shared/models/project/terminal.ts
+var metaFields = {
+  title: true,
+  globalTitle: true,
+  description: true,
+  icon: true,
+  iconColor: true
+};
+var requiredMetaFields = {
+  title: true,
+  description: true
+};
+var terminalSchema = z6.object({
+  id: z6.string().uuid(),
+  // UUIDv7
+  meta: objectMetaSchema.pick({
+    ...metaFields,
+    createdAt: true,
+    updatedAt: true
+  }).required(requiredMetaFields),
+  /**
+   * The ID of the instance produced the terminal if applicable.
+   */
+  instanceId: z6.string().optional()
+});
+var terminalSpecSchema = z6.object({
+  image: z6.string(),
+  command: z6.string().array(),
+  cwd: z6.string().optional(),
+  env: z6.record(z6.string()).optional(),
+  files: z6.record(fileSchema).optional()
+});
+var unitTerminalSchema = z6.object({
+  name: z6.string(),
+  meta: userObjectMetaSchema.pick(metaFields).required(requiredMetaFields),
+  spec: terminalSpecSchema
+});
+var terminalSessionSchema = z6.object({
+  id: z6.string().uuid(),
+  // UUIDv7
+  meta: objectMetaSchema.pick({ ...metaFields, createdAt: true, updatedAt: true }).required(requiredMetaFields).extend({
+    /**
+     * The time when the session was finished.
+     */
+    finishedAt: z6.number().optional()
+  }),
+  /**
+   * The ID of the project this session belongs to.
+   */
+  projectId: z6.string(),
+  /**
+   * References the terminal this session is based on.
+   */
+  terminalId: z6.string(),
+  /**
+   * References the instance produced the terminal if applicable.
+   */
+  instanceId: z6.string().optional()
+});
+
+// src/shared/models/project/page.ts
+import { z as z7 } from "zod";
+var pageBlockSchema = z7.union([
+  z7.object({
+    type: z7.literal("markdown"),
+    content: z7.string()
+  }),
+  z7.object({
+    type: z7.literal("qr"),
+    content: z7.string(),
+    showContent: z7.coerce.boolean(),
+    language: z7.string().optional()
+  }),
+  fileSchema.extend({
+    type: z7.literal("file")
+  })
+]);
+var pageSchema = z7.object({
+  id: z7.string(),
+  instanceId: z7.string().optional(),
+  meta: objectMetaSchema
+});
+var pageContentSchema = z7.object({
+  id: z7.string(),
+  content: z7.array(pageBlockSchema)
+});
+var unitPageSchema = pageContentSchema.omit({ id: true }).extend({
+  name: z7.string(),
+  meta: userObjectMetaSchema
+});
+
+// src/shared/models/project/trigger.ts
+import { z as z8 } from "zod";
+var triggerSpecSchema = z8.union([
+  z8.object({
+    type: z8.literal("before-destroy")
+  }),
+  z8.object({
+    type: z8.literal("schedule"),
+    schedule: z8.string()
+  })
+]);
+var triggerSchema = z8.object({
+  id: z8.string(),
+  instanceId: z8.string(),
+  meta: objectMetaSchema,
+  spec: triggerSpecSchema
+});
+var unitTriggerSchema = triggerSchema.omit({ id: true, instanceId: true, meta: true }).extend({
+  name: z8.string(),
+  meta: userObjectMetaSchema.optional()
+}).extend({
+  name: z8.string(),
+  meta: userObjectMetaSchema.optional()
+});
+var triggerInvocationSchema = z8.object({
+  name: z8.string()
+});
+
+// src/shared/models/project/unlock-method.ts
+import { z as z9 } from "zod";
+var unlockMethodType = z9.enum(["password", "passkey"]);
+var unlockMethodSchema = z9.object({
+  id: z9.string(),
+  meta: objectMetaSchema,
+  /**
+   * The type of unlock method (password or passkey).
+   */
+  type: unlockMethodType,
+  /**
+   * The encrypted identity used to decrypt the master key.
+   */
+  encryptedIdentity: z9.string(),
+  /**
+   * The recipient of the unlock method to use to encrypt the master key for this unlock method.
+   */
+  recipient: z9.string()
+});
+
+// src/shared/models/project/secret.ts
+import { z as z10 } from "zod";
+var secretDescriptorSchema = z10.discriminatedUnion("type", [
+  z10.object({
+    type: z10.literal("system"),
+    secretName: z10.string()
+  }),
+  z10.object({
+    type: z10.literal("instance"),
+    instanceId: z10.string(),
+    secretName: z10.string()
+  }),
+  z10.object({
+    type: z10.literal("custom"),
+    secretPath: z10.string()
+  })
+]);
+var secretSchema = z10.object({
+  /**
+   * The UUIDv7 of the secret generated when the secret is first created.
+   */
+  id: z10.string().uuid(),
+  /**
+   * The metadata of the secret object.
+   */
+  meta: objectMetaSchema,
+  /**
+   * The real descriptor of the secret in the object form, which follows one of these formats when serialized:
+   * - `system:<secretName>`
+   * - `instance:<instanceId>:<secretName>`
+   * - `custom:<secretPath>`
+   */
+  descriptor: secretDescriptorSchema
+});
+function formatSecretDescriptor(descriptor) {
+  switch (descriptor.type) {
+    case "system":
+      return `system:${descriptor.secretName}`;
+    case "instance":
+      return `instance:${descriptor.instanceId}:${descriptor.secretName}`;
+    case "custom":
+      return `custom:${descriptor.secretPath}`;
+  }
+}
+function parseSecretDescriptor(descriptorString) {
+  const parts = descriptorString.split(":");
+  if (parts.length < 2) {
+    throw new Error(`Invalid secret descriptor format: ${descriptorString}`);
+  }
+  switch (parts[0]) {
+    case "system": {
+      if (parts.length !== 2) {
+        throw new Error(`Invalid system secret descriptor: ${descriptorString}`);
+      }
+      return { type: "system", secretName: parts[1] };
+    }
+    case "instance": {
+      const secretName = parts[parts.length - 1];
+      const instanceId = parts.slice(1, -1).join(":");
+      if (!instanceId || !secretName) {
+        throw new Error(`Invalid instance secret descriptor: ${descriptorString}`);
+      }
+      return { type: "instance", instanceId, secretName };
+    }
+    case "custom": {
+      if (parts.length !== 2) {
+        throw new Error(`Invalid custom secret descriptor: ${descriptorString}`);
+      }
+      return { type: "custom", secretPath: parts[1] };
+    }
+    default:
+      throw new Error(`Unknown secret descriptor type: ${parts[0]}`);
+  }
+}
+var WellKnownSecretDescriptors = {
+  PulumiPassword: {
+    type: "system",
+    secretName: "pulumi-password"
+  }
+};
+
+// src/shared/models/project/lock.ts
+import { z as z11 } from "zod";
+var instanceLockSpecSchema = z11.union([
+  z11.object({
+    type: z11.literal("operation"),
+    /**
+     * The operation ID. Will be used to fetch the operation and detect whether it is still running or lost.
+     */
+    operationId: z11.string()
+  }),
+  z11.object({
+    type: z11.literal("evaluation"),
+    /**
+     * The internal evaluation ID that is used to detect lost evaluations and restart them.
+     */
+    evaluationId: z11.string()
+  }),
+  z11.object({
+    type: z11.literal("custom"),
+    /**
+     * The ID of the party that holds the lock.
+     *
+     * Each locker must only manage the locks it has created.
+     */
+    lockerId: z11.string(),
+    /**
+     * The ID of the lock provided by the locker.
+     *
+     * Must be unique across all locks in the locker system.
+     */
+    lockId: z11.string(),
+    /**
+     * The optional payload provided by the locker.
+     *
+     * Can be used to store additional information about the lock,
+     * like the ID of the lock in the locker system,
+     * or any other metadata that is relevant to the lock.
+     */
+    payload: z11.record(z11.string()).optional()
+  })
+]);
+var instanceLockSchema = z11.object({
+  id: z11.string(),
+  meta: objectMetaSchema,
+  spec: instanceLockSpecSchema
+});
+function compareInstanceLockSpecs(a, b) {
+  if (a.type === "operation" && b.type === "operation") {
+    return a.operationId === b.operationId;
+  }
+  if (a.type === "evaluation" && b.type === "evaluation") {
+    return a.evaluationId === b.evaluationId;
+  }
+  if (a.type === "custom" && b.type === "custom") {
+    return a.lockerId === b.lockerId && a.lockId === b.lockId;
+  }
+  return false;
+}
+var instanceLockEventSchema = z11.discriminatedUnion("type", [
+  z11.object({
+    type: z11.literal("locked"),
+    locks: z11.array(instanceLockSchema)
+  }),
+  z11.object({
+    type: z11.literal("unlocked"),
+    instanceIds: z11.array(z11.string())
+  })
+]);
+
+// src/shared/models/project/component.ts
+import { z as z12 } from "zod";
+var metaSchema = z12.object({
+  displayName: z12.string().optional(),
+  description: z12.string().optional(),
+  color: z12.string().optional()
+});
+var entitySchema = z12.object({
+  type: z12.string(),
+  schema: z12.any(),
+  // TSchema from TypeBox
+  meta: metaSchema,
+  definitionHash: z12.string()
+});
+var componentMetaSchema = metaSchema.extend({
+  primaryIcon: z12.string().optional(),
+  primaryIconColor: z12.string().optional(),
+  secondaryIcon: z12.string().optional(),
+  secondaryIconColor: z12.string().optional(),
+  category: z12.string().optional(),
+  defaultNamePrefix: z12.string().optional()
+});
+var componentArgumentSchema = z12.object({
+  schema: z12.any(),
+  // ArgumentValueSchema from TypeBox
+  required: z12.boolean(),
+  meta: componentMetaSchema
+});
+var componentInputSchema = z12.object({
+  type: z12.string(),
+  required: z12.boolean(),
+  multiple: z12.boolean(),
+  meta: componentMetaSchema
+});
+var componentModelSchema = z12.object({
+  type: z12.string(),
+  args: z12.record(componentArgumentSchema),
+  inputs: z12.record(componentInputSchema),
+  outputs: z12.record(componentInputSchema),
+  meta: componentMetaSchema,
+  definitionHash: z12.string()
+});
+
+// src/shared/models/project/service-account.ts
+import { z as z13 } from "zod";
+var serviceAccountSchema = z13.object({
+  id: z13.string().uuid(),
+  // UUIDv7
+  meta: objectMetaSchema.pick({
+    title: true,
+    description: true,
+    icon: true,
+    iconColor: true,
+    createdAt: true,
+    updatedAt: true
+  }),
+  /**
+   * The ID of the artifact that stores the avatar image for this service account.
+   */
+  avatarArtifactId: z13.string().optional()
+});
+
+// src/shared/models/project/worker.ts
+import { z as z14 } from "zod";
+var workerStatus = z14.enum([
+  // transient statuses
+  "running",
+  "starting"
+]);
+var workerSchema = z14.object({
+  id: z14.uuidv7(),
+  meta: objectMetaSchema.pick({
+    title: true,
+    description: true,
+    icon: true,
+    iconColor: true,
+    createdAt: true,
+    updatedAt: true
+  }),
+  /**
+   * The status of the worker.
+   */
+  status: workerStatus,
+  /**
+   * The number of failed attempts to start the worker. When a worker fails to start,
+   * this count is incremented.
+   * If the worker fails to start more than 5 times in a row, it is
+   * considered unhealthy and will not be started again
+   *
+   * This count is reset when the worker is successfully started and connected.
+   */
+  failedStartAttempts: z14.number(),
+  /**
+   * The fully qualified base docker image without tag and digest.
+   *
+   * It serves as the identity of the worker and can be shared across workers.
+   *
+   * Multiple workers sharing the same identity also share the same service accoun
+   * and have equal access to all its resources.
+   *
+   * Example: `ghcr.io/highstate-io/kubernetes-worker`
+   */
+  identity: z14.string(),
+  /**
+   * The fully qualified docker image name for this worker.
+   *
+   * Example: `ghcr.io/highstate-io/kubernetes-worker:v1.0.0@sha256:abc123...`
+   */
+  image: z14.string(),
+  /**
+   * The ID of the service account owned by this worker.
+   */
+  serviceAccountId: z14.string().uuid(),
+  /**
+   * The ID of the API key used to authenticate this worker with the system.
+   *
+   * Will be generated on the first run of the worker and will be rotated every time the worker is restarted.
+   */
+  apiKeyId: z14.string().uuid().optional()
+});
+var workerUnitRegistrationSchema = z14.object({
+  id: z14.string().uuid(),
+  // UUIDv7
+  meta: objectMetaSchema.pick({ createdAt: true, updatedAt: true }),
+  workerId: z14.string().uuid(),
+  // UUIDv7
+  instanceId: z14.string(),
+  /**
+   * The fully qualified base docker image with tag and digest.
+   */
+  image: z14.string(),
+  /**
+   * The parameters to pass to the worker.
+   */
+  params: z14.record(z14.string(), z14.unknown()).optional()
+});
+var unitWorkerSchema = z14.object({
+  name: z14.string(),
+  image: z14.string(),
+  params: z14.record(z14.string(), z14.unknown()).optional()
+});
+function getWorkerIdentity(image) {
+  const parts = image.split(":");
+  if (parts.length < 2) {
+    throw new Error(`Invalid image format: ${image}`);
+  }
+  return parts.slice(0, -1).join(":");
+}
+
+// src/shared/models/project/api-key.ts
+import { z as z15 } from "zod";
+var instanceActionSchema = z15.enum(["read", "write"]);
+var serviceAccountActionSchema = z15.enum(["full"]);
+var projectAccessScope = z15.discriminatedUnion("type", [
+  z15.object({
+    type: z15.literal("instance"),
+    actions: instanceActionSchema.array(),
+    instanceIds: z15.string().array()
+  }),
+  z15.object({
+    type: z15.literal("service-account"),
+    actions: serviceAccountActionSchema.array(),
+    serviceAccountIds: z15.string().array()
+  })
+]);
+var projectApiKeySchema = z15.object({
+  id: z15.string().ulid(),
+  meta: objectMetaSchema,
+  /**
+   * The 256-bit random token used to authenticate API requests.
+   */
+  token: z15.string(),
+  scopes: z15.array(projectAccessScope)
+});
+function hasAll(array, values) {
+  return values.every((value) => array.includes(value));
+}
+function validateInstanceAccess(apiKey, actions, instanceIds) {
+  return apiKey.scopes.filter((scope) => scope.type === "instance").some((scope) => hasAll(scope.actions, actions) && hasAll(scope.instanceIds, instanceIds));
+}
+var projectAccessActionDescriptions = {
+  "service-account": {
+    full: "Full access to the service account and all resources owned by it and granted to it."
+  },
+  instance: {
+    read: "Read access to the instance, including its state all resources owned by it.",
+    write: "Write access to the instance, including its state and all resources owned by it."
+  }
+};
+
+// src/shared/models/backend/project.ts
+var projectSchema = z16.object({
+  /**
+   * The identifier of the project unique across the backend.
+   */
+  id: z16.string(),
+  /**
+   * The metadata of the project.
+   */
+  meta: objectMetaSchema,
+  /**
+   * The identifier of the library used by the project.
+   */
+  libraryId: z16.string()
+});
+var projectModelSchema = z16.object({
+  instances: z16.array(instanceModelSchema),
+  hubs: z16.array(hubModelSchema)
+});
+var projectUnlockSuiteSchema = z16.object({
+  /**
+   * The list of encrypted AGE identities that can be used to decrypt the master key of the project.
+   *
+   * The frontend should try to decrypt at least one of these identities
+   * using the password or passkey.
+   */
+  encryptedIdentities: z16.array(z16.string()),
+  /**
+   * Whether one of the identities is a passkey and user should be asked to use it.
+   */
+  hasPasskey: z16.boolean()
+});
+var projectUnlockStateSchema = z16.discriminatedUnion("type", [
+  z16.object({
+    type: z16.literal("locked"),
+    unlockSuite: projectUnlockSuiteSchema.optional()
+  }),
+  z16.object({
+    type: z16.literal("unlocked")
+  })
+]);
+
+// src/shared/models/backend/library.ts
+function diffLibraries(oldLibrary, newLibrary) {
+  const updates = [];
+  for (const [componentType, newComponent] of Object.entries(newLibrary.components)) {
+    const existingComponent = oldLibrary.components[componentType];
+    if (existingComponent?.definitionHash !== newComponent.definitionHash) {
+      updates.push({ type: "component-updated", component: newComponent });
+    }
+  }
+  for (const componentType of Object.keys(oldLibrary.components)) {
+    if (!newLibrary.components[componentType]) {
+      updates.push({ type: "component-removed", componentType });
+    }
+  }
+  for (const [entityType, newEntity] of Object.entries(newLibrary.entities)) {
+    const existingEntity = oldLibrary.entities[entityType];
+    if (existingEntity?.definitionHash !== newEntity.definitionHash) {
+      updates.push({ type: "entity-updated", entity: newEntity });
+    }
+  }
+  for (const entityType of Object.keys(oldLibrary.entities)) {
+    if (!newLibrary.entities[entityType]) {
+      updates.push({ type: "entity-removed", entityType });
+    }
+  }
+  return updates;
+}
+function applyLibraryUpdate(components, entities, update) {
+  switch (update.type) {
+    case "component-updated":
+      components[update.component.type] = update.component;
+      break;
+    case "entity-updated":
+      entities[update.entity.type] = update.entity;
+      break;
+    case "component-removed":
+      delete components[update.componentType];
+      break;
+    case "entity-removed":
+      delete entities[update.entityType];
+      break;
+  }
+}
+
+// src/shared/models/backend/unlock-method.ts
+import { z as z17 } from "zod";
+var backendUnlockMethodSchema = z17.object({
+  id: z17.string(),
+  meta: objectMetaSchema,
+  /**
+   * The AGE recipient of the unlock method to use to encrypt the master key for this unlock method.
+   */
+  recipient: z17.string()
+});
+
+// src/shared/models/errors.ts
+var AccessError = class extends Error {
+  constructor(message) {
+    super(message);
+  }
+};
+
+// src/shared/resolvers/graph-resolver.ts
+import { unique } from "remeda";
+var GraphResolver = class {
+  constructor(nodes, logger, outputHandler, dependentSetHandler) {
+    this.nodes = nodes;
+    this.logger = logger;
+    this.outputHandler = outputHandler;
+    this.dependentSetHandler = dependentSetHandler;
+  }
+  workset = /* @__PURE__ */ new Set();
+  dependencyMap = /* @__PURE__ */ new Map();
+  dependentMap = /* @__PURE__ */ new Map();
+  outputMap = /* @__PURE__ */ new Map();
+  addToWorkset(nodeId) {
+    this.workset.add(nodeId);
+  }
+  addAllNodesToWorkset() {
+    for (const nodeId of this.nodes.keys()) {
+      this.workset.add(nodeId);
+    }
+  }
+  /**
+   * The map of calculated outputs.
+   */
+  get outputs() {
+    return this.outputMap;
+  }
+  requireOutput(nodeId) {
+    const output = this.outputMap.get(nodeId);
+    if (!output) {
+      throw new Error(`Output for node ${nodeId} is not available`);
+    }
+    return output;
+  }
+  /**
+   * Gets all identifiers of the nodes that depend on the given node directly or indirectly.
+   */
+  getAllDependents(nodeId) {
+    const result = /* @__PURE__ */ new Set();
+    const stack = [nodeId];
+    while (stack.length > 0) {
+      const dependents = this.dependentMap.get(stack.pop());
+      if (!dependents) {
+        continue;
+      }
+      for (const dependentId of dependents) {
+        if (!result.has(dependentId)) {
+          result.add(dependentId);
+          stack.push(dependentId);
+        }
+      }
+    }
+    return Array.from(result);
+  }
+  /**
+   * Gets the identifiers of the nodes that depend on the given node directly.
+   *
+   * Returns an empty array if there are no dependents.
+   */
+  getDependents(nodeId) {
+    const dependents = this.dependentMap.get(nodeId);
+    if (!dependents) {
+      return [];
+    }
+    return Array.from(dependents);
+  }
+  /**
+   * Invalidates the node and all nodes that depend on it.
+   *
+   * Also adds the node to the work set for processing.
+   */
+  invalidate(nodeId) {
+    const stack = [nodeId];
+    while (stack.length > 0) {
+      const nodeId2 = stack.pop();
+      if (!this.nodes.has(nodeId2)) {
+        continue;
+      }
+      this.outputMap.delete(nodeId2);
+      this.workset.add(nodeId2);
+      const dependents = this.dependentMap.get(nodeId2);
+      if (!dependents) {
+        continue;
+      }
+      for (const dependentId of dependents) {
+        if (this.outputMap.has(dependentId)) {
+          stack.push(dependentId);
+        }
+      }
+    }
+  }
+  /**
+   * Resolves all not-resolved or invalidated nodes in the graph.
+   *
+   * The abort signal of the previous operation must be called before calling this method again.
+   */
+  async process(signal) {
+    while (this.workset.size > 0) {
+      const rootNodeId = this.workset.values().next().value;
+      const stack = [{ nodeId: rootNodeId, resolved: false, dependencies: [] }];
+      while (stack.length > 0) {
+        const stackItem = stack[stack.length - 1];
+        const { nodeId, resolved } = stackItem;
+        const node = this.nodes.get(nodeId);
+        if (!node) {
+          this.logger.warn({ nodeId }, "node not found in the graph, skipping");
+          stack.pop();
+          continue;
+        }
+        if (this.outputMap.has(nodeId)) {
+          stack.pop();
+          continue;
+        }
+        if (!resolved) {
+          stackItem.dependencies = unique(this.getNodeDependencies(node));
+          let hasUnresolvedDependencies = false;
+          for (const depId of stackItem.dependencies) {
+            if (!this.nodes.has(depId)) {
+              this.logger.warn({ depId, nodeId }, "dependency not found in the graph, skipping");
+              continue;
+            }
+            if (!this.outputMap.has(depId)) {
+              stack.push({ nodeId: depId, resolved: false, dependencies: [] });
+              hasUnresolvedDependencies = true;
+            }
+          }
+          if (hasUnresolvedDependencies) {
+            stackItem.resolved = true;
+            continue;
+          }
+        }
+        const output = await this.processNode(node, this.logger);
+        if (signal?.aborted) {
+          this.logger.warn({ nodeId }, "processing aborted, skipping output");
+          return;
+        }
+        const changedDependentMaps = /* @__PURE__ */ new Set();
+        const oldDependencies = this.dependencyMap.get(nodeId) ?? [];
+        for (const depId of oldDependencies) {
+          const dependantSet = this.dependentMap.get(depId);
+          if (dependantSet) {
+            dependantSet.delete(nodeId);
+            changedDependentMaps.add(depId);
+            if (dependantSet.size === 0) {
+              this.dependentMap.delete(depId);
+            }
+          }
+        }
+        for (const depId of stackItem.dependencies) {
+          let dependantSet = this.dependentMap.get(depId);
+          if (!dependantSet) {
+            dependantSet = /* @__PURE__ */ new Set();
+            this.dependentMap.set(depId, dependantSet);
+          }
+          dependantSet.add(nodeId);
+          changedDependentMaps.add(depId);
+        }
+        if (this.dependentSetHandler) {
+          for (const depId of changedDependentMaps) {
+            const dependents = this.dependentMap.get(depId);
+            this.dependentSetHandler(depId, dependents ? Array.from(dependents) : []);
+          }
+        }
+        this.outputMap.set(nodeId, output);
+        this.outputHandler?.(nodeId, output);
+        this.dependencyMap.set(nodeId, stackItem.dependencies);
+        stack.pop();
+      }
+      this.workset.delete(rootNodeId);
+    }
+  }
+};
+
+// src/shared/resolvers/state.ts
+var StateResolver = class extends GraphResolver {
+  getNodeDependencies(node) {
+    return node.operationStatus?.dependencyIds ?? [];
+  }
+  processNode() {
+    return;
+  }
+};
+
+// src/shared/resolvers/input.ts
+import {
+  isUnitModel
+} from "@highstate/contract";
+import { fromEntries, mapValues } from "remeda";
+var InputResolver = class extends GraphResolver {
+  getNodeDependencies(node) {
+    const dependencies = [];
+    if (node.kind === "hub") {
+      for (const input of node.hub.inputs ?? []) {
+        dependencies.push(`instance:${input.instanceId}`);
+      }
+      for (const input of node.hub.injectionInputs ?? []) {
+        dependencies.push(`hub:${input.hubId}`);
+      }
+      return dependencies;
+    }
+    for (const inputs of Object.values(node.instance.inputs ?? {})) {
+      for (const input of inputs) {
+        dependencies.push(`instance:${input.instanceId}`);
+      }
+    }
+    for (const inputs of Object.values(node.instance.hubInputs ?? {})) {
+      for (const input of inputs) {
+        dependencies.push(`hub:${input.hubId}`);
+      }
+    }
+    for (const input of node.instance.injectionInputs ?? []) {
+      dependencies.push(`hub:${input.hubId}`);
+    }
+    return dependencies;
+  }
+  processNode(node) {
+    const getHubOutput = (input) => {
+      const output = this.outputs.get(`hub:${input.hubId}`);
+      if (!output) {
+        return { resolvedInputs: [] };
+      }
+      if (output.kind !== "hub") {
+        throw new Error("Expected hub node");
+      }
+      return output;
+    };
+    const getInstanceOutput = (input) => {
+      const output = this.outputs.get(`instance:${input.instanceId}`);
+      if (!output) {
+        return {
+          component: null,
+          resolvedInputs: [],
+          resolvedOutputs: []
+        };
+      }
+      if (output.kind !== "instance") {
+        throw new Error("Expected instance node");
+      }
+      return {
+        component: output.component,
+        resolvedInputs: output.resolvedInputs[input.output] ?? [],
+        resolvedOutputs: output.resolvedOutputs?.[input.output]
+      };
+    };
+    if (node.kind === "hub") {
+      const hubResult = /* @__PURE__ */ new Map();
+      const addHubResult = (input) => {
+        hubResult.set(`${input.input.instanceId}:${input.input.output}`, input);
+      };
+      for (const input of node.hub.inputs ?? []) {
+        const { component } = getInstanceOutput(input);
+        const componentInput = component?.outputs[input.output];
+        if (!componentInput) {
+          this.logger.warn({ msg: "output not found in the component", input, component });
+          continue;
+        }
+        addHubResult({ input, type: componentInput.type });
+      }
+      for (const injectionInput of node.hub.injectionInputs ?? []) {
+        const { resolvedInputs: resolvedInputs2 } = getHubOutput(injectionInput);
+        for (const input of resolvedInputs2) {
+          addHubResult(input);
+        }
+      }
+      return {
+        kind: "hub",
+        resolvedInputs: Array.from(hubResult.values())
+      };
+    }
+    if (node.instance.resolvedInputs) {
+      return {
+        kind: "instance",
+        instance: node.instance,
+        component: node.component,
+        resolvedInputs: mapValues(node.instance.resolvedInputs, (inputs, inputName) => {
+          const componentInput = node.component.inputs[inputName];
+          if (!componentInput) {
+            this.logger.warn({
+              msg: "input not found in the component",
+              inputName,
+              component: node.component
+            });
+            return [];
+          }
+          return inputs.map((input) => ({ input, type: componentInput.type }));
+        }),
+        resolvedOutputs: node.instance.resolvedOutputs ?? {},
+        resolvedInjectionInputs: [],
+        matchedInjectionInputs: []
+      };
+    }
+    const resolvedInputsMap = /* @__PURE__ */ new Map();
+    const addInstanceResult = (inputName, input) => {
+      let inputs = resolvedInputsMap.get(inputName);
+      if (!inputs) {
+        inputs = /* @__PURE__ */ new Map();
+        resolvedInputsMap.set(inputName, inputs);
+      }
+      inputs.set(`${input.input.instanceId}:${input.input.output}`, input);
+    };
+    const addInstanceInput = (inputName, input) => {
+      const componentInput = node.component.inputs[inputName];
+      if (!componentInput) {
+        this.logger.warn({
+          msg: "input not found in the component",
+          input,
+          component: node.component
+        });
+        return;
+      }
+      const { component, resolvedOutputs } = getInstanceOutput(input);
+      if (!component) {
+        this.logger.warn({ instanceId: node.instance.id, input }, "no output found for the input");
+        return;
+      }
+      if (isUnitModel(component)) {
+        addInstanceResult(inputName, { input, type: componentInput.type });
+        return;
+      }
+      if (resolvedOutputs) {
+        for (const output of resolvedOutputs) {
+          addInstanceResult(inputName, { input: output, type: componentInput.type });
+        }
+      } else {
+        addInstanceResult(inputName, { input, type: componentInput.type });
+      }
+    };
+    for (const [inputName, inputs] of Object.entries(node.instance.inputs ?? {})) {
+      for (const input of inputs) {
+        addInstanceInput(inputName, input);
+      }
+    }
+    const injectionInputs = /* @__PURE__ */ new Map();
+    const matchedInjectionInputs = /* @__PURE__ */ new Map();
+    for (const injectionInput of node.instance.injectionInputs ?? []) {
+      const { resolvedInputs: resolvedInputs2 } = getHubOutput(injectionInput);
+      for (const input of resolvedInputs2) {
+        injectionInputs.set(`${input.input.instanceId}:${input.input.output}`, input);
+      }
+    }
+    for (const [inputName, componentInput] of Object.entries(node.component.inputs ?? {})) {
+      const allInputs = new Map(injectionInputs);
+      const hubInputs = node.instance.hubInputs?.[inputName] ?? [];
+      for (const hubInput of hubInputs) {
+        const { resolvedInputs: resolvedInputs2 } = getHubOutput(hubInput);
+        for (const input of resolvedInputs2) {
+          allInputs.set(`${input.input.instanceId}:${input.input.output}`, input);
+        }
+      }
+      for (const input of allInputs.values()) {
+        if (input.type === componentInput.type) {
+          addInstanceInput(inputName, input.input);
+          const key = `${input.input.instanceId}:${input.input.output}`;
+          if (injectionInputs.has(key)) {
+            matchedInjectionInputs.set(key, input);
+          }
+        }
+      }
+    }
+    const resolvedInputs = fromEntries(
+      Array.from(resolvedInputsMap.entries()).map(([inputName, inputs]) => [
+        inputName,
+        Array.from(inputs.values())
+      ])
+    );
+    return {
+      kind: "instance",
+      instance: node.instance,
+      component: node.component,
+      resolvedInputs,
+      resolvedOutputs: node.instance.resolvedOutputs,
+      resolvedInjectionInputs: Array.from(injectionInputs.values()),
+      matchedInjectionInputs: Array.from(matchedInjectionInputs.values())
+    };
+  }
+};
+function getResolvedHubInputs(output) {
+  if (output.kind !== "hub") {
+    throw new Error("Expected hub node");
+  }
+  return output.resolvedInputs;
+}
+function getResolvedInstanceInputs(output) {
+  if (output.kind !== "instance") {
+    throw new Error("Expected instance node");
+  }
+  return output.resolvedInputs;
+}
+function getResolvedInjectionInstanceInputs(output) {
+  if (output.kind !== "instance") {
+    throw new Error("Expected instance node");
+  }
+  return output.resolvedInjectionInputs;
+}
+function getMatchedInjectionInstanceInputs(output) {
+  if (output.kind !== "instance") {
+    throw new Error("Expected instance node");
+  }
+  return output.matchedInjectionInputs;
+}
+
+// src/shared/resolvers/input-hash.ts
+import { isUnitModel as isUnitModel2 } from "@highstate/contract";
+import { crc32 } from "@aws-crypto/crc32";
+import { encode } from "@msgpack/msgpack";
+import { sha256 } from "@noble/hashes/sha2";
+import { bytesToHex } from "@noble/ciphers/utils";
+
+// src/shared/utils/promise-tracker.ts
+var PromiseTracker = class {
+  trackedPromises = /* @__PURE__ */ new Set();
+  /**
+   * Tracks a promise to ensure its rejection is handled inside the tracker's scope.
+   */
+  track(promise) {
+    this.trackedPromises.add(promise);
+    void promise.finally(() => this.trackedPromises.delete(promise));
+  }
+  /**
+   * Waits for all tracked promises to resolve or reject.
+   */
+  async waitForAll() {
+    if (this.trackedPromises.size === 0) {
+      return;
+    }
+    await Promise.allSettled(this.trackedPromises);
+  }
+};
+
+// src/shared/utils/async-batcher.ts
+function createAsyncBatcher(fn, { waitMs = 100, maxWaitTimeMs = 1e3 } = {}) {
+  let batch = [];
+  let activeTimeout = null;
+  let maxWaitTimeout = null;
+  let firstCallTimestamp = null;
+  async function processBatch() {
+    if (batch.length === 0) return;
+    const currentBatch = batch;
+    batch = [];
+    await fn(currentBatch);
+    if (maxWaitTimeout) {
+      clearTimeout(maxWaitTimeout);
+      maxWaitTimeout = null;
+    }
+    firstCallTimestamp = null;
+  }
+  function schedule() {
+    if (activeTimeout) clearTimeout(activeTimeout);
+    activeTimeout = setTimeout(() => {
+      activeTimeout = null;
+      void processBatch();
+    }, waitMs);
+    if (!firstCallTimestamp) {
+      firstCallTimestamp = Date.now();
+      maxWaitTimeout = setTimeout(() => {
+        if (activeTimeout) clearTimeout(activeTimeout);
+        activeTimeout = null;
+        void processBatch();
+      }, maxWaitTimeMs);
+    }
+  }
+  return {
+    /**
+     * Add an item to the batch.
+     */
+    call(item) {
+      batch.push(item);
+      schedule();
+    },
+    /**
+     * Immediately flush the pending batch (if any).
+     */
+    async flush() {
+      if (activeTimeout) {
+        clearTimeout(activeTimeout);
+        activeTimeout = null;
+      }
+      if (maxWaitTimeout) {
+        clearTimeout(maxWaitTimeout);
+        maxWaitTimeout = null;
+      }
+      await processBatch();
+    }
+  };
+}
+
+// src/shared/utils/hash.ts
+function int32ToBytes(value) {
+  const buffer = new ArrayBuffer(4);
+  const view = new DataView(buffer);
+  view.setInt32(0, value, true);
+  return new Uint8Array(buffer);
+}
+
+// src/shared/resolvers/input-hash.ts
+var InputHashResolver = class extends GraphResolver {
+  getNodeDependencies({ resolvedInputs }) {
+    const dependencies = [];
+    for (const inputs of Object.values(resolvedInputs ?? {})) {
+      for (const input of inputs) {
+        dependencies.push(input.input.instanceId);
+      }
+    }
+    return dependencies;
+  }
+  processNode({
+    instance,
+    component,
+    resolvedInputs,
+    sourceHash,
+    state
+  }) {
+    const inputHashSink = [];
+    inputHashSink.push(int32ToBytes(component.definitionHash));
+    if (state?.operationStatus?.inputHashNonce) {
+      inputHashSink.push(int32ToBytes(state.operationStatus.inputHashNonce));
+    }
+    if (instance.args) {
+      inputHashSink.push(encode(instance.args));
+    }
+    if (sourceHash) {
+      inputHashSink.push(int32ToBytes(sourceHash));
+    } else if (isUnitModel2(component)) {
+      this.logger.warn(
+        { instanceId: instance.id },
+        "missing source hash for unit model, this may lead to incorrect input hash"
+      );
+    }
+    const sortedInputs = Object.entries(resolvedInputs).sort(([a], [b]) => a.localeCompare(b));
+    const dependencyInstanceIds = /* @__PURE__ */ new Set();
+    for (const [inputKey, inputs] of sortedInputs) {
+      if (Object.keys(inputs).length === 0) {
+        continue;
+      }
+      inputHashSink.push(Buffer.from(inputKey));
+      const instanceIds = inputs.map((input) => input.input.instanceId).sort();
+      for (const instanceId of instanceIds) {
+        const dependency = this.outputs.get(instanceId);
+        if (!dependency) continue;
+        inputHashSink.push(int32ToBytes(dependency.inputHash));
+        inputHashSink.push(Buffer.from(dependency.outputHash));
+        dependencyInstanceIds.add(instanceId);
+      }
+    }
+    const dependencyOutputHashSink = [];
+    const sortedDependencyInstanceIds = Array.from(dependencyInstanceIds).sort();
+    for (const dependencyInstanceId of sortedDependencyInstanceIds) {
+      const dependency = this.outputs.get(dependencyInstanceId);
+      if (!dependency) continue;
+      dependencyOutputHashSink.push(Buffer.from(dependencyInstanceId));
+    }
+    return {
+      inputHash: crc32(Buffer.concat(inputHashSink)),
+      dependencyOutputHash: bytesToHex(sha256(Buffer.concat(dependencyOutputHashSink))),
+      outputHash: state?.operationStatus?.outputHash ?? ""
+    };
+  }
+};
+
+// src/shared/resolvers/validation.ts
+import { isUnitModel as isUnitModel3 } from "@highstate/contract";
+import { Ajv } from "ajv";
+import styles from "ansi-styles";
+var ValidationResolver = class extends GraphResolver {
+  getNodeDependencies({ resolvedInputs }) {
+    const dependencies = [];
+    for (const inputs of Object.values(resolvedInputs)) {
+      for (const input of inputs) {
+        dependencies.push(input.input.instanceId);
+      }
+    }
+    return dependencies;
+  }
+  processNode({ instance, component, state, resolvedInputs }) {
+    const ajv = new Ajv({ strict: false });
+    this.logger.debug({ instanceId: instance.id }, "validating instance");
+    const validationErrors = [];
+    for (const [name, argument] of Object.entries(component.args)) {
+      if (!argument.required && !instance.args?.[name]) {
+        continue;
+      }
+      if (!ajv.validate(argument.schema, instance.args?.[name])) {
+        this.logger.debug({ instanceId: instance.id, argumentName: name }, "invalid argument");
+        validationErrors.push(
+          `Invalid argument "${styles.blueBright.open}${name}${styles.reset.close}": ` + ajv.errorsText()
+        );
+      }
+    }
+    if (isUnitModel3(component)) {
+      for (const [secret, secretSchema2] of Object.entries(component.secrets)) {
+        if (secretSchema2.required && !state?.secretNames?.includes(secret)) {
+          validationErrors.push(
+            `Missing required secret "${styles.blueBright.open}${secret}${styles.reset.close}"`
+          );
+        }
+      }
+    }
+    for (const [key, inputs] of Object.entries(resolvedInputs)) {
+      for (const input of inputs) {
+        const inputInstance = this.outputs.get(input.input.instanceId);
+        if (inputInstance?.status !== "ok") {
+          validationErrors.push(
+            `Invalid input "${styles.blueBright.open}${key}${styles.reset.close}":
+"${styles.blueBright.open}${input.input.instanceId}${styles.reset.close}" has validation errors`
+          );
+        }
+      }
+    }
+    for (const [name, input] of Object.entries(component.inputs)) {
+      if (!input.required) {
+        continue;
+      }
+      if (!resolvedInputs[name] || !resolvedInputs[name].length) {
+        validationErrors.push(
+          `Missing required input "${styles.blueBright.open}${name}${styles.reset.close}" of type "${styles.greenBright.open}${input.type}${styles.reset.close}"`
+        );
+      }
+    }
+    if (validationErrors.length === 0) {
+      return { status: "ok" };
+    }
+    const numberPrefixLength = (validationErrors.length + 1).toString().length + 2;
+    const formattedError = validationErrors.map((error, index) => {
+      const lines = error.split("\n");
+      const prefix = `${index + 1}. `;
+      return lines.map((line, lineIndex) => {
+        const linePrefix = lineIndex === 0 ? prefix : " ".repeat(numberPrefixLength);
+        return `${linePrefix}${line}`;
+      }).join("\r\n");
+    }).join("\r\n");
+    return {
+      status: "error",
+      errorText: formattedError
+    };
+  }
+};
+
+// src/shared/resolvers/registry.ts
+var resolverFactories = {
+  InputResolver,
+  InputHashResolver,
+  ValidationResolver,
+  StateResolver
+};
+
+export {
+  userObjectMetaSchema,
+  objectMetaSchema,
+  hasObjectMeta,
+  collectionQuerySchema,
+  positionSchema,
+  instanceInputSchema,
+  hubInstanceInputSchema,
+  instanceModelPatchSchema,
+  instanceModelSchema,
+  compositeInstanceSchema,
+  compositeInstanceEventSchema,
+  hubModelPatchSchema,
+  hubModelSchema,
+  instanceOperationStatusEnumSchema,
+  instanceOperationStatusSchema,
+  instanceEvaludationStatusEnumSchema,
+  instanceEvaluationStatusSchema,
+  WellKnownInstanceCustomStatus,
+  instanceCustomStatusSchema,
+  instanceStatusFieldValueSchema,
+  instanceStatusFieldSchema,
+  unitInstanceStatusFieldSchema,
+  instanceStateExtraSchema,
+  instanceStateSchema,
+  instanceStatePatchSchema,
+  applyStatePatch,
+  isStateEmpty,
+  isTransientOperationStatus,
+  isStableOperationStatus,
+  instanceStateEventSchema,
+  operationTypeSchema,
+  operationStatusSchema,
+  operationOptionsSchema,
+  operationRequestSchema,
+  operationSchema,
+  isFinalOperationStatus,
+  operationLogEntrySchema,
+  operationEventSchema,
+  artifactUsageSchema,
+  compareArtifactUsage,
+  fileMetaSchema,
+  artifactSchema,
+  unitArtifactSchema,
+  fileContentSchema,
+  fileSchema,
+  terminalSchema,
+  terminalSpecSchema,
+  unitTerminalSchema,
+  terminalSessionSchema,
+  pageBlockSchema,
+  pageSchema,
+  pageContentSchema,
+  unitPageSchema,
+  triggerSpecSchema,
+  triggerSchema,
+  unitTriggerSchema,
+  triggerInvocationSchema,
+  unlockMethodType,
+  unlockMethodSchema,
+  secretDescriptorSchema,
+  secretSchema,
+  formatSecretDescriptor,
+  parseSecretDescriptor,
+  WellKnownSecretDescriptors,
+  instanceLockSpecSchema,
+  instanceLockSchema,
+  compareInstanceLockSpecs,
+  instanceLockEventSchema,
+  metaSchema,
+  entitySchema,
+  componentMetaSchema,
+  componentArgumentSchema,
+  componentInputSchema,
+  componentModelSchema,
+  serviceAccountSchema,
+  workerStatus,
+  workerSchema,
+  workerUnitRegistrationSchema,
+  unitWorkerSchema,
+  getWorkerIdentity,
+  instanceActionSchema,
+  serviceAccountActionSchema,
+  projectAccessScope,
+  projectApiKeySchema,
+  validateInstanceAccess,
+  projectAccessActionDescriptions,
+  projectSchema,
+  projectModelSchema,
+  projectUnlockSuiteSchema,
+  projectUnlockStateSchema,
+  diffLibraries,
+  applyLibraryUpdate,
+  backendUnlockMethodSchema,
+  AccessError,
+  GraphResolver,
+  InputResolver,
+  getResolvedHubInputs,
+  getResolvedInstanceInputs,
+  getResolvedInjectionInstanceInputs,
+  getMatchedInjectionInstanceInputs,
+  PromiseTracker,
+  createAsyncBatcher,
+  int32ToBytes,
+  InputHashResolver,
+  ValidationResolver,
+  resolverFactories
+};
+//# sourceMappingURL=chunk-WHALQHEZ.js.map