@highstate/designer 0.4.5 → 0.5.0

package/.output/server/index.mjs

@@ -1,6 +1,6 @@
 import process from 'node:process';globalThis._importMeta_={url:import.meta.url,env:process.env};import http, { Server as Server$1 } from 'node:http';
 import https, { Server } from 'node:https';
-import nodeCrypto, { randomUUID as randomUUID$1 } from 'node:crypto';
+import nodeCrypto from 'node:crypto';
 import require$$0$3 from 'events';
 import require$$2 from 'http';
 import require$$0$2 from 'stream';
@@ -14,27 +14,15 @@ import require$$7 from 'url';
 import { resolveResponse } from '@trpc/server/http';
 import { initTRPC, TRPCError } from '@trpc/server';
 import { z } from 'zod';
-import { pino } from 'pino';
-import { tmpdir, homedir } from 'node:os';
-import { resolve as resolve$1, dirname as dirname$1, join, basename, relative } from 'node:path';
-import { Readable as Readable$1, PassThrough } from 'node:stream';
-import { readdir as readdir$1, readFile as readFile$1, writeFile as writeFile$1, mkdir } from 'node:fs/promises';
-import spawn from 'nano-spawn';
-import { EventEmitter as EventEmitter$2, on } from 'node:events';
-import { fileURLToPath } from 'node:url';
-import { ensureDependencyInstalled } from 'nypm';
-import { pickBy, mapKeys, mapValues, omit, unique, fromEntries, funnel, pick } from 'remeda';
-import { resolve as resolve$2 } from 'import-meta-resolve';
-import { sha256 } from 'crypto-hash';
-import { BetterLock } from 'better-lock';
-import { findWorkspaceDir, readPackageJSON } from 'pkg-types';
-import { uuidv7 } from 'uuidv7';
-import { Worker } from 'node:worker_threads';
-import Watcher from 'watcher';
+import { parseInstanceId } from '@highstate/contract';
+import { SecretAccessDeniedError, getSharedServices } from '@highstate/backend';
+import { hubModelPatchSchema, hubModelSchema, instanceModelSchema, instanceModelPatchSchema, projectOperationRequestSchema } from '@highstate/backend/shared';
 import { getRequestDependencies, getPreloadLinks, getPrefetchLinks, createRenderer } from 'vue-bundle-renderer/runtime';
 import { stringify as stringify$1, uneval } from 'devalue';
 import { propsToString, renderSSRHead } from '@unhead/ssr';
 import { promises, existsSync } from 'node:fs';
+import { resolve as resolve$1, dirname as dirname$1, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { createServerHead as createServerHead$1, CapoPlugin } from 'unhead';
 import { unref, version } from 'vue';
 import { defineHeadPlugin } from '@unhead/shared';
@@ -7858,8 +7846,8 @@ function createNodeFetch() {
 }
 const fetch = globalThis.fetch ? (...args) => globalThis.fetch(...args) : createNodeFetch();
 const Headers$1 = globalThis.Headers || s;
-const AbortController$1 = globalThis.AbortController || i;
-createFetch$1({ fetch, Headers: Headers$1, AbortController: AbortController$1 });
+const AbortController = globalThis.AbortController || i;
+createFetch$1({ fetch, Headers: Headers$1, AbortController });
 
 function rawHeaders(headers) {
   const rawHeaders2 = [];
@@ -8703,114 +8691,114 @@ const assets$1 = {
   "/favicon.ico": {
     "type": "image/vnd.microsoft.icon",
     "etag": "\"10be-n8egyE9tcb7sKGr/pYCaQ4uWqxI\"",
-    "mtime": "2025-03-12T08:50:50.345Z",
+    "mtime": "2025-03-13T15:46:35.139Z",
     "size": 4286,
     "path": "../public/favicon.ico"
   },
   "/libavoid.wasm": {
     "type": "application/wasm",
     "etag": "\"766e3-UHfBWRoZIr7ZrE8DM+K3aPbBHHs\"",
-    "mtime": "2025-03-12T08:50:50.346Z",
+    "mtime": "2025-03-13T15:46:35.139Z",
     "size": 485091,
     "path": "../public/libavoid.wasm"
   },
   "/robots.txt": {
     "type": "text/plain; charset=utf-8",
     "etag": "\"1-rcg7GeeTSRscbqD9i0bNnzLlkvw\"",
-    "mtime": "2025-03-12T08:50:50.345Z",
+    "mtime": "2025-03-13T15:46:35.140Z",
     "size": 1,
     "path": "../public/robots.txt"
   },
-  "/_nuxt/BA0u-n1q.js": {
-    "type": "text/javascript; charset=utf-8",
-    "etag": "\"2e69ec-I67F4iAuM8BB51dVOA0nCKtaTbY\"",
-    "mtime": "2025-03-12T08:50:50.339Z",
-    "size": 3041772,
-    "path": "../public/_nuxt/BA0u-n1q.js"
-  },
-  "/_nuxt/B_hR0Ok_.js": {
+  "/_nuxt/CDvc066L.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": "\"24e4-RJFyfHcR8oLj9Sf/RtxT59EJmB4\"",
-    "mtime": "2025-03-12T08:50:50.334Z",
+    "etag": "\"24e4-+jqAx6qFy5SKHJwAj2O794Tdcbo\"",
+    "mtime": "2025-03-13T15:46:35.128Z",
     "size": 9444,
-    "path": "../public/_nuxt/B_hR0Ok_.js"
+    "path": "../public/_nuxt/CDvc066L.js"
   },
-  "/_nuxt/Cj8SV8PB.js": {
+  "/_nuxt/D0Jq3pX9.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": "\"d52-3iXtEdxPn2aBl5doZoJysdkuhfM\"",
-    "mtime": "2025-03-12T08:50:50.336Z",
-    "size": 3410,
-    "path": "../public/_nuxt/Cj8SV8PB.js"
+    "etag": "\"2e8e29-z/bd41TWP4osYIwxeZO04xqSJCg\"",
+    "mtime": "2025-03-13T15:46:35.131Z",
+    "size": 3051049,
+    "path": "../public/_nuxt/D0Jq3pX9.js"
   },
-  "/_nuxt/DE7L338O.js": {
+  "/_nuxt/DOPM99N_.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": "\"180-YHhGncYlIbnPEJ0dtqKkGJ8LjXE\"",
-    "mtime": "2025-03-12T08:50:50.334Z",
+    "etag": "\"180-CrBGOorbKNbqQRD0gmnALlvm39I\"",
+    "mtime": "2025-03-13T15:46:35.124Z",
     "size": 384,
-    "path": "../public/_nuxt/DE7L338O.js"
+    "path": "../public/_nuxt/DOPM99N_.js"
+  },
+  "/_nuxt/Dx2bEYXH.js": {
+    "type": "text/javascript; charset=utf-8",
+    "etag": "\"d52-Ay8ELiP5t9RXGTJSuzUiP4Fz0EY\"",
+    "mtime": "2025-03-13T15:46:35.124Z",
+    "size": 3410,
+    "path": "../public/_nuxt/Dx2bEYXH.js"
   },
-  "/_nuxt/entry.7p8V-3Ph.css": {
+  "/_nuxt/entry.VNeMltv3.css": {
     "type": "text/css; charset=utf-8",
-    "etag": "\"9cab0-3yvv6HVuNw9F+4Lip03axZMjgsc\"",
-    "mtime": "2025-03-12T08:50:50.335Z",
-    "size": 641712,
-    "path": "../public/_nuxt/entry.7p8V-3Ph.css"
+    "etag": "\"9cd57-ryYCZAd1Tpuq2Ku/MpNkfOb0IlM\"",
+    "mtime": "2025-03-13T15:46:35.125Z",
+    "size": 642391,
+    "path": "../public/_nuxt/entry.VNeMltv3.css"
   },
   "/_nuxt/error-404.BJkSn6RI.css": {
     "type": "text/css; charset=utf-8",
     "etag": "\"de4-r9xtDsKTiqf+9Q1gboMnptHSjqc\"",
-    "mtime": "2025-03-12T08:50:50.334Z",
+    "mtime": "2025-03-13T15:46:35.126Z",
     "size": 3556,
     "path": "../public/_nuxt/error-404.BJkSn6RI.css"
   },
   "/_nuxt/error-500.TOCKLquH.css": {
     "type": "text/css; charset=utf-8",
     "etag": "\"75c-UgDuztSkituCmi5v2gpTJ/CXJTw\"",
-    "mtime": "2025-03-12T08:50:50.336Z",
+    "mtime": "2025-03-13T15:46:35.125Z",
     "size": 1884,
     "path": "../public/_nuxt/error-500.TOCKLquH.css"
   },
   "/_nuxt/materialdesignicons-webfont.B6OSyW2I.woff2": {
     "type": "font/woff2",
     "etag": "\"4f67c-W8lIr//mYzY5FU4CS/BHzz74EyY\"",
-    "mtime": "2025-03-12T08:50:50.336Z",
+    "mtime": "2025-03-13T15:46:35.125Z",
     "size": 325244,
     "path": "../public/_nuxt/materialdesignicons-webfont.B6OSyW2I.woff2"
   },
   "/_nuxt/materialdesignicons-webfont.BpRar1d5.ttf": {
     "type": "font/ttf",
     "etag": "\"fa880-nkfshQEtwwStQS/6eMVMGW/xVqE\"",
-    "mtime": "2025-03-12T08:50:50.339Z",
+    "mtime": "2025-03-13T15:46:35.127Z",
     "size": 1026176,
     "path": "../public/_nuxt/materialdesignicons-webfont.BpRar1d5.ttf"
   },
   "/_nuxt/materialdesignicons-webfont.Bvl3VxMs.woff": {
     "type": "font/woff",
     "etag": "\"71924-jzj1x+KrB1ZBtcEM3SXV+zN4+UU\"",
-    "mtime": "2025-03-12T08:50:50.337Z",
+    "mtime": "2025-03-13T15:46:35.128Z",
     "size": 465188,
     "path": "../public/_nuxt/materialdesignicons-webfont.Bvl3VxMs.woff"
   },
   "/_nuxt/materialdesignicons-webfont.TEmAk13K.eot": {
     "type": "application/vnd.ms-fontobject",
     "etag": "\"fa95c-6ehgxBKVuQrh1OSTYvzSxNh2cco\"",
-    "mtime": "2025-03-12T08:50:50.339Z",
+    "mtime": "2025-03-13T15:46:35.132Z",
     "size": 1026396,
     "path": "../public/_nuxt/materialdesignicons-webfont.TEmAk13K.eot"
   },
   "/_nuxt/builds/latest.json": {
     "type": "application/json",
-    "etag": "\"47-GF6YtFSchsnd8nK/a2Lr+DruB0o\"",
-    "mtime": "2025-03-12T08:50:50.322Z",
+    "etag": "\"47-1fri3LB/F+dDpUPbv03igeXC4tw\"",
+    "mtime": "2025-03-13T15:46:35.110Z",
     "size": 71,
     "path": "../public/_nuxt/builds/latest.json"
   },
-  "/_nuxt/builds/meta/befe985c-c66f-4500-9488-46464c80fbfc.json": {
+  "/_nuxt/builds/meta/cb8636dd-e396-496a-9bd3-892327ee4ea5.json": {
     "type": "application/json",
-    "etag": "\"8b-Dy4sBIqTYyljp99wPVC+I0zZwlo\"",
-    "mtime": "2025-03-12T08:50:50.316Z",
+    "etag": "\"8b-OoVy5ynutPFlr2eWhRK1c4PUr68\"",
+    "mtime": "2025-03-13T15:46:35.104Z",
     "size": 139,
-    "path": "../public/_nuxt/builds/meta/befe985c-c66f-4500-9488-46464c80fbfc.json"
+    "path": "../public/_nuxt/builds/meta/cb8636dd-e396-496a-9bd3-892327ee4ea5.json"
   }
 };
 
@@ -9342,16 +9330,16 @@ function isNativeFunction(f) {
   return Function.prototype.toString.call(f).slice(-nativeFuncLength) === nativeFunc;
 }
 
-var __defProp$1$1 = Object.defineProperty;
-var __defNormalProp$1$1 = (obj, key, value) => key in obj ? __defProp$1$1(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$1$1 = (obj, key, value) => {
-  __defNormalProp$1$1(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$1 = Object.defineProperty;
+var __defNormalProp$1 = (obj, key, value) => key in obj ? __defProp$1(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$1 = (obj, key, value) => {
+  __defNormalProp$1(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 class WordArray {
   constructor(words, sigBytes) {
-    __publicField$1$1(this, "words");
-    __publicField$1$1(this, "sigBytes");
+    __publicField$1(this, "words");
+    __publicField$1(this, "sigBytes");
     words = this.words = words || [];
     this.sigBytes = sigBytes === void 0 ? words.length * 4 : sigBytes;
   }
@@ -9424,10 +9412,10 @@ const Utf8 = {
 };
 class BufferedBlockAlgorithm {
   constructor() {
-    __publicField$1$1(this, "_data", new WordArray());
-    __publicField$1$1(this, "_nDataBytes", 0);
-    __publicField$1$1(this, "_minBufferSize", 0);
-    __publicField$1$1(this, "blockSize", 512 / 32);
+    __publicField$1(this, "_data", new WordArray());
+    __publicField$1(this, "_nDataBytes", 0);
+    __publicField$1(this, "_minBufferSize", 0);
+    __publicField$1(this, "blockSize", 512 / 32);
   }
   reset() {
     this._data = new WordArray();
@@ -9475,10 +9463,10 @@ class Hasher extends BufferedBlockAlgorithm {
   }
 }
 
-var __defProp$7 = Object.defineProperty;
-var __defNormalProp$7 = (obj, key, value) => key in obj ? __defProp$7(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$7 = (obj, key, value) => {
-  __defNormalProp$7(obj, key + "" , value);
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => {
+  __defNormalProp(obj, key + "" , value);
   return value;
 };
 const H = [
@@ -9561,7 +9549,7 @@ const W = [];
 class SHA256 extends Hasher {
   constructor() {
     super(...arguments);
-    __publicField$7(this, "_hash", new WordArray([...H]));
+    __publicField(this, "_hash", new WordArray([...H]));
   }
   /**
    * Resets the internal state of the hash object to initial values.
@@ -10928,7 +10916,7 @@ function _expandFromEnv(value) {
 const _inlineRuntimeConfig = {
   "app": {
     "baseURL": "/",
-    "buildId": "befe985c-c66f-4500-9488-46464c80fbfc",
+    "buildId": "cb8636dd-e396-496a-9bd3-892327ee4ea5",
     "buildAssetsDir": "/_nuxt/",
     "cdnURL": ""
   },
@@ -10955,7 +10943,9 @@ const _inlineRuntimeConfig = {
       }
     }
   },
-  "public": {}
+  "public": {
+    "version": "0.4.6"
+  }
 };
 const envOptions = {
   prefix: "NITRO_",
@@ -11667,21 +11657,6 @@ const publicProcedure = t.procedure;
 const router = t.router;
 t.middleware;
 
-function getInstanceId(instanceType, instanceName) {
-  return `${instanceType}:${instanceName}`;
-}
-function parseInstanceId(instanceId) {
-  const parts = instanceId.split(":");
-  if (parts.length !== 2) {
-    throw new Error(`Invalid instance key: ${instanceId}`);
-  }
-  return parts;
-}
-
-function isUnitModel(model) {
-  return "source" in model;
-}
-
 const stateRouter = router({
   getInstanceStates: publicProcedure.input(
     z.object({
@@ -11735,3561 +11710,81 @@ const stateRouter = router({
   })
 });
 
-class SecretAccessDeniedError extends Error {
-  constructor(projectId, key) {
-    super(`Access to the secrets of component "${projectId}.${key}" is denied.`);
-  }
-}
-
-async function runWithRetryOnError(runner, tryHandleError, maxRetries = 1) {
-  let lastError;
-  for (let i = 0; i < maxRetries + 1; i++) {
+const secretRouter = router({
+  isLocked: publicProcedure.input(
+    z.object({
+      projectId: z.string()
+    })
+  ).query(async ({ input, ctx }) => {
+    var _a, _b;
+    const isLocked = await ((_b = (_a = ctx.secretBackend).isLocked) == null ? void 0 : _b.call(_a, input.projectId));
+    return isLocked != null ? isLocked : false;
+  }),
+  unlock: publicProcedure.input(
+    z.object({
+      projectId: z.string(),
+      passphrase: z.string()
+    })
+  ).mutation(async ({ input, ctx }) => {
+    if (!ctx.secretBackend.unlock) {
+      throw new Error("The secret backend does not support unlocking.");
+    }
+    return await ctx.secretBackend.unlock(input.projectId, input.passphrase);
+  }),
+  get: publicProcedure.input(
+    z.object({
+      projectId: z.string(),
+      instanceKey: z.string()
+    })
+  ).query(async ({ input, ctx }) => {
     try {
-      return await runner();
+      return await ctx.secretBackend.get(input.projectId, input.instanceKey);
     } catch (e) {
-      lastError = e;
-      if (await tryHandleError(e)) {
-        continue;
+      if (e instanceof SecretAccessDeniedError) {
+        throw new TRPCError({
+          code: "FORBIDDEN",
+          message: "Access to the secret is denied",
+          cause: e
+        });
       }
       throw e;
     }
-  }
-  throw lastError;
-}
-class AbortError extends Error {
-  constructor() {
-    super("Operation aborted");
-  }
-}
-function isAbortError(error) {
-  return error instanceof Error && error.name === "AbortError";
-}
-const stringArrayType = z.string().transform((args) => args.split(",").map((arg) => arg.trim()));
-function errorToString(error) {
-  if (error instanceof Error) {
-    return error.stack || error.message;
-  }
-  return JSON.stringify(error);
-}
-function arrayAccumulator(values, value) {
-  if (!values) {
-    return [value];
-  }
-  return [...values, value];
-}
-
-var __defProp$6 = Object.defineProperty;
-var __defNormalProp$6 = (obj, key, value) => key in obj ? __defProp$6(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$6 = (obj, key, value) => __defNormalProp$6(obj, typeof key !== "symbol" ? key + "" : key, value);
-var _a;
-class LocalPulumiHost {
-  constructor(logger) {
-    this.logger = logger;
-    __publicField$6(this, "lock", new BetterLock());
-    __publicField$6(this, "sharedPassword", (_a = process.env.PULUMI_CONFIG_PASSPHRASE) != null ? _a : "");
-    __publicField$6(this, "passwords", /* @__PURE__ */ new Map());
-  }
-  async getCurrentUser() {
-    const { LocalWorkspace } = await import('@pulumi/pulumi/automation/index.js');
-    const workspace = await LocalWorkspace.create({});
-    try {
-      return await workspace.whoAmI();
-    } catch (error) {
-      this.logger.error({ msg: "failed to get current user", error });
-      return null;
-    }
-  }
-  async runInline(projectId, pulumiProjectName, pulumiStackName, program, fn) {
-    return await this.lock.acquire(`${pulumiProjectName}.${pulumiStackName}`, async () => {
-      const { LocalWorkspace } = await import('@pulumi/pulumi/automation/index.js');
-      const stack = await LocalWorkspace.createOrSelectStack(
-        {
-          projectName: pulumiProjectName,
-          stackName: pulumiStackName,
-          program
-        },
-        {
-          projectSettings: {
-            name: pulumiProjectName,
-            runtime: "nodejs"
-          },
-          envVars: {
-            PULUMI_CONFIG_PASSPHRASE: this.getPassword(projectId),
-            PULUMI_K8S_AWAIT_ALL: "true"
-          }
-        }
-      );
-      try {
-        return await runWithRetryOnError(
-          () => fn(stack),
-          (error) => this.tryUnlockStack(stack, error)
-        );
-      } catch (e) {
-        if (e instanceof Error && e.message.includes("canceled")) {
-          throw new AbortError();
-        }
-        throw e;
-      }
-    });
-  }
-  async runEmpty(projectId, pulumiProjectName, pulumiStackName, fn) {
-    return await this.runInline(projectId, pulumiProjectName, pulumiStackName, async () => {
-    }, fn);
-  }
-  // TODO: extract args to options object
-  async runLocal(projectId, pulumiProjectName, pulumiStackName, programPathResolver, fn, stackConfig) {
-    return await this.lock.acquire(`${pulumiProjectName}.${pulumiStackName}`, async () => {
-      const { LocalWorkspace } = await import('@pulumi/pulumi/automation/index.js');
-      const stack = await LocalWorkspace.createOrSelectStack(
-        {
-          stackName: pulumiStackName,
-          workDir: await programPathResolver()
-        },
-        {
-          projectSettings: {
-            name: pulumiProjectName,
-            runtime: "nodejs"
-          },
-          stackSettings: stackConfig ? {
-            [pulumiStackName]: {
-              config: stackConfig
-            }
-          } : void 0,
-          envVars: {
-            PULUMI_CONFIG_PASSPHRASE: this.getPassword(projectId),
-            PULUMI_K8S_AWAIT_ALL: "true"
-          }
-        }
-      );
-      try {
-        return await runWithRetryOnError(
-          () => fn(stack),
-          (error) => this.tryUnlockStack(stack, error)
-        );
-      } catch (e) {
-        if (e instanceof Error && e.message.includes("canceled")) {
-          throw new AbortError();
-        }
-        throw e;
-      }
-    });
-  }
-  hasPassword(projectId) {
-    return !!this.sharedPassword || this.passwords.has(projectId);
-  }
-  setPassword(projectId, password) {
-    this.passwords.set(projectId, password);
-  }
-  getPassword(projectId) {
-    return this.sharedPassword || this.passwords.get(projectId) || "";
-  }
-  async tryUnlockStack(stack, error) {
-    if (error instanceof Error && error.message.includes("the stack is currently locked")) {
-      this.logger.warn({ stackName: stack.name }, "inlocking stack");
-      await stack.cancel();
-      return true;
-    }
-    return false;
-  }
-  static create(logger) {
-    return new LocalPulumiHost(logger.child({ service: "LocalPulumiHost" }));
-  }
-}
-function valueToString(value) {
-  if (typeof value === "string") {
-    return value;
-  }
-  return JSON.stringify(value);
-}
-function stringToValue(value) {
-  try {
-    return JSON.parse(value);
-  } catch {
-    return value;
-  }
-}
-function updateResourceCount(opType, currentCount) {
-  switch (opType) {
-    case "same":
-    case "create":
-    case "update":
-    case "replace":
-    case "create-replacement":
-    case "import":
-    case "import-replacement":
-      return currentCount + 1;
-    case "delete":
-    case "delete-replaced":
-    case "discard":
-    case "discard-replaced":
-    case "remove-pending-replace":
-      return currentCount - 1;
-    case "refresh":
-    case "read-replacement":
-    case "read":
-      return currentCount;
-    default:
-      throw new Error(`Unknown operation type: ${opType}`);
-  }
-}
-
-async function resolveMainLocalProject(projectPath, projectName) {
-  if (!projectPath) {
-    projectPath = await findWorkspaceDir();
-  }
-  if (!projectName) {
-    const packageJson = await readPackageJSON(projectPath);
-    projectName = packageJson.name;
-  }
-  if (!projectName) {
-    projectName = basename(projectPath);
-  }
-  return [projectPath, projectName];
-}
-
-const localSecretBackendConfig = z.object({
-  HIGHSTATE_BACKEND_SECRET_PROJECT_PATH: z.string().optional(),
-  HIGHSTATE_BACKEND_SECRET_PROJECT_NAME: z.string().optional()
-});
-class LocalSecretBackend {
-  constructor(projectPath, projectName, pulumiProjectHost, logger) {
-    this.projectPath = projectPath;
-    this.projectName = projectName;
-    this.pulumiProjectHost = pulumiProjectHost;
-    this.logger = logger;
-    this.logger.debug({ msg: "initialized", projectPath, projectName });
-  }
-  isLocked(projectId) {
-    return Promise.resolve(!this.pulumiProjectHost.hasPassword(projectId));
-  }
-  async unlock(projectId, password) {
-    this.pulumiProjectHost.setPassword(projectId, password);
+  }),
+  set: publicProcedure.input(
+    z.object({
+      projectId: z.string(),
+      instanceId: z.string(),
+      values: z.record(z.unknown())
+    })
+  ).mutation(async ({ input, ctx }) => {
     try {
-      await this.pulumiProjectHost.runLocal(
-        projectId,
-        this.projectName,
-        projectId,
-        () => this.projectPath,
-        async (stack) => {
-          this.logger.debug("checking password", { projectId });
-          await stack.info(true);
-        }
-      );
-      return true;
-    } catch (error) {
-      if (error instanceof Error) {
-        if (error.message.includes("incorrect passphrase")) {
-          return false;
-        }
-      }
-      throw error;
-    }
-  }
-  get(projectId, instanceId) {
-    return this.pulumiProjectHost.runLocal(
-      projectId,
-      this.projectName,
-      projectId,
-      () => this.projectPath,
-      async (stack) => {
-        this.logger.debug("getting secrets", { projectId, instanceId });
-        const config = await stack.getAllConfig();
-        const prefix = this.getPrefix(projectId, instanceId);
-        const secrets = pickBy(config, (_, key) => key.startsWith(prefix));
-        const trimmedSecrets = mapKeys(secrets, (key) => key.slice(prefix.length));
-        return mapValues(trimmedSecrets, (value) => stringToValue(value.value));
-      }
-    );
-  }
-  set(projectId, instanceId, values) {
-    return this.pulumiProjectHost.runLocal(
-      projectId,
-      this.projectName,
-      projectId,
-      () => this.projectPath,
-      async (stack) => {
-        this.logger.debug("setting secrets", { projectId, instanceId });
-        const componentSecrets = mapValues(
-          mapKeys(values, (key) => `${this.getPrefix(projectId, instanceId)}${key}`),
-          (value) => ({
-            value: valueToString(value),
-            secret: true
-          })
-        );
-        const config = await stack.getAllConfig();
-        Object.assign(config, componentSecrets);
-        await stack.setAllConfig(config);
-      }
-    );
-  }
-  getPrefix(projectId, instanceId) {
-    instanceId = instanceId.replace(/:/g, ".");
-    return `${this.projectName}:${projectId}/${instanceId}/`;
-  }
-  static async create(config, pulumiProjectHost, logger) {
-    const [projectPath, projectName] = await resolveMainLocalProject(
-      config.HIGHSTATE_BACKEND_SECRET_PROJECT_PATH,
-      config.HIGHSTATE_BACKEND_SECRET_PROJECT_NAME
-    );
-    return new LocalSecretBackend(
-      projectPath,
-      projectName,
-      pulumiProjectHost,
-      logger.child({ backend: "SecretBackend", service: "LocalSecretBackend" })
-    );
-  }
-}
-
-const secretBackendConfig = z.object({
-  HIGHSTATE_BACKEND_SECRET_TYPE: z.enum(["local"]).default("local"),
-  ...localSecretBackendConfig.shape
-});
-function createSecretBackend(config, localPulumiHost, logger) {
-  switch (config.HIGHSTATE_BACKEND_SECRET_TYPE) {
-    case "local": {
-      return LocalSecretBackend.create(config, localPulumiHost, logger);
-    }
-  }
-}
-
-var __defProp$5 = Object.defineProperty;
-var __defNormalProp$5 = (obj, key, value) => key in obj ? __defProp$5(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$5 = (obj, key, value) => __defNormalProp$5(obj, typeof key !== "symbol" ? key + "" : key, value);
-const localLibraryBackendConfig = z.object({
-  HIGHSTATE_BACKEND_LIBRARY_LOCAL_MODULES: stringArrayType.default("@highstate/library")
-});
-class LocalLibraryBackend {
-  constructor(modulePaths, logger) {
-    this.modulePaths = modulePaths;
-    this.logger = logger;
-    __publicField$5(this, "watcher");
-    __publicField$5(this, "lock", new BetterLock());
-    __publicField$5(this, "eventEmitter", new EventEmitter$2());
-    __publicField$5(this, "library", null);
-    __publicField$5(this, "worker", null);
-    this.watcher = new Watcher(modulePaths, { recursive: true, ignoreInitial: true });
-    this.watcher.on("all", (event, path) => {
-      const prefixPath = modulePaths.find((modulePath) => path.startsWith(modulePath));
-      this.logger.info({ msg: "library event", event, path: relative(prefixPath, path) });
-      void this.lock.acquire(() => this.updateLibrary());
-    });
-    this.logger.debug({ msg: "initialized", modulePaths });
-  }
-  async loadLibrary() {
-    return await this.lock.acquire(async () => {
-      const [library] = await this.getLibrary();
-      return library;
-    });
-  }
-  async *watchLibrary(signal) {
-    for await (const [library] of on(this.eventEmitter, "library", { signal })) {
-      yield library;
-    }
-  }
-  async evaluateCompositeInstances(allInstances, instanceIds) {
-    return await this.lock.acquire(async () => {
-      this.logger.info("evaluating composite instances", { instanceIds });
-      const [, worker] = await this.getLibrary();
-      worker.postMessage({ type: "evaluate-composite-instances", allInstances, instanceIds });
-      this.logger.debug("evaluation request sent");
-      return this.getInstances(worker);
-    });
-  }
-  async evaluateModules(modulePaths) {
-    return await this.lock.acquire(async () => {
-      this.logger.info({ msg: "evaluating modules", modulePaths });
-      const [, worker] = await this.getLibrary();
-      worker.postMessage({ type: "evaluate-modules", modulePaths });
-      this.logger.debug("evaluation request sent");
-      return this.getInstances(worker);
-    });
-  }
-  async getInstances(worker) {
-    for await (const [event] of on(worker, "message")) {
-      const eventData = event;
-      if (eventData.type === "error") {
-        throw new Error(`Worker error: ${eventData.error}`);
-      }
-      if (eventData.type !== "instances") {
-        throw new Error(`Unexpected message type '${eventData.type}', expected 'instances'`);
-      }
-      return eventData.instances;
-    }
-    throw new Error("Worker ended without sending instances");
-  }
-  async getLibrary() {
-    if (this.library && this.worker) {
-      return [this.library, this.worker];
-    }
-    return await this.updateLibrary();
-  }
-  async updateLibrary() {
-    this.logger.info("creating library worker");
-    this.worker = this.createWorker({ modulePaths: this.modulePaths, logLevel: "silent" });
-    for await (const [event] of on(this.worker, "message")) {
-      const eventData = event;
-      if (eventData.type === "error") {
-        throw new Error(`Worker error: ${eventData.error}`);
-      }
-      if (eventData.type !== "library") {
-        throw new Error(`Unexpected message type '${eventData.type}', expected 'library'`);
-      }
-      this.eventEmitter.emit("library", eventData.library);
-      this.library = eventData.library;
-      this.logger.info("library reloaded");
-      return [this.library, this.worker];
-    }
-    throw new Error("Worker ended without sending library model");
-  }
-  createWorker(workerData) {
-    const workerPathUrl = resolve$2(`@highstate/backend/library-worker`, globalThis._importMeta_.url);
-    const workerPath = fileURLToPath(workerPathUrl);
-    return new Worker(workerPath, { workerData });
-  }
-  static create(config, logger) {
-    const modulePaths = [];
-    for (const module of config.HIGHSTATE_BACKEND_LIBRARY_LOCAL_MODULES) {
-      const url = resolve$2(module, globalThis._importMeta_.url);
-      let path = fileURLToPath(url);
-      if (basename(path).includes(".")) {
-        path = dirname$1(path);
+      await ctx.secretBackend.set(input.projectId, input.instanceId, input.values);
+    } catch (e) {
+      if (e instanceof SecretAccessDeniedError) {
+        throw new TRPCError({
+          code: "FORBIDDEN",
+          message: "Access to the secret is denied",
+          cause: e
+        });
       }
-      modulePaths.push(path);
-    }
-    return new LocalLibraryBackend(
-      modulePaths,
-      logger.child({ backend: "LibraryBackend", service: "LocalLibraryBackend" })
-    );
-  }
-}
-
-const libraryBackendConfig = z.object({
-  HIGHSTATE_BACKEND_LIBRARY_TYPE: z.enum(["local"]).default("local"),
-  ...localLibraryBackendConfig.shape
-});
-function createLibraryBackend(config, logger) {
-  switch (config.HIGHSTATE_BACKEND_LIBRARY_TYPE) {
-    case "local": {
-      return LocalLibraryBackend.create(config, logger);
+      throw e;
     }
-  }
-}
-
-const positionSchema = z.object({
-  x: z.number(),
-  y: z.number()
-});
-const instanceInputSchema = z.object({
-  instanceId: z.string(),
-  output: z.string()
-});
-const hubInstanceInputSchema = z.object({
-  hubId: z.string()
-});
-const instanceModelPatchSchema = z.object({
-  args: z.record(z.unknown()).optional(),
-  inputs: z.record(z.array(instanceInputSchema)).optional(),
-  hubInputs: z.record(z.array(hubInstanceInputSchema)).optional(),
-  injectionInputs: z.array(hubInstanceInputSchema).optional(),
-  position: positionSchema.optional()
-});
-const instanceModelSchema = z.object({
-  id: z.string(),
-  type: z.string(),
-  name: z.string(),
-  ...instanceModelPatchSchema.shape,
-  parentId: z.string().optional(),
-  outputs: z.record(z.array(instanceInputSchema)).optional()
-});
-const compositeInstanceSchema = z.object({
-  instance: instanceModelSchema,
-  children: z.array(instanceModelSchema)
-});
-const hubModelPatchSchema = z.object({
-  position: positionSchema.optional(),
-  inputs: z.array(instanceInputSchema).optional(),
-  injectionInputs: z.array(hubInstanceInputSchema).optional()
-});
-const hubModelSchema = z.object({
-  id: z.string().nanoid(),
-  position: positionSchema,
-  inputs: z.array(instanceInputSchema).optional(),
-  injectionInputs: z.array(hubInstanceInputSchema).optional()
-});
-
-const instanceStatusSchema = z.enum([
-  "not_created",
-  "updating",
-  "destroying",
-  "refreshing",
-  "created",
-  "error",
-  "pending",
-  "unknown"
-]);
-const instanceStatusFieldSchema = z.object({
-  name: z.string(),
-  value: z.string().optional(),
-  displayName: z.string().optional(),
-  sensitive: z.boolean().optional(),
-  url: z.string().optional()
-});
-const instanceFileMetaSchema = z.object({
-  name: z.string(),
-  contentType: z.string(),
-  isBinary: z.boolean().optional()
-});
-const instanceFileSchema = z.object({
-  ...instanceFileMetaSchema.shape,
-  content: z.string()
-});
-const instancePageBlockSchema = z.union([
-  z.object({
-    type: z.literal("markdown"),
-    content: z.string()
-  }),
-  z.object({
-    type: z.literal("qr"),
-    content: z.string(),
-    showContent: z.coerce.boolean(),
-    language: z.string().optional()
-  }),
-  z.object({
-    type: z.literal("file"),
-    fileMeta: instanceFileMetaSchema
-  })
-]);
-const instancePageMetaSchema = z.object({
-  name: z.string(),
-  title: z.string()
-});
-const instancePageSchema = z.object({
-  ...instancePageMetaSchema.shape,
-  content: z.array(instancePageBlockSchema)
-});
-const instanceTerminalMetaSchema = z.object({
-  name: z.string(),
-  title: z.string(),
-  description: z.string().optional()
-});
-const instanceTerminalFileSchema = z.object({
-  content: z.string().optional(),
-  isBinary: z.boolean().optional()
-});
-const instanceTerminalSchema = z.object({
-  ...instanceTerminalMetaSchema.shape,
-  image: z.string(),
-  command: z.string().array(),
-  cwd: z.string().optional(),
-  env: z.record(z.string()).optional(),
-  files: z.record(instanceTerminalFileSchema).optional()
-});
-const instanceTriggerSpecSchema = z.union([
-  z.object({
-    type: z.literal("before-destroy")
-  }),
-  z.object({
-    type: z.literal("schedule"),
-    schedule: z.string()
   })
-]);
-const instanceTriggerSchema = z.object({
-  name: z.string(),
-  title: z.string(),
-  description: z.string().optional(),
-  spec: instanceTriggerSpecSchema
-});
-z.object({
-  name: z.string()
-});
-const instanceStateSchema = z.object({
-  id: z.string(),
-  parentId: z.string().nullable().default(null),
-  status: instanceStatusSchema,
-  latestOperationId: z.string().nullable().default(null),
-  currentResourceCount: z.number().nullable().default(null),
-  totalResourceCount: z.number().nullable().default(null),
-  inputHash: z.string().nullable().default(null),
-  outputHash: z.string().nullable().default(null),
-  error: z.string().nullable().default(null),
-  statusFields: z.array(instanceStatusFieldSchema).default(() => []),
-  files: z.array(instanceFileMetaSchema).default(() => []),
-  pages: z.array(instancePageMetaSchema).default(() => []),
-  terminals: z.array(instanceTerminalMetaSchema).default(() => []),
-  triggers: z.array(instanceTriggerSchema).default(() => [])
-});
-z.object({
-  ...instanceStateSchema.shape,
-  // secrets updated by the unit
-  secrets: z.record(z.string()).nullable(),
-  // log line emitted by the unit
-  logLine: z.string().nullable()
-}).partial();
-function createInstanceState(id, status = "not_created", fields = {}) {
-  return {
-    id,
-    parentId: null,
-    status,
-    latestOperationId: null,
-    currentResourceCount: null,
-    totalResourceCount: null,
-    inputHash: null,
-    outputHash: null,
-    error: null,
-    statusFields: [],
-    files: [],
-    pages: [],
-    terminals: [],
-    triggers: [],
-    ...fields
-  };
-}
-function applyPartialInstanceState(states, patch) {
-  if (!patch.id) {
-    throw new Error("The ID of the instance state is required.");
-  }
-  let state = states.get(patch.id);
-  if (!state) {
-    state = createInstanceState(patch.id, "unknown");
-    states.set(patch.id, state);
-  }
-  if (patch.status !== void 0) {
-    state.status = patch.status;
-  }
-  if (patch.latestOperationId !== void 0) {
-    state.latestOperationId = patch.latestOperationId;
-  }
-  if (patch.currentResourceCount !== void 0) {
-    state.currentResourceCount = patch.currentResourceCount;
-  }
-  if (patch.totalResourceCount !== void 0) {
-    state.totalResourceCount = patch.totalResourceCount;
-  }
-  if (patch.inputHash !== void 0) {
-    state.inputHash = patch.inputHash;
-  }
-  if (patch.outputHash !== void 0) {
-    state.outputHash = patch.outputHash;
-  }
-  if (patch.error !== void 0) {
-    state.error = patch.error;
-  }
-  if (patch.statusFields !== void 0) {
-    state.statusFields = patch.statusFields;
-  }
-  if (patch.files !== void 0) {
-    state.files = patch.files;
-  }
-  if (patch.pages !== void 0) {
-    state.pages = patch.pages;
-  }
-  if (patch.terminals !== void 0) {
-    state.terminals = patch.terminals;
-  }
-  if (patch.triggers !== void 0) {
-    state.triggers = patch.triggers;
-  }
-  return state;
-}
-function createInstanceStateFrontendPatch(patch) {
-  return omit(patch, ["secrets", "logLine"]);
-}
-
-const operationTypeSchema = z.enum(["update", "destroy", "recreate", "refresh", "evaluate"]);
-const operationStatusSchema = z.enum([
-  "pending",
-  "evaluating",
-  "running",
-  "completed",
-  "failed",
-  "cancelled"
-]);
-const projectOperationSchema = z.object({
-  id: z.string().uuid(),
-  projectId: z.string(),
-  type: operationTypeSchema,
-  status: operationStatusSchema,
-  instanceIds: z.array(z.string()),
-  error: z.string().nullable(),
-  startedAt: z.number(),
-  completedAt: z.number().nullable()
 });
-const projectOperationRequestSchema = z.object({
-  projectId: z.string(),
-  type: operationTypeSchema,
-  instanceIds: z.array(z.string())
-});
-function isFinalOperationStatus(status) {
-  return status === "completed" || status === "failed" || status === "cancelled";
-}
 
-class CircularDependencyError extends Error {
-  constructor(path) {
-    super(`Circular dependency detected: ${path.join(" -> ")}`);
-    this.name = "CircularDependencyError";
-  }
-}
-function createDefaultGraphResolverBackend() {
-  const promiseCache = /* @__PURE__ */ new Map();
-  return {
-    promiseCache,
-    setOutput() {
-    },
-    setDependencies() {
-    }
-  };
-}
-function defineGraphResolver(options) {
-  return (nodes, logger, backend) => {
-    backend != null ? backend : backend = createDefaultGraphResolverBackend();
-    const resolver = (itemId, dependencyChain) => {
-      logger.trace({ itemId }, "resolving item");
-      const existingPromise = backend.promiseCache.get(itemId);
-      if (existingPromise) {
-        return existingPromise;
-      }
-      if (dependencyChain.includes(itemId)) {
-        throw new CircularDependencyError([...dependencyChain, itemId]);
-      }
-      const item = nodes.get(itemId);
-      if (!item) {
-        return Promise.resolve(void 0);
-      }
-      const resolve = async () => {
-        const dependencies = unique(options.getNodeDependencies(item));
-        backend.setDependencies(itemId, dependencies);
-        logger.trace({ itemId, dependencies }, "resolving item dependencies");
-        const resolvedDependencies = /* @__PURE__ */ new Map();
-        const newChain = [...dependencyChain, itemId];
-        for (const depId of dependencies) {
-          const depResult = await resolver(depId, newChain);
-          if (depResult !== void 0) {
-            resolvedDependencies.set(depId, depResult);
-          }
-        }
-        return await options.process(item, resolvedDependencies, logger);
-      };
-      const promise = resolve().then((result) => {
-        if (backend.promiseCache.get(itemId) === promise) {
-          backend.setOutput(itemId, result);
-        }
-        return result;
-      });
-      backend.promiseCache.set(itemId, promise);
-      return promise;
-    };
-    return (id) => resolver(id, []);
-  };
-}
-
-const createInputResolver = defineGraphResolver({
-  getNodeId(node) {
-    if (node.kind === "hub") {
-      return `hub:${node.hub.id}`;
-    }
-    return `instance:${node.instance.id}`;
-  },
-  getNodeDependencies(node) {
-    var _a, _b, _c, _d;
-    const dependencies = [];
-    if (node.kind === "hub") {
-      for (const input of (_a = node.hub.inputs) != null ? _a : []) {
-        dependencies.push(`instance:${input.instanceId}`);
-      }
-      for (const input of (_b = node.hub.injectionInputs) != null ? _b : []) {
-        dependencies.push(`hub:${input.hubId}`);
-      }
-      return dependencies;
-    }
-    for (const inputs of Object.values((_c = node.instance.hubInputs) != null ? _c : {})) {
-      for (const input of inputs) {
-        dependencies.push(`hub:${input.hubId}`);
-      }
-    }
-    for (const input of (_d = node.instance.injectionInputs) != null ? _d : []) {
-      dependencies.push(`hub:${input.hubId}`);
-    }
-    return dependencies;
-  },
-  process(node, dependencies, logger) {
-    var _a, _b, _c, _d, _e, _f, _g;
-    const getHubOutput = (input) => {
-      const output = dependencies.get(`hub:${input.hubId}`);
-      if (!output) {
-        throw new Error("Hub not found");
-      }
-      if (output.kind !== "hub") {
-        throw new Error("Expected hub node");
-      }
-      return output;
-    };
-    const getInstanceOutput = (input) => {
-      const output = dependencies.get(`instance:${input.instanceId}`);
-      if (!output) {
-        throw new Error("Instance not found");
-      }
-      if (output.kind !== "instance") {
-        throw new Error("Expected instance node");
-      }
-      return output;
-    };
-    if (node.kind === "hub") {
-      const hubResult = /* @__PURE__ */ new Map();
-      const addHubResult = (input) => {
-        hubResult.set(`${input.input.instanceId}:${input.input.output}`, input);
-      };
-      for (const input of (_a = node.hub.inputs) != null ? _a : []) {
-        const { component } = getInstanceOutput(input);
-        const componentInput = component.outputs[input.output];
-        if (!componentInput) {
-          logger.warn({ msg: "output not found in the component", input, component });
-          continue;
-        }
-        addHubResult({ input, type: componentInput.type });
-      }
-      for (const injectionInput of (_b = node.hub.injectionInputs) != null ? _b : []) {
-        const { resolvedInputs: resolvedInputs2 } = getHubOutput(injectionInput);
-        for (const input of resolvedInputs2) {
-          addHubResult(input);
-        }
-      }
-      return {
-        kind: "hub",
-        resolvedInputs: Array.from(hubResult.values())
-      };
-    }
-    const resolvedInputsMap = /* @__PURE__ */ new Map();
-    const addInstanceResult = (inputName, input) => {
-      let inputs = resolvedInputsMap.get(inputName);
-      if (!inputs) {
-        inputs = /* @__PURE__ */ new Map();
-        resolvedInputsMap.set(inputName, inputs);
-      }
-      inputs.set(`${input.input.instanceId}:${input.input.output}`, input);
-    };
-    for (const [inputName, inputs] of Object.entries((_c = node.instance.inputs) != null ? _c : {})) {
-      for (const input of inputs) {
-        const componentInput = node.component.inputs[inputName];
-        if (!componentInput) {
-          logger.warn({ msg: "input not found in the component", input, component: node.component });
-          continue;
-        }
-        addInstanceResult(inputName, { input, type: componentInput.type });
-      }
-    }
-    const injectionInputs = /* @__PURE__ */ new Map();
-    const matchedInjectionInputs = /* @__PURE__ */ new Map();
-    for (const injectionInput of (_d = node.instance.injectionInputs) != null ? _d : []) {
-      const { resolvedInputs: resolvedInputs2 } = getHubOutput(injectionInput);
-      for (const input of resolvedInputs2) {
-        injectionInputs.set(`${input.input.instanceId}:${input.input.output}`, input);
-      }
-    }
-    for (const [inputName, componentInput] of Object.entries((_e = node.component.inputs) != null ? _e : {})) {
-      const allInputs = new Map(injectionInputs);
-      const hubInputs = (_g = (_f = node.instance.hubInputs) == null ? void 0 : _f[inputName]) != null ? _g : [];
-      for (const hubInput of hubInputs) {
-        const { resolvedInputs: resolvedInputs2 } = getHubOutput(hubInput);
-        for (const input of resolvedInputs2) {
-          allInputs.set(`${input.input.instanceId}:${input.input.output}`, input);
-        }
-      }
-      for (const input of allInputs.values()) {
-        if (input.type === componentInput.type) {
-          addInstanceResult(inputName, input);
-          const key = `${input.input.instanceId}:${input.input.output}`;
-          if (injectionInputs.has(key)) {
-            matchedInjectionInputs.set(key, input);
-          }
-        }
-      }
-    }
-    const resolvedInputs = fromEntries(
-      Array.from(resolvedInputsMap.entries()).map(([inputName, inputs]) => [
-        inputName,
-        Array.from(inputs.values())
-      ])
-    );
-    return {
-      kind: "instance",
-      component: node.component,
-      resolvedInputs,
-      resolvedInjectionInputs: Array.from(injectionInputs.values()),
-      matchedInjectionInputs: Array.from(matchedInjectionInputs.values())
-    };
-  }
-});
-
-const createInputHashResolver = defineGraphResolver({
-  getNodeId: (node) => node.instance.id,
-  getNodeDependencies({ resolvedInputs }) {
-    const dependencies = [];
-    for (const inputs of Object.values(resolvedInputs != null ? resolvedInputs : {})) {
-      for (const input of inputs) {
-        dependencies.push(input.input.instanceId);
-      }
-    }
-    return dependencies;
-  },
-  async process({ instance, resolvedInputs, sourceHash, state }, dependencies) {
-    var _a;
-    let sink = JSON.stringify((_a = instance.args) != null ? _a : {});
-    if (sourceHash) {
-      sink += sourceHash;
-    }
-    if (state == null ? void 0 : state.outputHash) {
-      sink += state.outputHash;
-    }
-    const sortedInputs = Object.entries(resolvedInputs).sort(([a], [b]) => a.localeCompare(b));
-    for (const [inputKey, inputs] of sortedInputs) {
-      if (Object.keys(inputs).length === 0) {
-        continue;
-      }
-      sink += inputKey;
-      const instanceIds = inputs.map((input) => input.input.instanceId);
-      instanceIds.sort();
-      for (const instanceId of instanceIds) {
-        sink += dependencies.get(instanceId);
-      }
-    }
-    return await sha256(sink);
-  }
-});
-
-const terminalSessionSchema = z.object({
-  id: z.string().uuid(),
-  terminalName: z.string()
-});
-
-const localProjectBackendConfig = z.object({
-  HIGHSTATE_BACKEND_PROJECT_PROJECTS_DIR: z.string().optional()
-});
-const projectModelSchema = z.object({
-  instances: z.record(instanceModelSchema),
-  hubs: z.record(hubModelSchema)
-});
-class LocalProjectBackend {
-  constructor(projectsDir) {
-    this.projectsDir = projectsDir;
-  }
-  async getProjectNames() {
-    try {
-      const files = await readdir$1(this.projectsDir);
-      return files.filter((file) => file.endsWith(".json")).map((file) => file.replace(/\.json$/, ""));
-    } catch (error) {
-      throw new Error("Failed to get project names", { cause: error });
-    }
-  }
-  async getProject(projectId) {
-    try {
-      const project = await this.loadProject(projectId);
-      return {
-        instances: Object.values(project.instances),
-        hubs: Object.values(project.hubs)
-      };
-    } catch (error) {
-      throw new Error("Failed to get project instances", { cause: error });
-    }
-  }
-  async createInstance(projectId, instance) {
-    try {
-      return await this.withProject(projectId, (project) => {
-        if (project.instances[instance.id]) {
-          throw new Error(`Instance ${instance.id} already exists`);
-        }
-        project.instances[instance.id] = instance;
-        return instance;
-      });
-    } catch (error) {
-      throw new Error("Failed to create project instance", { cause: error });
-    }
-  }
-  async updateInstance(projectId, instanceId, patch) {
-    try {
-      return await this.withInstance(projectId, instanceId, (instance) => {
-        if (patch.args) {
-          instance.args = patch.args;
-        }
-        if (patch.position) {
-          instance.position = patch.position;
-        }
-        if (patch.inputs) {
-          if (Object.keys(patch.inputs).length > 0) {
-            instance.inputs = patch.inputs;
-          } else {
-            delete instance.inputs;
-          }
-        }
-        if (patch.hubInputs) {
-          if (Object.keys(patch.hubInputs).length > 0) {
-            instance.hubInputs = patch.hubInputs;
-          } else {
-            delete instance.hubInputs;
-          }
-        }
-        if (patch.injectionInputs) {
-          if (patch.injectionInputs.length > 0) {
-            instance.injectionInputs = patch.injectionInputs;
-          } else {
-            delete instance.injectionInputs;
-          }
-        }
-        return instance;
-      });
-    } catch (error) {
-      throw new Error("Failed to update project instance", { cause: error });
-    }
-  }
-  async deleteInstance(projectId, instanceId) {
-    try {
-      await this.withProject(projectId, (project) => {
-        if (!project.instances[instanceId]) {
-          throw new Error(`Instance ${instanceId} not found`);
-        }
-        delete project.instances[instanceId];
-        for (const otherInstance of Object.values(project.instances)) {
-          if (!otherInstance.inputs) {
-            continue;
-          }
-          this.deleteInstanceReferences(otherInstance.inputs, instanceId);
-          if (Object.keys(otherInstance.inputs).length === 0) {
-            delete otherInstance.inputs;
-          }
-        }
-        for (const hub of Object.values(project.hubs)) {
-          if (!hub.inputs) {
-            continue;
-          }
-          hub.inputs = hub.inputs.filter((input) => input.instanceId !== instanceId);
-          if (hub.inputs.length === 0) {
-            delete hub.inputs;
-          }
-        }
-      });
-    } catch (error) {
-      throw new Error("Failed to delete project instance", { cause: error });
-    }
-  }
-  deleteInstanceReferences(inputs, instanceId) {
-    for (const [inputKey, input] of Object.entries(inputs)) {
-      inputs[inputKey] = input.filter((inputItem) => inputItem.instanceId !== instanceId);
-      if (inputs[inputKey].length === 0) {
-        delete inputs[inputKey];
-      }
-    }
-  }
-  async renameInstance(projectId, instanceId, newName) {
-    try {
-      return await this.withProject(projectId, (project) => {
-        var _a, _b;
-        const instance = project.instances[instanceId];
-        if (!instance) {
-          throw new Error(`Instance ${instanceId} not found`);
-        }
-        const newInstanceId = getInstanceId(instance.type, newName);
-        if (project.instances[newInstanceId]) {
-          throw new Error(`Instance ${newInstanceId} already exists`);
-        }
-        delete project.instances[instanceId];
-        instance.id = newInstanceId;
-        instance.name = newName;
-        project.instances[newInstanceId] = instance;
-        for (const otherInstance of Object.values(project.instances)) {
-          for (const inputs of Object.values((_a = otherInstance.inputs) != null ? _a : {})) {
-            this.renameInstanceReferences(inputs, instanceId, instance.id);
-          }
-        }
-        for (const hub of Object.values(project.hubs)) {
-          this.renameInstanceReferences((_b = hub.inputs) != null ? _b : [], instanceId, instance.id);
-        }
-        return instance;
-      });
-    } catch (error) {
-      throw new Error("Failed to rename project instance", { cause: error });
-    }
-  }
-  renameInstanceReferences(inputs, instanceId, newInstanceId) {
-    for (const input of inputs) {
-      if (input.instanceId === instanceId) {
-        input.instanceId = newInstanceId;
-      }
-    }
-  }
-  async createHub(projectId, hub) {
-    try {
-      return await this.withProject(projectId, (project) => {
-        if (project.hubs[hub.id]) {
-          throw new Error(`Hub ${hub.id} already exists`);
-        }
-        project.hubs[hub.id] = hub;
-        return hub;
-      });
-    } catch (error) {
-      throw new Error("Failed to create project hub", { cause: error });
-    }
-  }
-  async updateHub(projectId, hubId, patch) {
-    try {
-      return await this.withProject(projectId, (project) => {
-        const hub = project.hubs[hubId];
-        if (!hub) {
-          throw new Error(`Hub ${hubId} not found`);
-        }
-        if (patch.position) {
-          hub.position = patch.position;
-        }
-        if (patch.inputs) {
-          if (patch.inputs.length > 0) {
-            hub.inputs = patch.inputs;
-          } else {
-            delete hub.inputs;
-          }
-        }
-        if (patch.injectionInputs) {
-          if (patch.injectionInputs.length > 0) {
-            hub.injectionInputs = patch.injectionInputs;
-          } else {
-            delete hub.injectionInputs;
-          }
-        }
-        return hub;
-      });
-    } catch (error) {
-      throw new Error("Failed to update project hub", { cause: error });
-    }
-  }
-  async deleteHub(projectId, hubId) {
-    try {
-      await this.withProject(projectId, (project) => {
-        if (!project.hubs[hubId]) {
-          throw new Error(`Hub ${hubId} not found`);
-        }
-        delete project.hubs[hubId];
-        for (const instance of Object.values(project.instances)) {
-          if (instance.hubInputs) {
-            this.deleteHubReferences(instance.hubInputs, hubId);
-            if (Object.keys(instance.hubInputs).length === 0) {
-              delete instance.hubInputs;
-            }
-          }
-          if (instance.injectionInputs) {
-            instance.injectionInputs = instance.injectionInputs.filter(
-              (input) => input.hubId !== hubId
-            );
-            if (instance.injectionInputs.length === 0) {
-              delete instance.injectionInputs;
-            }
-          }
-        }
-        for (const otherHub of Object.values(project.hubs)) {
-          if (!otherHub.injectionInputs) {
-            continue;
-          }
-          otherHub.injectionInputs = otherHub.injectionInputs.filter((input) => input.hubId !== hubId);
-          if (otherHub.injectionInputs.length === 0) {
-            delete otherHub.injectionInputs;
-          }
-        }
-      });
-    } catch (error) {
-      throw new Error("Failed to delete project hub", { cause: error });
-    }
-  }
-  deleteHubReferences(inputs, hubId) {
-    for (const [inputKey, input] of Object.entries(inputs)) {
-      inputs[inputKey] = input.filter((inputItem) => inputItem.hubId !== hubId);
-      if (inputs[inputKey].length === 0) {
-        delete inputs[inputKey];
-      }
-    }
-  }
-  getProjectPath(projectId) {
-    return `${this.projectsDir}/${projectId}.json`;
-  }
-  async loadProject(projectId) {
-    const projectPath = this.getProjectPath(projectId);
-    try {
-      const content = await readFile$1(projectPath, "utf-8");
-      return projectModelSchema.parse(JSON.parse(content));
-    } catch (error) {
-      if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-        return { instances: {}, hubs: {} };
-      }
-      throw error;
-    }
-  }
-  async writeProject(projectId, project) {
-    const projectPath = this.getProjectPath(projectId);
-    const content = JSON.stringify(project, void 0, 2);
-    await writeFile$1(projectPath, content);
-  }
-  async withInstance(projectId, instanceId, callback) {
-    return await this.withProject(projectId, (project) => {
-      const instance = project.instances[instanceId];
-      if (!instance) {
-        throw new Error(`Instance ${instanceId} not found`);
-      }
-      return callback(instance);
-    });
-  }
-  async withProject(projectId, callback) {
-    const project = await this.loadProject(projectId);
-    const result = callback(project);
-    await this.writeProject(projectId, project);
-    return result;
-  }
-  static async create(config) {
-    let projectsPath = config.HIGHSTATE_BACKEND_PROJECT_PROJECTS_DIR;
-    if (!projectsPath) {
-      const [mainProjectPath] = await resolveMainLocalProject();
-      projectsPath = resolve$1(mainProjectPath, "projects");
-    }
-    await mkdir(projectsPath, { recursive: true });
-    return new LocalProjectBackend(projectsPath);
-  }
-}
-
-const projectBackendConfig = z.object({
-  HIGHSTATE_BACKEND_PROJECT_TYPE: z.enum(["local"]).default("local"),
-  ...localProjectBackendConfig.shape
-});
-function createProjectBackend(config) {
-  return LocalProjectBackend.create(config);
-}
-
-var __defProp$4 = Object.defineProperty;
-var __defNormalProp$4 = (obj, key, value) => key in obj ? __defProp$4(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$4 = (obj, key, value) => __defNormalProp$4(obj, key + "" , value);
-class ProjectLock {
-  constructor(lock, projectId) {
-    this.lock = lock;
-    this.projectId = projectId;
-  }
-  lockInstance(instanceId, fn) {
-    return this.lock.acquire(`${this.projectId}/${instanceId}`, fn);
-  }
-  lockInstances(instanceIds, fn) {
-    return this.lock.acquire(
-      instanceIds.map((id) => `${this.projectId}/${id}`),
-      fn
-    );
-  }
-}
-class ProjectLockManager {
-  constructor() {
-    __publicField$4(this, "lock", new BetterLock());
-  }
-  getLock(projectId) {
-    return new ProjectLock(this.lock, projectId);
-  }
-}
-
-class ProjectManager {
-  constructor(projectBackend, stateBackend, operationManager, library, logger) {
-    this.projectBackend = projectBackend;
-    this.stateBackend = stateBackend;
-    this.operationManager = operationManager;
-    this.library = library;
-    this.logger = logger;
-  }
-  async getCompositeInstance(projectId, instanceId) {
-    const { resolveInputHash } = await this.prepareInputHashResolver(projectId, instanceId);
-    const [compositeInstance, actualInputHash] = await Promise.all([
-      this.stateBackend.getCompositeInstance(projectId, instanceId),
-      resolveInputHash(instanceId)
-    ]);
-    if (compositeInstance && compositeInstance.inputHash === actualInputHash) {
-      return compositeInstance;
-    }
-    this.logger.info("re-evaluating instance since input hash has changed", {
-      projectId,
-      instanceId
-    });
-    const instancePromise = this.waitForCompositeInstance(
-      projectId,
-      instanceId,
-      actualInputHash,
-      resolveInputHash
-    );
-    await this.operationManager.launch({
-      type: "evaluate",
-      projectId,
-      instanceIds: [instanceId]
-    });
-    return await instancePromise;
-  }
-  async createInstance(projectId, instance) {
-    const createdInstance = await this.projectBackend.createInstance(projectId, instance);
-    await this.updateInstanceChildren(projectId, createdInstance);
-    return createdInstance;
-  }
-  async updateInstance(projectId, instanceId, patch) {
-    const instance = await this.projectBackend.updateInstance(projectId, instanceId, patch);
-    await this.updateInstanceChildren(projectId, instance);
-    return instance;
-  }
-  async renameInstance(projectId, instanceId, newName) {
-    const instance = await this.projectBackend.renameInstance(projectId, instanceId, newName);
-    await this.updateInstanceChildren(projectId, instance);
-    return instance;
-  }
-  async deleteInstance(projectId, instanceId) {
-    await Promise.all([
-      this.projectBackend.deleteInstance(projectId, instanceId),
-      this.stateBackend.clearCompositeInstances(projectId, [instanceId])
-    ]);
-  }
-  async updateInstanceChildren(projectId, instance) {
-    const { resolveInputHash, library } = await this.prepareInputHashResolver(
-      projectId,
-      instance.id
-    );
-    const component = library.components[instance.type];
-    if (!component) {
-      return;
-    }
-    if (isUnitModel(component)) {
-      return;
-    }
-    const expectedInputHash = await resolveInputHash(instance.id);
-    const inputHash = await this.stateBackend.getCompositeInstanceInputHash(projectId, instance.id);
-    if (inputHash !== expectedInputHash) {
-      this.logger.info("re-evaluating instance since input hash has changed", {
-        projectId,
-        instanceId: instance.id
-      });
-      await this.operationManager.launch({
-        type: "evaluate",
-        projectId,
-        instanceIds: [instance.id]
-      });
-    }
-  }
-  async waitForCompositeInstance(projectId, instanceId, expectedInputHash, resolveInputHash) {
-    for await (const instance of this.operationManager.watchCompositeInstance(
-      projectId,
-      instanceId
-    )) {
-      const actualInputHash = await resolveInputHash(instanceId);
-      if (actualInputHash !== expectedInputHash) {
-        throw new Error("Composite instance input hash changed while waiting for evaluation");
-      }
-      return instance;
-    }
-    throw new Error("Composite instance stream ended without receiving the expected instance");
-  }
-  async prepareInputHashResolver(projectId, instanceId) {
-    const { instances, hubs } = await this.projectBackend.getProject(projectId);
-    const library = await this.library.loadLibrary();
-    const filteredInstances = instances.filter((instance2) => instance2.type in library.components);
-    const states = await this.stateBackend.getInstanceStates(projectId);
-    const stateMap = new Map(states.map((state) => [state.id, state]));
-    const instance = filteredInstances.find((instance2) => instance2.id === instanceId);
-    if (!instance) {
-      throw new Error(`Instance not found: ${instanceId}`);
-    }
-    const inputResolverNodes = /* @__PURE__ */ new Map();
-    for (const instance2 of filteredInstances) {
-      inputResolverNodes.set(`instance:${instance2.id}`, {
-        kind: "instance",
-        instance: instance2,
-        component: library.components[instance2.type]
-      });
-    }
-    for (const hub of hubs) {
-      inputResolverNodes.set(`hub:${hub.id}`, { kind: "hub", hub });
-    }
-    const resolveInputs = createInputResolver(
-      inputResolverNodes,
-      this.logger.child({ resolver: "input-resolver" })
-    );
-    const inputHashNodes = /* @__PURE__ */ new Map();
-    for (const instance2 of filteredInstances) {
-      const output = await resolveInputs(`instance:${instance2.id}`);
-      if (output.kind !== "instance") {
-        throw new Error("Expected instance node");
-      }
-      inputHashNodes.set(instance2.id, {
-        instance: instance2,
-        resolvedInputs: output.resolvedInputs,
-        state: stateMap.get(instance2.id),
-        sourceHash: void 0
-        // implement source hash
-      });
-    }
-    const resolveInputHash = createInputHashResolver(
-      inputHashNodes,
-      this.logger.child({ resolver: "input-hash-resolver" })
-    );
-    return {
-      resolveInputHash,
-      library
-    };
-  }
-  static create(projectBackend, stateBackend, operationManager, library, logger) {
-    return new ProjectManager(
-      projectBackend,
-      stateBackend,
-      operationManager,
-      library,
-      logger.child({ service: "ProjectManager" })
-    );
-  }
-}
-
-const runScript = `set -e -o pipefail
-read -r data
-
-# Extract env and files as key-value pairs, and command as an array
-envKeys=($(jq -r '.env | keys[]' <<<"$data"))
-filesKeys=($(jq -r '.files | keys[]' <<<"$data"))
-commandArr=($(jq -r '.command[]' <<<"$data"))
-
-# Set environment variables
-for key in "\${envKeys[@]}"; do
-  value=$(jq -r ".env[\\"$key\\"]" <<<"$data")
-  export "$key=$value"
-done
-
-# Create files
-for key in "\${filesKeys[@]}"; do
-  isBinary=$(jq -r ".files[\\"$key\\"].isBinary // false" <<<"$data")
-  content=$(jq -r ".files[\\"$key\\"].content" <<<"$data")
-  if [ "$isBinary" = "true" ]; then
-    echo -n "$content" | base64 -d > "$key"
-  else
-    echo -n "$content" > "$key"
-  fi
-done
-
-# Execute the command, keeping stdin/stdout open
-exec "\${commandArr[@]}"`;
-
-const dockerTerminalBackendConfig = z.object({
-  HIGHSTATE_BACKEND_TERMINAL_DOCKER_BINARY: z.string().default("docker"),
-  HIGHSTATE_BACKEND_TERMINAL_DOCKER_HOST: z.string().optional()
-});
-class DockerTerminalBackend {
-  constructor(binary, host, logger) {
-    this.binary = binary;
-    this.host = host;
-    this.logger = logger;
-  }
-  async run({ factory, stdin, stdout, signal }) {
-    var _a, _b;
-    const hsTempDir = resolve$1(tmpdir(), "highstate");
-    await mkdir(hsTempDir, { recursive: true });
-    const runScriptPath = resolve$1(hsTempDir, "run.sh");
-    await writeFile$1(runScriptPath, runScript, { mode: 493 });
-    const args = [
-      "run",
-      "-i",
-      "-v",
-      `${runScriptPath}:/run.sh:ro`,
-      factory.image,
-      "/bin/bash",
-      "/run.sh"
-    ];
-    const initData = {
-      command: factory.command,
-      cwd: factory.cwd,
-      env: (_a = factory.env) != null ? _a : {},
-      files: (_b = factory.files) != null ? _b : {}
-    };
-    const initDataStream = Readable$1.from(JSON.stringify(initData) + "\n");
-    const process = spawn(this.binary, args, {
-      env: {
-        DOCKER_HOST: this.host
-      },
-      signal
-    });
-    const childProcess = await process.nodeChildProcess;
-    initDataStream.pipe(childProcess.stdin, { end: false });
-    initDataStream.on("end", () => stdin.pipe(childProcess.stdin));
-    childProcess.stdout.pipe(stdout);
-    childProcess.stderr.pipe(stdout);
-    this.logger.info("process started", { pid: childProcess.pid });
-    await process;
-  }
-  static create(config, logger) {
-    return new DockerTerminalBackend(
-      config.HIGHSTATE_BACKEND_TERMINAL_DOCKER_BINARY,
-      config.HIGHSTATE_BACKEND_TERMINAL_DOCKER_HOST,
-      logger.child({ backend: "TerminalBackend", service: "DockerTerminalBackend" })
-    );
-  }
-}
-
-const terminalBackendConfig = z.object({
-  HIGHSTATE_BACKEND_TERMINAL_TYPE: z.enum(["docker"]).default("docker"),
-  ...dockerTerminalBackendConfig.shape
-});
-function createTerminalBackend(config, logger) {
-  switch (config.HIGHSTATE_BACKEND_TERMINAL_TYPE) {
-    case "docker": {
-      return DockerTerminalBackend.create(config, logger);
-    }
-  }
-}
-
-var __defProp$3 = Object.defineProperty;
-var __defNormalProp$3 = (obj, key, value) => key in obj ? __defProp$3(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$3 = (obj, key, value) => __defNormalProp$3(obj, typeof key !== "symbol" ? key + "" : key, value);
-const notAttachedTerminalLifetime = 30 * 1e3;
-class TerminalManager {
-  constructor(terminalBackend, stateBackend, runnerBackend, logger) {
-    this.terminalBackend = terminalBackend;
-    this.stateBackend = stateBackend;
-    this.runnerBackend = runnerBackend;
-    this.logger = logger;
-    __publicField$3(this, "managedTerminals", /* @__PURE__ */ new Map());
-    __publicField$3(this, "persistHistory", funnel(
-      (entries) => {
-        this.logger.trace({ msg: "persisting history lines", count: entries.length });
-        void this.stateBackend.appendTerminalSessionHistory(entries);
-      },
-      {
-        minQuietPeriodMs: 100,
-        maxBurstDurationMs: 200,
-        reducer: arrayAccumulator
-      }
-    ));
-  }
-  async createSession(projectId, instanceId, terminalName) {
-    const terminalSession = {
-      id: randomUUID$1(),
-      terminalName
-    };
-    await this.stateBackend.putTerminalSession(projectId, instanceId, terminalSession);
-    this.logger.info({ msg: "terminal session created", id: terminalSession.id });
-    await this.createManagedTerminal(projectId, instanceId, terminalSession);
-    return terminalSession;
-  }
-  async ensureSessionCreated(projectId, instanceId, terminalName) {
-    const terminalSessions = await this.stateBackend.getTerminalSessions(projectId, instanceId);
-    let session = terminalSessions.find((session2) => session2.terminalName === terminalName);
-    if (session) {
-      this.logger.info({ msg: "reusing existing terminal session", id: session.id });
-    } else {
-      this.logger.info("creating new terminal session");
-      session = await this.createSession(projectId, instanceId, terminalName);
-    }
-    if (!this.managedTerminals.has(session.id)) {
-      this.logger.info({ msg: "no managed terminal found, creating new one", id: session.id });
-      await this.createManagedTerminal(projectId, instanceId, session);
-    }
-    return session;
-  }
-  close(sessionId) {
-    this.logger.info({ msg: "closing terminal session", id: sessionId });
-    const managedTerminal = this.managedTerminals.get(sessionId);
-    if (managedTerminal) {
-      managedTerminal.abortController.abort();
-    }
-  }
-  async attach(projectId, instanceId, sessionId, stdin, stdout, signal) {
-    this.logger.info({ msg: "attaching terminal", projectId, instanceId, sessionId });
-    let terminal = this.managedTerminals.get(sessionId);
-    if (!terminal) {
-      this.logger.info({ msg: "no managed terminal found, creating new one", sessionId });
-      const session = await this.stateBackend.getTerminalSession(projectId, instanceId, sessionId);
-      if (!session) {
-        throw new Error(`Terminal session "${sessionId}" not found`);
-      }
-      terminal = await this.createManagedTerminal(projectId, instanceId, session);
-      terminal.history = await this.stateBackend.getTerminalSessionHistory(sessionId);
-    }
-    if (terminal.attached) {
-      throw new Error(`Terminal session "${sessionId}" is already attached`);
-    }
-    terminal.attached = true;
-    for (const line of terminal.history) {
-      stdout.write(line);
-    }
-    this.logger.info({ msg: "history replayed", count: terminal.history.length, sessionId });
-    stdin.pipe(terminal.stdin);
-    terminal.stdout.pipe(stdout);
-    this.logger.info({ msg: "terminal attached", id: sessionId });
-    signal.addEventListener("abort", () => {
-      terminal.attached = false;
-      this.logger.info({ msg: "terminal detached", id: sessionId });
-    });
-  }
-  async createManagedTerminal(projectId, instanceId, terminalSession) {
-    const [instanceType, instanceName] = parseInstanceId(instanceId);
-    const factory = await this.runnerBackend.getTerminalFactory(
-      { projectId, instanceType, instanceName },
-      terminalSession.terminalName
-    );
-    if (!factory) {
-      throw new Error(
-        `Terminal factory for instance "${instanceId}" with name "${terminalSession.terminalName}" not found`
-      );
-    }
-    const managedTerminal = {
-      sessionId: terminalSession.id,
-      abortController: new AbortController(),
-      attached: false,
-      stdin: new PassThrough(),
-      stdout: new PassThrough(),
-      history: []
-    };
-    managedTerminal.stdout.on("data", (data) => {
-      const line = String(data);
-      managedTerminal.history.push(String(data));
-      void this.persistHistory.call([terminalSession.id, line]);
-    });
-    this.managedTerminals.set(managedTerminal.sessionId, managedTerminal);
-    void this.terminalBackend.run({
-      factory,
-      stdin: managedTerminal.stdin,
-      stdout: managedTerminal.stdout,
-      signal: managedTerminal.abortController.signal
-    }).catch((error) => {
-      this.logger.error({
-        msg: "managed terminal failed",
-        id: managedTerminal.sessionId,
-        error
-      });
-    }).finally(() => {
-      this.logger.info({ msg: "managed terminal closed", id: managedTerminal.sessionId });
-      this.managedTerminals.delete(managedTerminal.sessionId);
-    });
-    setTimeout(() => this.closeTerminalIfNotAttached(managedTerminal), notAttachedTerminalLifetime);
-    this.logger.info({ msg: "managed terminal created", id: managedTerminal.sessionId });
-    return managedTerminal;
-  }
-  closeTerminalIfNotAttached(terminal) {
-    if (!this.managedTerminals.has(terminal.sessionId)) {
-      return;
-    }
-    if (!terminal.attached) {
-      this.logger.info({
-        msg: "terminal not attached for too long, closing",
-        id: terminal.sessionId
-      });
-      terminal.abortController.abort();
-      this.managedTerminals.delete(terminal.sessionId);
-      return;
-    }
-    setTimeout(() => this.closeTerminalIfNotAttached(terminal), notAttachedTerminalLifetime);
-  }
-  static create(terminalBackend, stateBackend, runnerBackend, logger) {
-    return new TerminalManager(
-      terminalBackend,
-      stateBackend,
-      runnerBackend,
-      logger.child({ service: "TerminalManager" })
-    );
-  }
-}
-
-class InvalidInstanceStatusError extends Error {
-  constructor(currentStatus, expectedStatuses) {
-    const expectedString = expectedStatuses.join(", ");
-    super(`The current state is "${currentStatus}", but it should be one of "${expectedString}".`);
-    this.currentStatus = currentStatus;
-    this.expectedStatuses = expectedStatuses;
-  }
-}
-
-var __defProp$2 = Object.defineProperty;
-var __defNormalProp$2 = (obj, key, value) => key in obj ? __defProp$2(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$2 = (obj, key, value) => __defNormalProp$2(obj, key + "" , value);
-const localRunnerBackendConfig = z.object({
-  HIGHSTATE_BACKEND_RUNNER_LOCAL_SKIP_SOURCE_CHECK: z.boolean({ coerce: true }).default(false),
-  HIGHSTATE_BACKEND_RUNNER_LOCAL_SKIP_STATE_CHECK: z.boolean({ coerce: true }).default(false),
-  HIGHSTATE_BACKEND_RUNNER_LOCAL_PRINT_OUTPUT: z.boolean({ coerce: true }).default(true),
-  HIGHSTATE_BACKEND_RUNNER_LOCAL_SOURCE_BASE_PATH: z.string().optional()
-});
-class LocalRunnerBackend {
-  constructor(skipSourceCheck, skipStateCheck, printOutput, sourceBasePath, pulumiProjectHost) {
-    this.skipSourceCheck = skipSourceCheck;
-    this.skipStateCheck = skipStateCheck;
-    this.printOutput = printOutput;
-    this.sourceBasePath = sourceBasePath;
-    this.pulumiProjectHost = pulumiProjectHost;
-    __publicField$2(this, "events", new EventEmitter$2());
-  }
-  async *watch(options) {
-    var _a;
-    const stream = on(
-      //
-      this.events,
-      `state:${LocalRunnerBackend.getInstanceId(options)}`,
-      { signal: options.signal }
-    );
-    for await (const [statePatch] of stream) {
-      yield statePatch;
-      if (statePatch.status && ((_a = options.finalStatuses) == null ? void 0 : _a.includes(statePatch.status))) {
-        return;
-      }
-    }
-  }
-  getState(options) {
-    return this.pulumiProjectHost.runEmpty(
-      options.projectId,
-      options.instanceType,
-      options.instanceName,
-      async (stack) => {
-        const info = await stack.info();
-        const instanceId = getInstanceId(options.instanceType, options.instanceName);
-        if (!info) {
-          return createInstanceState(instanceId);
-        }
-        if (info.result === "failed") {
-          return createInstanceState(instanceId, "error");
-        }
-        if (info.result !== "succeeded") {
-          return createInstanceState(instanceId, "unknown");
-        }
-        const summary = await stack.workspace.stack();
-        const resourceCount = summary == null ? void 0 : summary.resourceCount;
-        if (!resourceCount) {
-          return createInstanceState(instanceId, "not_created");
-        }
-        return createInstanceState(instanceId, "created", {
-          currentResourceCount: resourceCount,
-          totalResourceCount: resourceCount
-        });
-      }
-    );
-  }
-  getTerminalFactory(options, terminalName) {
-    return this.pulumiProjectHost.runEmpty(
-      options.projectId,
-      options.instanceType,
-      options.instanceName,
-      async (stack) => {
-        const outputs = await stack.outputs();
-        if (!outputs["$terminals"]) {
-          return null;
-        }
-        const terminals = z.array(instanceTerminalSchema).parse(outputs["$terminals"].value);
-        const terminal = terminals.find((t) => t.name === terminalName);
-        if (!terminal) {
-          return null;
-        }
-        return terminal;
-      }
-    );
-  }
-  getPageContent(options, pageName) {
-    return this.pulumiProjectHost.runEmpty(
-      options.projectId,
-      options.instanceType,
-      options.instanceName,
-      async (stack) => {
-        const outputs = await stack.outputs();
-        if (!outputs["$pages"]) {
-          return null;
-        }
-        const pages = z.array(instancePageSchema).parse(outputs["$pages"].value);
-        const page = pages.find((p) => p.name === pageName);
-        if (!page) {
-          return null;
-        }
-        return page.content;
-      }
-    );
-  }
-  getFileContent(options, fileName) {
-    return this.pulumiProjectHost.runEmpty(
-      options.projectId,
-      options.instanceType,
-      options.instanceName,
-      async (stack) => {
-        const outputs = await stack.outputs();
-        if (!outputs["$files"]) {
-          return null;
-        }
-        const files = z.array(instanceFileSchema).parse(outputs["$files"].value);
-        const file = files.find((f) => f.name === fileName);
-        if (!file) {
-          return null;
-        }
-        return file.content;
-      }
-    );
-  }
-  async update(options) {
-    const currentStatus = await this.validateStatus(options, [
-      "not_created",
-      "updating",
-      "created",
-      "error"
-    ]);
-    if (currentStatus === "updating") {
-      return;
-    }
-    const configMap = {
-      ...mapValues(options.config, (value) => ({ value })),
-      ...mapValues(options.secrets, (value) => ({ value, secret: true }))
-    };
-    void this.updateWorker(options, configMap);
-  }
-  async updateWorker(options, configMap) {
-    const instanceId = LocalRunnerBackend.getInstanceId(options);
-    try {
-      await this.pulumiProjectHost.runLocal(
-        options.projectId,
-        options.instanceType,
-        options.instanceName,
-        () => this.resolveProjectPath(options.source),
-        async (stack) => {
-          await stack.setAllConfig(configMap);
-          this.updateState({
-            id: instanceId,
-            status: "updating",
-            currentResourceCount: 0,
-            totalResourceCount: 0
-          });
-          let currentResourceCount = 0;
-          let totalResourceCount = 0;
-          await runWithRetryOnError(
-            async () => {
-              await stack.up({
-                color: "always",
-                onEvent: (event) => {
-                  if (event.resourcePreEvent) {
-                    totalResourceCount = updateResourceCount(
-                      event.resourcePreEvent.metadata.op,
-                      totalResourceCount
-                    );
-                    this.updateState({ id: instanceId, totalResourceCount });
-                    return;
-                  }
-                  if (event.resOutputsEvent) {
-                    currentResourceCount = updateResourceCount(
-                      event.resOutputsEvent.metadata.op,
-                      currentResourceCount
-                    );
-                    this.updateState({ id: instanceId, currentResourceCount });
-                    return;
-                  }
-                },
-                onOutput: (message) => {
-                  this.updateState({ id: instanceId, logLine: message });
-                  if (this.printOutput) {
-                    console.log(message);
-                  }
-                },
-                signal: options.signal
-              });
-              const extraOutputs = await this.getExtraOutputsStatePatch(stack);
-              this.updateState({
-                id: instanceId,
-                status: "created",
-                totalResourceCount: currentResourceCount,
-                ...extraOutputs
-              });
-            },
-            async (error) => {
-              const isUnlocked = await this.pulumiProjectHost.tryUnlockStack(stack, error);
-              if (isUnlocked) return true;
-              const isResolved = await this.tryInstallMissingDependencies(error);
-              if (isResolved) return true;
-              return false;
-            }
-          );
-        },
-        configMap
-      );
-    } catch (error) {
-      this.updateState({
-        id: instanceId,
-        status: "error",
-        error: errorToString(error)
-      });
-    }
-  }
-  async destroy(options) {
-    const currentStatus = await this.validateStatus(options, [
-      "not_created",
-      "destroying",
-      "created",
-      "error"
-    ]);
-    if (currentStatus === "destroying") {
-      return;
-    }
-    void this.destroyWorker(options);
-  }
-  async destroyWorker(options) {
-    const instanceId = LocalRunnerBackend.getInstanceId(options);
-    try {
-      await this.pulumiProjectHost.runEmpty(
-        options.projectId,
-        options.instanceType,
-        options.instanceName,
-        async (stack) => {
-          var _a;
-          const summary = await stack.workspace.stack();
-          let currentResourceCount = (_a = summary == null ? void 0 : summary.resourceCount) != null ? _a : 0;
-          this.updateState({
-            id: instanceId,
-            status: "destroying",
-            currentResourceCount,
-            totalResourceCount: currentResourceCount
-          });
-          await runWithRetryOnError(
-            async () => {
-              await stack.destroy({
-                color: "always",
-                onEvent: (event) => {
-                  if (event.resOutputsEvent) {
-                    currentResourceCount = updateResourceCount(
-                      event.resOutputsEvent.metadata.op,
-                      currentResourceCount
-                    );
-                    this.updateState({ id: instanceId, currentResourceCount });
-                    return;
-                  }
-                },
-                onOutput: (message) => {
-                  this.updateState({ id: instanceId, logLine: message });
-                  if (this.printOutput) {
-                    console.log(message);
-                  }
-                },
-                signal: options.signal
-              });
-              const extraOutputs = await this.getExtraOutputsStatePatch(stack);
-              this.updateState({
-                id: instanceId,
-                status: "not_created",
-                totalResourceCount: currentResourceCount,
-                ...extraOutputs
-              });
-            },
-            (error) => this.pulumiProjectHost.tryUnlockStack(stack, error)
-          );
-        }
-      );
-    } catch (error) {
-      this.updateState({
-        id: instanceId,
-        status: "error",
-        error: errorToString(error)
-      });
-    }
-  }
-  async refresh(options) {
-    const currentStatus = await this.validateStatus(options, [
-      "not_created",
-      "created",
-      "refreshing",
-      "error"
-    ]);
-    if (currentStatus === "refreshing") {
-      return;
-    }
-    void this.refreshWorker(options);
-  }
-  async refreshWorker(options) {
-    const instanceId = LocalRunnerBackend.getInstanceId(options);
-    try {
-      await this.pulumiProjectHost.runEmpty(
-        options.projectId,
-        options.instanceType,
-        options.instanceName,
-        async (stack) => {
-          var _a;
-          const summary = await stack.workspace.stack();
-          let currentResourceCount = 0;
-          let totalResourceCount = (_a = summary == null ? void 0 : summary.resourceCount) != null ? _a : 0;
-          this.updateState({
-            id: instanceId,
-            status: "refreshing",
-            currentResourceCount,
-            totalResourceCount
-          });
-          await runWithRetryOnError(
-            async () => {
-              await stack.refresh({
-                color: "always",
-                onEvent: (event) => {
-                  if (event.resourcePreEvent) {
-                    totalResourceCount = updateResourceCount(
-                      event.resourcePreEvent.metadata.op,
-                      totalResourceCount
-                    );
-                    this.updateState({ id: instanceId, totalResourceCount });
-                    return;
-                  }
-                  if (event.resOutputsEvent) {
-                    currentResourceCount = updateResourceCount(
-                      event.resOutputsEvent.metadata.op,
-                      currentResourceCount
-                    );
-                    this.updateState({ id: instanceId, currentResourceCount });
-                    return;
-                  }
-                },
-                onOutput: (message) => {
-                  this.updateState({ id: instanceId, logLine: message });
-                  if (this.printOutput) {
-                    console.log(message);
-                  }
-                },
-                signal: options.signal
-              });
-              const extraOutputs = await this.getExtraOutputsStatePatch(stack);
-              this.updateState({
-                id: instanceId,
-                status: "created",
-                totalResourceCount: currentResourceCount,
-                ...extraOutputs
-              });
-            },
-            (error) => this.pulumiProjectHost.tryUnlockStack(stack, error)
-          );
-        }
-      );
-    } catch (error) {
-      this.updateState({
-        id: instanceId,
-        status: "error",
-        error: errorToString(error)
-      });
-    }
-  }
-  async getExtraOutputsStatePatch(stack) {
-    const outputs = await stack.outputs();
-    const patch = {};
-    if (outputs["$status"]) {
-      patch.statusFields = z.array(instanceStatusFieldSchema).parse(outputs["$status"].value);
-    } else {
-      patch.statusFields = [];
-    }
-    if (outputs["$pages"]) {
-      const pages = z.array(instancePageSchema).parse(outputs["$pages"].value);
-      patch.pages = pages.map((page) => omit(page, ["content"]));
-    } else {
-      patch.pages = [];
-    }
-    if (outputs["$files"]) {
-      const files = z.array(instanceFileSchema).parse(outputs["$files"].value);
-      patch.files = files.map((file) => omit(file, ["content"]));
-    } else {
-      patch.files = [];
-    }
-    if (outputs["$terminals"]) {
-      const terminals = z.array(instanceTerminalSchema).parse(outputs["$terminals"].value);
-      patch.terminals = terminals.map((terminal) => pick(terminal, ["name", "title", "description"]));
-    } else {
-      patch.terminals = [];
-    }
-    if (outputs["$triggers"]) {
-      patch.triggers = z.array(instanceTriggerSchema).parse(outputs["$triggers"].value);
-    } else {
-      patch.triggers = [];
-    }
-    if (outputs["$secrets"]) {
-      patch.secrets = pickBy(
-        z.record(z.string().nullish()).parse(outputs["$secrets"].value),
-        (v) => !!v
-      );
-    } else {
-      patch.secrets = null;
-    }
-    patch.outputHash = await sha256(JSON.stringify(outputs));
-    return patch;
-  }
-  updateState(patch) {
-    this.events.emit(`state:${patch.id}`, patch);
-  }
-  async validateStatus(options, expectedStatuses) {
-    if (this.skipStateCheck) {
-      return;
-    }
-    const existingState = await this.getState(options);
-    if (!existingState) {
-      return;
-    }
-    if (!expectedStatuses.includes(existingState.status)) {
-      throw new InvalidInstanceStatusError(existingState.status, expectedStatuses);
-    }
-    return existingState.status;
-  }
-  static getInstanceId(options) {
-    return getInstanceId(options.instanceType, options.instanceName);
-  }
-  async resolveProjectPath(source) {
-    if (source.type === "local") {
-      if (!source.path) {
-        throw new Error("Source path is required for local units");
-      }
-      return resolve$1(this.sourceBasePath, source.path);
-    }
-    if (!this.skipSourceCheck) {
-      const packageName = source.version ? `${source.package}@${source.version}` : source.package;
-      await ensureDependencyInstalled(packageName);
-    }
-    const fullPath = source.path ? `${source.package}/${source.path}` : source.package;
-    const url = resolve$2(fullPath, globalThis._importMeta_.url);
-    const path = fileURLToPath(url);
-    const projectPath = dirname$1(path);
-    return projectPath;
-  }
-  async tryInstallMissingDependencies(error) {
-    if (!(error instanceof Error)) {
-      return false;
-    }
-    const pattern = /Cannot find module '(.*)'/;
-    const match = error.message.match(pattern);
-    if (!match) {
-      return false;
-    }
-    const packageName = match[1];
-    await ensureDependencyInstalled(packageName);
-    return true;
-  }
-  static async create(config, pulumiProjectHost) {
-    let sourceBasePath = config.HIGHSTATE_BACKEND_RUNNER_LOCAL_SOURCE_BASE_PATH;
-    if (!sourceBasePath) {
-      const [projectPath] = await resolveMainLocalProject();
-      sourceBasePath = resolve$1(projectPath, "units");
-    }
-    return new LocalRunnerBackend(
-      config.HIGHSTATE_BACKEND_RUNNER_LOCAL_SKIP_SOURCE_CHECK,
-      config.HIGHSTATE_BACKEND_RUNNER_LOCAL_SKIP_STATE_CHECK,
-      config.HIGHSTATE_BACKEND_RUNNER_LOCAL_PRINT_OUTPUT,
-      sourceBasePath,
-      pulumiProjectHost
-    );
-  }
-}
-
-const runnerBackendConfig = z.object({
-  HIGHSTATE_BACKEND_RUNNER_TYPE: z.enum(["local"]).default("local"),
-  ...localRunnerBackendConfig.shape
-});
-function createRunnerBackend(config, pulumiProjectHost) {
-  switch (config.HIGHSTATE_BACKEND_RUNNER_TYPE) {
-    case "local": {
-      return LocalRunnerBackend.create(config, pulumiProjectHost);
-    }
-  }
-}
-
-const evaluatedCompositeInstanceSchema = compositeInstanceSchema.extend({
-  inputHash: z.string()
-});
-
-const localStateBackendConfig = z.object({
-  HIGHSTATE_BACKEND_STATE_LOCAL_DIR: z.string().optional()
-});
-class LocalStateBackend {
-  constructor(db, logger) {
-    this.db = db;
-    this.logger = logger;
-    this.logger.debug({ msg: "initialized", dbLocation: db.location });
-  }
-  async getActiveOperations() {
-    const sublevel = this.getActiveOperationsSublevel();
-    return this.getSublevelItems(sublevel, projectOperationSchema);
-  }
-  async getOperations(projectId, beforeOperationId) {
-    const sublevel = this.getProjectOperationsSublevel(projectId);
-    const pageSize = 10;
-    return await this.getSublevelItems(sublevel, projectOperationSchema, pageSize, {
-      lt: beforeOperationId,
-      reverse: true
-    });
-  }
-  async getInstanceStates(projectId) {
-    const sublevel = this.getProjectInstanceStatesSublevel(projectId);
-    return await this.getSublevelItems(sublevel, instanceStateSchema);
-  }
-  async getInstanceState(projectId, instanceID) {
-    const sublevel = this.getProjectInstanceStatesSublevel(projectId);
-    return await this.getSublevelItem(sublevel, instanceStateSchema, instanceID);
-  }
-  async getAffectedInstanceStates(operationId) {
-    const sublevel = this.getOperationInstanceStatesSublevel(operationId);
-    return await this.getSublevelItems(sublevel, instanceStateSchema);
-  }
-  async getInstanceLogs(operationId, instanceId) {
-    const sublevel = this.getOperationInstanceLogsSublevel(operationId, instanceId);
-    return await Array.fromAsync(sublevel.values());
-  }
-  async putOperation(operation) {
-    this.validateItem(projectOperationSchema, operation);
-    const operationsSublevel = this.getProjectOperationsSublevel(operation.projectId);
-    const activeOperationsSublevel = this.getActiveOperationsSublevel();
-    if (!isFinalOperationStatus(operation.status)) {
-      await this.db.batch([
-        { type: "put", key: operation.id, value: operation, sublevel: operationsSublevel },
-        { type: "put", key: operation.id, value: operation, sublevel: activeOperationsSublevel }
-      ]);
-    } else {
-      await this.db.batch([
-        { type: "put", key: operation.id, value: operation, sublevel: operationsSublevel },
-        { type: "del", key: operation.id, sublevel: activeOperationsSublevel }
-      ]);
-    }
-  }
-  async putAffectedInstanceStates(projectId, operationId, states) {
-    this.validateArray(instanceStateSchema, states);
-    const operationInstanceStatesSublevel = this.getOperationInstanceStatesSublevel(operationId);
-    const projectInstanceStatesSublevel = this.getProjectInstanceStatesSublevel(projectId);
-    await this.db.batch(
-      // put the states to both the operation and project sublevels
-      // denormalization is cool
-      // this separation is also necessary because the instance states can be updated without operations
-      states.flatMap((state) => [
-        {
-          type: "put",
-          key: state.id,
-          value: state,
-          sublevel: operationInstanceStatesSublevel
-        },
-        {
-          type: "put",
-          key: state.id,
-          value: state,
-          sublevel: projectInstanceStatesSublevel
-        }
-      ])
-    );
-  }
-  async putInstanceStates(projectId, states) {
-    this.validateArray(instanceStateSchema, states);
-    const sublevel = this.getProjectInstanceStatesSublevel(projectId);
-    await sublevel.batch(
-      // as i told before, we update the instance states without operations
-      // this method is used when upstream instance state changes are detected
-      states.map((state) => ({
-        type: "put",
-        key: state.id,
-        value: state
-      }))
-    );
-  }
-  async appendInstanceLogs(operationId, logs) {
-    const sublevels = /* @__PURE__ */ new Map();
-    for (const [instanceId] of logs) {
-      if (sublevels.has(instanceId)) {
-        continue;
-      }
-      const sublevel = this.getOperationInstanceLogsSublevel(operationId, instanceId);
-      sublevels.set(instanceId, sublevel);
-    }
-    await this.db.batch(
-      logs.map(([instanceID, line]) => ({
-        type: "put",
-        key: uuidv7(),
-        value: line,
-        sublevel: sublevels.get(instanceID)
-      }))
-    );
-  }
-  async getCompositeInstance(projectId, instanceId) {
-    const sublevel = this.getProjectCompositeInstancesSublevel(projectId);
-    return this.getSublevelItem(sublevel, evaluatedCompositeInstanceSchema, instanceId);
-  }
-  async getCompositeInstanceInputHash(projectId, instanceId) {
-    const sublevel = this.getProjectCompositeInstanceInputHashesSublevel(projectId);
-    const inputHash = await sublevel.get(instanceId);
-    return inputHash != null ? inputHash : null;
-  }
-  async putCompositeInstances(projectId, instances) {
-    this.validateArray(evaluatedCompositeInstanceSchema, instances);
-    const sublevel = this.getProjectCompositeInstancesSublevel(projectId);
-    const inputHashesSublevel = this.getProjectCompositeInstanceInputHashesSublevel(projectId);
-    await this.db.batch(
-      instances.flatMap((instance) => [
-        {
-          type: "put",
-          key: instance.instance.id,
-          value: evaluatedCompositeInstanceSchema.parse(instance),
-          sublevel
-        },
-        {
-          type: "put",
-          key: instance.instance.id,
-          value: instance.inputHash,
-          sublevel: inputHashesSublevel
-        }
-      ])
-    );
-  }
-  async clearCompositeInstances(projectId, instanceIds) {
-    const sublevel = this.getProjectCompositeInstancesSublevel(projectId);
-    const inputHashesSublevel = this.getProjectCompositeInstanceInputHashesSublevel(projectId);
-    await this.db.batch(
-      instanceIds.flatMap((instanceId) => [
-        { type: "del", key: instanceId, sublevel },
-        { type: "del", key: instanceId, sublevel: inputHashesSublevel }
-      ])
-    );
-  }
-  async getTerminalSessions(projectId, instanceId) {
-    const sublevel = this.getTerminalSessionsSublevel(projectId, instanceId);
-    return await this.getSublevelItems(sublevel, terminalSessionSchema);
-  }
-  async getTerminalSession(projectId, instanceId, sessionId) {
-    const sublevel = this.getTerminalSessionsSublevel(projectId, instanceId);
-    return await this.getSublevelItem(sublevel, terminalSessionSchema, sessionId);
-  }
-  async putTerminalSession(projectId, instanceId, session) {
-    this.validateItem(terminalSessionSchema, session);
-    const sublevel = this.getTerminalSessionsSublevel(projectId, instanceId);
-    await sublevel.put(session.id, session);
-  }
-  async getTerminalSessionHistory(sessionId) {
-    const sublevel = this.getTerminalSessionHistorySublevel(sessionId);
-    return await Array.fromAsync(sublevel.values());
-  }
-  async appendTerminalSessionHistory(lines) {
-    const sublevels = /* @__PURE__ */ new Map();
-    for (const [sessionId] of lines) {
-      if (sublevels.has(sessionId)) {
-        continue;
-      }
-      const sublevel = this.getTerminalSessionHistorySublevel(sessionId);
-      sublevels.set(sessionId, sublevel);
-    }
-    await this.db.batch(
-      lines.map(([sessionId, line]) => ({
-        type: "put",
-        key: uuidv7(),
-        value: line,
-        sublevel: sublevels.get(sessionId)
-      }))
-    );
-  }
-  async getSublevelItems(sublevel, schema, limit, options) {
-    const result = [];
-    const iterator = options ? sublevel.iterator(options) : sublevel.iterator();
-    const invalidKeys = [];
-    for await (const [key, value] of iterator) {
-      const parseResult = schema.safeParse(value);
-      if (!parseResult.success) {
-        this.logger.warn({
-          msg: "failed to parse item, it will be deleted",
-          error: parseResult.error,
-          sublevel: sublevel.prefix,
-          key
-        });
-        invalidKeys.push(key);
-        continue;
-      }
-      result.push(parseResult.data);
-      if (limit && result.length >= limit) {
-        break;
-      }
-    }
-    if (invalidKeys.length > 0) {
-      this.logger.info({
-        msg: "deleting invalid items",
-        sublevel: sublevel.prefix,
-        keyCount: invalidKeys.length
-      });
-      await sublevel.batch(invalidKeys.map((key) => ({ type: "del", key })));
-    }
-    return result;
-  }
-  async getSublevelItem(sublevel, schema, key) {
-    const value = await sublevel.get(key);
-    if (!value) {
-      return null;
-    }
-    const parseResult = schema.safeParse(value);
-    if (!parseResult.success) {
-      this.logger.warn({
-        msg: "failed to parse item, it will be deleted",
-        error: parseResult.error,
-        sublevel: sublevel.prefix,
-        key
-      });
-      await sublevel.del(key);
-      return null;
-    }
-    return parseResult.data;
-  }
-  validateItem(schema, item) {
-    const parseResult = schema.safeParse(item);
-    if (!parseResult.success) {
-      this.logger.error({
-        msg: "failed to validate item",
-        error: parseResult.error,
-        item
-      });
-      throw new Error(`Failed to validate item: ${parseResult.error.errors[0].message}`, {
-        cause: parseResult.error
-      });
-    }
-  }
-  validateArray(schema, items) {
-    for (const item of items) {
-      this.validateItem(schema, item);
-    }
-  }
-  getActiveOperationsSublevel() {
-    return this.getJsonSublevel("activeOperations");
-  }
-  getProjectOperationsSublevel(projectId) {
-    return this.getJsonSublevel(`projects/${projectId}/operations`);
-  }
-  getProjectCompositeInstancesSublevel(projectId) {
-    return this.getJsonSublevel(`projects/${projectId}/compositeInstances`);
-  }
-  getProjectCompositeInstanceInputHashesSublevel(projectId) {
-    return this.getStringSublevel(`projects/${projectId}/compositeInstanceInputHashes`);
-  }
-  getProjectInstanceStatesSublevel(projectId) {
-    return this.getJsonSublevel(`projects/${projectId}/instanceStates`);
-  }
-  getOperationInstanceStatesSublevel(operationId) {
-    return this.getJsonSublevel(`operations/${operationId}/instanceStates`);
-  }
-  getOperationInstanceLogsSublevel(operationId, instanceId) {
-    return this.getStringSublevel(`operations/${operationId}/instances/${instanceId}/logs`);
-  }
-  getTerminalSessionsSublevel(projectId, instanceId) {
-    return this.getJsonSublevel(`projects/${projectId}/instances/${instanceId}/terminalSessions`);
-  }
-  getTerminalSessionHistorySublevel(sessionId) {
-    return this.getStringSublevel(`terminalSessions/${sessionId}/history`);
-  }
-  getStringSublevel(path) {
-    return this.db.sublevel(path, { valueEncoding: "utf8" });
-  }
-  getJsonSublevel(path) {
-    return this.db.sublevel(path, { valueEncoding: "json" });
-  }
-  static async create(config, localPulumiHost, logger) {
-    const childLogger = logger.child({ backend: "StateBackend", service: "LocalStateBackend" });
-    let location = config.HIGHSTATE_BACKEND_STATE_LOCAL_DIR;
-    if (!location) {
-      const currentUser = await localPulumiHost.getCurrentUser();
-      if (!currentUser) {
-        throw new Error(
-          "The pulumi is not authenticated, please login first or specify the state location manually"
-        );
-      }
-      if (!currentUser.url) {
-        throw new Error(
-          "The pulumi user does not have a URL, please specify the state location manually"
-        );
-      }
-      const path = currentUser.url.replace("file://", "").replace("~", process.env.HOME);
-      location = resolve$1(path, ".pulumi", ".highstate");
-      childLogger.debug({
-        msg: "auto-detected state location",
-        pulumiStateUrl: currentUser.url,
-        location
-      });
-    }
-    const { ClassicLevel } = await import('classic-level');
-    const db = new ClassicLevel(location);
-    return new LocalStateBackend(db, childLogger);
-  }
-}
-
-const stateBackendConfig = z.object({
-  HIGHSTATE_BACKEND_STATE_TYPE: z.enum(["local"]).default("local"),
-  ...localStateBackendConfig.shape
-});
-function createStateBackend(config, localPulumiHost, logger) {
-  switch (config.HIGHSTATE_BACKEND_STATE_TYPE) {
-    case "local": {
-      return LocalStateBackend.create(config, localPulumiHost, logger);
-    }
-  }
-}
-
-const localWorkspaceBackendConfig = z.object({
-  HIGHSTATE_BACKEND_WORKSPACE_LOCAL_DIR: z.string().optional()
-});
-class LocalWorkspaceBackend {
-  constructor(db) {
-    this.db = db;
-  }
-  async getWorkspaceLayout() {
-    return await this.db.get("layout");
-  }
-  async setWorkspaceLayout(layout) {
-    await this.db.put("layout", layout);
-  }
-  async getProjectViewport(projectId) {
-    return await this.db.get(`viewports/projects/${projectId}`);
-  }
-  async setProjectViewport(projectId, viewport) {
-    await this.db.put(`viewports/projects/${projectId}`, viewport);
-  }
-  async getInstanceViewport(projectId, instanceId) {
-    return await this.db.get(`viewports/instances/${projectId}/${instanceId}`);
-  }
-  async setInstanceViewport(projectId, instanceId, viewport) {
-    await this.db.put(`viewports/instances/${projectId}/${instanceId}`, viewport);
-  }
-  static async create(config) {
-    let location = config.HIGHSTATE_BACKEND_WORKSPACE_LOCAL_DIR;
-    if (!location) {
-      const home = homedir();
-      location = resolve$1(home, ".highstate/workspace");
-    }
-    const { ClassicLevel } = await import('classic-level');
-    const db = new ClassicLevel(location, { valueEncoding: "json" });
-    return new LocalWorkspaceBackend(db);
-  }
-}
-
-const workspaceBackendConfig = z.object({
-  HIGHSTATE_BACKEND_WORKSPACE_TYPE: z.enum(["local"]).default("local"),
-  ...localWorkspaceBackendConfig.shape
-});
-function createWorkspaceBackend(config) {
-  return LocalWorkspaceBackend.create(config);
-}
-
-const loggerConfig = z.object({
-  HIGHSTATE_BACKEND_LOGGER_NAME: z.string().default("highstate-backend"),
-  HIGHSTATE_BACKEND_LOGGER_LEVEL: z.enum(["fatal", "error", "warn", "info", "debug", "trace"]).default("info")
-});
-const configSchema = z.object({
-  ...libraryBackendConfig.shape,
-  ...projectBackendConfig.shape,
-  ...secretBackendConfig.shape,
-  ...stateBackendConfig.shape,
-  ...runnerBackendConfig.shape,
-  ...terminalBackendConfig.shape,
-  ...workspaceBackendConfig.shape,
-  ...loggerConfig.shape
-});
-async function loadConfig(env = process.env, useDotenv = true) {
-  if (useDotenv) {
-    await import('dotenv/config');
-  }
-  return configSchema.parse(env);
-}
-
-var __defProp$1 = Object.defineProperty;
-var __defNormalProp$1 = (obj, key, value) => key in obj ? __defProp$1(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$1 = (obj, key, value) => __defNormalProp$1(obj, typeof key !== "symbol" ? key + "" : key, value);
-const _RuntimeOperation = class _RuntimeOperation {
-  constructor(operation, runnerBackend, stateBackend, libraryBackend, projectBackend, secretBackend, projectLock, operationEE, stateEE, compositeInstanceEE, instanceLogsEE, logger) {
-    this.operation = operation;
-    this.runnerBackend = runnerBackend;
-    this.stateBackend = stateBackend;
-    this.libraryBackend = libraryBackend;
-    this.projectBackend = projectBackend;
-    this.secretBackend = secretBackend;
-    this.projectLock = projectLock;
-    this.operationEE = operationEE;
-    this.stateEE = stateEE;
-    this.compositeInstanceEE = compositeInstanceEE;
-    this.instanceLogsEE = instanceLogsEE;
-    this.logger = logger;
-    __publicField$1(this, "abortController", new AbortController());
-    __publicField$1(this, "instanceMap", /* @__PURE__ */ new Map());
-    __publicField$1(this, "hubMap", /* @__PURE__ */ new Map());
-    __publicField$1(this, "resolvedInstanceInputs", /* @__PURE__ */ new Map());
-    __publicField$1(this, "compositeInstanceLock", new BetterLock());
-    __publicField$1(this, "compositeInstanceMap", /* @__PURE__ */ new Map());
-    __publicField$1(this, "initialStatusMap", /* @__PURE__ */ new Map());
-    __publicField$1(this, "stateMap", /* @__PURE__ */ new Map());
-    __publicField$1(this, "instancePromiseMap", /* @__PURE__ */ new Map());
-    __publicField$1(this, "childrenStateMap", /* @__PURE__ */ new Map());
-    __publicField$1(this, "dependentStateMap", /* @__PURE__ */ new Map());
-    __publicField$1(this, "library");
-    __publicField$1(this, "resolveInputHash");
-    __publicField$1(this, "persistStates", funnel(
-      (states) => {
-        this.logger.debug({ msg: "persisting states", count: states.length });
-        void this.stateBackend.putAffectedInstanceStates(
-          this.operation.projectId,
-          this.operation.id,
-          states
-        );
-      },
-      {
-        minQuietPeriodMs: 100,
-        maxBurstDurationMs: 1e3,
-        triggerAt: "end",
-        reducer: arrayAccumulator
-      }
-    ));
-    __publicField$1(this, "persistLogs", funnel(
-      (entries) => {
-        this.logger.trace({ msg: "persisting logs", count: entries.length });
-        void this.stateBackend.appendInstanceLogs(this.operation.id, entries);
-      },
-      {
-        minQuietPeriodMs: 100,
-        maxBurstDurationMs: 200,
-        reducer: arrayAccumulator
-      }
-    ));
-    __publicField$1(this, "persistSecrets", funnel(
-      (entries) => {
-        this.logger.debug({ msg: "persisting secrets", count: entries.length });
-        for (const [instanceId, secrets] of entries) {
-          void this.secretBackend.get(this.operation.projectId, instanceId).then((existingSecrets) => {
-            Object.assign(existingSecrets, secrets);
-            return this.secretBackend.set(this.operation.projectId, instanceId, existingSecrets);
-          });
-        }
-      },
-      {
-        minQuietPeriodMs: 100,
-        maxBurstDurationMs: 200,
-        reducer: arrayAccumulator
-      }
-    ));
-  }
-  async operateSafe() {
-    try {
-      await this.operate();
-    } catch (error) {
-      if (_RuntimeOperation.isAbortError(error)) {
-        this.logger.info("the operation was cancelled");
-        this.operation.status = "cancelled";
-        await this.updateOperation();
-        return;
-      }
-      this.logger.error({ msg: "an error occurred while running the operation", error });
-      this.operation.status = "failed";
-      this.operation.error = errorToString(error);
-      await this.updateOperation();
-    } finally {
-      this.resetPendingStateStatuses();
-      await Promise.all([
-        this.persistStates.flush(),
-        this.persistLogs.flush(),
-        this.persistSecrets.flush()
-      ]);
-      this.logger.debug("operation finished, all entries persisted");
-    }
-  }
-  resetPendingStateStatuses() {
-    for (const state of this.stateMap.values()) {
-      if (state.status !== "pending") {
-        continue;
-      }
-      let initialStatus = this.initialStatusMap.get(state.id);
-      let error = state.error;
-      if (initialStatus === "destroying" || initialStatus === "pending" || initialStatus === "refreshing" || initialStatus === "updating") {
-        initialStatus = "error";
-        error != null ? error : error = "unexpected progressing instance status";
-      }
-      if (initialStatus) {
-        this.updateInstanceState({ id: state.id, status: initialStatus, error });
-      }
-    }
-  }
-  async operate() {
-    this.logger.info("starting operation");
-    const { instances: projectInstances, hubs } = await this.projectBackend.getProject(
-      this.operation.projectId
-    );
-    this.abortController.signal.throwIfAborted();
-    const states = await this.stateBackend.getInstanceStates(this.operation.projectId);
-    this.abortController.signal.throwIfAborted();
-    this.library = await this.libraryBackend.loadLibrary();
-    this.logger.info("library ready");
-    this.abortController.signal.throwIfAborted();
-    const allInstances = projectInstances.filter((instance) => {
-      return instance.type in this.library.components;
-    });
-    const inputResolverNodes = /* @__PURE__ */ new Map();
-    for (const hub of hubs) {
-      this.hubMap.set(hub.id, hub);
-      inputResolverNodes.set(`hub:${hub.id}`, { kind: "hub", hub });
-    }
-    for (const instance of allInstances) {
-      this.instanceMap.set(instance.id, instance);
-      inputResolverNodes.set(`instance:${instance.id}`, {
-        kind: "instance",
-        instance,
-        component: this.library.components[instance.type]
-      });
-    }
-    const resolveInputs = createInputResolver(
-      inputResolverNodes,
-      this.logger.child({ resolver: "input-resolver" })
-    );
-    for (const instance of allInstances) {
-      const output = await resolveInputs(`instance:${instance.id}`);
-      if (output.kind !== "instance") {
-        throw new Error("Unexpected output kind, expected instance");
-      }
-      this.resolvedInstanceInputs.set(instance.id, output.resolvedInputs);
-    }
-    for (const state of states) {
-      this.stateMap.set(state.id, state);
-      this.initialStatusMap.set(state.id, state.status);
-      this.tryAddStateToParent(state);
-      this.addDependentState(state);
-    }
-    const inputHashNodes = /* @__PURE__ */ new Map();
-    for (const instance of allInstances) {
-      inputHashNodes.set(instance.id, {
-        instance,
-        resolvedInputs: this.resolvedInstanceInputs.get(instance.id),
-        state: this.stateMap.get(instance.id),
-        sourceHash: void 0
-        // TODO: implement source hash
-      });
-    }
-    this.resolveInputHash = createInputHashResolver(
-      inputHashNodes,
-      this.logger.child({ resolver: "input-hash-resolver" })
-    );
-    if (this.operation.type === "update") {
-      await this.extendWithNotCreatedDependencies();
-      await this.updateOperation();
-    } else if (this.operation.type === "destroy") {
-      this.extendWithCreatedDependents();
-      await this.updateOperation();
-    }
-    this.logger.info("all instances loaded", {
-      count: allInstances.length,
-      affectedCount: this.operation.instanceIds.length
-    });
-    if (this.operation.type === "evaluate") {
-      this.logger.info("evaluating instances");
-      await this.evaluateCompositeInstances();
-    } else {
-      const promises = [];
-      for (const instanceId of this.operation.instanceIds) {
-        promises.push(this.getInstancePromiseForOperation(instanceId));
-      }
-      this.logger.info("all units operations started");
-      this.operation.status = "running";
-      await this.updateOperation();
-      await Promise.all(promises);
-      this.logger.info("all units completed");
-    }
-    this.operation.status = "completed";
-    this.operation.error = null;
-    await this.updateOperation();
-    this.logger.info("operation completed");
-  }
-  cancel() {
-    this.logger.info("cancelling operation");
-    this.abortController.abort();
-  }
-  getInstancePromiseForOperation(instanceId) {
-    const instance = this.instanceMap.get(instanceId);
-    if (!instance) {
-      throw new Error(`Instance not found: ${instanceId}`);
-    }
-    const component = this.library.components[instance.type];
-    if (!component) {
-      throw new Error(`Component not found: ${instance.type}`);
-    }
-    if (isUnitModel(component)) {
-      return this.getUnitPromise(instance, component);
-    }
-    return this.getCompositePromise(instance);
-  }
-  async getUnitPromise(instance, component) {
-    switch (this.operation.type) {
-      case "update": {
-        return this.updateUnit(instance, component);
-      }
-      case "recreate": {
-        return this.recreateUnit(instance, component);
-      }
-      case "destroy": {
-        return this.destroyUnit(instance.id, component);
-      }
-      case "refresh": {
-        return this.refreshUnit(instance.id);
-      }
-    }
-  }
-  async getCompositePromise(instance) {
-    const logger = this.logger.child({ instanceId: instance.id });
-    return this.getInstancePromise(instance.id, async () => {
-      var _a, _b;
-      const initialStatus = (_b = (_a = this.stateMap.get(instance.id)) == null ? void 0 : _a.status) != null ? _b : "not_created";
-      this.updateInstanceState({
-        id: instance.id,
-        latestOperationId: this.operation.id,
-        status: this.getStatusByOperationType(),
-        currentResourceCount: 0,
-        totalResourceCount: 0
-      });
-      const { children } = await this.loadCompositeInstance(instance.id);
-      const childPromises = [];
-      if (!children.length) {
-        logger.warn("no children found for composite component");
-      }
-      for (const child of children) {
-        logger.info("waiting for child", { childId: child.id });
-        childPromises.push(this.getInstancePromiseForOperation(child.id));
-      }
-      try {
-        await Promise.all(childPromises);
-        this.abortController.signal.throwIfAborted();
-        if (children.length > 0) {
-          logger.info("all children completed", { count: children.length });
-        }
-        this.updateInstanceState({
-          id: instance.id,
-          status: "created"
-        });
-      } catch (error) {
-        if (_RuntimeOperation.isAbortError(error)) {
-          this.updateInstanceState({
-            id: instance.id,
-            status: initialStatus
-          });
-          return;
-        }
-        this.updateInstanceState({
-          id: instance.id,
-          status: "error",
-          error: errorToString(error)
-        });
-      }
-    });
-  }
-  updateUnit(instance, component) {
-    const logger = this.logger.child({ instanceId: instance.id });
-    return this.getInstancePromise(instance.id, async () => {
-      this.updateInstanceState({
-        id: instance.id,
-        latestOperationId: this.operation.id,
-        status: "pending",
-        currentResourceCount: 0,
-        totalResourceCount: 0
-      });
-      const dependencies = this.getInstanceDependencies(instance);
-      const dependencyPromises = [];
-      for (const dependency of dependencies) {
-        if (!this.operation.instanceIds.includes(dependency.id)) {
-          continue;
-        }
-        logger.info("waiting for dependency", { dependencyId: dependency.id });
-        dependencyPromises.push(this.getInstancePromiseForOperation(dependency.id));
-      }
-      await Promise.all(dependencyPromises);
-      this.abortController.signal.throwIfAborted();
-      if (dependencies.length > 0) {
-        logger.info("all dependencies completed", { count: dependencies.length });
-      }
-      logger.info("updating unit...");
-      const secrets = await this.secretBackend.get(this.operation.projectId, instance.id);
-      this.abortController.signal.throwIfAborted();
-      logger.debug("secrets loaded", { count: Object.keys(secrets).length });
-      await this.runnerBackend.update({
-        projectId: this.operation.projectId,
-        instanceType: instance.type,
-        instanceName: instance.name,
-        config: await this.prepareUnitConfig(instance),
-        secrets: mapValues(secrets, (value) => valueToString(value)),
-        source: this.resolveUnitSource(component),
-        signal: this.abortController.signal
-      });
-      logger.debug("unit update requested");
-      const stream = this.runnerBackend.watch({
-        projectId: this.operation.projectId,
-        instanceType: instance.type,
-        instanceName: instance.name,
-        finalStatuses: ["created", "error"]
-      });
-      await this.watchStateStream(stream);
-      const inputHash = await this.resolveInputHash(instance.id);
-      this.updateInstanceState({ id: instance.id, inputHash });
-      logger.debug("input hash after update", { inputHash });
-      logger.info("unit updated");
-    });
-  }
-  async processBeforeDestroyTriggers(state, component, logger) {
-    const instance = this.instanceMap.get(state.id);
-    if (!instance) {
-      throw new Error(`Instance not found: ${state.id}`);
-    }
-    const triggers = state.triggers.filter((trigger) => trigger.spec.type === "before-destroy");
-    if (triggers.length === 0) {
-      return;
-    }
-    const invokedTriggers = triggers.map((trigger) => ({ name: trigger.name }));
-    logger.info("updating unit to process before-destroy triggers...");
-    const secrets = await this.secretBackend.get(this.operation.projectId, instance.id);
-    this.abortController.signal.throwIfAborted();
-    logger.debug("secrets loaded", { count: Object.keys(secrets).length });
-    await this.runnerBackend.update({
-      projectId: this.operation.projectId,
-      instanceType: instance.type,
-      instanceName: instance.name,
-      config: await this.prepareUnitConfig(instance, invokedTriggers),
-      secrets: mapValues(secrets, (value) => valueToString(value)),
-      source: this.resolveUnitSource(component),
-      signal: this.abortController.signal
-    });
-    logger.debug("unit update requested");
-    const stream = this.runnerBackend.watch({
-      projectId: this.operation.projectId,
-      instanceType: instance.type,
-      instanceName: instance.name,
-      finalStatuses: ["created", "error"]
-    });
-    await this.watchStateStream(stream);
-    logger.debug("before-destroy triggers processed");
-  }
-  async destroyUnit(instanceId, component) {
-    const logger = this.logger.child({ instanceId });
-    return this.getInstancePromise(instanceId, async () => {
-      var _a;
-      this.updateInstanceState({
-        id: instanceId,
-        latestOperationId: this.operation.id,
-        status: "pending",
-        currentResourceCount: 0,
-        totalResourceCount: 0
-      });
-      const state = this.stateMap.get(instanceId);
-      if (!state) {
-        logger.warn("state not found for unit, but destroy was requested");
-        return;
-      }
-      const dependentPromises = [];
-      const dependents = (_a = this.dependentStateMap.get(instanceId)) != null ? _a : [];
-      for (const dependent of dependents) {
-        dependentPromises.push(this.getInstancePromiseForOperation(dependent.id));
-      }
-      await Promise.all(dependentPromises);
-      this.abortController.signal.throwIfAborted();
-      await this.processBeforeDestroyTriggers(state, component, logger);
-      logger.info("destroying unit...");
-      const [type, name] = parseInstanceId(instanceId);
-      await this.runnerBackend.destroy({
-        projectId: this.operation.projectId,
-        instanceType: type,
-        instanceName: name,
-        signal: this.abortController.signal
-      });
-      this.logger.debug("destroy request sent");
-      const stream = this.runnerBackend.watch({
-        projectId: this.operation.projectId,
-        instanceType: type,
-        instanceName: name,
-        finalStatuses: ["not_created", "error"]
-      });
-      await this.watchStateStream(stream);
-      this.logger.info("unit destroyed");
-    });
-  }
-  async recreateUnit(instance, component) {
-    const logger = this.logger.child({ instanceId: instance.id });
-    return this.getInstancePromise(instance.id, async () => {
-      this.updateInstanceState({
-        id: instance.id,
-        latestOperationId: this.operation.id,
-        status: "pending",
-        currentResourceCount: 0,
-        totalResourceCount: 0
-      });
-      const state = this.stateMap.get(instance.id);
-      if (!state) {
-        logger.warn("state not found for unit, but recreate was requested");
-        return;
-      }
-      await this.processBeforeDestroyTriggers(state, component, logger);
-      logger.info("destroying unit...");
-      await this.runnerBackend.destroy({
-        projectId: this.operation.projectId,
-        instanceType: instance.type,
-        instanceName: instance.name,
-        signal: this.abortController.signal
-      });
-      logger.debug("destroy request sent");
-      const destroyStream = this.runnerBackend.watch({
-        projectId: this.operation.projectId,
-        instanceType: instance.type,
-        instanceName: instance.name,
-        finalStatuses: ["not_created", "error"]
-      });
-      await this.watchStateStream(destroyStream);
-      this.abortController.signal.throwIfAborted();
-      logger.info("unit destroyed");
-      logger.info("updating unit...");
-      const secrets = await this.secretBackend.get(this.operation.projectId, instance.id);
-      this.abortController.signal.throwIfAborted();
-      logger.debug("secrets loaded", { count: Object.keys(secrets).length });
-      await this.runnerBackend.update({
-        projectId: this.operation.projectId,
-        instanceType: instance.type,
-        instanceName: instance.name,
-        config: await this.prepareUnitConfig(instance),
-        secrets: mapValues(secrets, (value) => valueToString(value)),
-        source: this.resolveUnitSource(component),
-        signal: this.abortController.signal
-      });
-      logger.debug("unit update requested");
-      const updateStream = this.runnerBackend.watch({
-        projectId: this.operation.projectId,
-        instanceType: instance.type,
-        instanceName: instance.name,
-        finalStatuses: ["created", "error"]
-      });
-      this.updateInstanceState({ id: instance.id, inputHash: null });
-      await this.watchStateStream(updateStream);
-      logger.info("unit recreated");
-    });
-  }
-  async refreshUnit(instanceId) {
-    const logger = this.logger.child({ instanceId });
-    return this.getInstancePromise(instanceId, async () => {
-      this.updateInstanceState({
-        id: instanceId,
-        latestOperationId: this.operation.id,
-        status: "refreshing",
-        currentResourceCount: 0,
-        totalResourceCount: 0
-      });
-      logger.info("refreshing unit...");
-      const [type, name] = parseInstanceId(instanceId);
-      await this.runnerBackend.refresh({
-        projectId: this.operation.projectId,
-        instanceType: type,
-        instanceName: name,
-        signal: this.abortController.signal
-      });
-      logger.debug("unit refresh requested");
-      const stream = this.runnerBackend.watch({
-        projectId: this.operation.projectId,
-        instanceType: type,
-        instanceName: name,
-        finalStatuses: ["created", "error"]
-      });
-      await this.watchStateStream(stream);
-      logger.info("unit refreshed");
-    });
-  }
-  async watchStateStream(stream) {
-    let statePatch;
-    for await (statePatch of stream) {
-      if (statePatch.status === "not_created" && this.operation.type === "recreate") {
-        continue;
-      }
-      this.updateInstanceState(statePatch);
-    }
-    if (!statePatch) {
-      throw new Error("The stream ended without emitting any state.");
-    }
-    if (statePatch.status === "error") {
-      throw new Error(`The operation on unit "${statePatch.id}" failed: ${statePatch.error}`);
-    }
-  }
-  async prepareUnitConfig(instance, invokedTriggers = []) {
-    var _a, _b;
-    const config = {};
-    for (const [key, value] of Object.entries((_a = instance.args) != null ? _a : {})) {
-      config[key] = valueToString(value);
-    }
-    const instanceInputs = (_b = this.resolvedInstanceInputs.get(instance.id)) != null ? _b : {};
-    for (const [key, value] of Object.entries(instanceInputs)) {
-      const resolvedInput = await this.resolveInstanceInput(value.map((input) => input.input));
-      config[`input.${key}`] = JSON.stringify(resolvedInput);
-    }
-    config["$invokedTriggers"] = JSON.stringify(invokedTriggers);
-    return config;
-  }
-  async resolveInstanceInput(input) {
-    const promises = input.map((input2) => this.resolveSingleInstanceInput(input2));
-    const results = await Promise.all(promises);
-    return results.flat();
-  }
-  async resolveSingleInstanceInput(input) {
-    var _a;
-    const loadedInstance = this.instanceMap.get(input.instanceId);
-    if (loadedInstance && !loadedInstance.parentId) {
-      return [input];
-    }
-    const parentInstance = await this.loadCompositeInstance(input.instanceId);
-    const parentOutput = (_a = parentInstance.instance.outputs) == null ? void 0 : _a[input.output];
-    if (!parentOutput) {
-      throw new Error(`Output "${input.output}" not found in "${input.instanceId}"`);
-    }
-    return await this.resolveInstanceInput(parentOutput);
-  }
-  async loadCompositeInstance(instanceId) {
-    return await this.compositeInstanceLock.acquire(instanceId, async () => {
-      const existingInstance = this.compositeInstanceMap.get(instanceId);
-      if (existingInstance) {
-        return existingInstance;
-      }
-      const compositeInstance = await this.stateBackend.getCompositeInstance(
-        this.operation.projectId,
-        instanceId
-      );
-      if (!compositeInstance) {
-        throw new Error(`Composite instance not found: ${instanceId}`);
-      }
-      this.abortController.signal.throwIfAborted();
-      for (const child of compositeInstance.children) {
-        this.instanceMap.set(child.id, child);
-      }
-      this.compositeInstanceMap.set(instanceId, compositeInstance);
-      return compositeInstance;
-    });
-  }
-  async evaluateCompositeInstances() {
-    await this.projectLock.lockInstances(this.operation.instanceIds, async () => {
-      const compositeInstances = await this.libraryBackend.evaluateCompositeInstances(
-        Array.from(this.instanceMap.values()),
-        this.operation.instanceIds
-      );
-      this.abortController.signal.throwIfAborted();
-      for (const instance of compositeInstances) {
-        this.compositeInstanceEE.emit(
-          `${this.operation.projectId}/${instance.instance.id}`,
-          instance
-        );
-      }
-      await this.stateBackend.putCompositeInstances(
-        this.operation.projectId,
-        await Promise.all(
-          compositeInstances.map(async (instance) => ({
-            ...instance,
-            inputHash: await this.resolveInputHash(instance.instance.id)
-          }))
-        )
-      );
-    });
-  }
-  async updateOperation() {
-    this.operationEE.emit(this.operation.projectId, this.operation);
-    await this.stateBackend.putOperation(this.operation);
-  }
-  updateInstanceState(patch) {
-    if (!patch.id) {
-      throw new Error("The ID of the instance state is required.");
-    }
-    if (patch.logLine) {
-      this.persistLogs.call([patch.id, patch.logLine]);
-      this.instanceLogsEE.emit(`${this.operation.id}/${patch.id}`, patch.logLine);
-      return;
-    }
-    const state = applyPartialInstanceState(this.stateMap, patch);
-    this.persistStates.call(state);
-    if (patch.secrets) {
-      this.persistSecrets.call([patch.id, patch.secrets]);
-    }
-    this.stateEE.emit(this.operation.projectId, createInstanceStateFrontendPatch(patch));
-  }
-  tryAddStateToParent(state) {
-    var _a;
-    if (!state.parentId) {
-      return;
-    }
-    const children = (_a = this.childrenStateMap.get(state.parentId)) != null ? _a : [];
-    children.push(state);
-    this.childrenStateMap.set(state.parentId, children);
-  }
-  addDependentState(state) {
-    var _a, _b;
-    const instance = this.instanceMap.get(state.id);
-    if (!instance) {
-      return;
-    }
-    const instanceInputs = (_a = this.resolvedInstanceInputs.get(state.id)) != null ? _a : {};
-    for (const inputs of Object.values(instanceInputs)) {
-      for (const input of inputs) {
-        const dependents = (_b = this.dependentStateMap.get(input.input.instanceId)) != null ? _b : [];
-        dependents.push(state);
-        this.dependentStateMap.set(input.input.instanceId, dependents);
-      }
-    }
-  }
-  async extendWithNotCreatedDependencies() {
-    const instanceIdsSet = /* @__PURE__ */ new Set();
-    const traverse = async (instanceId) => {
-      var _a;
-      if (instanceIdsSet.has(instanceId)) {
-        return;
-      }
-      const instance = this.instanceMap.get(instanceId);
-      if (!instance) {
-        return;
-      }
-      const instanceInputs = (_a = this.resolvedInstanceInputs.get(instance.id)) != null ? _a : {};
-      for (const inputs of Object.values(instanceInputs)) {
-        for (const input of inputs) {
-          await traverse(input.input.instanceId);
-        }
-      }
-      const state = this.stateMap.get(instance.id);
-      const expectedInputHash = await this.resolveInputHash(instance.id);
-      if ((state == null ? void 0 : state.status) !== "created" || state.inputHash !== expectedInputHash) {
-        instanceIdsSet.add(instanceId);
-      }
-    };
-    for (const instanceId of this.operation.instanceIds) {
-      await traverse(instanceId);
-      instanceIdsSet.add(instanceId);
-    }
-    this.operation.instanceIds = Array.from(instanceIdsSet);
-  }
-  extendWithCreatedDependents() {
-    const instanceIdsSet = /* @__PURE__ */ new Set();
-    const traverse = (instanceKey) => {
-      var _a;
-      if (instanceIdsSet.has(instanceKey)) {
-        return;
-      }
-      const state = this.stateMap.get(instanceKey);
-      if (!state || state.status === "not_created") {
-        return;
-      }
-      const dependents = (_a = this.dependentStateMap.get(instanceKey)) != null ? _a : [];
-      for (const dependent of dependents) {
-        traverse(dependent.id);
-        instanceIdsSet.add(instanceKey);
-      }
-    };
-    for (const instanceId of this.operation.instanceIds) {
-      const instance = this.instanceMap.get(instanceId);
-      if (!instance) {
-        throw new Error(`Instance not found: ${instanceId}`);
-      }
-      traverse(instance.id);
-      instanceIdsSet.add(instanceId);
-    }
-    this.operation.instanceIds = Array.from(instanceIdsSet);
-  }
-  getInstancePromise(instanceId, fn) {
-    let instancePromise = this.instancePromiseMap.get(instanceId);
-    if (instancePromise) {
-      return instancePromise;
-    }
-    instancePromise = this.projectLock.lockInstance(instanceId, fn);
-    instancePromise = instancePromise.finally(() => this.instancePromiseMap.delete(instanceId));
-    this.instancePromiseMap.set(instanceId, instancePromise);
-    return instancePromise;
-  }
-  getStatusByOperationType() {
-    switch (this.operation.type) {
-      case "update":
-        return "updating";
-      case "recreate":
-        return "updating";
-      case "destroy":
-        return "destroying";
-      case "refresh":
-        return "refreshing";
-      default:
-        throw new Error(`Unexpected operation type: ${this.operation.type}`);
-    }
-  }
-  getInstanceDependencies(instance) {
-    var _a;
-    const dependencies = [];
-    const instanceInputs = (_a = this.resolvedInstanceInputs.get(instance.id)) != null ? _a : {};
-    for (const inputs of Object.values(instanceInputs)) {
-      for (const input of inputs) {
-        const dependency = this.instanceMap.get(input.input.instanceId);
-        if (dependency) {
-          dependencies.push(dependency);
-        }
-      }
-    }
-    return dependencies;
-  }
-  resolveUnitSource(component) {
-    var _a, _b;
-    if (!component.source || component.source.type === "local") {
-      return {
-        type: "local",
-        // auto-generate path for local units
-        path: (_b = (_a = component.source) == null ? void 0 : _a.path) != null ? _b : component.type.split(".").join("/")
-      };
-    }
-    return component.source;
-  }
-  static isAbortError(err) {
-    if (isAbortError(err)) {
-      return true;
-    }
-    if (err instanceof Error) {
-      return _RuntimeOperation.abortMessagePatterns.some((pattern) => err.message.includes(pattern));
-    }
-    return false;
-  }
-};
-__publicField$1(_RuntimeOperation, "abortMessagePatterns", [
-  "Operation aborted",
-  "Command was killed with SIGINT"
-]);
-let RuntimeOperation = _RuntimeOperation;
-
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
-class OperationManager {
-  constructor(runnerBackend, stateBackend, libraryBackend, projectBackend, secretBackend, projectLockManager, logger) {
-    this.runnerBackend = runnerBackend;
-    this.stateBackend = stateBackend;
-    this.libraryBackend = libraryBackend;
-    this.projectBackend = projectBackend;
-    this.secretBackend = secretBackend;
-    this.projectLockManager = projectLockManager;
-    this.logger = logger;
-    __publicField(this, "operationEE", new EventEmitter$2());
-    __publicField(this, "stateEE", new EventEmitter$2());
-    __publicField(this, "compositeInstanceEE", new EventEmitter$2());
-    __publicField(this, "instanceLogsEE", new EventEmitter$2());
-    __publicField(this, "runtimeOperations", /* @__PURE__ */ new Map());
-  }
-  /**
-   * Watches for all instance state changes in the project.
-   *
-   * @param projectId The project ID to watch.
-   * @param signal The signal to abort the operation.
-   */
-  async *watchInstanceStates(projectId, signal) {
-    for await (const [state] of on(this.stateEE, projectId, { signal })) {
-      yield state;
-    }
-  }
-  /**
-   * Watches for all project operations in the project.
-   *
-   * @param projectId The project ID to watch.
-   * @param signal The signal to abort the operation.
-   */
-  async *watchOperations(projectId, signal) {
-    for await (const [operation] of on(this.operationEE, projectId, { signal })) {
-      yield operation;
-    }
-  }
-  /**
-   * Watches for changes in the composite instance.
-   *
-   * @param projectId The project ID to watch.
-   * @param instanceId The instance ID to watch.
-   * @param signal The signal to abort the operation.
-   */
-  async *watchCompositeInstance(projectId, instanceId, signal) {
-    const eventKey = `${projectId}/${instanceId}`;
-    for await (const [instance] of on(this.compositeInstanceEE, eventKey, { signal })) {
-      yield instance;
-    }
-  }
-  /**
-   * Watches for logs of the instance in the operation.
-   *
-   * @param operationId The operation ID to watch.
-   * @param instanceId The instance ID to watch.
-   * @param signal The signal to abort the operation.
-   */
-  async *watchInstanceLogs(operationId, instanceId, signal) {
-    const eventKey = `${operationId}/${instanceId}`;
-    for await (const [log] of on(this.instanceLogsEE, eventKey, { signal })) {
-      yield log;
-    }
-  }
-  /**
-   * Launches the project operation.
-   *
-   * @param request The operation request to launch.
-   */
-  async launch(request) {
-    const operation = {
-      id: uuidv7(),
-      projectId: request.projectId,
-      type: request.type,
-      instanceIds: request.instanceIds,
-      status: "pending",
-      error: null,
-      startedAt: Date.now(),
-      completedAt: null
-    };
-    await this.stateBackend.putOperation(operation);
-    this.startOperation(operation);
-  }
-  /**
-   * Cancels the current operation.
-   * Does nothing if no operation is running.
-   */
-  cancel(operationId) {
-    const runtimeOperation = this.runtimeOperations.get(operationId);
-    if (runtimeOperation) {
-      runtimeOperation.cancel();
-    }
-  }
-  startOperation(operation) {
-    const runtimeOperation = new RuntimeOperation(
-      operation,
-      this.runnerBackend,
-      this.stateBackend,
-      this.libraryBackend,
-      this.projectBackend,
-      this.secretBackend,
-      this.projectLockManager.getLock(operation.projectId),
-      this.operationEE,
-      this.stateEE,
-      this.compositeInstanceEE,
-      this.instanceLogsEE,
-      this.logger.child({ service: "RuntimeOperation", operationId: operation.id })
-    );
-    this.runtimeOperations.set(operation.id, runtimeOperation);
-    void runtimeOperation.operateSafe().finally(() => this.runtimeOperations.delete(operation.id));
-  }
-  static async create(runnerBackend, stateBackend, libraryBackend, projectBackend, secretBackend, projectLockManager, logger) {
-    const operator = new OperationManager(
-      runnerBackend,
-      stateBackend,
-      libraryBackend,
-      projectBackend,
-      secretBackend,
-      projectLockManager,
-      logger.child({ service: "OperationManager" })
-    );
-    const activeOperations = await stateBackend.getActiveOperations();
-    for (const operation of activeOperations) {
-      logger.info({ msg: "relaunching operation", operationId: operation.id });
-      operation.status = "cancelled";
-      await stateBackend.putOperation(operation);
-    }
-    return operator;
-  }
-}
-
-async function createServices({
-  config,
-  services: {
-    logger,
-    libraryBackend,
-    secretBackend,
-    runnerBackend,
-    projectBackend,
-    projectManager,
-    stateBackend,
-    operationManager,
-    terminalBackend,
-    terminalManager,
-    workspaceBackend
-  } = {}
-} = {}) {
-  config != null ? config : config = await loadConfig();
-  logger != null ? logger : logger = pino({
-    name: config.HIGHSTATE_BACKEND_LOGGER_NAME,
-    level: config.HIGHSTATE_BACKEND_LOGGER_LEVEL,
-    errorKey: "error"
-  });
-  const localPulumiHost = LocalPulumiHost.create(logger);
-  const projectLockManager = new ProjectLockManager();
-  libraryBackend != null ? libraryBackend : libraryBackend = createLibraryBackend(config, logger);
-  secretBackend != null ? secretBackend : secretBackend = await createSecretBackend(config, localPulumiHost, logger);
-  stateBackend != null ? stateBackend : stateBackend = await createStateBackend(config, localPulumiHost, logger);
-  runnerBackend != null ? runnerBackend : runnerBackend = await createRunnerBackend(config, localPulumiHost);
-  projectBackend != null ? projectBackend : projectBackend = await createProjectBackend(config);
-  terminalBackend != null ? terminalBackend : terminalBackend = createTerminalBackend(config, logger);
-  terminalManager != null ? terminalManager : terminalManager = TerminalManager.create(terminalBackend, stateBackend, runnerBackend, logger);
-  operationManager != null ? operationManager : operationManager = await OperationManager.create(
-    runnerBackend,
-    stateBackend,
-    libraryBackend,
-    projectBackend,
-    secretBackend,
-    projectLockManager,
-    logger
-  );
-  projectManager != null ? projectManager : projectManager = ProjectManager.create(
-    projectBackend,
-    stateBackend,
-    operationManager,
-    libraryBackend,
-    logger
-  );
-  workspaceBackend != null ? workspaceBackend : workspaceBackend = await createWorkspaceBackend(config);
-  logger.info("services created");
-  return {
-    logger,
-    libraryBackend,
-    secretBackend,
-    runnerBackend,
-    projectBackend,
-    projectManager,
-    stateBackend,
-    operationManager,
-    terminalBackend,
-    terminalManager,
-    workspaceBackend
-  };
-}
-let sharedServicesPromise;
-function getSharedServices(options = {}) {
-  if (!sharedServicesPromise) {
-    sharedServicesPromise = createServices(options);
-  }
-  return sharedServicesPromise;
-}
-
-const secretRouter = router({
-  isLocked: publicProcedure.input(
-    z.object({
-      projectId: z.string()
-    })
-  ).query(async ({ input, ctx }) => {
-    var _a, _b;
-    const isLocked = await ((_b = (_a = ctx.secretBackend).isLocked) == null ? void 0 : _b.call(_a, input.projectId));
-    return isLocked != null ? isLocked : false;
-  }),
-  unlock: publicProcedure.input(
-    z.object({
-      projectId: z.string(),
-      passphrase: z.string()
-    })
-  ).mutation(async ({ input, ctx }) => {
-    if (!ctx.secretBackend.unlock) {
-      throw new Error("The secret backend does not support unlocking.");
-    }
-    return await ctx.secretBackend.unlock(input.projectId, input.passphrase);
-  }),
-  get: publicProcedure.input(
-    z.object({
-      projectId: z.string(),
-      instanceKey: z.string()
-    })
-  ).query(async ({ input, ctx }) => {
-    try {
-      return await ctx.secretBackend.get(input.projectId, input.instanceKey);
-    } catch (e) {
-      if (e instanceof SecretAccessDeniedError) {
-        throw new TRPCError({
-          code: "FORBIDDEN",
-          message: "Access to the secret is denied",
-          cause: e
-        });
-      }
-      throw e;
-    }
+const projectRouter = router({
+  getProjects: publicProcedure.query(async ({ ctx }) => {
+    return await ctx.projectBackend.getProjectNames();
   }),
-  set: publicProcedure.input(
+  createProject: publicProcedure.input(
     z.object({
       projectId: z.string(),
-      instanceId: z.string(),
-      values: z.record(z.unknown())
+      password: z.string()
     })
-  ).mutation(async ({ input, ctx }) => {
-    try {
-      await ctx.secretBackend.set(input.projectId, input.instanceId, input.values);
-    } catch (e) {
-      if (e instanceof SecretAccessDeniedError) {
-        throw new TRPCError({
-          code: "FORBIDDEN",
-          message: "Access to the secret is denied",
-          cause: e
-        });
-      }
-      throw e;
-    }
-  })
-});
-
-const projectRouter = router({
-  getProjects: publicProcedure.query(async ({ ctx }) => {
-    return await ctx.projectBackend.getProjectNames();
+  ).output(z.void()).mutation(async ({ input, ctx }) => {
+    var _a, _b;
+    await ctx.projectBackend.createProject(input.projectId);
+    await ((_b = (_a = ctx.secretBackend).unlock) == null ? void 0 : _b.call(_a, input.projectId, input.password));
   }),
   watchCompositeInstance: publicProcedure.input(
     z.object({
@@ -15922,13 +12417,13 @@ const client_manifest = {
     "module": true,
     "prefetch": true,
     "preload": true,
-    "file": "B_hR0Ok_.js",
+    "file": "CDvc066L.js",
     "name": "error-404",
     "src": "../node_modules/nuxt/dist/app/components/error-404.vue",
     "isDynamicEntry": true,
     "imports": [
       "../node_modules/nuxt/dist/app/entry.js",
-      "_DE7L338O.js"
+      "_DOPM99N_.js"
     ],
     "css": [
       "error-404.BJkSn6RI.css"
@@ -15945,13 +12440,13 @@ const client_manifest = {
     "module": true,
     "prefetch": true,
     "preload": true,
-    "file": "Cj8SV8PB.js",
+    "file": "Dx2bEYXH.js",
     "name": "error-500",
     "src": "../node_modules/nuxt/dist/app/components/error-500.vue",
     "isDynamicEntry": true,
     "imports": [
       "../node_modules/nuxt/dist/app/entry.js",
-      "_DE7L338O.js"
+      "_DOPM99N_.js"
     ],
     "css": [
       "error-500.TOCKLquH.css"
@@ -15968,7 +12463,7 @@ const client_manifest = {
     "module": true,
     "prefetch": true,
     "preload": true,
-    "file": "BA0u-n1q.js",
+    "file": "D0Jq3pX9.js",
     "name": "entry",
     "src": "../node_modules/nuxt/dist/app/entry.js",
     "isEntry": true,
@@ -15977,7 +12472,7 @@ const client_manifest = {
       "../node_modules/nuxt/dist/app/components/error-500.vue"
     ],
     "css": [
-      "entry.7p8V-3Ph.css"
+      "entry.VNeMltv3.css"
     ],
     "assets": [
       "materialdesignicons-webfont.TEmAk13K.eot",
@@ -15986,8 +12481,8 @@ const client_manifest = {
       "materialdesignicons-webfont.BpRar1d5.ttf"
     ]
   },
-  "entry.7p8V-3Ph.css": {
-    "file": "entry.7p8V-3Ph.css",
+  "entry.VNeMltv3.css": {
+    "file": "entry.VNeMltv3.css",
     "resourceType": "style",
     "prefetch": true,
     "preload": true
@@ -16012,12 +12507,12 @@ const client_manifest = {
     "resourceType": "font",
     "mimeType": "font/ttf"
   },
-  "_DE7L338O.js": {
+  "_DOPM99N_.js": {
     "resourceType": "script",
     "module": true,
     "prefetch": true,
     "preload": true,
-    "file": "DE7L338O.js",
+    "file": "DOPM99N_.js",
     "name": "vue.-sixQ7xP",
     "imports": [
       "../node_modules/nuxt/dist/app/entry.js"