@highstate/backend 0.9.18 → 0.9.19

package/dist/chunk-5WVU2AK4.js

@@ -0,0 +1,1535 @@
+import { z, commonObjectMetaSchema, genericNameSchema, timestampsSchema, objectMetaSchema, serviceAccountMetaSchema, instanceIdSchema, instanceModelSchema, hubModelSchema, pageBlockSchema, globalCommonObjectMetaSchema, terminalSpecSchema, isUnitModel, parseArgumentValue } from '@highstate/contract';
+import { z as z$1 } from 'zod';
+import { mapValues, constant, unique, fromEntries } from 'remeda';
+import { crc32 } from '@aws-crypto/crc32';
+import { encode } from '@msgpack/msgpack';
+import { Ajv } from 'ajv';
+import styles from 'ansi-styles';
+
+// src/shared/models/backend/library.ts
+var librarySpecSchema = z.discriminatedUnion("type", [
+  z.object({
+    type: z.literal("host")
+  })
+]);
+function diffLibraries(oldLibrary, newLibrary) {
+  const updates = [];
+  for (const [componentType, newComponent] of Object.entries(newLibrary.components)) {
+    const existingComponent = oldLibrary.components[componentType];
+    if (existingComponent?.definitionHash !== newComponent.definitionHash) {
+      updates.push({ type: "component-updated", component: newComponent });
+    }
+  }
+  for (const componentType of Object.keys(oldLibrary.components)) {
+    if (!newLibrary.components[componentType]) {
+      updates.push({ type: "component-removed", componentType });
+    }
+  }
+  for (const [entityType, newEntity] of Object.entries(newLibrary.entities)) {
+    const existingEntity = oldLibrary.entities[entityType];
+    if (existingEntity?.definitionHash !== newEntity.definitionHash) {
+      updates.push({ type: "entity-updated", entity: newEntity });
+    }
+  }
+  for (const entityType of Object.keys(oldLibrary.entities)) {
+    if (!newLibrary.entities[entityType]) {
+      updates.push({ type: "entity-removed", entityType });
+    }
+  }
+  return updates;
+}
+function applyLibraryUpdate(components, entities, update) {
+  switch (update.type) {
+    case "component-updated":
+      components[update.component.type] = update.component;
+      break;
+    case "entity-updated":
+      entities[update.entity.type] = update.entity;
+      break;
+    case "component-removed":
+      delete components[update.componentType];
+      break;
+    case "entity-removed":
+      delete entities[update.entityType];
+      break;
+  }
+}
+
+// src/shared/models/backend/well-known.ts
+var globalProjectSpace = {
+  id: "q8xbilhwpsn65zjlv5kz44qh",
+  meta: {
+    title: "Global Project Space",
+    description: "The default project space for all projects.",
+    icon: "mdi-earth",
+    iconColor: "#4CAF50"
+  }
+};
+var codebaseLibrary = {
+  id: "n0rfvpl9o77iqf29ff4kk5gf",
+  meta: {
+    title: "Codebase Library",
+    description: "The library which loads components and entities from packages (local or NPM-installed) in the codebase.",
+    icon: "mdi-package-variant",
+    iconColor: "#2196F3"
+  },
+  spec: { type: "host" }
+};
+var hostPulumiBackend = {
+  id: "pmn9y901jeiz2ydh93045l39",
+  meta: {
+    title: "Host Pulumi Backend",
+    description: "The Pulumi backend which will always use the Pulumi CLI configured on the host."
+  },
+  spec: { type: "host" }
+};
+var codebaseProjectModelStorage = {
+  id: "qppfcerovu3h22o0x8rlpc3g",
+  meta: {
+    title: "Codebase Model Storage",
+    description: "The storage which stores project model in the codebase.",
+    icon: "mdi-code-json"
+  },
+  spec: { type: "codebase" }
+};
+var databaseProjectModelStorage = {
+  id: "rmi0hmo1tjjsyfry9l178fus",
+  meta: {
+    title: "Database Model Storage",
+    description: "The storage which stores project model in the database alongside the project state.",
+    icon: "mdi-database"
+  },
+  spec: { type: "database" }
+};
+
+// src/shared/models/backend/project.ts
+var projectModelStorageSpecSchema = z.discriminatedUnion("type", [
+  z.object({
+    /**
+     * The project model is stored in the codebase where Highstate is running.
+     */
+    type: z.literal("codebase")
+  }),
+  z.object({
+    /**
+     * The project model is stored in the project database alongside the project data.
+     */
+    type: z.literal("database")
+  })
+]);
+var projectInputSchema = z.object({
+  name: genericNameSchema,
+  spaceId: z.cuid2().default(globalProjectSpace.id),
+  modelStorageId: z.cuid2().default(codebaseProjectModelStorage.id),
+  libraryId: z.cuid2().default(codebaseLibrary.id),
+  pulumiBackendId: z.cuid2().default(hostPulumiBackend.id),
+  meta: commonObjectMetaSchema
+});
+var projectOutputSchema = z.object({
+  id: z.string(),
+  name: genericNameSchema,
+  meta: commonObjectMetaSchema,
+  spaceId: z.cuid2(),
+  modelStorageId: z.cuid2(),
+  libraryId: z.cuid2(),
+  pulumiBackendId: z.cuid2(),
+  ...timestampsSchema.shape
+});
+var projectUnlockSuiteSchema = z.object({
+  /**
+   * The list of encrypted AGE identities that can be used to decrypt the master key of the project.
+   *
+   * The frontend should try to decrypt at least one of these identities
+   * using the password or passkey.
+   */
+  encryptedIdentities: z.array(z.string()),
+  /**
+   * Whether one of the identities is a passkey and user should be asked to use it.
+   */
+  hasPasskey: z.boolean()
+});
+var projectUnlockStateSchema = z.discriminatedUnion("type", [
+  z.object({
+    type: z.literal("locked"),
+    unlockSuite: projectUnlockSuiteSchema.optional()
+  }),
+  z.object({
+    type: z.literal("unlocked")
+  })
+]);
+var pulumiBackendSpecSchema = z.discriminatedUnion("type", [
+  z.object({
+    /**
+     * Use the Pulumi backend configured on the host where Highstate backend is running.
+     *
+     * The backend is expected to be configured with the `pulumi login` command by the user.
+     */
+    type: z.literal("host")
+  })
+]);
+var backendUnlockMethodSchema = z$1.object({
+  id: z$1.string(),
+  meta: objectMetaSchema,
+  /**
+   * The AGE recipient of the unlock method to use to encrypt the master key for this unlock method.
+   */
+  recipient: z$1.string()
+});
+function hasObjectMeta(value) {
+  return typeof value === "object" && value !== null && "meta" in value;
+}
+var sortBySchema = z$1.object({
+  key: z$1.string(),
+  order: z$1.enum(["asc", "desc"])
+});
+var collectionQuerySchema = z$1.object({
+  /**
+   * The search string to filter documents by display name, description, or other text fields.
+   */
+  search: z$1.string().optional(),
+  /**
+   * The sorting configuration for the results.
+   *
+   * Can be a single sort field or an array of sort fields.
+   * Each sort field contains the key and order.
+   */
+  sortBy: z$1.array(sortBySchema).optional(),
+  /**
+   * The number of items to skip.
+   *
+   * Defaults to 0 if not specified.
+   */
+  skip: z$1.number().int().nonnegative().default(0).optional(),
+  /**
+   * The count of documents to return.
+   *
+   * Defaults to 20 if not specified.
+   * Maximum value is 100.
+   */
+  count: z$1.number().int().positive().max(100).default(20).optional()
+});
+function collectionQueryResult(schema) {
+  return z$1.object({
+    items: z$1.array(schema),
+    total: z$1.number().int().nonnegative()
+  });
+}
+function forSchema(schema) {
+  return mapValues(schema.shape, constant(true));
+}
+
+// src/shared/models/errors.ts
+var BackendError = class extends Error {
+  constructor(message, cause) {
+    super(message, { cause });
+    this.name = "BackendError";
+  }
+};
+var AccessError = class extends BackendError {
+  constructor(message) {
+    super(message);
+    this.name = "AccessError";
+  }
+};
+var ProjectLockedError = class extends AccessError {
+  constructor(projectId) {
+    super(`The project with ID "${projectId}" is locked, decryption is not possible.`);
+  }
+};
+var ProjectNotFoundError = class extends BackendError {
+  constructor(projectId) {
+    super(`Project with ID "${projectId}" not found.`);
+    this.name = "ProjectNotFoundError";
+  }
+};
+var CannotDeleteLastUnlockMethodError = class extends BackendError {
+  constructor(projectId) {
+    super(`Refused to delete the last unlock method for project "${projectId}".`);
+    this.name = "CannotDeleteLastUnlockMethodError";
+  }
+};
+var InstanceNotFoundError = class extends BackendError {
+  constructor(projectId, instanceId) {
+    super(`Instance with ID "${instanceId}" not found in project "${projectId}".`);
+    this.name = "InstanceNotFoundError";
+  }
+};
+var InvalidInstanceKindError = class extends BackendError {
+  constructor(projectId, instanceId, expectedKind, actualKind) {
+    super(
+      `Instance "${instanceId}" in project "${projectId}" has kind "${actualKind}", but expected "${expectedKind}".`
+    );
+    this.name = "InvalidInstanceKindError";
+  }
+};
+var OperationNotFoundError = class extends BackendError {
+  constructor(projectId, operationId) {
+    super(`Operation with ID "${operationId}" not found in project "${projectId}".`);
+    this.name = "OperationNotFoundError";
+  }
+};
+var InstanceLockLostError = class extends BackendError {
+  constructor(projectId, instanceIds, token) {
+    super(
+      `Instance lock lost for instances [${instanceIds.join(", ")}] in project "${projectId}" with token "${token}".`
+    );
+    this.name = "InstanceLockLostError";
+  }
+};
+var InstanceStateNotFoundError = class extends BackendError {
+  constructor(projectId, instanceId) {
+    super(`State for instance with ID "${instanceId}" not found in project "${projectId}".`);
+    this.name = "InstanceStateNotFoundError";
+  }
+};
+var InstanceLockedError = class extends BackendError {
+  constructor(projectId, instanceId) {
+    super(`Instance with ID "${instanceId}" in project "${projectId}" is locked.`);
+    this.name = "InstanceLockedError";
+  }
+};
+var WorkerVersionNotFoundError = class extends BackendError {
+  constructor(projectId, workerVersionId) {
+    super(`Worker version with ID "${workerVersionId}" not found in project "${projectId}".`);
+    this.name = "WorkerVersionNotFoundError";
+  }
+};
+var apiKeyMetaSchema = objectMetaSchema.pick({
+  title: true,
+  description: true
+}).required({ title: true });
+var apiKeyOutputSchema = z.object({
+  id: z.cuid2(),
+  meta: commonObjectMetaSchema,
+  serviceAccountId: z.cuid2(),
+  serviceAccountMeta: serviceAccountMetaSchema.nullable(),
+  createdAt: z.date()
+});
+var apiKeyQuerySchema = collectionQuerySchema.extend({
+  serviceAccountId: z.string().optional()
+});
+function toApiKeyOutput(apiKey, serviceAccount) {
+  return {
+    ...apiKey,
+    serviceAccountMeta: serviceAccount?.meta ?? null
+  };
+}
+var artifactOutputSchema = z$1.object({
+  id: z$1.cuid2(),
+  hash: z$1.string(),
+  size: z$1.number(),
+  meta: commonObjectMetaSchema,
+  createdAt: z$1.date(),
+  updatedAt: z$1.date()
+});
+var artifactQuerySchema = collectionQuerySchema.extend({
+  stateId: z$1.string().optional(),
+  serviceAccountId: z$1.string().optional(),
+  terminalId: z$1.string().optional(),
+  pageId: z$1.string().optional()
+});
+var instanceCustomStatusInputSchema = z$1.object({
+  name: z$1.string(),
+  meta: commonObjectMetaSchema,
+  value: z$1.string(),
+  message: z$1.string().optional(),
+  order: z$1.number().min(0).max(100).optional()
+});
+var instanceLockOutputSchema = z$1.object({
+  stateId: z$1.cuid2(),
+  meta: commonObjectMetaSchema,
+  acquiredAt: z$1.date()
+});
+var instanceLockEventSchema = z$1.discriminatedUnion("type", [
+  z$1.object({
+    type: z$1.literal("locked"),
+    locks: instanceLockOutputSchema.array()
+  }),
+  z$1.object({
+    type: z$1.literal("unlocked"),
+    stateIds: z$1.array(z$1.string())
+  })
+]);
+var projectModelEventSchema = z$1.object({
+  updatedInstances: instanceModelSchema.array().optional(),
+  updatedHubs: hubModelSchema.array().optional(),
+  updatedVirtualInstances: instanceModelSchema.array().optional(),
+  updatedGhostInstances: instanceModelSchema.array().optional(),
+  deletedInstanceIds: instanceIdSchema.array().optional(),
+  deletedHubIds: z$1.string().array().optional(),
+  deletedVirtualInstanceIds: instanceIdSchema.array().optional(),
+  deletedGhostInstanceIds: instanceIdSchema.array().optional()
+});
+var operationPhaseTypeSchema = z.enum(["destroy", "update", "refresh"]);
+var operationPhaseInstanceSchema = z.object({
+  /**
+   * The ID of the instance.
+   */
+  id: instanceIdSchema,
+  /**
+   * The parent ID of the instance, either from the model or the state.
+   */
+  parentId: z.string().optional(),
+  /**
+   * Human-readable explanation of the decision.
+   * */
+  message: z.string()
+});
+var operationPhaseSchema = z.object({
+  /**
+   * Type of phase being executed.
+   */
+  type: operationPhaseTypeSchema,
+  /**
+   * List of instances to be processed in this phase.
+   */
+  instances: z.array(operationPhaseInstanceSchema)
+});
+var operationOptionsSchema = z.object({
+  /**
+   * Force update all dependencies regardless of their current state.
+   *
+   * **Operation Behavior Impact:**
+   * - bypasses hash-based change detection for dependency chains;
+   * - includes **ALL** dependencies (up-to-date, out-of-date, and error states);
+   * - traverses the entire dependency graph from requested instances.
+   *
+   * **Usage with other options:**
+   * - combined with `forceUpdateChildren`: updates entire dependency tree **AND** all composite children;
+   * - independent of `allowPartialCompositeInstanceCreation`: affects dependency traversal, not composite logic.
+   */
+  forceUpdateDependencies: z.boolean().default(false),
+  /**
+   * Force update all children of composite instances regardless of their state.
+   *
+   * **Operation Behavior Impact:**
+   * - overrides selective child inclusion logic for composites;
+   * - includes **ALL** children of affected composites (up-to-date, out-of-date, and error states);
+   * - applied after dependency traversal and parent inclusion.
+   *
+   * **Usage with other options:**
+   * - combined with `forceUpdateDependencies`: creates comprehensive force-update behavior;
+   * - overrides `allowPartialCompositeInstanceCreation`: when enabled, **ALL** children are included regardless of existence.
+   */
+  forceUpdateChildren: z.boolean().default(false),
+  /**
+   * Include dependent instances when destroying instances.
+   *
+   * **Operation Behavior Impact:**
+   * - extends destroy operations to include instances that depend on the target;
+   * - traverses the dependency graph in reverse (dependents, not dependencies);
+   * - prevents orphaned instances that would fail without their dependencies.
+   *
+   * **Usage with other options:**
+   * - works with `invokeDestroyTriggers`: ensures triggers run for all dependents;
+   * - independent of update-related options.
+   */
+  destroyDependentInstances: z.boolean().default(true),
+  /**
+   * Execute destroy triggers when destroying instances.
+   *
+   * **Operation Behavior Impact:**
+   * - affects how individual units are destroyed (triggers vs direct deletion);
+   * - does not change which instances are selected for destruction;
+   * - controls trigger execution during the destruction phase.
+   *
+   * **Usage with other options:**
+   * - used with `destroyDependentInstances`: ensures triggers run for cascade deletions;
+   * - independent of update-related options.
+   */
+  invokeDestroyTriggers: z.boolean().default(true),
+  /**
+   * Delete Pulumi resources that are no longer referenced in the state.
+   *
+   * **Operation Behavior Impact:**
+   * - does not affect which instances are selected for operations;
+   * - deletes orphaned Pulumi resources within individual instances.
+   *
+   * **Usage with other options:**
+   * - independent of instance selection options;
+   * - complements destroy-related options for thorough cleanup.
+   */
+  deleteUnreachableResources: z.boolean().default(false),
+  /**
+   * Force deletion of instance state even if the destroy operation fails.
+   *
+   * **Operation Behavior Impact:**
+   * - forces state deletion even when destroy operations fail;
+   * - does not affect which instances are selected for operations;
+   * - bypasses normal destroy procedures as emergency fallback.
+   *
+   * **Usage with other options:**
+   * - used with destroy-related options when normal cleanup fails;
+   * - should be used cautiously as it can create state inconsistencies.
+   */
+  forceDeleteState: z.boolean().default(false),
+  /**
+   * Allow partial update of composite instances without requiring all outdated children.
+   *
+   * **Operation Behavior Impact:**
+   * - controls whether composite operations must include all outdated children or only necessary ones;
+   * - when `false` (default): all outdated children of substantive composites are included in operations;
+   * - when `true`: only necessary children are included, allowing partial composite operations;
+   * - applied during composite child traversal phase for substantive composites only.
+   *
+   * **Usage with other options:**
+   * - overridden by `forceUpdateChildren`: when force is enabled, **ALL** children are included regardless;
+   * - independent of `forceUpdateDependencies`: affects composite logic, not dependency traversal.
+   */
+  allowPartialCompositeInstanceUpdate: z.boolean().default(false),
+  /**
+   * Allow partial destruction of composite instances during cascade operations.
+   *
+   * **Operation Behavior Impact:**
+   * - controls whether cascade destruction must include all children or only necessary ones;
+   * - when `false` (default): cascade destruction includes **ALL** children of affected composites;
+   * - when `true`: cascade destruction includes only directly dependent children;
+   * - does not affect explicit composite destruction (always destroys all children);
+   * - does not affect parent propagation when destroying sibling composites.
+   *
+   * **Usage with other options:**
+   * - works with `destroyDependentInstances`: controls completeness of cascade destruction;
+   * - independent of update-related options.
+   */
+  allowPartialCompositeInstanceDestruction: z.boolean().default(false),
+  /**
+   * Also refresh the state of instances during the operation.
+   *
+   * **Operation Behavior Impact:**
+   * - does not change which instances are selected for operations;
+   * - synchronizes state with actual infrastructure during the operation.
+   *
+   * **Usage with other options:**
+   * - additive with dependency resolution options: refreshes all selected instances;
+   * - works with both all operation types.
+   */
+  refresh: z.boolean().default(false)
+}).partial();
+var operationTypeSchema = z.enum([
+  "update",
+  "preview",
+  "destroy",
+  "recreate",
+  "refresh"
+]);
+var operationStatusSchema = z.enum([
+  "pending",
+  "running",
+  "failing",
+  "completed",
+  "failed",
+  "cancelled"
+]);
+var operationMetaSchema = objectMetaSchema.pick({
+  title: true,
+  description: true
+});
+var operationInputSchema = z.object({
+  projectId: z.string(),
+  type: operationTypeSchema,
+  instanceIds: z.array(instanceIdSchema).min(1),
+  options: operationOptionsSchema.partial().optional(),
+  meta: operationMetaSchema.optional(),
+  plan: operationPhaseSchema.array().optional()
+});
+var operationEventSchema = z.discriminatedUnion("type", [
+  z.object({
+    type: z.literal("updated"),
+    operation: z.custom()
+  }),
+  z.object({
+    type: z.literal("deleted"),
+    operationId: z.string()
+  })
+]);
+var operationOutputSchema = z.object({
+  id: z.cuid2(),
+  type: operationTypeSchema,
+  status: operationStatusSchema,
+  meta: operationMetaSchema,
+  startedAt: z.date(),
+  updatedAt: z.date(),
+  finishedAt: z.date().nullable()
+});
+var finalOperationStatuses = ["completed", "failed", "cancelled"];
+function isFinalOperationStatus(status) {
+  return finalOperationStatuses.includes(status);
+}
+function isTransientOperationStatus(status) {
+  return !!status && !finalOperationStatuses.includes(status);
+}
+var pageOutputSchema = z$1.object({
+  id: z$1.cuid2(),
+  meta: commonObjectMetaSchema,
+  name: z$1.string().nullable(),
+  stateId: z$1.cuid2().nullable(),
+  serviceAccountId: z$1.cuid2().nullable(),
+  serviceAccountMeta: serviceAccountMetaSchema.nullable(),
+  createdAt: z$1.date(),
+  updatedAt: z$1.date()
+});
+var pageQuerySchema = collectionQuerySchema.extend({
+  serviceAccountId: z$1.string().optional(),
+  stateId: z$1.string().optional(),
+  artifactId: z$1.string().optional()
+});
+var pageDetailsOutputSchema = z$1.object({
+  ...pageOutputSchema.shape,
+  content: z$1.array(pageBlockSchema)
+});
+function toPageOutput(page, serviceAccount) {
+  return {
+    ...page,
+    serviceAccountMeta: serviceAccount?.meta ?? null
+  };
+}
+var secretOutputSchema = z.object({
+  id: z.cuid2(),
+  meta: globalCommonObjectMetaSchema,
+  name: z.string().nullable(),
+  systemName: z.string().nullable(),
+  stateId: z.cuid2().nullable(),
+  serviceAccountId: z.cuid2().nullable(),
+  serviceAccountMeta: serviceAccountMetaSchema.nullable(),
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+var secretQuerySchema = collectionQuerySchema.extend({
+  serviceAccountId: z.string().optional(),
+  stateId: z.string().optional()
+});
+function toSecretOutput(secret, serviceAccount) {
+  return {
+    ...secret,
+    serviceAccountMeta: serviceAccount?.meta ?? null
+  };
+}
+var SystemSecretNames = /* @__PURE__ */ ((SystemSecretNames2) => {
+  SystemSecretNames2["PulumiPassword"] = "pulumi-password";
+  return SystemSecretNames2;
+})(SystemSecretNames || {});
+var serviceAccountOutputSchema = z.object({
+  id: z.cuid2(),
+  meta: serviceAccountMetaSchema,
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+var serviceAccountQuerySchema = collectionQuerySchema.extend({
+  artifactId: z.string().optional()
+});
+var instanceStateEventSchema = z$1.discriminatedUnion("type", [
+  z$1.object({
+    type: z$1.literal("updated"),
+    state: z$1.custom()
+  }),
+  z$1.object({
+    type: z$1.literal("patched"),
+    stateId: z$1.string(),
+    patch: z$1.custom()
+  }),
+  z$1.object({
+    type: z$1.literal("deleted"),
+    stateId: z$1.string()
+  })
+]);
+function isVirtualGhostInstance(state) {
+  if (state.source !== "virtual") return false;
+  if (state.status === "undeployed") return false;
+  return !state.evaluationState;
+}
+function isInstanceDeployed(state) {
+  return !!state && state.status !== "undeployed";
+}
+var finalInstanceOperationStatuses = [
+  "destroyed",
+  "updated",
+  "cancelled",
+  "destroyed",
+  "failed",
+  "skipped"
+];
+function isTransientInstanceOperationStatus(status) {
+  return !!status && !finalInstanceOperationStatuses.includes(status);
+}
+var workerUnitRegistrationEventSchema = z$1.discriminatedUnion("type", [
+  z$1.object({
+    type: z$1.literal("registered"),
+    instanceId: z$1.string(),
+    params: z$1.record(z$1.string(), z$1.unknown())
+  }),
+  z$1.object({
+    type: z$1.literal("deregistered"),
+    instanceId: z$1.string()
+  })
+]);
+var terminalStatusSchema = z$1.enum([
+  "active",
+  "unavailable"
+]);
+var terminalSessionOutputSchema = z$1.object({
+  id: z$1.cuid2(),
+  terminalId: z$1.cuid2(),
+  meta: commonObjectMetaSchema,
+  startedAt: z$1.date(),
+  finishedAt: z$1.date().nullable()
+});
+var terminalOutputSchema = z$1.object({
+  id: z$1.cuid2(),
+  name: z$1.string().nullable(),
+  meta: commonObjectMetaSchema,
+  status: terminalStatusSchema,
+  stateId: z$1.string().nullable(),
+  serviceAccountId: z$1.string().nullable(),
+  serviceAccountMeta: serviceAccountMetaSchema.nullable(),
+  createdAt: z$1.date(),
+  updatedAt: z$1.date()
+});
+var terminalQuerySchema = collectionQuerySchema.extend({
+  serviceAccountId: z$1.string().optional(),
+  stateId: z$1.string().optional(),
+  artifactId: z$1.string().optional()
+});
+function toTerminalOutput(terminal, serviceAccount) {
+  return {
+    ...terminal,
+    serviceAccountMeta: serviceAccount?.meta ?? null
+  };
+}
+function toTerminalDetailsOutput(terminal, serviceAccount) {
+  return {
+    ...terminal,
+    serviceAccountMeta: serviceAccount?.meta ?? null
+  };
+}
+var terminalDetailsOutputSchema = z$1.object({
+  ...terminalOutputSchema.shape,
+  spec: terminalSpecSchema
+});
+function toTerminalSessionOutput(terminal, session) {
+  return {
+    id: session.id,
+    terminalId: terminal.id,
+    meta: terminal.meta,
+    startedAt: session.startedAt,
+    finishedAt: session.finishedAt
+  };
+}
+var triggerOutputSchema = z$1.object({
+  id: z$1.cuid2(),
+  meta: commonObjectMetaSchema,
+  name: z$1.string(),
+  stateId: z$1.cuid2(),
+  createdAt: z$1.date(),
+  updatedAt: z$1.date()
+});
+var triggerQuerySchema = collectionQuerySchema.extend({
+  stateId: z$1.string().optional()
+});
+var unlockMethodType = z.enum(["password", "passkey"]);
+var unlockMethodMetaSchema = objectMetaSchema.pick({
+  title: true,
+  description: true
+}).required({ title: true });
+var unlockMethodInputSchema = z.object({
+  meta: unlockMethodMetaSchema,
+  type: unlockMethodType,
+  encryptedIdentity: z.string(),
+  recipient: z.string()
+});
+var unlockMethodOutputSchema = z.object({
+  id: z.cuid2(),
+  type: unlockMethodType,
+  meta: unlockMethodMetaSchema,
+  recipient: z.string(),
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+var MAX_WORKER_START_ATTEMPTS = 3;
+var SHA256_PREFIX = "sha256:";
+var SHA256_REGEX = /^[a-f0-9]{64}$/;
+function extractDigestFromImage(image) {
+  const atIndex = image.indexOf("@");
+  if (atIndex === -1) {
+    throw new Error(`Invalid worker image "${image}": missing digest.`);
+  }
+  const digestPart = image.slice(atIndex + 1);
+  if (!digestPart.startsWith(SHA256_PREFIX)) {
+    throw new Error(`Invalid worker image "${image}": digest must start with "sha256:".`);
+  }
+  const digest = digestPart.slice(SHA256_PREFIX.length).toLowerCase();
+  if (!SHA256_REGEX.test(digest)) {
+    throw new Error(`Invalid worker image "${image}": digest must be 64 hex chars.`);
+  }
+  return digest;
+}
+function getWorkerIdentity(image) {
+  const atIndex = image.indexOf("@");
+  const withoutDigest = atIndex === -1 ? image : image.slice(0, atIndex);
+  const lastColon = withoutDigest.lastIndexOf(":");
+  const lastSlash = withoutDigest.lastIndexOf("/");
+  if (lastColon > -1 && lastColon > lastSlash) {
+    return withoutDigest.slice(0, lastColon);
+  }
+  return withoutDigest;
+}
+var workerVersionStatusSchema = z$1.enum([
+  "unknown",
+  "starting",
+  "running",
+  "stopping",
+  "stopped",
+  "error"
+]);
+var workerVersionOutputSchema = z$1.object({
+  id: z$1.cuid2(),
+  digest: z$1.string(),
+  meta: commonObjectMetaSchema,
+  status: workerVersionStatusSchema,
+  enabled: z$1.boolean(),
+  apiKeyId: z$1.string(),
+  apiKeyMeta: apiKeyMetaSchema,
+  createdAt: z$1.date(),
+  updatedAt: z$1.date()
+});
+var workerOutputSchema = z$1.object({
+  id: z$1.cuid2(),
+  identity: z$1.string(),
+  meta: commonObjectMetaSchema,
+  serviceAccountId: z$1.string(),
+  serviceAccountMeta: serviceAccountMetaSchema,
+  createdAt: z$1.date()
+});
+var workerQuerySchema = collectionQuerySchema.extend({
+  serviceAccountId: z$1.string().optional()
+});
+function toWorkerOutput(worker, lastVersion, serviceAccount) {
+  return {
+    ...worker,
+    meta: lastVersion?.meta ?? { title: "Unknown" },
+    serviceAccountMeta: serviceAccount.meta
+  };
+}
+function toWorkerVersionOutput(version, apiKey) {
+  return {
+    ...version,
+    apiKeyMeta: apiKey.meta
+  };
+}
+var GraphResolver = class {
+  constructor(nodes, logger, outputHandler, dependentSetHandler) {
+    this.nodes = nodes;
+    this.logger = logger;
+    this.outputHandler = outputHandler;
+    this.dependentSetHandler = dependentSetHandler;
+  }
+  workset = /* @__PURE__ */ new Set();
+  dependencyMap = /* @__PURE__ */ new Map();
+  dependentMap = /* @__PURE__ */ new Map();
+  outputMap = /* @__PURE__ */ new Map();
+  addToWorkset(nodeId) {
+    this.workset.add(nodeId);
+  }
+  addAllNodesToWorkset() {
+    for (const nodeId of this.nodes.keys()) {
+      this.workset.add(nodeId);
+    }
+  }
+  /**
+   * The map of calculated outputs.
+   */
+  get outputs() {
+    return this.outputMap;
+  }
+  /**
+   * The map of dependencies for each node.
+   *
+   * The key is the node identifier, and the value is an array of identifiers of the nodes which depend on it.
+   */
+  get dependents() {
+    return this.dependentMap;
+  }
+  requireOutput(nodeId) {
+    const output = this.outputMap.get(nodeId);
+    if (!output) {
+      throw new Error(`Output for node ${nodeId} is not available`);
+    }
+    return output;
+  }
+  /**
+   * Gets the identifiers of the nodes that depend on the given node directly.
+   *
+   * Returns an empty array if there are no dependents.
+   */
+  getDependents(nodeId) {
+    const dependents = this.dependentMap.get(nodeId);
+    if (!dependents) {
+      return [];
+    }
+    return Array.from(dependents);
+  }
+  /**
+   * Invalidates the node and all nodes that depend on it.
+   *
+   * Also adds the node to the work set for processing.
+   */
+  invalidate(nodeId) {
+    const stack = [nodeId];
+    while (stack.length > 0) {
+      const nodeId2 = stack.pop();
+      if (!this.nodes.has(nodeId2)) {
+        continue;
+      }
+      this.outputMap.delete(nodeId2);
+      this.workset.add(nodeId2);
+      const dependents = this.dependentMap.get(nodeId2);
+      if (!dependents) {
+        continue;
+      }
+      for (const dependentId of dependents) {
+        if (this.outputMap.has(dependentId)) {
+          stack.push(dependentId);
+        }
+      }
+    }
+  }
+  /**
+   * Invalidates a single node without invalidating its dependents.
+   *
+   * Also adds the node to the work set for processing.
+   *
+   * Should be used with caution, as it may lead to inconsistent state if the dependents are not re-processed separately.
+   */
+  invalidateSingle(nodeId) {
+    if (!this.nodes.has(nodeId)) {
+      return;
+    }
+    this.outputMap.delete(nodeId);
+    this.workset.add(nodeId);
+  }
+  /**
+   * Resolves all not-resolved or invalidated nodes in the graph.
+   *
+   * The abort signal of the previous operation must be called before calling this method again.
+   */
+  async process(signal) {
+    while (this.workset.size > 0) {
+      const rootNodeId = this.workset.values().next().value;
+      const stack = [{ nodeId: rootNodeId, resolved: false, dependencies: [] }];
+      while (stack.length > 0) {
+        const stackItem = stack[stack.length - 1];
+        const { nodeId, resolved } = stackItem;
+        const node = this.nodes.get(nodeId);
+        if (!node) {
+          this.logger.warn({ nodeId }, "node not found in the graph, skipping");
+          stack.pop();
+          continue;
+        }
+        if (this.outputMap.has(nodeId)) {
+          stack.pop();
+          continue;
+        }
+        if (!resolved) {
+          stackItem.dependencies = unique(this.getNodeDependencies(node));
+          let hasUnresolvedDependencies = false;
+          for (const depId of stackItem.dependencies) {
+            if (!this.nodes.has(depId)) {
+              this.logger.warn({ depId, nodeId }, "dependency not found in the graph, skipping");
+              continue;
+            }
+            if (!this.outputMap.has(depId)) {
+              stack.push({ nodeId: depId, resolved: false, dependencies: [] });
+              hasUnresolvedDependencies = true;
+            }
+          }
+          if (hasUnresolvedDependencies) {
+            stackItem.resolved = true;
+            continue;
+          }
+        }
+        const output = await this.processNode(node, this.logger);
+        if (signal?.aborted) {
+          this.logger.warn({ nodeId }, "processing aborted, skipping output");
+          return;
+        }
+        const changedDependentMaps = /* @__PURE__ */ new Set();
+        const oldDependencies = this.dependencyMap.get(nodeId) ?? [];
+        for (const depId of oldDependencies) {
+          const dependantSet = this.dependentMap.get(depId);
+          if (dependantSet) {
+            dependantSet.delete(nodeId);
+            changedDependentMaps.add(depId);
+            if (dependantSet.size === 0) {
+              this.dependentMap.delete(depId);
+            }
+          }
+        }
+        for (const depId of stackItem.dependencies) {
+          let dependantSet = this.dependentMap.get(depId);
+          if (!dependantSet) {
+            dependantSet = /* @__PURE__ */ new Set();
+            this.dependentMap.set(depId, dependantSet);
+          }
+          dependantSet.add(nodeId);
+          changedDependentMaps.add(depId);
+        }
+        if (this.dependentSetHandler) {
+          for (const depId of changedDependentMaps) {
+            const dependents = this.dependentMap.get(depId);
+            this.dependentSetHandler(depId, dependents);
+          }
+        }
+        this.outputMap.set(nodeId, output);
+        this.outputHandler?.(nodeId, output);
+        this.dependencyMap.set(nodeId, stackItem.dependencies);
+        stack.pop();
+      }
+      this.workset.delete(rootNodeId);
+    }
+  }
+};
+function getAllDependents(dependentMap, nodeId) {
+  const result = /* @__PURE__ */ new Set();
+  const stack = [nodeId];
+  while (stack.length > 0) {
+    const dependents = dependentMap.get(stack.pop());
+    if (!dependents) {
+      continue;
+    }
+    for (const dependentId of dependents) {
+      if (!result.has(dependentId)) {
+        result.add(dependentId);
+        stack.push(dependentId);
+      }
+    }
+  }
+  return Array.from(result);
+}
+var InputResolver = class extends GraphResolver {
+  getNodeDependencies(node) {
+    const dependencies = [];
+    if (node.kind === "hub") {
+      for (const input of node.hub.inputs ?? []) {
+        dependencies.push(`instance:${input.instanceId}`);
+      }
+      for (const input of node.hub.injectionInputs ?? []) {
+        dependencies.push(`hub:${input.hubId}`);
+      }
+      return dependencies;
+    }
+    for (const inputs of Object.values(node.instance.inputs ?? {})) {
+      for (const input of inputs) {
+        dependencies.push(`instance:${input.instanceId}`);
+      }
+    }
+    for (const inputs of Object.values(node.instance.hubInputs ?? {})) {
+      for (const input of inputs) {
+        dependencies.push(`hub:${input.hubId}`);
+      }
+    }
+    for (const input of node.instance.injectionInputs ?? []) {
+      dependencies.push(`hub:${input.hubId}`);
+    }
+    return dependencies;
+  }
+  processNode(node) {
+    const getHubOutput = (input) => {
+      const output = this.outputs.get(`hub:${input.hubId}`);
+      if (!output) {
+        return { resolvedInputs: [] };
+      }
+      if (output.kind !== "hub") {
+        throw new Error("Expected hub node");
+      }
+      return output;
+    };
+    const getInstanceOutput = (input) => {
+      const output = this.outputs.get(`instance:${input.instanceId}`);
+      if (!output) {
+        return {
+          component: null,
+          resolvedInputs: [],
+          resolvedOutputs: []
+        };
+      }
+      if (output.kind !== "instance") {
+        throw new Error("Expected instance node");
+      }
+      return {
+        component: output.component,
+        resolvedInputs: output.resolvedInputs[input.output] ?? [],
+        resolvedOutputs: output.resolvedOutputs?.[input.output]
+      };
+    };
+    if (node.kind === "hub") {
+      const hubResult = /* @__PURE__ */ new Map();
+      const addHubResult = (input) => {
+        hubResult.set(`${input.input.instanceId}:${input.input.output}`, input);
+      };
+      for (const input of node.hub.inputs ?? []) {
+        const { component } = getInstanceOutput(input);
+        const componentInput = component?.outputs[input.output];
+        if (!componentInput) {
+          this.logger.warn({ msg: "output not found in the component", input, component });
+          continue;
+        }
+        addHubResult({ input, type: componentInput.type });
+      }
+      for (const injectionInput of node.hub.injectionInputs ?? []) {
+        const { resolvedInputs: resolvedInputs2 } = getHubOutput(injectionInput);
+        for (const input of resolvedInputs2) {
+          addHubResult(input);
+        }
+      }
+      return {
+        kind: "hub",
+        resolvedInputs: Array.from(hubResult.values())
+      };
+    }
+    if (node.instance.resolvedInputs) {
+      return {
+        kind: "instance",
+        instance: node.instance,
+        component: node.component,
+        resolvedInputs: mapValues(node.instance.resolvedInputs, (inputs, inputName) => {
+          const componentInput = node.component.inputs[inputName];
+          if (!componentInput) {
+            this.logger.warn({
+              msg: "input not found in the component",
+              inputName,
+              component: node.component
+            });
+            return [];
+          }
+          return inputs.map((input) => ({ input, type: componentInput.type }));
+        }),
+        resolvedOutputs: node.instance.resolvedOutputs ?? {},
+        resolvedInjectionInputs: [],
+        matchedInjectionInputs: []
+      };
+    }
+    const resolvedInputsMap = /* @__PURE__ */ new Map();
+    const addInstanceResult = (inputName, input) => {
+      let inputs = resolvedInputsMap.get(inputName);
+      if (!inputs) {
+        inputs = /* @__PURE__ */ new Map();
+        resolvedInputsMap.set(inputName, inputs);
+      }
+      inputs.set(`${input.input.instanceId}:${input.input.output}`, input);
+    };
+    const addInstanceInput = (inputName, input) => {
+      const componentInput = node.component.inputs[inputName];
+      if (!componentInput) {
+        this.logger.warn({
+          msg: "input not found in the component",
+          input,
+          component: node.component
+        });
+        return;
+      }
+      const { component, resolvedOutputs } = getInstanceOutput(input);
+      if (!component) {
+        this.logger.warn({ instanceId: node.instance.id, input }, "no output found for the input");
+        return;
+      }
+      if (isUnitModel(component)) {
+        addInstanceResult(inputName, { input, type: componentInput.type });
+        return;
+      }
+      if (resolvedOutputs) {
+        for (const output of resolvedOutputs) {
+          addInstanceResult(inputName, { input: output, type: componentInput.type });
+        }
+      } else {
+        addInstanceResult(inputName, { input, type: componentInput.type });
+      }
+    };
+    for (const [inputName, inputs] of Object.entries(node.instance.inputs ?? {})) {
+      for (const input of inputs) {
+        addInstanceInput(inputName, input);
+      }
+    }
+    const injectionInputs = /* @__PURE__ */ new Map();
+    const matchedInjectionInputs = /* @__PURE__ */ new Map();
+    for (const injectionInput of node.instance.injectionInputs ?? []) {
+      const { resolvedInputs: resolvedInputs2 } = getHubOutput(injectionInput);
+      for (const input of resolvedInputs2) {
+        injectionInputs.set(`${input.input.instanceId}:${input.input.output}`, input);
+      }
+    }
+    for (const [inputName, componentInput] of Object.entries(node.component.inputs ?? {})) {
+      const allInputs = new Map(injectionInputs);
+      const hubInputs = node.instance.hubInputs?.[inputName] ?? [];
+      for (const hubInput of hubInputs) {
+        const { resolvedInputs: resolvedInputs2 } = getHubOutput(hubInput);
+        for (const input of resolvedInputs2) {
+          allInputs.set(`${input.input.instanceId}:${input.input.output}`, input);
+        }
+      }
+      for (const input of allInputs.values()) {
+        if (input.type === componentInput.type) {
+          addInstanceInput(inputName, input.input);
+          const key = `${input.input.instanceId}:${input.input.output}`;
+          if (injectionInputs.has(key)) {
+            matchedInjectionInputs.set(key, input);
+          }
+        }
+      }
+    }
+    const resolvedInputs = fromEntries(
+      Array.from(resolvedInputsMap.entries()).map(([inputName, inputs]) => [
+        inputName,
+        Array.from(inputs.values())
+      ])
+    );
+    return {
+      kind: "instance",
+      instance: node.instance,
+      component: node.component,
+      resolvedInputs,
+      resolvedOutputs: node.instance.resolvedOutputs,
+      resolvedInjectionInputs: Array.from(injectionInputs.values()),
+      matchedInjectionInputs: Array.from(matchedInjectionInputs.values())
+    };
+  }
+};
+function getResolvedHubInputs(outputMap, hubId) {
+  const output = outputMap.get(`hub:${hubId}`);
+  if (!output) {
+    return [];
+  }
+  if (output.kind !== "hub") {
+    throw new Error("Expected hub node");
+  }
+  return output.resolvedInputs;
+}
+function getResolvedInstanceInputs(outputMap, instanceId) {
+  const output = outputMap.get(`instance:${instanceId}`);
+  if (!output) {
+    return {};
+  }
+  if (output.kind !== "instance") {
+    throw new Error("Expected instance node");
+  }
+  return output.resolvedInputs;
+}
+function getResolvedInjectionInstanceInputs(outputMap, instanceId) {
+  const output = outputMap.get(`instance:${instanceId}`);
+  if (!output) {
+    return [];
+  }
+  if (output.kind !== "instance") {
+    throw new Error("Expected instance node");
+  }
+  return output.resolvedInjectionInputs;
+}
+function getMatchedInjectionInstanceInputs(outputMap, instanceId) {
+  const output = outputMap.get(`instance:${instanceId}`);
+  if (!output) {
+    return [];
+  }
+  if (output.kind !== "instance") {
+    throw new Error("Expected instance node");
+  }
+  return output.matchedInjectionInputs;
+}
+function getResolvedInstanceOutputs(outputMap, instanceId) {
+  const output = outputMap.get(`instance:${instanceId}`);
+  if (!output) {
+    return void 0;
+  }
+  if (output.kind !== "instance") {
+    throw new Error("Expected instance node");
+  }
+  return output.resolvedOutputs;
+}
+
+// src/shared/utils/async-batcher.ts
+function createAsyncBatcher(fn, { waitMs = 100, maxWaitTimeMs = 1e3 } = {}) {
+  let batch = [];
+  let activeTimeout = null;
+  let maxWaitTimeout = null;
+  let firstCallTimestamp = null;
+  async function processBatch() {
+    if (batch.length === 0) return;
+    const currentBatch = batch;
+    batch = [];
+    await fn(currentBatch);
+    if (maxWaitTimeout) {
+      clearTimeout(maxWaitTimeout);
+      maxWaitTimeout = null;
+    }
+    firstCallTimestamp = null;
+  }
+  function schedule() {
+    if (activeTimeout) clearTimeout(activeTimeout);
+    activeTimeout = setTimeout(() => {
+      activeTimeout = null;
+      void processBatch();
+    }, waitMs);
+    if (!firstCallTimestamp) {
+      firstCallTimestamp = Date.now();
+      maxWaitTimeout = setTimeout(() => {
+        if (activeTimeout) clearTimeout(activeTimeout);
+        activeTimeout = null;
+        void processBatch();
+      }, maxWaitTimeMs);
+    }
+  }
+  return {
+    /**
+     * Add an item to the batch.
+     */
+    call(item) {
+      batch.push(item);
+      schedule();
+    },
+    /**
+     * Immediately flush the pending batch (if any).
+     */
+    async flush() {
+      if (activeTimeout) {
+        clearTimeout(activeTimeout);
+        activeTimeout = null;
+      }
+      if (maxWaitTimeout) {
+        clearTimeout(maxWaitTimeout);
+        maxWaitTimeout = null;
+      }
+      await processBatch();
+    }
+  };
+}
+
+// src/shared/utils/hash.ts
+function int32ToBytes(value) {
+  const buffer = new ArrayBuffer(4);
+  const view = new DataView(buffer);
+  view.setInt32(0, value, true);
+  return new Uint8Array(buffer);
+}
+
+// src/shared/utils/promise-tracker.ts
+var PromiseTracker = class {
+  trackedPromises = /* @__PURE__ */ new Set();
+  /**
+   * Tracks a promise to ensure its rejection is handled inside the tracker's scope.
+   */
+  track(promise) {
+    const wrapped = promise.finally(() => this.trackedPromises.delete(promise));
+    this.trackedPromises.add(wrapped);
+  }
+  /**
+   * Waits for all tracked promises to resolve or reject.
+   */
+  async waitForAll() {
+    if (this.trackedPromises.size === 0) {
+      return;
+    }
+    const toTrack = Array.from(this.trackedPromises);
+    this.trackedPromises.clear();
+    await waitAll(toTrack);
+  }
+};
+async function waitAll(promises) {
+  const results = await Promise.allSettled(promises);
+  const rejected = results.filter((p) => p.status === "rejected");
+  if (!rejected.length) {
+    return;
+  }
+  throw new AggregateError(
+    rejected.map((p) => p.reason),
+    "Some promises were rejected"
+  );
+}
+
+// src/shared/resolvers/input-hash.ts
+var InputHashResolver = class extends GraphResolver {
+  getNodeDependencies({ resolvedInputs }) {
+    const dependencies = [];
+    for (const inputs of Object.values(resolvedInputs ?? {})) {
+      for (const input of inputs) {
+        dependencies.push(input.input.instanceId);
+      }
+    }
+    return dependencies;
+  }
+  processNode({
+    instance,
+    component,
+    resolvedInputs,
+    sourceHash,
+    state
+  }) {
+    const inputHashSink = [];
+    inputHashSink.push(int32ToBytes(component.definitionHash));
+    if (state?.inputHashNonce) {
+      inputHashSink.push(int32ToBytes(state.inputHashNonce));
+    }
+    if (instance.args) {
+      inputHashSink.push(encode(instance.args));
+    }
+    if (sourceHash) {
+      inputHashSink.push(int32ToBytes(sourceHash));
+    } else if (isUnitModel(component)) {
+      this.logger.warn(
+        { instanceId: instance.id },
+        "missing source hash for unit model, this may lead to incorrect input hash"
+      );
+    }
+    const sortedInputs = Object.entries(resolvedInputs).sort(([a], [b]) => a.localeCompare(b));
+    const dependencyInstanceIds = /* @__PURE__ */ new Set();
+    for (const [inputKey, inputs] of sortedInputs) {
+      if (Object.keys(inputs).length === 0) {
+        continue;
+      }
+      inputHashSink.push(Buffer.from(inputKey));
+      const instanceIds = inputs.map((input) => input.input.instanceId).sort();
+      for (const instanceId of instanceIds) {
+        const dependency = this.outputs.get(instanceId);
+        if (!dependency) {
+          this.logger.warn(
+            { instanceId, dependentInstanceId: instance.id },
+            "missing dependency when calculating input hash, this may lead to incorrect input hash"
+          );
+          continue;
+        }
+        inputHashSink.push(int32ToBytes(dependency.inputHash));
+        inputHashSink.push(int32ToBytes(dependency.outputHash));
+        dependencyInstanceIds.add(instanceId);
+      }
+    }
+    const dependencyOutputHashSink = [];
+    const sortedDependencyInstanceIds = Array.from(dependencyInstanceIds).sort();
+    for (const dependencyInstanceId of sortedDependencyInstanceIds) {
+      const dependency = this.outputs.get(dependencyInstanceId);
+      if (!dependency) {
+        this.logger.warn(
+          { instanceId: dependencyInstanceId, dependentInstanceId: instance.id },
+          "missing dependency when calculating dependency output hash, this may lead to incorrect input hash"
+        );
+        continue;
+      }
+      dependencyOutputHashSink.push(int32ToBytes(dependency.outputHash));
+    }
+    return {
+      inputHash: crc32(Buffer.concat(inputHashSink)),
+      dependencyOutputHash: crc32(Buffer.concat(dependencyOutputHashSink)),
+      outputHash: state?.outputHash ?? 0
+    };
+  }
+};
+
+// src/shared/resolvers/state.ts
+var StateResolver = class extends GraphResolver {
+  getNodeDependencies(node) {
+    if (!node.lastOperationState) {
+      return [];
+    }
+    const dependencies = /* @__PURE__ */ new Set();
+    for (const inputs of Object.values(node.lastOperationState.resolvedInputs)) {
+      for (const input of inputs) {
+        dependencies.add(input.instanceId);
+      }
+    }
+    return Array.from(dependencies);
+  }
+  processNode() {
+    return;
+  }
+};
+var ValidationResolver = class extends GraphResolver {
+  getNodeDependencies({ resolvedInputs }) {
+    const dependencies = [];
+    for (const inputs of Object.values(resolvedInputs)) {
+      for (const input of inputs) {
+        dependencies.push(input.input.instanceId);
+      }
+    }
+    return dependencies;
+  }
+  processNode({ instance, component, state, resolvedInputs }) {
+    const ajv = new Ajv({ strict: false });
+    this.logger.debug({ instanceId: instance.id }, "validating instance");
+    const validationErrors = [];
+    for (const [name, argument] of Object.entries(component.args)) {
+      try {
+        const value = parseArgumentValue(instance.args?.[name]);
+        if (!argument.required && value === void 0) {
+          continue;
+        }
+        if (!ajv.validate(argument.schema, value)) {
+          this.logger.debug({ instanceId: instance.id, argumentName: name }, "invalid argument");
+          validationErrors.push(
+            `Invalid argument "${styles.blueBright.open}${name}${styles.reset.close}": ` + ajv.errorsText()
+          );
+        }
+      } catch (error) {
+        this.logger.debug(
+          { instanceId: instance.id, argumentName: name, error },
+          "failed to validate argument"
+        );
+        validationErrors.push(
+          `Failed to validate argument "${styles.blueBright.open}${name}${styles.reset.close}": ` + (error instanceof Error ? error.message : String(error))
+        );
+      }
+    }
+    if (isUnitModel(component)) {
+      for (const [secret, secretSchema] of Object.entries(component.secrets)) {
+        if (secretSchema.required && !state?.secretNames?.includes(secret)) {
+          validationErrors.push(
+            `Missing required secret "${styles.blueBright.open}${secret}${styles.reset.close}"`
+          );
+        }
+      }
+    }
+    for (const [key, inputs] of Object.entries(resolvedInputs)) {
+      for (const input of inputs) {
+        const inputInstance = this.outputs.get(input.input.instanceId);
+        if (inputInstance?.status !== "ok") {
+          validationErrors.push(
+            `Invalid input "${styles.blueBright.open}${key}${styles.reset.close}":
+"${styles.blueBright.open}${input.input.instanceId}${styles.reset.close}" has validation errors`
+          );
+        }
+      }
+    }
+    for (const [name, input] of Object.entries(component.inputs)) {
+      if (!input.required) {
+        continue;
+      }
+      if (!resolvedInputs[name] || !resolvedInputs[name].length) {
+        validationErrors.push(
+          `Missing required input "${styles.blueBright.open}${name}${styles.reset.close}" of type "${styles.greenBright.open}${input.type}${styles.reset.close}"`
+        );
+      }
+    }
+    if (validationErrors.length === 0) {
+      return { status: "ok" };
+    }
+    const numberPrefixLength = (validationErrors.length + 1).toString().length + 2;
+    const formattedError = validationErrors.map((error, index) => {
+      const lines = error.split("\n");
+      const prefix = `${index + 1}. `;
+      return lines.map((line, lineIndex) => {
+        const linePrefix = lineIndex === 0 ? prefix : " ".repeat(numberPrefixLength);
+        return `${linePrefix}${line}`;
+      }).join("\r\n");
+    }).join("\r\n");
+    return {
+      status: "error",
+      errorText: formattedError
+    };
+  }
+};
+
+// src/shared/resolvers/registry.ts
+var resolverFactories = {
+  InputResolver,
+  InputHashResolver,
+  ValidationResolver,
+  StateResolver
+};
+
+export { AccessError, BackendError, CannotDeleteLastUnlockMethodError, GraphResolver, InputHashResolver, InputResolver, InstanceLockLostError, InstanceLockedError, InstanceNotFoundError, InstanceStateNotFoundError, InvalidInstanceKindError, MAX_WORKER_START_ATTEMPTS, OperationNotFoundError, ProjectLockedError, ProjectNotFoundError, PromiseTracker, SystemSecretNames, ValidationResolver, WorkerVersionNotFoundError, apiKeyMetaSchema, apiKeyOutputSchema, apiKeyQuerySchema, applyLibraryUpdate, artifactOutputSchema, artifactQuerySchema, backendUnlockMethodSchema, codebaseLibrary, codebaseProjectModelStorage, collectionQueryResult, collectionQuerySchema, createAsyncBatcher, databaseProjectModelStorage, diffLibraries, extractDigestFromImage, finalInstanceOperationStatuses, finalOperationStatuses, forSchema, getAllDependents, getMatchedInjectionInstanceInputs, getResolvedHubInputs, getResolvedInjectionInstanceInputs, getResolvedInstanceInputs, getResolvedInstanceOutputs, getWorkerIdentity, globalProjectSpace, hasObjectMeta, hostPulumiBackend, instanceCustomStatusInputSchema, instanceLockEventSchema, instanceLockOutputSchema, instanceStateEventSchema, int32ToBytes, isFinalOperationStatus, isInstanceDeployed, isTransientInstanceOperationStatus, isTransientOperationStatus, isVirtualGhostInstance, librarySpecSchema, operationEventSchema, operationInputSchema, operationMetaSchema, operationOptionsSchema, operationOutputSchema, operationPhaseInstanceSchema, operationPhaseSchema, operationPhaseTypeSchema, operationStatusSchema, operationTypeSchema, pageDetailsOutputSchema, pageOutputSchema, pageQuerySchema, projectInputSchema, projectModelEventSchema, projectModelStorageSpecSchema, projectOutputSchema, projectUnlockStateSchema, projectUnlockSuiteSchema, pulumiBackendSpecSchema, resolverFactories, secretOutputSchema, secretQuerySchema, serviceAccountOutputSchema, serviceAccountQuerySchema, terminalDetailsOutputSchema, terminalOutputSchema, terminalQuerySchema, terminalSessionOutputSchema, terminalStatusSchema, toApiKeyOutput, toPageOutput, toSecretOutput, toTerminalDetailsOutput, toTerminalOutput, toTerminalSessionOutput, toWorkerOutput, toWorkerVersionOutput, triggerOutputSchema, triggerQuerySchema, unlockMethodInputSchema, unlockMethodMetaSchema, unlockMethodOutputSchema, unlockMethodType, waitAll, workerOutputSchema, workerQuerySchema, workerUnitRegistrationEventSchema, workerVersionOutputSchema, workerVersionStatusSchema };
+//# sourceMappingURL=chunk-5WVU2AK4.js.map
+//# sourceMappingURL=chunk-5WVU2AK4.js.map