@highstate/backend 0.9.26 → 0.9.28

package/dist/shared/index.js

@@ -1,4 +1,4 @@
-export { AccessError, BackendError, CannotDeleteLastUnlockMethodError, GraphResolver, InputHashResolver, InputResolver, InstanceLockLostError, InstanceLockedError, InstanceNotFoundError, InstanceStateNotFoundError, InvalidInstanceKindError, MAX_WORKER_START_ATTEMPTS, OperationNotFoundError, ProjectLockedError, ProjectNotFoundError, PromiseTracker, SystemSecretNames, ValidationResolver, WorkerVersionNotFoundError, apiKeyMetaSchema, apiKeyOutputSchema, apiKeyQuerySchema, applyLibraryUpdate, artifactOutputSchema, artifactQuerySchema, backendUnlockMethodSchema, codebaseLibrary, codebaseProjectModelStorage, collectionQueryResult, collectionQuerySchema, createAsyncBatcher, databaseProjectModelStorage, diffLibraries, extractDigestFromImage, finalInstanceOperationStatuses, finalOperationStatuses, forSchema, getAllDependents, getMatchedInjectionInstanceInputs, getResolvedHubInputs, getResolvedInjectionInstanceInputs, getResolvedInstanceInputs, getResolvedInstanceOutputs, getWorkerIdentity, globalProjectSpace, hasObjectMeta, hostPulumiBackend, instanceCustomStatusInputSchema, instanceLockEventSchema, instanceLockOutputSchema, instanceStateEventSchema, int32ToBytes, isFinalOperationStatus, isInstanceDeployed, isTransientInstanceOperationStatus, isTransientOperationStatus, isVirtualGhostInstance, librarySpecSchema, operationEventSchema, operationLaunchInputSchema, operationMetaSchema, operationOptionsSchema, operationOutputSchema, operationPhaseInstanceSchema, operationPhaseSchema, operationPhaseTypeSchema, operationPlanInputSchema, operationStatusSchema, operationTypeSchema, pageDetailsOutputSchema, pageOutputSchema, pageQuerySchema, projectInputSchema, projectModelEventSchema, projectModelStorageSpecSchema, projectOutputSchema, projectUnlockStateSchema, projectUnlockSuiteSchema, pulumiBackendSpecSchema, resolverFactories, secretOutputSchema, secretQuerySchema, serviceAccountOutputSchema, serviceAccountQuerySchema, terminalDetailsOutputSchema, terminalOutputSchema, terminalQuerySchema, terminalSessionOutputSchema, terminalStatusSchema, toApiKeyOutput, toPageOutput, toSecretOutput, toTerminalDetailsOutput, toTerminalOutput, toTerminalSessionOutput, toWorkerOutput, toWorkerVersionOutput, triggerOutputSchema, triggerQuerySchema, unlockMethodInputSchema, unlockMethodMetaSchema, unlockMethodOutputSchema, unlockMethodType, waitAll, workerOutputSchema, workerQuerySchema, workerUnitRegistrationEventSchema, workerVersionOutputSchema, workerVersionStatusSchema } from '../chunk-GJTMJQUW.js';
+export { AccessError, BackendError, BackendUnlockMethodNotFoundError, CannotDeleteLastBackendUnlockMethodError, CannotDeleteLastUnlockMethodError, GraphResolver, InputHashResolver, InputResolver, InstanceLockLostError, InstanceLockedError, InstanceNotFoundError, InstanceStateNotFoundError, InvalidInstanceKindError, MAX_WORKER_START_ATTEMPTS, OperationNotFoundError, ProjectLockedError, ProjectNotFoundError, PromiseTracker, SystemSecretNames, ValidationResolver, WorkerVersionNotFoundError, apiKeyMetaSchema, apiKeyOutputSchema, apiKeyQuerySchema, applyLibraryUpdate, artifactOutputSchema, artifactQuerySchema, backendUnlockMethodInputSchema, backendUnlockMethodMetaSchema, codebaseLibrary, codebaseProjectModelStorage, collectionQueryResult, collectionQuerySchema, createAsyncBatcher, databaseProjectModelStorage, diffLibraries, extractDigestFromImage, finalInstanceOperationStatuses, finalOperationStatuses, forSchema, getAllDependents, getMatchedInjectionInstanceInputs, getResolvedHubInputs, getResolvedInjectionInstanceInputs, getResolvedInstanceInputs, getResolvedInstanceOutputs, getWorkerIdentity, globalProjectSpace, hasObjectMeta, hostPulumiBackend, instanceCustomStatusInputSchema, instanceLockEventSchema, instanceLockOutputSchema, instanceStateEventSchema, int32ToBytes, isFinalOperationStatus, isInstanceDeployed, isTransientInstanceOperationStatus, isTransientOperationStatus, isVirtualGhostInstance, librarySpecSchema, operationEventSchema, operationLaunchInputSchema, operationMetaSchema, operationOptionsSchema, operationOutputSchema, operationPhaseInstanceSchema, operationPhaseSchema, operationPhaseTypeSchema, operationPlanInputSchema, operationStatusSchema, operationTypeSchema, pageDetailsOutputSchema, pageOutputSchema, pageQuerySchema, projectInputSchema, projectModelEventSchema, projectModelStorageSpecSchema, projectOutputSchema, projectUnlockStateSchema, projectUnlockSuiteSchema, pulumiBackendSpecSchema, resolverFactories, secretOutputSchema, secretQuerySchema, serviceAccountOutputSchema, serviceAccountQuerySchema, terminalDetailsOutputSchema, terminalOutputSchema, terminalQuerySchema, terminalSessionOutputSchema, terminalStatusSchema, toApiKeyOutput, toPageOutput, toSecretOutput, toTerminalDetailsOutput, toTerminalOutput, toTerminalSessionOutput, toWorkerOutput, toWorkerVersionOutput, triggerOutputSchema, triggerQuerySchema, unlockMethodInputSchema, unlockMethodMetaSchema, unlockMethodOutputSchema, unlockMethodType, waitAll, workerOutputSchema, workerQuerySchema, workerUnitRegistrationEventSchema, workerVersionOutputSchema, workerVersionStatusSchema } from '../chunk-QSHSXLO2.js';
 import '../chunk-I7BWSAN6.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highstate/backend",
-  "version": "0.9.26",
+  "version": "0.9.28",
   "type": "module",
   "highstate": {
     "sourceHash": {
@@ -41,7 +41,7 @@
   },
   "dependencies": {
     "@aws-crypto/crc32": "^5.2.0",
-    "@highstate/contract": "^0.9.26",
+    "@highstate/contract": "^0.9.28",
     "@msgpack/msgpack": "^3.1.2",
     "@napi-rs/keyring": "^1.1.8",
     "@noble/ciphers": "^1.3.0",
@@ -98,5 +98,5 @@
     "type-fest": "^4.41.0",
     "vitest": "^3.2.4"
   },
-  "gitHead": "64e8a656a17dfcce88727c24969f9a3b73539ac9"
+  "gitHead": "6de09d98fa66e808c42aba7fe65e6e0762945b9b"
 }

package/prisma/backend/_schema/layout.prisma

@@ -1,7 +1,9 @@
-model UserWorkspaseLayout {
+model UserWorkspaceLayout {
     /// The opaque ID of the user to which this layout belongs.
     userId String @id
 
     /// The layout of the user workspace managed by the frontend.
+    ///
+    /// ![unknown]
     layout Json
 }

package/prisma/backend/_schema/project.prisma

@@ -34,10 +34,10 @@ model Project {
     /// This is used to determine if the project needs to be migrated.
     databaseVersion Int
 
-    /// The date and time when the project was created.
+    /// The time when the project was created.
     createdAt DateTime @default(now())
 
-    /// The date and time when the project was last updated.
+    /// The time when the project was last updated.
     updatedAt DateTime @updatedAt
 
     /// The project space this project belongs to.
@@ -80,6 +80,8 @@ model ProjectSpace {
 
     /// The child project spaces, if any.
     children ProjectSpace[] @relation("ProjectSpaceHierarchy")
+
+    @@unique([parentId, name])
 }
 
 model ProjectModelStorage {

package/prisma/backend/_schema/unlock-method.prisma

@@ -0,0 +1,19 @@
+/// Unlock methods describe trusted identities that can decrypt the backend master key.
+model BackendUnlockMethod {
+    /// The CUIDv2 of the unlock method.
+    id String @id @default(cuid(2))
+
+    /// The metadata of the unlock method managed by the backend.
+    /// 
+    /// [BackendUnlockMethodMeta]
+    meta Json
+
+    /// The AGE recipient for this unlock method.
+    recipient String @unique
+
+    /// The time when the unlock method was created.
+    createdAt DateTime @default(now())
+
+    /// The time when the unlock method was last updated.
+    updatedAt DateTime @updatedAt
+}

package/prisma/backend/sqlite/migrations/{20250818082732_add_models → 20250928124105_initial_migration}/migration.sql

@@ -1,21 +1,18 @@
-/*
-  Warnings:
-
-  - Added the required column `modelStorageId` to the `Project` table without a default value. This is not possible if the table is not empty.
+-- CreateTable
+CREATE TABLE "UserWorkspaceLayout" (
+    "userId" TEXT NOT NULL PRIMARY KEY,
+    "layout" JSONB NOT NULL
+);
 
-*/
 -- CreateTable
-CREATE TABLE "ProjectModelStorage" (
+CREATE TABLE "Library" (
     "id" TEXT NOT NULL PRIMARY KEY,
-    "projectId" TEXT NOT NULL,
     "meta" JSONB NOT NULL,
     "spec" JSONB NOT NULL
 );
 
--- RedefineTables
-PRAGMA defer_foreign_keys=ON;
-PRAGMA foreign_keys=OFF;
-CREATE TABLE "new_Project" (
+-- CreateTable
+CREATE TABLE "Project" (
     "id" TEXT NOT NULL PRIMARY KEY,
     "meta" JSONB NOT NULL,
     "name" TEXT NOT NULL,
@@ -33,9 +30,44 @@ CREATE TABLE "new_Project" (
     CONSTRAINT "Project_libraryId_fkey" FOREIGN KEY ("libraryId") REFERENCES "Library" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
     CONSTRAINT "Project_pulumiBackendId_fkey" FOREIGN KEY ("pulumiBackendId") REFERENCES "PulumiBackend" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
 );
-INSERT INTO "new_Project" ("createdAt", "databaseVersion", "encryptedMasterKey", "id", "libraryId", "meta", "name", "pulumiBackendId", "spaceId", "unlockSuite", "updatedAt") SELECT "createdAt", "databaseVersion", "encryptedMasterKey", "id", "libraryId", "meta", "name", "pulumiBackendId", "spaceId", "unlockSuite", "updatedAt" FROM "Project";
-DROP TABLE "Project";
-ALTER TABLE "new_Project" RENAME TO "Project";
+
+-- CreateTable
+CREATE TABLE "ProjectSpace" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "name" TEXT,
+    "parentId" TEXT,
+    "meta" JSONB NOT NULL,
+    CONSTRAINT "ProjectSpace_parentId_fkey" FOREIGN KEY ("parentId") REFERENCES "ProjectSpace" ("id") ON DELETE SET NULL ON UPDATE CASCADE
+);
+
+-- CreateTable
+CREATE TABLE "ProjectModelStorage" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "meta" JSONB NOT NULL,
+    "spec" JSONB NOT NULL
+);
+
+-- CreateTable
+CREATE TABLE "PulumiBackend" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "meta" JSONB NOT NULL,
+    "spec" JSONB NOT NULL
+);
+
+-- CreateTable
+CREATE TABLE "BackendUnlockMethod" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "meta" JSONB NOT NULL,
+    "recipient" TEXT NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL
+);
+
+-- CreateIndex
 CREATE UNIQUE INDEX "Project_spaceId_name_key" ON "Project"("spaceId", "name");
-PRAGMA foreign_keys=ON;
-PRAGMA defer_foreign_keys=OFF;
+
+-- CreateIndex
+CREATE UNIQUE INDEX "ProjectSpace_parentId_name_key" ON "ProjectSpace"("parentId", "name");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "BackendUnlockMethod_recipient_key" ON "BackendUnlockMethod"("recipient");

package/prisma/project/api-key.prisma

@@ -16,6 +16,8 @@ model ApiKey {
     serviceAccountId String
 
     /// The API token for authentication.
+    ///
+    /// Should be treated as a secret and only shown once at creation/regeneration.
     token String @unique
 
     /// The time when the API key was created.
@@ -28,5 +30,5 @@ model ApiKey {
     worker WorkerVersion?
 
     /// The service account which this API key impersonates.
-    serviceAccount ServiceAccount @relation(fields: [serviceAccountId], references: [id], onDelete: Cascade)
+    serviceAccount ServiceAccount @relation(fields: [serviceAccountId], references: [id])
 }

package/prisma/project/artifact.prisma

@@ -32,10 +32,10 @@ model Artifact {
     /// Used to split the artifact into smaller chunks for storage.
     chunkSize Int
 
-    /// The timestamp when the artifact fist appeared in the system.
+    /// The time when the artifact first appeared in the system.
     createdAt DateTime @default(now())
 
-    /// The timestamp when the artifact was last updated.
+    /// The time when the artifact was last updated.
     updatedAt DateTime @updatedAt
 
     /// The service accounts using this artifact.

package/prisma/project/custom-status.prisma

@@ -21,7 +21,7 @@ model InstanceCustomStatus {
     /// Can be used to provide additional context or information about the status.
     ///
     /// The message will be displayed in the 800x600 ANSI terminal in the UI,
-    /// so differenet TUI elements should be drawn within this area.
+    /// so different TUI elements should be drawn within this area.
     message String?
 
     /// The order of the custom status in the list of statuses.

package/prisma/project/layout.prisma

@@ -3,6 +3,8 @@ model UserProjectViewport {
     userId String @id
 
     /// The viewport of the user project managed by the frontend.
+    ///
+    /// ![unknown]
     viewport Json
 }
 
@@ -14,6 +16,8 @@ model UserCompositeViewport {
     stateId String
 
     /// The viewport of the user composite instance managed by the frontend.
+    ///
+    /// ![unknown]
     viewport Json
 
     /// The instance state to which this viewport belongs.

package/prisma/project/migrations/{20250816081310_initial → 20250928130725_initial_migration}/migration.sql

@@ -2,8 +2,11 @@
 CREATE TABLE "ApiKey" (
     "id" TEXT NOT NULL PRIMARY KEY,
     "meta" JSONB NOT NULL,
-    "scopes" JSONB NOT NULL,
-    "token" TEXT NOT NULL
+    "serviceAccountId" TEXT NOT NULL,
+    "token" TEXT NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL,
+    CONSTRAINT "ApiKey_serviceAccountId_fkey" FOREIGN KEY ("serviceAccountId") REFERENCES "ServiceAccount" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
 );
 
 -- CreateTable
@@ -12,52 +15,97 @@ CREATE TABLE "Artifact" (
     "meta" JSONB NOT NULL,
     "hash" TEXT NOT NULL,
     "size" INTEGER NOT NULL,
+    "chunkSize" INTEGER NOT NULL,
     "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
     "updatedAt" DATETIME NOT NULL
 );
 
 -- CreateTable
 CREATE TABLE "InstanceCustomStatus" (
-    "instanceId" TEXT NOT NULL,
+    "stateId" TEXT NOT NULL,
+    "serviceAccountId" TEXT NOT NULL,
     "name" TEXT NOT NULL,
     "meta" JSONB NOT NULL,
     "value" TEXT NOT NULL,
     "message" TEXT,
     "order" INTEGER NOT NULL DEFAULT 50,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL,
 
-    PRIMARY KEY ("instanceId", "name"),
-    CONSTRAINT "InstanceCustomStatus_instanceId_fkey" FOREIGN KEY ("instanceId") REFERENCES "InstanceState" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+    PRIMARY KEY ("stateId", "serviceAccountId", "name"),
+    CONSTRAINT "InstanceCustomStatus_stateId_fkey" FOREIGN KEY ("stateId") REFERENCES "InstanceState" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
+    CONSTRAINT "InstanceCustomStatus_serviceAccountId_fkey" FOREIGN KEY ("serviceAccountId") REFERENCES "ServiceAccount" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
 );
 
 -- CreateTable
 CREATE TABLE "InstanceEvaluationState" (
-    "instanceId" TEXT NOT NULL PRIMARY KEY,
+    "stateId" TEXT NOT NULL PRIMARY KEY,
     "status" TEXT NOT NULL,
     "message" TEXT,
     "model" JSONB,
-    CONSTRAINT "InstanceEvaluationState_instanceId_fkey" FOREIGN KEY ("instanceId") REFERENCES "InstanceState" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+    "evaluatedAt" DATETIME NOT NULL,
+    CONSTRAINT "InstanceEvaluationState_stateId_fkey" FOREIGN KEY ("stateId") REFERENCES "InstanceState" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
 );
 
 -- CreateTable
 CREATE TABLE "InstanceState" (
     "id" TEXT NOT NULL PRIMARY KEY,
+    "instanceId" TEXT NOT NULL,
     "status" TEXT NOT NULL,
+    "source" TEXT NOT NULL,
     "kind" TEXT NOT NULL,
+    "parentId" TEXT,
     "inputHashNonce" INTEGER,
-    "lastOperationId" TEXT,
-    "statusFields" JSONB,
     "inputHash" INTEGER,
     "outputHash" INTEGER,
     "dependencyOutputHash" INTEGER,
-    CONSTRAINT "InstanceState_lastOperationId_fkey" FOREIGN KEY ("lastOperationId") REFERENCES "Operation" ("id") ON DELETE SET NULL ON UPDATE CASCADE,
-    CONSTRAINT "InstanceState_id_lastOperationId_fkey" FOREIGN KEY ("id", "lastOperationId") REFERENCES "InstanceOperationState" ("instanceId", "operationId") ON DELETE RESTRICT ON UPDATE CASCADE
+    "exportedArtifactIds" JSONB,
+    "model" JSONB,
+    "resolvedInputs" JSONB,
+    "currentResourceCount" INTEGER,
+    "statusFields" JSONB,
+    CONSTRAINT "InstanceState_parentId_fkey" FOREIGN KEY ("parentId") REFERENCES "InstanceState" ("id") ON DELETE SET NULL ON UPDATE CASCADE
+);
+
+-- CreateTable
+CREATE TABLE "UserProjectViewport" (
+    "userId" TEXT NOT NULL PRIMARY KEY,
+    "viewport" JSONB NOT NULL
+);
+
+-- CreateTable
+CREATE TABLE "UserCompositeViewport" (
+    "userId" TEXT NOT NULL,
+    "stateId" TEXT NOT NULL,
+    "viewport" JSONB NOT NULL,
+
+    PRIMARY KEY ("userId", "stateId"),
+    CONSTRAINT "UserCompositeViewport_stateId_fkey" FOREIGN KEY ("stateId") REFERENCES "InstanceState" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
 );
 
 -- CreateTable
 CREATE TABLE "InstanceLock" (
-    "instanceId" TEXT NOT NULL PRIMARY KEY,
+    "stateId" TEXT NOT NULL PRIMARY KEY,
     "meta" JSONB NOT NULL,
-    CONSTRAINT "InstanceLock_instanceId_fkey" FOREIGN KEY ("instanceId") REFERENCES "InstanceState" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+    "token" TEXT NOT NULL,
+    "acquiredAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "InstanceLock_stateId_fkey" FOREIGN KEY ("stateId") REFERENCES "InstanceState" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
+
+-- CreateTable
+CREATE TABLE "InstanceModel" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "model" JSONB NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL
+);
+
+-- CreateTable
+CREATE TABLE "HubModel" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "model" JSONB NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL
 );
 
 -- CreateTable
@@ -65,47 +113,54 @@ CREATE TABLE "Operation" (
     "id" TEXT NOT NULL PRIMARY KEY,
     "meta" JSONB NOT NULL,
     "type" TEXT NOT NULL,
+    "status" TEXT NOT NULL DEFAULT 'pending',
     "options" JSONB NOT NULL,
     "requestedInstanceIds" JSONB NOT NULL,
+    "phases" JSONB,
     "startedAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "completedAt" DATETIME
+    "updatedAt" DATETIME NOT NULL,
+    "finishedAt" DATETIME
 );
 
 -- CreateTable
 CREATE TABLE "InstanceOperationState" (
     "operationId" TEXT NOT NULL,
-    "instanceId" TEXT NOT NULL,
-    "parentId" TEXT,
+    "stateId" TEXT NOT NULL,
     "status" TEXT NOT NULL,
-    "message" TEXT,
     "currentResourceCount" INTEGER,
     "totalResourceCount" INTEGER,
-    "args" JSONB NOT NULL,
+    "model" JSONB NOT NULL,
     "resolvedInputs" JSONB NOT NULL,
+    "startedAt" DATETIME,
+    "finishedAt" DATETIME,
 
-    PRIMARY KEY ("operationId", "instanceId"),
+    PRIMARY KEY ("operationId", "stateId"),
     CONSTRAINT "InstanceOperationState_operationId_fkey" FOREIGN KEY ("operationId") REFERENCES "Operation" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
-    CONSTRAINT "InstanceOperationState_instanceId_fkey" FOREIGN KEY ("instanceId") REFERENCES "InstanceState" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+    CONSTRAINT "InstanceOperationState_stateId_fkey" FOREIGN KEY ("stateId") REFERENCES "InstanceState" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
 );
 
 -- CreateTable
 CREATE TABLE "OperationLog" (
     "id" TEXT NOT NULL PRIMARY KEY,
     "operationId" TEXT NOT NULL,
-    "instanceId" TEXT,
+    "stateId" TEXT,
+    "isSystem" BOOLEAN NOT NULL DEFAULT false,
     "content" TEXT NOT NULL,
     CONSTRAINT "OperationLog_operationId_fkey" FOREIGN KEY ("operationId") REFERENCES "Operation" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
-    CONSTRAINT "OperationLog_instanceId_fkey" FOREIGN KEY ("instanceId") REFERENCES "InstanceState" ("id") ON DELETE SET NULL ON UPDATE CASCADE
+    CONSTRAINT "OperationLog_stateId_fkey" FOREIGN KEY ("stateId") REFERENCES "InstanceState" ("id") ON DELETE SET NULL ON UPDATE CASCADE
 );
 
 -- CreateTable
 CREATE TABLE "Page" (
     "id" TEXT NOT NULL PRIMARY KEY,
     "meta" JSONB NOT NULL,
-    "instanceId" TEXT,
+    "stateId" TEXT,
+    "name" TEXT,
     "serviceAccountId" TEXT,
     "content" JSONB NOT NULL,
-    CONSTRAINT "Page_instanceId_fkey" FOREIGN KEY ("instanceId") REFERENCES "InstanceState" ("id") ON DELETE SET NULL ON UPDATE CASCADE,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL,
+    CONSTRAINT "Page_stateId_fkey" FOREIGN KEY ("stateId") REFERENCES "InstanceState" ("id") ON DELETE SET NULL ON UPDATE CASCADE,
     CONSTRAINT "Page_serviceAccountId_fkey" FOREIGN KEY ("serviceAccountId") REFERENCES "ServiceAccount" ("id") ON DELETE SET NULL ON UPDATE CASCADE
 );
 
@@ -113,39 +168,47 @@ CREATE TABLE "Page" (
 CREATE TABLE "Secret" (
     "id" TEXT NOT NULL PRIMARY KEY,
     "meta" JSONB NOT NULL,
-    "instanceId" TEXT,
+    "stateId" TEXT,
     "name" TEXT,
     "systemName" TEXT,
     "serviceAccountId" TEXT,
     "content" JSONB NOT NULL,
-    CONSTRAINT "Secret_instanceId_fkey" FOREIGN KEY ("instanceId") REFERENCES "InstanceState" ("id") ON DELETE SET NULL ON UPDATE CASCADE,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL,
+    CONSTRAINT "Secret_stateId_fkey" FOREIGN KEY ("stateId") REFERENCES "InstanceState" ("id") ON DELETE SET NULL ON UPDATE CASCADE,
     CONSTRAINT "Secret_serviceAccountId_fkey" FOREIGN KEY ("serviceAccountId") REFERENCES "ServiceAccount" ("id") ON DELETE SET NULL ON UPDATE CASCADE
 );
 
 -- CreateTable
 CREATE TABLE "ServiceAccount" (
     "id" TEXT NOT NULL PRIMARY KEY,
-    "meta" JSONB NOT NULL
+    "meta" JSONB NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL
 );
 
 -- CreateTable
 CREATE TABLE "Terminal" (
     "id" TEXT NOT NULL PRIMARY KEY,
     "meta" JSONB NOT NULL,
+    "status" TEXT NOT NULL DEFAULT 'active',
     "spec" JSONB NOT NULL,
-    "instanceId" TEXT,
+    "stateId" TEXT,
     "name" TEXT,
     "serviceAccountId" TEXT,
-    CONSTRAINT "Terminal_instanceId_fkey" FOREIGN KEY ("instanceId") REFERENCES "InstanceState" ("id") ON DELETE SET NULL ON UPDATE CASCADE,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL,
+    CONSTRAINT "Terminal_stateId_fkey" FOREIGN KEY ("stateId") REFERENCES "InstanceState" ("id") ON DELETE SET NULL ON UPDATE CASCADE,
     CONSTRAINT "Terminal_serviceAccountId_fkey" FOREIGN KEY ("serviceAccountId") REFERENCES "ServiceAccount" ("id") ON DELETE SET NULL ON UPDATE CASCADE
 );
 
 -- CreateTable
 CREATE TABLE "TerminalSession" (
     "id" TEXT NOT NULL PRIMARY KEY,
-    "meta" JSONB NOT NULL,
     "terminalId" TEXT NOT NULL,
-    CONSTRAINT "TerminalSession_terminalId_fkey" FOREIGN KEY ("terminalId") REFERENCES "Terminal" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+    "startedAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "finishedAt" DATETIME,
+    CONSTRAINT "TerminalSession_terminalId_fkey" FOREIGN KEY ("terminalId") REFERENCES "Terminal" ("id") ON DELETE CASCADE ON UPDATE CASCADE
 );
 
 -- CreateTable
@@ -153,17 +216,19 @@ CREATE TABLE "TerminalSessionLog" (
     "id" TEXT NOT NULL PRIMARY KEY,
     "sessionId" TEXT NOT NULL,
     "content" TEXT NOT NULL,
-    CONSTRAINT "TerminalSessionLog_sessionId_fkey" FOREIGN KEY ("sessionId") REFERENCES "TerminalSession" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+    CONSTRAINT "TerminalSessionLog_sessionId_fkey" FOREIGN KEY ("sessionId") REFERENCES "TerminalSession" ("id") ON DELETE CASCADE ON UPDATE CASCADE
 );
 
 -- CreateTable
 CREATE TABLE "Trigger" (
     "id" TEXT NOT NULL PRIMARY KEY,
     "meta" JSONB NOT NULL,
-    "instanceId" TEXT NOT NULL,
+    "stateId" TEXT NOT NULL,
     "name" TEXT NOT NULL,
     "spec" JSONB NOT NULL,
-    CONSTRAINT "Trigger_instanceId_fkey" FOREIGN KEY ("instanceId") REFERENCES "InstanceState" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL,
+    CONSTRAINT "Trigger_stateId_fkey" FOREIGN KEY ("stateId") REFERENCES "InstanceState" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
 );
 
 -- CreateTable
@@ -172,7 +237,9 @@ CREATE TABLE "UnlockMethod" (
     "meta" JSONB NOT NULL,
     "type" TEXT NOT NULL,
     "encryptedIdentity" TEXT NOT NULL,
-    "recipient" TEXT NOT NULL
+    "recipient" TEXT NOT NULL,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL
 );
 
 -- CreateTable
@@ -187,24 +254,40 @@ CREATE TABLE "Worker" (
 -- CreateTable
 CREATE TABLE "WorkerVersion" (
     "id" TEXT NOT NULL PRIMARY KEY,
+    "meta" JSONB NOT NULL,
+    "status" TEXT NOT NULL DEFAULT 'unknown',
+    "enabled" BOOLEAN NOT NULL DEFAULT true,
+    "runtimeId" TEXT,
     "workerId" TEXT NOT NULL,
     "digest" TEXT NOT NULL,
     "apiKeyId" TEXT NOT NULL,
     "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL,
+    CONSTRAINT "WorkerVersion_workerId_fkey" FOREIGN KEY ("workerId") REFERENCES "Worker" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
     CONSTRAINT "WorkerVersion_apiKeyId_fkey" FOREIGN KEY ("apiKeyId") REFERENCES "ApiKey" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
 );
 
 -- CreateTable
 CREATE TABLE "WorkerUnitRegistration" (
-    "workerVersionId" TEXT NOT NULL,
-    "instanceId" TEXT NOT NULL,
+    "stateId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
     "params" JSONB NOT NULL,
+    "workerVersionId" TEXT NOT NULL,
     "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
     "updatedAt" DATETIME NOT NULL,
 
-    PRIMARY KEY ("workerVersionId", "instanceId"),
-    CONSTRAINT "WorkerUnitRegistration_workerVersionId_fkey" FOREIGN KEY ("workerVersionId") REFERENCES "WorkerVersion" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
-    CONSTRAINT "WorkerUnitRegistration_instanceId_fkey" FOREIGN KEY ("instanceId") REFERENCES "InstanceState" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+    PRIMARY KEY ("stateId", "name"),
+    CONSTRAINT "WorkerUnitRegistration_stateId_fkey" FOREIGN KEY ("stateId") REFERENCES "InstanceState" ("id") ON DELETE RESTRICT ON UPDATE CASCADE,
+    CONSTRAINT "WorkerUnitRegistration_workerVersionId_fkey" FOREIGN KEY ("workerVersionId") REFERENCES "WorkerVersion" ("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
+
+-- CreateTable
+CREATE TABLE "WorkerVersionLog" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "workerVersionId" TEXT NOT NULL,
+    "content" TEXT NOT NULL,
+    "isSystem" BOOLEAN NOT NULL DEFAULT false,
+    CONSTRAINT "WorkerVersionLog_workerVersionId_fkey" FOREIGN KEY ("workerVersionId") REFERENCES "WorkerVersion" ("id") ON DELETE CASCADE ON UPDATE CASCADE
 );
 
 -- CreateTable
@@ -246,22 +329,25 @@ CREATE UNIQUE INDEX "ApiKey_token_key" ON "ApiKey"("token");
 CREATE UNIQUE INDEX "Artifact_hash_key" ON "Artifact"("hash");
 
 -- CreateIndex
-CREATE UNIQUE INDEX "InstanceState_id_lastOperationId_key" ON "InstanceState"("id", "lastOperationId");
+CREATE UNIQUE INDEX "InstanceState_instanceId_key" ON "InstanceState"("instanceId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "Page_stateId_name_key" ON "Page"("stateId", "name");
 
 -- CreateIndex
-CREATE INDEX "Page_instanceId_idx" ON "Page"("instanceId");
+CREATE UNIQUE INDEX "Secret_systemName_key" ON "Secret"("systemName");
 
 -- CreateIndex
-CREATE INDEX "Page_serviceAccountId_idx" ON "Page"("serviceAccountId");
+CREATE UNIQUE INDEX "Secret_stateId_name_key" ON "Secret"("stateId", "name");
 
 -- CreateIndex
-CREATE INDEX "Terminal_serviceAccountId_idx" ON "Terminal"("serviceAccountId");
+CREATE UNIQUE INDEX "Terminal_stateId_name_key" ON "Terminal"("stateId", "name");
 
 -- CreateIndex
-CREATE UNIQUE INDEX "Terminal_instanceId_name_key" ON "Terminal"("instanceId", "name");
+CREATE UNIQUE INDEX "Trigger_stateId_name_key" ON "Trigger"("stateId", "name");
 
 -- CreateIndex
-CREATE UNIQUE INDEX "Trigger_instanceId_name_key" ON "Trigger"("instanceId", "name");
+CREATE UNIQUE INDEX "UnlockMethod_recipient_key" ON "UnlockMethod"("recipient");
 
 -- CreateIndex
 CREATE UNIQUE INDEX "Worker_identity_key" ON "Worker"("identity");

package/prisma/project/terminal.prisma

@@ -52,10 +52,10 @@ model Terminal {
     updatedAt DateTime @updatedAt
 
     /// The instance this terminal belongs to.
-    state InstanceState? @relation(fields: [stateId], references: [id], onDelete: Cascade)
+    state InstanceState? @relation(fields: [stateId], references: [id])
 
     /// The service account this terminal belongs to.
-    serviceAccount ServiceAccount? @relation(fields: [serviceAccountId], references: [id], onDelete: Cascade)
+    serviceAccount ServiceAccount? @relation(fields: [serviceAccountId], references: [id])
 
     /// The terminal sessions associated with this terminal.
     sessions TerminalSession[]

package/prisma/project/unlock-method.prisma

@@ -36,7 +36,7 @@ model UnlockMethod {
     encryptedIdentity String
 
     /// The AGE recipient for this unlock method.
-    recipient String
+    recipient String @unique
 
     /// The time when the unlock method was created.
     createdAt DateTime @default(now())

package/prisma/project/worker.prisma

@@ -84,7 +84,7 @@ model WorkerVersion {
     workerId String
 
     /// The digest of the worker version used to identify it.
-    /// The format is raw SHA256 digest without the `sha256:` prefix.
+    /// The format is raw SHA256 digest without the `sha256:` prefix in lowercase hex.
     digest String @unique
 
     /// The ID of the API key this worker version uses.