@highstate/backend 0.9.18 → 0.9.20

package/prisma/project/migrations/20250824093656_b/migration.sql

@@ -0,0 +1,21 @@
+/*
+  Warnings:
+
+  - You are about to drop the column `createdAt` on the `InstanceLock` table. All the data in the column will be lost.
+
+*/
+-- RedefineTables
+PRAGMA defer_foreign_keys=ON;
+PRAGMA foreign_keys=OFF;
+CREATE TABLE "new_InstanceLock" (
+    "stateId" TEXT NOT NULL PRIMARY KEY,
+    "meta" JSONB NOT NULL,
+    "token" TEXT NOT NULL,
+    "acquiredAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "InstanceLock_stateId_fkey" FOREIGN KEY ("stateId") REFERENCES "InstanceState" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
+INSERT INTO "new_InstanceLock" ("meta", "stateId", "token") SELECT "meta", "stateId", "token" FROM "InstanceLock";
+DROP TABLE "InstanceLock";
+ALTER TABLE "new_InstanceLock" RENAME TO "InstanceLock";
+PRAGMA foreign_keys=ON;
+PRAGMA defer_foreign_keys=OFF;

package/prisma/project/migrations/20250825082518_a/migration.sql

@@ -0,0 +1 @@
+-- This is an empty migration.

package/prisma/project/migrations/20250825085343_b/migration.sql

@@ -0,0 +1 @@
+-- This is an empty migration.

package/prisma/project/migrations/20250825091312_a/migration.sql

@@ -0,0 +1 @@
+-- This is an empty migration.

package/prisma/project/migrations/20250903095431_hi/migration.sql

@@ -0,0 +1,44 @@
+/*
+  Warnings:
+
+  - You are about to drop the column `scopes` on the `ApiKey` table. All the data in the column will be lost.
+  - You are about to drop the column `message` on the `InstanceOperationState` table. All the data in the column will be lost.
+  - Added the required column `serviceAccountId` to the `ApiKey` table without a default value. This is not possible if the table is not empty.
+
+*/
+-- RedefineTables
+PRAGMA defer_foreign_keys=ON;
+PRAGMA foreign_keys=OFF;
+CREATE TABLE "new_ApiKey" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "meta" JSONB NOT NULL,
+    "serviceAccountId" TEXT NOT NULL,
+    "token" TEXT NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL,
+    CONSTRAINT "ApiKey_serviceAccountId_fkey" FOREIGN KEY ("serviceAccountId") REFERENCES "ServiceAccount" ("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+INSERT INTO "new_ApiKey" ("createdAt", "id", "meta", "token", "updatedAt") SELECT "createdAt", "id", "meta", "token", "updatedAt" FROM "ApiKey";
+DROP TABLE "ApiKey";
+ALTER TABLE "new_ApiKey" RENAME TO "ApiKey";
+CREATE UNIQUE INDEX "ApiKey_token_key" ON "ApiKey"("token");
+CREATE TABLE "new_InstanceOperationState" (
+    "operationId" TEXT NOT NULL,
+    "stateId" TEXT NOT NULL,
+    "status" TEXT NOT NULL,
+    "currentResourceCount" INTEGER,
+    "totalResourceCount" INTEGER,
+    "model" JSONB NOT NULL,
+    "resolvedInputs" JSONB NOT NULL,
+    "startedAt" DATETIME,
+    "finishedAt" DATETIME,
+
+    PRIMARY KEY ("operationId", "stateId"),
+    CONSTRAINT "InstanceOperationState_operationId_fkey" FOREIGN KEY ("operationId") REFERENCES "Operation" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
+    CONSTRAINT "InstanceOperationState_stateId_fkey" FOREIGN KEY ("stateId") REFERENCES "InstanceState" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
+INSERT INTO "new_InstanceOperationState" ("currentResourceCount", "finishedAt", "model", "operationId", "resolvedInputs", "startedAt", "stateId", "status", "totalResourceCount") SELECT "currentResourceCount", "finishedAt", "model", "operationId", "resolvedInputs", "startedAt", "stateId", "status", "totalResourceCount" FROM "InstanceOperationState";
+DROP TABLE "InstanceOperationState";
+ALTER TABLE "new_InstanceOperationState" RENAME TO "InstanceOperationState";
+PRAGMA foreign_keys=ON;
+PRAGMA defer_foreign_keys=OFF;

package/prisma/project/migrations/20250903174255_a/migration.sql

@@ -0,0 +1,24 @@
+-- RedefineTables
+PRAGMA defer_foreign_keys=ON;
+PRAGMA foreign_keys=OFF;
+CREATE TABLE "new_WorkerVersion" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "meta" JSONB NOT NULL,
+    "status" TEXT NOT NULL DEFAULT 'unknown',
+    "enabled" BOOLEAN NOT NULL DEFAULT true,
+    "runtimeId" TEXT,
+    "workerId" TEXT NOT NULL,
+    "digest" TEXT NOT NULL,
+    "apiKeyId" TEXT NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL,
+    CONSTRAINT "WorkerVersion_workerId_fkey" FOREIGN KEY ("workerId") REFERENCES "Worker" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
+    CONSTRAINT "WorkerVersion_apiKeyId_fkey" FOREIGN KEY ("apiKeyId") REFERENCES "ApiKey" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
+INSERT INTO "new_WorkerVersion" ("apiKeyId", "createdAt", "digest", "id", "meta", "updatedAt", "workerId") SELECT "apiKeyId", "createdAt", "digest", "id", "meta", "updatedAt", "workerId" FROM "WorkerVersion";
+DROP TABLE "WorkerVersion";
+ALTER TABLE "new_WorkerVersion" RENAME TO "WorkerVersion";
+CREATE UNIQUE INDEX "WorkerVersion_digest_key" ON "WorkerVersion"("digest");
+CREATE UNIQUE INDEX "WorkerVersion_apiKeyId_key" ON "WorkerVersion"("apiKeyId");
+PRAGMA foreign_keys=ON;
+PRAGMA defer_foreign_keys=OFF;

package/prisma/project/migrations/20250908095205_hi/migration.sql

@@ -0,0 +1,18 @@
+/*
+  Warnings:
+
+  - You are about to drop the `WorkerLog` table. If the table is not empty, all the data it contains will be lost.
+
+*/
+-- DropTable
+PRAGMA foreign_keys=off;
+DROP TABLE "WorkerLog";
+PRAGMA foreign_keys=on;
+
+-- CreateTable
+CREATE TABLE "WorkerVersionLog" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "workerVersionId" TEXT NOT NULL,
+    "content" TEXT NOT NULL,
+    CONSTRAINT "WorkerVersionLog_workerVersionId_fkey" FOREIGN KEY ("workerVersionId") REFERENCES "WorkerVersion" ("id") ON DELETE CASCADE ON UPDATE CASCADE
+);

package/prisma/project/migrations/20250909155857_hi/migration.sql

@@ -0,0 +1,15 @@
+-- RedefineTables
+PRAGMA defer_foreign_keys=ON;
+PRAGMA foreign_keys=OFF;
+CREATE TABLE "new_WorkerVersionLog" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "workerVersionId" TEXT NOT NULL,
+    "content" TEXT NOT NULL,
+    "isSystem" BOOLEAN NOT NULL DEFAULT false,
+    CONSTRAINT "WorkerVersionLog_workerVersionId_fkey" FOREIGN KEY ("workerVersionId") REFERENCES "WorkerVersion" ("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+INSERT INTO "new_WorkerVersionLog" ("content", "id", "workerVersionId") SELECT "content", "id", "workerVersionId" FROM "WorkerVersionLog";
+DROP TABLE "WorkerVersionLog";
+ALTER TABLE "new_WorkerVersionLog" RENAME TO "WorkerVersionLog";
+PRAGMA foreign_keys=ON;
+PRAGMA defer_foreign_keys=OFF;

package/prisma/project/migrations/migration_lock.toml

@@ -0,0 +1,3 @@
+# Please do not edit this file manually
+# It should be added in your version-control system (e.g., Git)
+provider = "sqlite"

package/prisma/project/model.prisma

@@ -0,0 +1,37 @@
+/// The container for project instances. 
+///
+/// Only used when "database" project model storage is used.
+model InstanceModel {
+    /// The ID of the instance in the format of `{type}:{name}`.
+    id String @id
+
+    /// The model of the instance managed by the backend.
+    ///
+    /// [InstanceModel]
+    model Json
+
+    /// The time when the instance model was created.
+    createdAt DateTime @default(now())
+
+    /// The time when the instance model was last updated.
+    updatedAt DateTime @updatedAt
+}
+
+/// The container for project hubs.
+///
+/// Only used when "database" project model storage is used.
+model HubModel {
+    /// The CUIDv2 of the hub.
+    id String @id
+
+    /// The model of the hub managed by the backend.
+    ///
+    /// [HubModel]
+    model Json
+
+    /// The time when the hub model was created.
+    createdAt DateTime @default(now())
+
+    /// The time when the hub model was last updated.
+    updatedAt DateTime @updatedAt
+}

package/prisma/project/operation.prisma

@@ -0,0 +1,148 @@
+enum OperationStatus {
+    // transient statuses
+    pending
+    running
+    failing
+
+    // stable statuses
+    completed
+    failed
+    cancelled
+}
+
+enum OperationType {
+    update
+    preview
+    destroy
+    recreate
+    refresh
+}
+
+enum InstanceOperationStatus {
+    // transient statuses
+    updating
+    processing_triggers
+    previewing
+    destroying
+    refreshing
+    pending
+    cancelling
+
+    // stable statuses
+    updated
+    skipped
+    destroyed
+    refreshed
+    cancelled
+    failed
+}
+
+model Operation {
+    /// The CUIDv2 of the operation.
+    id String @id @default(cuid(2))
+
+    /// The metadata of the operation.
+    ///
+    /// [OperationMeta]
+    meta Json
+
+    /// The type of the operation.
+    type OperationType
+
+    /// The status of the operation.
+    status OperationStatus @default(pending)
+
+    /// The options of the operation.
+    ///
+    /// [OperationOptions]
+    options Json
+
+    /// The IDs of the instances that were exlicitly requested to operate on.
+    ///
+    /// [InstanceIds]
+    requestedInstanceIds Json
+
+    /// The execution phases of the operation.
+    ///
+    /// [OperationPhase[]]
+    phases Json?
+
+    /// The time when the operation started.
+    startedAt DateTime @default(now())
+
+    /// The time when the operation was last updated.
+    updatedAt DateTime @updatedAt
+
+    /// The time when the operation finished.
+    finishedAt DateTime?
+
+    /// The operation states associated with this operation.
+    operationStates InstanceOperationState[]
+
+    /// The logs of the operation.
+    logs OperationLog[]
+}
+
+model InstanceOperationState {
+    /// The ID of the operation this state belongs to.
+    operationId String
+
+    /// The ID of the instance state affected by the operation.
+    stateId String
+
+    /// The enum representing the current status of the instance from the operation perspective.
+    status InstanceOperationStatus
+
+    /// The current count of the Pulumi resources being managed by this instance.
+    currentResourceCount Int?
+
+    /// The total count of the Pulumi resources that this instance is expected to manage.
+    totalResourceCount Int?
+
+    /// The snapshot of the instance model at the moment of operation start.
+    ///
+    /// [InstanceModel]
+    model Json
+
+    /// The snapshot of the resolved inputs at the moment of operation start.
+    ///
+    /// [InstanceResolvedInputs]
+    resolvedInputs Json
+
+    /// The time when the operation on this instance started.
+    /// Not populated on create, even if the instance is ready to start immediately.
+    startedAt DateTime?
+
+    /// The time when the operation on this instance finished.
+    finishedAt DateTime?
+
+    /// The operation this state belongs to.
+    operation Operation @relation(fields: [operationId], references: [id])
+
+    /// The instance this state belongs to.
+    state InstanceState @relation(fields: [stateId], references: [id])
+
+    @@id([operationId, stateId])
+}
+
+model OperationLog {
+    /// The ULID of the log. Also used to extract the timestamp.
+    id String @id
+
+    /// The ID of the operation this log belongs to.
+    operationId String
+
+    /// The ID of the instance state this log produced by.
+    /// Can be `null` if the log is not associated with any instance.
+    stateId String?
+
+    /// The content of the log.
+    content String
+
+    /// The operation this log belongs to.
+    operation Operation @relation(fields: [operationId], references: [id])
+
+    /// The instance this log produced by.
+    /// Can be `null` if the log is not associated with any instance.
+    state InstanceState? @relation(fields: [stateId], references: [id])
+}

package/prisma/project/page.prisma

@@ -0,0 +1,49 @@
+/// The page provides custom UI content for instances and service accounts.
+///
+/// Pages can be created by units to display instance-specific information or by service accounts.
+/// The content consists of blocks that support markdown text, QR codes with optional content display,
+/// and file attachments (inline or artifact references). Instance pages are explicitly deleted
+/// when instances are destroyed.
+model Page {
+    /// The CUIDv2 of the page.
+    id String @id @default(cuid(2))
+
+    /// The metadata of the page managed by the backend.
+    ///
+    /// [GlobalCommonObjectMeta]
+    meta Json
+
+    /// The ID of the instance state that owns this page.
+    stateId String?
+
+    /// The name of the page within the instance.
+    /// Will be null if the page is not owned by an instance.
+    name String?
+
+    /// The ID of the service account that owns this page.
+    serviceAccountId String?
+
+    /// The content of the page as an array of blocks.
+    ///
+    /// Supports markdown, QR codes, and file blocks.
+    ///
+    /// [PageContent]
+    content Json
+
+    /// The time when the page was created.
+    createdAt DateTime @default(now())
+
+    /// The time when the page was last updated.
+    updatedAt DateTime @updatedAt
+
+    /// The instance this page belongs to if any.
+    state InstanceState? @relation(fields: [stateId], references: [id])
+
+    /// The service account this page belongs to if any. 
+    serviceAccount ServiceAccount? @relation(fields: [serviceAccountId], references: [id])
+
+    /// The artifacts used by this page.
+    artifacts Artifact[]
+
+    @@unique([stateId, name]) // the name is unique within the instance
+}

package/prisma/project/secret.prisma

@@ -0,0 +1,54 @@
+/// The secret stores sensitive configuration values for instances, service accounts, and system components.
+///
+/// Secrets can be instance-owned (for unit configuration), service account-owned, or system-level
+/// (like Pulumi passwords). 
+///
+/// Secrets persist through normal destroy (recreate) operations
+/// and are only deleted when explicitly forgetting instance state with the deleteSecrets flag or when manually deleted.
+///
+/// Secret updates invalidate instance input hashes via inputHashNonce, triggering re-execution
+/// during operations. But the content of the secrets itself do not contribute to the input hash.
+///
+/// System secrets like Pulumi passwords are created on-demand and persist for the whole project lifetime.
+model Secret {
+    /// The CUIDv2 of the secret.
+    id String @id @default(cuid(2))
+
+    /// The metadata of the secret managed by the backend.
+    ///
+    /// [GlobalCommonObjectMeta]
+    meta Json
+
+    /// The ID of the state of the instance owning this secret.
+    stateId String?
+
+    /// The name of the secret within the instance.
+    ///
+    /// Will be null if the secret is not owned by an instance.
+    name String?
+
+    /// The name of the secret within the project if the secret is a system secret.
+    systemName String? @unique
+
+    /// The ID of the service account owning this secret.
+    serviceAccountId String?
+
+    /// The content of the secret.
+    ///
+    /// ![unknown]
+    content Json
+
+    /// The time when the secret was created.
+    createdAt DateTime @default(now())
+
+    /// The time when the secret was last updated.
+    updatedAt DateTime @updatedAt
+
+    /// The instance this secret belongs to.
+    state InstanceState? @relation(fields: [stateId], references: [id])
+
+    /// The service account this secret belongs to.
+    serviceAccount ServiceAccount? @relation(fields: [serviceAccountId], references: [id])
+
+    @@unique([stateId, name]) // the name must be unique within the instance
+}

package/prisma/project/service-account.prisma

@@ -0,0 +1,42 @@
+/// The service account represents an identity for non-human actors in the system.
+///
+/// Service accounts are automatically created for workers and can be manually created
+/// for external integrations. They define the access scope for resources like artifacts,
+/// secrets, terminals, and pages. Multiple API keys can impersonate the same service account,
+/// allowing different authentication tokens to share the same permissions.
+model ServiceAccount {
+    /// The CUIDv2 of the service account.
+    id String @id @default(cuid(2))
+
+    /// The metadata of the service account managed by the backend.
+    ///
+    /// [ServiceAccountMeta]
+    meta Json
+
+    /// The time when the service account was created.
+    createdAt DateTime @default(now())
+
+    /// The time when the service account was last updated.
+    updatedAt DateTime @updatedAt
+
+    /// The workers using this service account.
+    workers Worker[]
+
+    /// The artifacts used by this service account.
+    artifacts Artifact[]
+
+    /// The secrets owned by this service account.
+    secrets Secret[]
+
+    /// The terminals owned by this service account.
+    terminals Terminal[]
+
+    /// The pages owned by this service account.
+    pages Page[]
+
+    /// The instance custom statuses attached by this service account.
+    customStatuses InstanceCustomStatus[]
+
+    /// The API keys impersonating this service account.
+    apiKeys ApiKey[]
+}

package/prisma/project/terminal.prisma

@@ -0,0 +1,107 @@
+/// The terminal status indicates whether a terminal can accept new connections.
+enum TerminalStatus {
+    /// The terminal is currently active and can create new sessions.
+    active
+
+    /// The instance was destroyed and the terminal is no longer available, but here for historical purposes.
+    unavailable
+}
+
+/// The terminal provides interactive shell access to infrastructure resources.
+///
+/// Terminals can be created by units (owned by instances) or by service accounts.
+/// Each terminal maintains a specification for creating containers that power the terminal,
+/// including image, command, environment, and mounted files.
+///
+/// Instance-owned terminals are marked unavailable when the instance is destroyed, preserving session history.
+/// Service account terminals persist independently.
+model Terminal {
+    /// The CUIDv2 of the terminal.
+    id String @id @default(cuid(2))
+
+    /// The metadata of the terminal managed by the backend.
+    ///
+    /// [GlobalCommonObjectMeta]
+    meta Json
+
+    /// The status of the terminal.
+    status TerminalStatus @default(active)
+
+    /// The specification for creating the container that powers this terminal.
+    ///
+    /// Includes image, command, working directory, environment variables, and files.
+    ///
+    /// [TerminalSpec]
+    spec Json
+
+    /// The ID of the instance state owning this terminal.
+    stateId String?
+
+    /// The name of the terminal within the instance.
+    ///
+    /// Will be null if the terminal is not owned by an instance.
+    name String?
+
+    /// The ID of the service account owning this terminal.
+    serviceAccountId String?
+
+    /// The time when the terminal was created.
+    createdAt DateTime @default(now())
+
+    /// The time when the terminal was last updated.
+    updatedAt DateTime @updatedAt
+
+    /// The instance this terminal belongs to.
+    state InstanceState? @relation(fields: [stateId], references: [id], onDelete: Cascade)
+
+    /// The service account this terminal belongs to.
+    serviceAccount ServiceAccount? @relation(fields: [serviceAccountId], references: [id], onDelete: Cascade)
+
+    /// The terminal sessions associated with this terminal.
+    sessions TerminalSession[]
+
+    /// The artifacts used by this terminal.
+    artifacts Artifact[]
+
+    @@unique([stateId, name]) // the name is unique within the instance
+}
+
+/// The terminal session represents a single interactive connection to a terminal.
+///
+/// Each session tracks when it started and finished. All session output is preserved in logs.
+model TerminalSession {
+    /// The CUIDv2 of the terminal session.
+    id String @id @default(cuid(2))
+
+    /// The ID of the terminal this session belongs to.
+    terminalId String
+
+    /// The time when the terminal session started.
+    startedAt DateTime @default(now())
+
+    /// The time when the terminal session finished.
+    finishedAt DateTime?
+
+    /// The terminal this session belongs to.
+    terminal Terminal @relation(fields: [terminalId], references: [id], onDelete: Cascade)
+
+    /// The logs of the terminal session.
+    logs TerminalSessionLog[]
+}
+
+/// The terminal session log captures all input and output from a terminal session.
+///
+/// Logs are stored with ULID identifiers for timestamp ordering.
+model TerminalSessionLog {
+    /// The ULID of the session log. Also used to extract the timestamp.
+    id String @id
+
+    /// The ID of the terminal session this log belongs to.
+    sessionId String
+
+    /// The content of the log.
+    content String
+
+    /// The terminal session this log belongs to.
+    session TerminalSession @relation(fields: [sessionId], references: [id], onDelete: Cascade)
+}

package/prisma/project/trigger.prisma

@@ -0,0 +1,37 @@
+/// The trigger defines automated actions that execute in response to specific events.
+///
+/// Triggers are created by units to perform actions at defined points in the instance lifecycle
+/// or on schedule. The spec field determines the trigger type and behavior - currently supporting
+/// before-destroy triggers, with planned support for additional types like cron scheduling.
+/// Triggers are deleted along with their instance.
+model Trigger {
+    /// The CUIDv2 of the trigger.
+    id String @id @default(cuid(2))
+
+    /// The metadata of the trigger managed by the backend.
+    ///
+    /// [GlobalCommonObjectMeta]
+    meta Json
+
+    /// The ID of the instance state this trigger belongs to.
+    stateId String
+
+    /// The name of the trigger within the instance.
+    name String
+
+    /// The specification of the trigger describing its type and behavior.
+    ///
+    /// [TriggerSpec]
+    spec Json
+
+    /// The time when the trigger was created.
+    createdAt DateTime @default(now())
+
+    /// The time when the trigger was last updated.
+    updatedAt DateTime @updatedAt
+
+    /// The instance this trigger belongs to.
+    state InstanceState @relation(fields: [stateId], references: [id])
+
+    @@unique([stateId, name]) // the name is unique within the instance
+}

package/prisma/project/unlock-method.prisma

@@ -0,0 +1,46 @@
+/// The unlock method type determines how users authenticate to decrypt project databases.
+enum UnlockMethodType {
+    /// The password is used to unlock the project.
+    password
+
+    /// The passkey (via WebAuthn) is used to unlock the project.
+    passkey
+}
+
+/// The unlock method enables decryption of project databases through user authentication.
+///
+/// Each project database is encrypted with a master key, which is then encrypted for each
+/// unlock method's recipient using AGE encryption. Users authenticate (password or passkey)
+/// to decrypt their specific AGE identity, which then decrypts the master key.
+///
+/// Multiple unlock methods can exist per project, allowing different authentication paths
+/// to the same encrypted database. When unlock methods are added/removed, the master key
+/// is re-encrypted for the new set of recipients.
+///
+/// The encryptedIdentity contains the AGE identity encrypted with the user's authentication
+/// method (password-derived key or WebAuthn), while the recipient is the public key
+/// corresponding to that identity.
+model UnlockMethod {
+    /// The CUIDv2 of the unlock method.
+    id String @id @default(cuid(2))
+
+    /// The metadata of the unlock method managed by the backend.
+    /// 
+    /// [UnlockMethodMeta]
+    meta Json
+
+    /// The type of unlock method.
+    type UnlockMethodType
+
+    /// The AGE identity encrypted and armored also with AGE.
+    encryptedIdentity String
+
+    /// The AGE recipient for this unlock method.
+    recipient String
+
+    /// The time when the unlock method was created.
+    createdAt DateTime @default(now())
+
+    /// The time when the unlock method was last updated.
+    updatedAt DateTime @updatedAt
+}