@highstate/backend 0.9.18 → 0.9.19

package/src/runner/local.ts

@@ -1,47 +1,52 @@
+/** biome-ignore-all lint/complexity/useLiteralKeys: не ори на меня */
+
 import type { ConfigMap, OutputMap, Stack } from "@pulumi/pulumi/automation/index.js"
-import type { LibraryBackend, ResolvedUnitSource } from "../library"
-import type { ArtifactBackend, ArtifactService } from "../artifact"
 import type { Logger } from "pino"
+import type { ArtifactBackend, ArtifactService } from "../artifact"
+import type { LibraryBackend, ResolvedUnitSource } from "../library"
+import type {
+  OperationType,
+  RunnerBackend,
+  TypedUnitStateUpdate,
+  UnitDestroyOptions,
+  UnitOptions,
+  UnitStateUpdate,
+  UnitUpdateOptions,
+} from "./abstractions"
 import type { DualAbortSignal } from "./force-abort"
 import { EventEmitter, on } from "node:events"
-import { resolve, join } from "node:path"
-import { tmpdir } from "node:os"
 import { mkdtemp, rm } from "node:fs/promises"
-import { getInstanceId, unitArtifactSchema, unitSecretSchema } from "@highstate/contract"
-import { ensureDependencyInstalled } from "nypm"
-import { mapValues, omitBy } from "remeda"
-import { z } from "zod"
-import { sha256 } from "@noble/hashes/sha2"
-import { bytesToHex } from "@noble/hashes/utils"
-import { encode } from "@msgpack/msgpack"
-import { runWithRetryOnError } from "../common"
+import { tmpdir } from "node:os"
+import { join, resolve } from "node:path"
+import { crc32 } from "node:zlib"
 import {
-  unitInstanceStatusFieldSchema,
+  getInstanceId,
+  HighstateConfigKey,
+  type InstanceId,
+  instanceStatusFieldSchema,
+  unitArtifactSchema,
   unitPageSchema,
   unitTerminalSchema,
   unitTriggerSchema,
   unitWorkerSchema,
-} from "../shared"
+} from "@highstate/contract"
+import { encode } from "@msgpack/msgpack"
+import { sha256 } from "@noble/hashes/sha2"
+import { ensureDependencyInstalled } from "nypm"
+import { omitBy } from "remeda"
+import { z } from "zod"
+import { runWithRetryOnError } from "../common"
+import {
+  type ArtifactEnvironment,
+  collectAndStoreArtifacts,
+  setupArtifactEnvironment,
+} from "./artifact-env"
 import {
   getOperationSummary,
+  type LocalPulumiHost,
   pulumiErrorToString,
   updateResourceCount,
-  type LocalPulumiHost,
 } from "./pulumi"
-import {
-  setupArtifactEnvironment,
-  collectAndStoreArtifacts,
-  type ArtifactEnvironment,
-} from "./artifact-env"
-import {
-  type RunnerBackend,
-  type UnitOptions,
-  type UnitUpdateOptions,
-  type UnitDestroyOptions,
-  type UnitStateUpdate,
-  type TypedUnitStateUpdate,
-  type RunnerArtifact,
-} from "./abstractions"
 
 type Events = {
   [K in `update:${string}`]: [UnitStateUpdate]
@@ -83,32 +88,23 @@ export class LocalRunnerBackend implements RunnerBackend {
   }
 
   update(options: UnitUpdateOptions): Promise<void> {
-    const configMap: ConfigMap = {
-      ...mapValues(options.config, value => ({ value })),
-      ...mapValues(options.secrets, value => ({ value, secret: true })),
-    }
-
-    void this.updateWorker(options, configMap, false)
+    void this.updateWorker(options, false)
 
     return Promise.resolve()
   }
 
   preview(options: UnitUpdateOptions): Promise<void> {
-    const configMap: ConfigMap = {
-      ...mapValues(options.config, value => ({ value })),
-      ...mapValues(options.secrets, value => ({ value, secret: true })),
-    }
-
-    void this.updateWorker(options, configMap, true)
+    void this.updateWorker(options, true)
 
     return Promise.resolve()
   }
 
-  private async updateWorker(
-    options: UnitUpdateOptions,
-    configMap: ConfigMap,
-    preview: boolean,
-  ): Promise<void> {
+  private async updateWorker(options: UnitUpdateOptions, preview: boolean): Promise<void> {
+    const configMap: ConfigMap = {
+      [HighstateConfigKey.Config]: { value: JSON.stringify(options.config) },
+      [HighstateConfigKey.Secrets]: { value: JSON.stringify(options.secrets), secret: true },
+    }
+
     const unitId = LocalRunnerBackend.getInstanceId(options)
     const childLogger = this.logger.child({ unitId })
 
@@ -118,8 +114,6 @@ export class LocalRunnerBackend implements RunnerBackend {
 
     try {
       // create unit-specific temp directory for better cleanup reliability
-      // this provides a second layer of reliability: even if materialized files/folders
-      // cannot clean up their specific paths, this entire directory will be cleaned up
       unitTempPath = await mkdtemp(join(tmpdir(), `highstate-unit-${unitId}-`))
       childLogger.debug({ msg: "created unit temp directory", unitTempPath })
       options.signal?.throwIfAborted()
@@ -211,23 +205,27 @@ export class LocalRunnerBackend implements RunnerBackend {
               })
 
               const outputs = await stack.outputs()
-              const completionUpdate = this.createCompletionStateUpdate(unitId, outputs, stdout)
+              const completionUpdate = this.createCompletionStateUpdate(
+                "update",
+                unitId,
+                outputs,
+                stdout,
+              )
 
               if (outputs["$artifacts"]) {
                 const artifacts = z
                   .record(z.string(), unitArtifactSchema.array())
-                  // "id" of artifacts will be filled by collectAndStoreArtifacts
-                  .parse(outputs["$artifacts"].value) as Record<string, RunnerArtifact[]>
+                  .parse(outputs["$artifacts"].value)
 
                 await collectAndStoreArtifacts(
+                  // biome-ignore lint/style/noNonNullAssertion: writePath is guaranteed to be non-null here
                   artifactEnv!.writePath,
                   options.projectId,
+                  options.stateId,
                   this.arttifactManager,
                   Object.values(artifacts).flat(),
                   childLogger,
                 )
-
-                completionUpdate.exportedArtifacts = artifacts
               }
 
               this.emitStateUpdate(completionUpdate)
@@ -356,7 +354,7 @@ export class LocalRunnerBackend implements RunnerBackend {
                   },
                 })
 
-                await this.emitCompletionStateUpdate(unitId, stack, stdout)
+                await this.emitCompletionStateUpdate("destroy", unitId, stack, stdout)
               },
               error => this.pulumiProjectHost.tryUnlockStack(stack, error),
             )
@@ -375,6 +373,7 @@ export class LocalRunnerBackend implements RunnerBackend {
       if (error instanceof StackNotFoundError) {
         this.emitStateUpdate({
           type: "completion",
+          operationType: "destroy",
           unitId,
           outputHash: null,
           message: null,
@@ -462,6 +461,7 @@ export class LocalRunnerBackend implements RunnerBackend {
 
               this.emitStateUpdate({
                 type: "completion",
+                operationType: "refresh",
                 unitId,
                 message: getOperationSummary(stdout),
 
@@ -483,7 +483,8 @@ export class LocalRunnerBackend implements RunnerBackend {
   }
 
   private createCompletionStateUpdate(
-    unitId: string,
+    opType: "update" | "destroy" | "refresh",
+    unitId: InstanceId,
     outputs: OutputMap,
     stdout: string,
   ): TypedUnitStateUpdate<"completion"> {
@@ -492,12 +493,13 @@ export class LocalRunnerBackend implements RunnerBackend {
     return {
       unitId,
       type: "completion",
+      operationType: opType,
       message: getOperationSummary(stdout),
 
-      outputHash: bytesToHex(sha256(encode(unitOutputs))),
+      outputHash: crc32(sha256(encode(unitOutputs))),
 
       statusFields: outputs["$statusFields"]
-        ? z.array(unitInstanceStatusFieldSchema).parse(outputs["$statusFields"].value)
+        ? z.array(instanceStatusFieldSchema).parse(outputs["$statusFields"].value)
         : null,
 
       terminals: outputs["$terminals"]
@@ -514,25 +516,20 @@ export class LocalRunnerBackend implements RunnerBackend {
         ? z.array(unitWorkerSchema).parse(outputs["$workers"].value)
         : null,
 
-      exportedSecrets: outputs["$exportedSecrets"]
-        ? z
-            .record(z.string(), unitSecretSchema.omit({ value: true }).array())
-            .parse(outputs["$secrets"].value)
-        : null,
-
       secrets: outputs["$secrets"]
-        ? z.record(z.string(), z.string()).parse(outputs["$secrets"].value)
+        ? z.record(z.string(), z.unknown()).parse(outputs["$secrets"].value)
         : null,
     }
   }
 
   private async emitCompletionStateUpdate(
-    unitId: string,
+    opType: OperationType,
+    unitId: InstanceId,
     stack: Stack,
     stdout: string,
   ): Promise<TypedUnitStateUpdate<"completion">> {
     const output = await stack.outputs()
-    const update = this.createCompletionStateUpdate(unitId, output, stdout)
+    const update = this.createCompletionStateUpdate(opType, unitId, output, stdout)
 
     return this.emitStateUpdate(update)
   }
@@ -615,7 +612,7 @@ export class LocalRunnerBackend implements RunnerBackend {
   }
 
   private static getStackName(options: UnitOptions) {
-    return `${options.projectId}_${options.instanceName}`
+    return options.stateId
   }
 
   public static create(

package/src/runner/pulumi.ts

@@ -1,15 +1,13 @@
-import type { Logger } from "pino"
-import type { StateManager } from "../state"
-import {
-  type ConfigMap,
-  type OpMap,
-  type OpType,
-  type Stack,
-  type WhoAmIResult,
+import type {
+  ConfigMap,
+  OpMap,
+  OpType,
+  Stack,
+  WhoAmIResult,
 } from "@pulumi/pulumi/automation/index.js"
+import type { Logger } from "pino"
+import type { SecretService } from "../business"
 import { BetterLock } from "better-lock"
-import { v4 as uuidv4, v7 as uuidv7 } from "uuid"
-import { formatSecretDescriptor, WellKnownSecretDescriptors, type Secret } from "../shared"
 import { AbortError, errorToString, runWithRetryOnError } from "../common/utils"
 import { createForceAbortableCommand } from "./force-abort"
 
@@ -29,7 +27,7 @@ export class LocalPulumiHost {
   private lock = new BetterLock()
 
   private constructor(
-    private readonly stateManager: StateManager,
+    private readonly secretService: SecretService,
     private readonly logger: Logger,
   ) {}
 
@@ -68,8 +66,9 @@ export class LocalPulumiHost {
             runtime: "nodejs",
           },
           envVars: {
-            PULUMI_CONFIG_PASSPHRASE: await this.getPassword(projectId),
+            PULUMI_CONFIG_PASSPHRASE: await this.secretService.getPulumiPassword(projectId),
             PULUMI_K8S_AWAIT_ALL: "true",
+            PULUMI_DEBUG_PROMISE_LEAKS: "true",
             ...envVars,
           },
           pulumiCommand: await createForceAbortableCommand(),
@@ -83,12 +82,12 @@ export class LocalPulumiHost {
           () => fn(stack),
           error => this.tryUnlockStack(stack, error),
         )
-      } catch (e) {
-        if (e instanceof Error && e.message.includes("canceled")) {
-          throw new AbortError()
+      } catch (error) {
+        if (error instanceof Error && error.message.includes("canceled")) {
+          throw new AbortError("Stack cancelled", { cause: error })
         }
 
-        throw e
+        throw error
       }
     })
   }
@@ -125,7 +124,7 @@ export class LocalPulumiHost {
               }
             : undefined,
           envVars: {
-            PULUMI_CONFIG_PASSPHRASE: await this.getPassword(projectId),
+            PULUMI_CONFIG_PASSPHRASE: await this.secretService.getPulumiPassword(projectId),
             PULUMI_K8S_AWAIT_ALL: "true",
             ...envVars,
           },
@@ -140,52 +139,13 @@ export class LocalPulumiHost {
           () => fn(stack),
           error => this.tryUnlockStack(stack, error),
         )
-      } catch (e) {
-        if (e instanceof Error && e.message.includes("canceled")) {
-          throw new AbortError()
+      } catch (error) {
+        if (error instanceof Error && error.message.includes("canceled")) {
+          throw new AbortError("Stack cancelled", { cause: error })
         }
 
-        throw e
-      }
-    })
-  }
-
-  private async getPassword(projectId: string): Promise<string> {
-    return await this.lock.acquire(`pulumi-password.${projectId}`, async () => {
-      const secretRepo = this.stateManager.getSecretRepository(projectId)
-      const secretContentRepo = this.stateManager.getSecretContentRepository(projectId)
-      const indexRepo = this.stateManager.getSecretIndexRepository(projectId)
-
-      const contentKey = formatSecretDescriptor(WellKnownSecretDescriptors.PulumiPassword)
-      const pulumiPasswordContent = await secretContentRepo.get(contentKey)
-      if (typeof pulumiPasswordContent === "string") {
-        return pulumiPasswordContent
+        throw error
       }
-
-      this.logger.info({ projectId }, "generating new Pulumi password")
-
-      const pulumiPassword = uuidv4()
-      const batch = this.stateManager.batch()
-
-      const pulumiPasswordSecret: Secret = {
-        id: uuidv7(),
-        descriptor: WellKnownSecretDescriptors.PulumiPassword,
-        meta: {
-          title: "Pulumi Password",
-          description: "The password used to encrypt the Pulumi state.",
-          icon: "devicon:pulumi",
-        },
-      }
-
-      await Promise.all([
-        secretRepo.putItem(pulumiPasswordSecret, batch),
-        secretContentRepo.put(contentKey, pulumiPassword, batch),
-        indexRepo.indexRepository.put(contentKey, pulumiPasswordSecret.id, batch),
-      ])
-
-      await batch.write()
-
-      return pulumiPassword
     })
   }
 
@@ -201,8 +161,8 @@ export class LocalPulumiHost {
     return false
   }
 
-  static create(stateManager: StateManager, logger: Logger) {
-    return new LocalPulumiHost(stateManager, logger.child({ service: "LocalPulumiHost" }))
+  static create(secretService: SecretService, logger: Logger) {
+    return new LocalPulumiHost(secretService, logger.child({ service: "LocalPulumiHost" }))
   }
 }
 
@@ -255,7 +215,7 @@ export async function pulumiErrorToString(error: unknown): Promise<string> {
   const { CommandError } = await import("@pulumi/pulumi/automation/index.js")
 
   if (error instanceof CommandError) {
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+    // biome-ignore lint/complexity/useLiteralKeys: не ори на отца
     const stderr = error["commandResult"].stderr as string
     let diagnosticsStart = stderr.indexOf("\u001b[38;5;13m\u001b[1mDiagnostics:")