@highstate/pulumi 0.9.18 → 0.9.20

package/src/unit.ts

@@ -1,152 +1,73 @@
-/* eslint-disable @typescript-eslint/no-unsafe-assignment */
-/* eslint-disable @typescript-eslint/no-unsafe-member-access */
-/* eslint-disable @typescript-eslint/no-unsafe-argument */
-/* eslint-disable @typescript-eslint/no-unsafe-return */
-/* eslint-disable @typescript-eslint/no-explicit-any */
-
-import type { DeepInput, InputArray, InputMap } from "./utils"
-import type { ComponentSecret } from "../../contract/src/unit"
+/** biome-ignore-all lint/suspicious/noExplicitAny: здесь орать запрещено */
 import {
-  type ComponentInputSpec,
-  type EntityModel,
-  type Unit,
   type ComponentInput,
+  type ComponentInputSpec,
+  camelCaseToHumanReadable,
+  HighstateConfigKey,
   type InstanceInput,
+  type InstanceStatusField,
+  type InstanceStatusFieldValue,
+  type PartialKeys,
+  parseArgumentValue,
   parseInstanceId,
-  getInstanceId,
-  type ComponentArgumentSpec,
-  type ComponentArgumentSpecToStatic,
-  HighstateSignature,
-  camelCaseToHumanReadable,
-  z,
-  type UnitSecretModel,
-  unitSecretSchema,
+  runtimeSchema,
+  type TriggerInvocation,
+  type Unit,
+  type UnitArtifact,
+  type UnitConfig,
+  type UnitPage,
+  type UnitTerminal,
+  type UnitTrigger,
+  type UnitWorker,
   unitArtifactSchema,
+  unitConfigSchema,
+  z,
 } from "@highstate/contract"
-import { mapValues, pickBy, pipe } from "remeda"
 import {
   Config,
-  getStack,
-  Output,
+  type Input,
+  type Output,
   output,
-  secret,
+  secret as pulumiSecret,
   StackReference,
-  type Input,
   type Unwrap,
 } from "@pulumi/pulumi"
-import { Ajv } from "ajv"
-import { updatedSecretValues, type UnitSecret } from "./secret"
-
-const ajv = new Ajv({ strict: false })
-
-export type ObjectMeta = {
-  title?: Input<string | undefined>
-  description?: Input<string | undefined>
-  icon?: Input<string | undefined>
-  iconColor?: Input<string | undefined>
-}
-
-export type InstanceFileMeta = {
-  name: Input<string>
-  contentType?: Input<string>
-  size?: Input<number>
-  isBinary?: Input<boolean>
-  mode?: Input<number>
-}
-
-export type UnitArtifact = {
-  hash: Input<string>
-  meta?: Input<ObjectMeta>
-}
-
-export type InstanceFile = {
-  meta: Input<InstanceFileMeta>
-  content:
-    | { type: "embedded"; value: Input<string> }
-    | {
-        type: "artifact"
-        [HighstateSignature.Artifact]: UnitArtifact
-      }
-}
-
-export type InstanceTerminalSpec = {
-  image: Input<string>
-  command: InputArray<string>
-  cwd?: Input<string | undefined>
-  env?: InputMap<string | undefined>
-  files?: InputMap<InstanceFile | string | undefined>
-}
-
-export type InstanceTerminal = {
-  name: Input<string>
-  meta: Input<ObjectMeta>
-  spec: Input<InstanceTerminalSpec>
-}
-
-export type StatusFieldValue = string | number | boolean | string[]
-
-export type StatusField<TArgName extends string = string> = {
-  name: Input<string>
-  meta?: Input<ObjectMeta>
-  complementaryTo?: Input<TArgName | undefined>
-  value?: Input<StatusFieldValue | undefined>
-}
-
-export type InstancePageBlock =
-  | { type: "markdown"; content: Input<string> }
-  | { type: "qr"; content: Input<string>; showContent?: boolean; language?: string }
-  | ({ type: "file" } & InstanceFile)
-
-export type InstancePage = {
-  name: Input<string>
-  meta: Input<ObjectMeta>
-  content: InputArray<InstancePageBlock>
-}
-
-export type InstanceTriggerSpec =
-  | {
-      type: "before-destroy"
-    }
-  | {
-      type: "schedule"
-      schedule: string
-    }
-
-export type InstanceTrigger = {
-  name: Input<string>
-  title: Input<string>
-  description?: Input<string>
-  spec: Input<InstanceTriggerSpec>
-}
+import { mapValues } from "remeda"
+import { type DeepInput, toPromise } from "./utils"
 
-export type InstanceWorker = {
-  name: Input<string>
-  image: Input<string>
-  params?: InputMap<unknown>
+type StatusField<TArgName extends string = string> = Omit<
+  InstanceStatusField,
+  "complementaryTo" | "meta"
+> & {
+  meta?: PartialKeys<InstanceStatusField["meta"], "title">
+  complementaryTo?: TArgName
 }
 
-export type ExtraOutputs<TArgName extends string = string> = {
+type ExtraOutputs<TArgName extends string = string> = {
   $statusFields?:
-    | InputMap<Omit<StatusField<TArgName>, "name"> | StatusFieldValue | undefined>
-    | InputArray<StatusField<TArgName> | undefined>
+    | Input<
+        Record<
+          string,
+          DeepInput<Omit<StatusField<TArgName>, "name"> | InstanceStatusFieldValue | undefined>
+        >
+      >
+    | Input<DeepInput<StatusField<TArgName> | undefined>[]>
 
   $terminals?:
-    | InputMap<Omit<InstanceTerminal, "name"> | undefined>
-    | InputArray<InstanceTerminal | undefined>
+    | Input<Record<string, DeepInput<Omit<UnitTerminal, "name"> | undefined>>>
+    | Input<DeepInput<UnitTerminal | undefined>[]>
 
-  $pages?: InputMap<Omit<InstancePage, "name"> | undefined> | InputArray<InstancePage | undefined>
+  $pages?:
+    | Input<Record<string, DeepInput<Omit<UnitPage, "name"> | undefined>>>
+    | Input<DeepInput<UnitPage | undefined>[]>
 
   $triggers?:
-    | InputMap<Omit<InstanceTrigger, "name"> | undefined>
-    | InputArray<InstanceTrigger | undefined>
+    | Input<Record<string, DeepInput<Omit<UnitTrigger, "name"> | undefined>>>
+    | Input<DeepInput<UnitTrigger | undefined>[]>
 
   $workers?:
-    | InputMap<Omit<InstanceWorker, "name"> | undefined>
-    | InputArray<InstanceWorker | undefined>
-}
-
-export type InstanceTriggerInvocation = {
-  name: string
+    | Input<Record<string, DeepInput<Omit<UnitWorker, "name"> | undefined>>>
+    | Input<DeepInput<UnitWorker | undefined>[]>
 }
 
 type OutputMapToDeepInputMap<T extends Record<string, unknown>, TArgName extends string> =
@@ -154,11 +75,7 @@ type OutputMapToDeepInputMap<T extends Record<string, unknown>, TArgName extends
     ? ExtraOutputs
     : { [K in keyof T]: DeepInput<T[K]> } & ExtraOutputs<TArgName>
 
-export type SecretValueMapToSecretMap<T extends Record<string, unknown>> = {
-  [K in keyof T]-?: UnitSecret<T[K]>
-}
-
-export interface UnitContext<
+interface UnitContext<
   TArgs extends Record<string, unknown>,
   TInputs extends Record<string, unknown>,
   TOutputs extends Record<string, unknown>,
@@ -168,17 +85,26 @@ export interface UnitContext<
   instanceId: string
   type: string
   name: string
-  secrets: SecretValueMapToSecretMap<TSecrets>
-
-  inputs: TInputs extends Record<string, never>
-    ? never
-    : {
-        [K in keyof TInputs]: undefined extends TInputs[K]
-          ? Output<NonNullable<TInputs[K]>> | undefined
-          : Output<TInputs[K]>
-      }
 
-  invokedTriggers: InstanceTriggerInvocation[]
+  secrets: {
+    [K in keyof TSecrets]: undefined extends TSecrets[K]
+      ? Output<NonNullable<TSecrets[K]>> | undefined
+      : Output<TSecrets[K]>
+  }
+
+  getSecret<K extends keyof TSecrets>(
+    this: void,
+    name: K,
+  ): Output<NonNullable<TSecrets[K]> | undefined>
+
+  getSecret<K extends keyof TSecrets>(
+    this: void,
+    name: K,
+    factory: () => Input<NonNullable<TSecrets[K]>>,
+  ): Output<NonNullable<TSecrets[K]>>
+
+  inputs: TInputs
+  invokedTriggers: TriggerInvocation[]
 
   outputs(
     this: void,
@@ -186,68 +112,102 @@ export interface UnitContext<
   ): Promise<unknown>
 }
 
-type InputSpecToValue<T extends ComponentInputSpec> = T[2] extends true
-  ? z.infer<T[0]["schema"]>[]
+// z.output since the values are validated/transformed and passed to the user
+type InputSpecToWrappedValue<T extends ComponentInputSpec> = T[2] extends true
+  ? // we have to wrap the array in Output since we don't know how many items will be returned by each multiple input
+    Output<NonNullable<z.output<T[0]["schema"]>>[]>
   : T[1] extends true
-    ? z.infer<T[0]["schema"]>
-    : z.infer<T[0]["schema"]> | undefined
-
-type InputSpecMapToValueMap<T extends Record<string, ComponentInputSpec>> =
-  T extends Record<string, never>
-    ? Record<string, never>
-    : { [K in keyof T]: InputSpecToValue<T[K]> }
+    ? Output<NonNullable<z.output<T[0]["schema"]>>>
+    : Output<NonNullable<z.output<T[0]["schema"]>>> | undefined
+
+// z.input since the values are passed from the user and should be validated/transformed before returning from the unit
+type OutputSpecToValue<T extends ComponentInputSpec> = T[2] extends true
+  ? T[1] extends true
+    ? NonNullable<z.input<T[0]["schema"]>>[]
+    : NonNullable<z.input<T[0]["schema"]>>[] | undefined
+  : T[1] extends true
+    ? NonNullable<z.input<T[0]["schema"]>>
+    : NonNullable<z.input<T[0]["schema"]>> | undefined
 
 const stackRefMap = new Map<string, StackReference>()
-const [projectId, instanceName] = getStack().split("_")
 
 let instanceId: string | undefined
+let instanceName: string | undefined
 
+/**
+ * Returns the current unit instance id.
+ *
+ * Only available after calling `forUnit` function.
+ */
 export function getUnitInstanceId(): string {
   if (!instanceId) {
-    throw new Error("Instance id is not set. Did you call 'forUnit' function?")
+    throw new Error(`Instance id is not set. Did you call "forUnit" function?`)
   }
 
   return instanceId
 }
 
-export function getResourceComment(): string {
-  return `Managed by Highstate Unit (${getUnitInstanceId()})`
-}
-
+/**
+ * Returns the current unit instance name.
+ */
 export function getUnitInstanceName(): string {
+  if (!instanceName) {
+    throw new Error(`Instance name is not set. Did you call "forUnit" function?`)
+  }
+
   return instanceName
 }
 
-function getStackRef(input: InstanceInput) {
-  const [instanceType, instanceName] = parseInstanceId(input.instanceId)
-  const key = `organization/${instanceType}/${projectId}_${instanceName}`
+/**
+ * Returns a comment that can be used in resources to indicate that they are managed by Highstate.
+ */
+export function getResourceComment(): string {
+  return `Managed by Highstate (${getUnitInstanceId()})`
+}
 
-  if (!stackRefMap.has(key)) {
-    stackRefMap.set(key, new StackReference(key))
+function getStackRef(config: UnitConfig, input: InstanceInput) {
+  const [instanceType] = parseInstanceId(input.instanceId)
+  const stateId = config.stateIdMap[input.instanceId]
+  if (!stateId) {
+    throw new Error(`State ID for instance "${input.instanceId}" not found in the unit config.`)
   }
 
-  return stackRefMap.get(key)!
+  const key = `organization/${instanceType}/${stateId}`
+  let stackRef = stackRefMap.get(key)
+
+  if (!stackRef) {
+    stackRef = new StackReference(key)
+    stackRefMap.set(key, stackRef)
+  }
+
+  return stackRef
 }
 
-function getOutput(unit: Unit, input: ComponentInput, refs: InstanceInput[]) {
+function getOutput(config: UnitConfig, unit: Unit, input: ComponentInput, refs: InstanceInput[]) {
   const entity = unit.entities.get(input.type)
   if (!entity) {
-    throw new Error(`Entity '${input.type}' not found in the unit '${unit.model.type}'.`)
+    throw new Error(`Entity "${input.type}" not found in the unit "${unit.model.type}".`)
   }
 
   const _getOutput = (ref: InstanceInput) => {
-    const value = getStackRef(ref).requireOutput(ref.output)
+    const value = getStackRef(config, ref).requireOutput(ref.output)
 
     return value.apply(value => {
       if (Array.isArray(value)) {
         for (const [index, item] of value.entries()) {
-          if (!ajv.validate(entity.schema, item)) {
-            throw new Error(`Invalid output for '${input.type}[${index}]': ${ajv.errorsText()}`)
+          const result = entity.schema.safeParse(item)
+
+          if (!result.success) {
+            throw new Error(
+              `Invalid output for "${input.type}[${index}]": ${z.prettifyError(result.error)}`,
+            )
           }
         }
       } else {
-        if (!ajv.validate(entity.schema, value)) {
-          throw new Error(`Invalid output for '${input.type}': ${ajv.errorsText()}`)
+        const result = entity.schema.safeParse(value)
+
+        if (!result.success) {
+          throw new Error(`Invalid output for "${input.type}": ${z.prettifyError(result.error)}`)
         }
       }
 
@@ -268,199 +228,105 @@ function getOutput(unit: Unit, input: ComponentInput, refs: InstanceInput[]) {
   return values
 }
 
-function isAnyOfSchema(schema: z.core.JSONSchema.BaseSchema, itemType: string): boolean {
-  if (schema.anyOf) {
-    return Object.values(schema.anyOf).every(schema => isAnyOfSchema(schema, itemType))
-  }
-
-  return schema.type === itemType
-}
-
-function isStringSchema(schema: z.core.JSONSchema.BaseSchema): boolean {
-  if (schema.type === "string") {
-    return true
-  }
-
-  if (isAnyOfSchema(schema, "string")) {
-    return true
-  }
-
-  return false
-}
-
-function isNumberSchema(schema: z.core.JSONSchema.BaseSchema): boolean {
-  if (schema.type === "number") {
-    return true
-  }
-
-  if (isAnyOfSchema(schema, "number")) {
-    return true
-  }
-
-  return false
-}
-
-function isBooleanSchema(schema: z.core.JSONSchema.BaseSchema): boolean {
-  if (schema.type === "boolean") {
-    return true
-  }
-
-  if (isAnyOfSchema(schema, "boolean")) {
-    return true
-  }
-
-  return false
-}
-
 export function forUnit<
-  TArgs extends Record<string, ComponentArgumentSpec>,
+  TArgs extends Record<string, z.ZodType>,
   TInputs extends Record<string, ComponentInputSpec>,
   TOutputs extends Record<string, ComponentInputSpec>,
-  TSecrets extends Record<string, ComponentArgumentSpec>,
+  TSecrets extends Record<string, z.ZodType>,
 >(
   unit: Unit<TArgs, TInputs, TOutputs, TSecrets>,
 ): UnitContext<
-  //
-  ComponentArgumentSpecToStatic<TArgs>,
-  InputSpecMapToValueMap<TInputs>,
-  InputSpecMapToValueMap<TOutputs>,
-  ComponentArgumentSpecToStatic<TSecrets>
+  { [K in keyof TArgs]: z.output<TArgs[K]> },
+  { [K in keyof TInputs]: InputSpecToWrappedValue<TInputs[K]> },
+  { [K in keyof TOutputs]: OutputSpecToValue<TOutputs[K]> },
+  { [K in keyof TSecrets]: z.output<TSecrets[K]> }
 > {
   const config = new Config()
+  const rawHSConfig = config.requireObject(HighstateConfigKey.Config)
+  const hsConfig = unitConfigSchema.parse(rawHSConfig)
 
-  const args = mapValues(unit.model.args, (arg, argName) => {
-    switch (true) {
-      case isStringSchema(arg.schema): {
-        if (arg.required) {
-          return config.require(argName)
-        }
-
-        // handle empty strings as undefined
-        return config.get(argName) || arg.schema.default
-      }
-      case isNumberSchema(arg.schema): {
-        if (arg.required) {
-          return config.requireNumber(argName)
-        }
-
-        // handle empty strings as undefined
-        const value = config.get(argName)
-        if (!value) {
-          return arg.schema.default
-        }
+  const rawHsSecrets = config
+    .requireSecretObject(HighstateConfigKey.Secrets)
+    .apply(secrets => z.record(z.string(), z.unknown()).parse(secrets))
 
-        return config.getNumber(argName) ?? arg.schema.default
-      }
-      case isBooleanSchema(arg.schema): {
-        if (arg.required) {
-          return config.requireBoolean(argName)
-        }
-
-        // handle empty strings as undefined
-        const value = config.get(argName)
-        if (!value) {
-          return arg.schema.default
-        }
+  const args = mapValues(unit.model.args, (arg, argName) => {
+    const value = parseArgumentValue(hsConfig.args[argName])
+    // biome-ignore lint/style/noNonNullAssertion: runtime schema is there in runtime
+    const result = arg[runtimeSchema]!.safeParse(value)
 
-        return config.getBoolean(argName) ?? arg.schema.default
-      }
-      default: {
-        if (!arg.required) {
-          const value = config.get(argName)
-          // handle empty strings as undefined
-          if (!value) {
-            return arg.schema.default
-          }
-        }
+    if (!result.success) {
+      throw new Error(`Invalid argument "${argName}": ${z.prettifyError(result.error)}`)
+    }
 
-        const value = arg.required ? config.requireObject(argName) : config.getObject(argName)
-        if (value === undefined) return arg.schema.default
+    return result.data
+  })
 
-        if (!ajv.validate(arg.schema, value)) {
-          throw new Error(`Invalid config for '${argName}': ${ajv.errorsText()}`)
-        }
+  const secrets = mapValues(unit.model.secrets, (secret, secretName) => {
+    const hasValue = hsConfig.secretNames.includes(secretName)
 
-        return value
-      }
+    if (!hasValue && !secret.required) {
+      return secret.schema.default ? pulumiSecret(secret.schema.default) : undefined
     }
-  }) as ComponentArgumentSpecToStatic<TArgs>
-
-  const secretIds = config.requireObject<Record<string, string>>("$secretIds")
 
-  const getSecretValue = (
-    secretName: string,
-    secret: ComponentSecret,
-  ): Output<unknown> | undefined => {
-    switch (true) {
-      case isStringSchema(secret.schema): {
-        return secret.required ? config.requireSecret(secretName) : config.getSecret(secretName)
-      }
-      case isNumberSchema(secret.schema): {
-        return secret.required
-          ? config.requireSecretNumber(secretName)
-          : config.getSecretNumber(secretName)
-      }
-      case isBooleanSchema(secret.schema): {
-        return secret.required
-          ? config.requireSecretBoolean(secretName)
-          : config.getSecretBoolean(secretName)
-      }
-      default: {
-        const value = secret.required
-          ? config.requireSecretObject(secretName)
-          : config.getSecretObject(secretName)
+    if (!hasValue && secret.required) {
+      throw new Error(`Secret "${secretName}" is required but not provided.`)
+    }
 
-        if (!ajv.validate(secret.schema, value)) {
-          throw new Error(`Invalid secret for '${secretName}': ${ajv.errorsText()}`)
-        }
+    return rawHsSecrets[secretName].apply(rawValue => {
+      const value = parseArgumentValue(rawValue)
+      // biome-ignore lint/style/noNonNullAssertion: runtime schema is there in runtime
+      const result = secret[runtimeSchema]!.safeParse(value)
 
-        return value
+      if (!result.success) {
+        throw new Error(`Invalid secret "${secretName}": ${z.prettifyError(result.error)}`)
       }
-    }
-  }
 
-  const secrets = mapValues(unit.model.secrets, (secret, secretName): UnitSecret<unknown> => {
-    const secretId = secretIds[secretName]
-    if (!secretId) {
-      throw new Error(`Secret '${secretName}' not found in the config.`)
-    }
-
-    return {
-      [HighstateSignature.Secret]: true,
-      id: secretId,
-      value: secret.required
-        ? config.requireSecret(secretName)
-        : output(getSecretValue(secretName, secret)),
-    }
+      return pulumiSecret(result.data)
+    })
   })
 
   const inputs = mapValues(unit.model.inputs, (input, inputName) => {
-    const value = input.required
-      ? config.requireObject<InstanceInput[]>(`input.${inputName}`)
-      : config.getObject<InstanceInput[]>(`input.${inputName}`)
+    const value = hsConfig.inputs[inputName]
 
     if (!value) {
       if (input.multiple) {
-        return output([])
+        return []
       }
 
       return undefined
     }
 
-    return getOutput(unit as unknown as Unit, input, value)
+    return getOutput(hsConfig, unit as unknown as Unit, input, value)
   })
 
-  const type = unit.model.type
-  instanceId = getInstanceId(type, instanceName)
+  const [type, name] = parseInstanceId(hsConfig.instanceId)
+
+  instanceId = hsConfig.instanceId
+  instanceName = name
 
   return {
-    args,
-    instanceId,
+    instanceId: hsConfig.instanceId,
     type,
-    name: instanceName,
-    secrets: secrets as SecretValueMapToSecretMap<ComponentArgumentSpecToStatic<TSecrets>>,
+    name,
+
+    args: args as any,
+    secrets: secrets as any,
     inputs: inputs as any,
-    invokedTriggers: config.getObject<InstanceTriggerInvocation[]>("$invokedTriggers") ?? [],
+    invokedTriggers: hsConfig.invokedTriggers,
+
+    getSecret: (<K extends keyof TSecrets>(
+      name: K,
+      factory?: () => Input<NonNullable<TSecrets[K]>>,
+    ) => {
+      if (!factory) {
+        return secrets[name as string]
+      }
+
+      const value = secrets[name as string] ?? pulumiSecret(factory())
+      secrets[name as string] = value
+
+      return value
+    }) as any,
 
     outputs: async (outputs: any = {}) => {
       const result: any = mapValues(outputs, (outputValue, outputName) => {
@@ -480,75 +346,59 @@ export function forUnit<
           return output(outputValue).apply(mapTriggers)
         }
 
+        if (outputName === "$workers") {
+          return output(outputValue).apply(mapWorkers)
+        }
+
         if (outputName.startsWith("$")) {
-          throw new Error(`Unknown extra output '${outputName}'.`)
+          throw new Error(`Unknown extra output "${outputName}".`)
         }
 
         const outputModel = unit.model.outputs[outputName]
         if (!outputModel) {
-          throw new Error(`Output '${outputName}' not found in the unit '${unit.model.type}'.`)
+          throw new Error(
+            `Output "${outputName}" not found in the unit "${unit.model.type}", but was passed to outputs(...).`,
+          )
         }
 
         const entity = unit.entities.get(outputModel.type)
         if (!entity) {
           throw new Error(
-            `Entity '${outputModel.type}' not found in the unit '${unit.model.type}'.`,
+            `Entity "${outputModel.type}" not found in the unit "${unit.model.type}". It looks like a bug in the unit definition.`,
           )
         }
 
         return output(outputValue).apply(value => {
-          if (value === undefined) {
-            if (outputModel.required) {
-              throw new Error(`Output '${outputName}' is required.`)
-            }
-
-            return undefined
-          }
-
           const schema = outputModel.multiple ? entity.schema.array() : entity.schema
+          const result = schema.safeParse(value)
 
-          if (!ajv.validate(schema, value)) {
-            throw new Error(`Invalid output for '${outputName}': ${ajv.errorsText()}`)
+          if (!result.success) {
+            throw new Error(
+              `Invalid output "${outputName}" of type "${outputModel.type}": ${z.prettifyError(result.error)}`,
+            )
           }
 
-          return value
+          return result.data
         })
-      }) as Record<string, Output<unknown>> & ExtraOutputs
-
-      await Promise.all(Object.values(result).map(o => outputToPromise(o)))
+      })
 
-      result.$secrets = updatedSecretValues
+      // wait for all outputs to resolve before collecting secrets and artifacts
+      await Promise.all(Object.values(result).map(o => toPromise(o)))
 
-      // collect secrets from all outputs
-      const secretsMap: Record<string, UnitSecretModel[]> = {}
-      for (const [outputName, outputValue] of Object.entries(outputs)) {
-        if (!outputName.startsWith("$")) {
-          const resolvedValue = await outputToPromise(outputValue)
-          const secrets = extractObjectsFromValue(unitSecretSchema, resolvedValue)
-          if (secrets.length > 0) {
-            secretsMap[outputName] = secrets
-          }
-        }
-      }
+      result.$secrets = secrets
 
       // collect artifacts from all outputs
       const artifactsMap: Record<string, UnitArtifact[]> = {}
       for (const [outputName, outputValue] of Object.entries(outputs)) {
-        if (!outputName.startsWith("$")) {
-          const resolvedValue = await outputToPromise(outputValue)
-          const artifacts = extractObjectsFromValue(unitArtifactSchema, resolvedValue)
-          if (artifacts.length > 0) {
-            artifactsMap[outputName] = artifacts
-          }
+        const resolvedValue = await toPromise(outputValue)
+        const artifacts = extractObjectsFromValue(unitArtifactSchema, resolvedValue)
+        if (artifacts.length > 0) {
+          artifactsMap[outputName] = artifacts
         }
       }
 
       if (Object.keys(artifactsMap).length > 0) {
-        result.$exportedArtifacts = artifactsMap
-      }
-
-      if (Object.keys(secretsMap).length > 0) {
-        result.$exportedSecretIds = mapValues(secretsMap, v => v.map(secret => secret.id))
+        result.$artifacts = artifactsMap
       }
 
       return result
@@ -556,29 +406,22 @@ export function forUnit<
   }
 }
 
-export type EntityValue<T extends EntityModel> = z.infer<T["schema"]>
-export type EntityInput<T extends EntityModel> = Output<EntityValue<T>>
-
-function outputToPromise(o: unknown): Promise<unknown> {
-  return new Promise(resolve => (output(o) as Output<unknown>).apply(resolve))
-}
-
-function mapStatusFields(status: Unwrap<ExtraOutputs["$statusFields"]>): StatusField[] {
+function mapStatusFields(status: Unwrap<ExtraOutputs["$statusFields"]>): InstanceStatusField[] {
   if (!status) {
     return []
   }
 
   if (Array.isArray(status)) {
     return status
-      .filter(field => !!field?.value)
+      .filter((field): field is NonNullable<StatusField> => field?.value !== undefined)
       .map(field => {
         return {
-          name: field!.name,
+          name: field.name,
           meta: {
-            title: field!.meta?.title ?? camelCaseToHumanReadable(field!.name),
+            title: field.meta?.title ?? camelCaseToHumanReadable(field.name),
           },
-          value: field!.value,
-        } as StatusField
+          value: field.value,
+        }
       })
   }
 
@@ -604,7 +447,7 @@ function mapStatusFields(status: Unwrap<ExtraOutputs["$statusFields"]>): StatusF
       }
 
       return {
-        ...(field as StatusField),
+        ...field,
         meta: {
           ...field.meta,
           title: field.meta?.title ?? camelCaseToHumanReadable(name),
@@ -612,65 +455,30 @@ function mapStatusFields(status: Unwrap<ExtraOutputs["$statusFields"]>): StatusF
         name,
       }
     })
-    .filter(field => !!field?.value) as StatusField[]
+    .filter((field): field is InstanceStatusField => field?.value !== undefined)
 }
 
-function mapPages(pages: Unwrap<ExtraOutputs["$pages"]>): InstancePage[] {
+function mapPages(pages: Unwrap<ExtraOutputs["$pages"]>): Output<UnitPage[]> {
   if (!pages) {
-    return []
-  }
-
-  if (Array.isArray(pages)) {
-    return pages.filter(page => !!page)
+    return output([])
   }
 
-  return Object.entries(pages)
-    .filter(([, page]) => !!page)
-    .map(([name, page]) => ({ ...page!, name }))
-}
+  if (!Array.isArray(pages)) {
+    pages = Object.entries(pages).map(([name, page]) => {
+      if (!page) {
+        return undefined
+      }
 
-export function fileFromString(
-  name: string,
-  content: string,
-  contentType = "text/plain",
-  isSecret = false,
-): InstanceFile {
-  return {
-    meta: {
-      name,
-      contentType,
-      size: Buffer.byteLength(content, "utf8"),
-    },
-    content: {
-      type: "embedded",
-      value: isSecret ? secret(content) : content,
-    },
+      return { ...page, name }
+    })
   }
-}
 
-export function fileFromBuffer(
-  name: string,
-  content: Buffer,
-  contentType = "application/octet-stream",
-  isSecret = false,
-): InstanceFile {
-  return {
-    meta: {
-      name,
-      contentType,
-      size: content.byteLength,
-      isBinary: true,
-    },
-    content: {
-      type: "embedded",
-      value: isSecret ? secret(content.toString("base64")) : content.toString("base64"),
-    },
-  }
+  return output(pages.filter((page): page is NonNullable<UnitPage> => !!page))
 }
 
-function mapTerminals(terminals: Unwrap<ExtraOutputs["$terminals"]>): InstanceTerminal[] {
+function mapTerminals(terminals: Unwrap<ExtraOutputs["$terminals"]>): Output<UnitTerminal[]> {
   if (!terminals) {
-    return []
+    return output([])
   }
 
   if (!Array.isArray(terminals)) {
@@ -683,57 +491,43 @@ function mapTerminals(terminals: Unwrap<ExtraOutputs["$terminals"]>): InstanceTe
     })
   }
 
-  return terminals
-    .filter(terminal => !!terminal)
-    .map(terminal => {
-      if (!terminal.spec.files) {
-        return terminal
-      }
+  return output(terminals.filter((terminal): terminal is NonNullable<UnitTerminal> => !!terminal))
+}
 
-      return {
-        ...terminal,
-
-        spec: {
-          ...terminal.spec,
-
-          files: pipe(
-            terminal.spec.files,
-            mapValues(file => {
-              if (typeof file === "string") {
-                return {
-                  meta: {
-                    name: "content",
-                    contentType: "text/plain",
-                    size: Buffer.byteLength(file, "utf8"),
-                  },
-                  content: {
-                    type: "embedded" as const,
-                    value: file,
-                  },
-                }
-              }
-
-              return file
-            }),
-            pickBy(value => !!value),
-          ),
-        },
+function mapTriggers(triggers: Unwrap<ExtraOutputs["$triggers"]>): Output<UnitTrigger[]> {
+  if (!triggers) {
+    return output([])
+  }
+
+  if (!Array.isArray(triggers)) {
+    triggers = Object.entries(triggers).map(([name, trigger]) => {
+      if (!trigger) {
+        return undefined
       }
+
+      return { ...trigger, name }
     })
+  }
+
+  return output(triggers.filter((trigger): trigger is NonNullable<UnitTrigger> => !!trigger))
 }
 
-function mapTriggers(triggers: Unwrap<ExtraOutputs["$triggers"]>): InstanceTrigger[] {
-  if (!triggers) {
-    return []
+function mapWorkers(workers: Unwrap<ExtraOutputs["$workers"]>): Output<Unwrap<UnitWorker>[]> {
+  if (!workers) {
+    return output([])
   }
 
-  if (Array.isArray(triggers)) {
-    return triggers.filter(trigger => !!trigger)
+  if (!Array.isArray(workers)) {
+    workers = Object.entries(workers).map(([name, worker]) => {
+      if (!worker) {
+        return undefined
+      }
+
+      return { ...worker, name }
+    })
   }
 
-  return Object.entries(triggers)
-    .filter(([, trigger]) => !!trigger)
-    .map(([name, trigger]) => ({ ...(trigger as InstanceTrigger), name }))
+  return output(workers.filter((worker): worker is NonNullable<Unwrap<UnitWorker>> => !!worker))
 }
 
 /**