@backstage/backend-app-api 0.6.0-next.2 → 0.6.0

package/dist/index.cjs.js

@@ -30,6 +30,7 @@ var cookie = require('cookie');
 var PromiseRouter = require('express-promise-router');
 var types = require('@backstage/types');
 var pathToRegexp = require('path-to-regexp');
+var expressRateLimit = require('express-rate-limit');
 var pluginAuthNode = require('@backstage/plugin-auth-node');
 var pluginPermissionNode = require('@backstage/plugin-permission-node');
 var express = require('express');
@@ -70,18 +71,18 @@ var PromiseRouter__default = /*#__PURE__*/_interopDefaultLegacy(PromiseRouter);
 var express__default = /*#__PURE__*/_interopDefaultLegacy(express);
 var trimEnd__default = /*#__PURE__*/_interopDefaultLegacy(trimEnd);
 
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => {
-  __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$1 = Object.defineProperty;
+var __defNormalProp$1 = (obj, key, value) => key in obj ? __defProp$1(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$1 = (obj, key, value) => {
+  __defNormalProp$1(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 class ObservableConfigProxy {
   constructor(parent, parentKey) {
     this.parent = parent;
     this.parentKey = parentKey;
-    __publicField(this, "config", new config.ConfigReader({}));
-    __publicField(this, "subscribers", []);
+    __publicField$1(this, "config", new config.ConfigReader({}));
+    __publicField$1(this, "subscribers", []);
     if (parent && !parentKey) {
       throw new Error("parentKey is required if parent is set");
     }
@@ -612,31 +613,31 @@ function applyInternalErrorFilter(error, logger) {
   return error;
 }
 
-var __accessCheck$a = (obj, member, msg) => {
+var __accessCheck$b = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$9 = (obj, member, getter) => {
-  __accessCheck$a(obj, member, "read from private field");
+var __privateGet$a = (obj, member, getter) => {
+  __accessCheck$b(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$a = (obj, member, value) => {
+var __privateAdd$b = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$9 = (obj, member, value, setter) => {
-  __accessCheck$a(obj, member, "write to private field");
+var __privateSet$a = (obj, member, value, setter) => {
+  __accessCheck$b(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
 var _config, _logger;
 const _MiddlewareFactory = class _MiddlewareFactory {
   constructor(options) {
-    __privateAdd$a(this, _config, void 0);
-    __privateAdd$a(this, _logger, void 0);
-    __privateSet$9(this, _config, options.config);
-    __privateSet$9(this, _logger, options.logger);
+    __privateAdd$b(this, _config, void 0);
+    __privateAdd$b(this, _logger, void 0);
+    __privateSet$a(this, _config, options.config);
+    __privateSet$a(this, _logger, options.logger);
   }
   /**
    * Creates a new {@link MiddlewareFactory}.
@@ -682,7 +683,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
    * @returns An Express request handler
    */
   logging() {
-    const logger = __privateGet$9(this, _logger).child({
+    const logger = __privateGet$a(this, _logger).child({
       type: "incomingRequest"
     });
     return morgan__default["default"]("combined", {
@@ -706,7 +707,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
    * @returns An Express request handler
    */
   helmet() {
-    return helmet__default["default"](readHelmetOptions(__privateGet$9(this, _config).getOptionalConfig("backend")));
+    return helmet__default["default"](readHelmetOptions(__privateGet$a(this, _config).getOptionalConfig("backend")));
   }
   /**
    * Returns a middleware that implements the cors library.
@@ -721,7 +722,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
    * @returns An Express request handler
    */
   cors() {
-    return cors__default["default"](readCorsOptions(__privateGet$9(this, _config).getOptionalConfig("backend")));
+    return cors__default["default"](readCorsOptions(__privateGet$a(this, _config).getOptionalConfig("backend")));
   }
   /**
    * Express middleware to handle errors during request processing.
@@ -746,7 +747,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
   error(options = {}) {
     var _a;
     const showStackTraces = (_a = options.showStackTraces) != null ? _a : process.env.NODE_ENV === "development";
-    const logger = __privateGet$9(this, _logger).child({
+    const logger = __privateGet$a(this, _logger).child({
       type: "errorHandler"
     });
     return (rawError, req, res, next) => {
@@ -805,31 +806,31 @@ const escapeRegExp = (text) => {
   return text.replace(/[.*+?^${}(\)|[\]\\]/g, "\\$&");
 };
 
-var __accessCheck$9 = (obj, member, msg) => {
+var __accessCheck$a = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$8 = (obj, member, getter) => {
-  __accessCheck$9(obj, member, "read from private field");
+var __privateGet$9 = (obj, member, getter) => {
+  __accessCheck$a(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$9 = (obj, member, value) => {
+var __privateAdd$a = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$8 = (obj, member, value, setter) => {
-  __accessCheck$9(obj, member, "write to private field");
+var __privateSet$9 = (obj, member, value, setter) => {
+  __accessCheck$a(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
 var _winston, _addRedactions;
 const _WinstonLogger = class _WinstonLogger {
   constructor(winston, addRedactions) {
-    __privateAdd$9(this, _winston, void 0);
-    __privateAdd$9(this, _addRedactions, void 0);
-    __privateSet$8(this, _winston, winston);
-    __privateSet$8(this, _addRedactions, addRedactions);
+    __privateAdd$a(this, _winston, void 0);
+    __privateAdd$a(this, _addRedactions, void 0);
+    __privateSet$9(this, _winston, winston);
+    __privateSet$9(this, _addRedactions, addRedactions);
   }
   /**
    * Creates a {@link WinstonLogger} instance.
@@ -914,44 +915,44 @@ const _WinstonLogger = class _WinstonLogger {
     );
   }
   error(message, meta) {
-    __privateGet$8(this, _winston).error(message, meta);
+    __privateGet$9(this, _winston).error(message, meta);
   }
   warn(message, meta) {
-    __privateGet$8(this, _winston).warn(message, meta);
+    __privateGet$9(this, _winston).warn(message, meta);
   }
   info(message, meta) {
-    __privateGet$8(this, _winston).info(message, meta);
+    __privateGet$9(this, _winston).info(message, meta);
   }
   debug(message, meta) {
-    __privateGet$8(this, _winston).debug(message, meta);
+    __privateGet$9(this, _winston).debug(message, meta);
   }
   child(meta) {
-    return new _WinstonLogger(__privateGet$8(this, _winston).child(meta));
+    return new _WinstonLogger(__privateGet$9(this, _winston).child(meta));
   }
   addRedactions(redactions) {
     var _a;
-    (_a = __privateGet$8(this, _addRedactions)) == null ? void 0 : _a.call(this, redactions);
+    (_a = __privateGet$9(this, _addRedactions)) == null ? void 0 : _a.call(this, redactions);
   }
 };
 _winston = new WeakMap();
 _addRedactions = new WeakMap();
 let WinstonLogger = _WinstonLogger;
 
-var __accessCheck$8 = (obj, member, msg) => {
+var __accessCheck$9 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$7 = (obj, member, getter) => {
-  __accessCheck$8(obj, member, "read from private field");
+var __privateGet$8 = (obj, member, getter) => {
+  __accessCheck$9(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$8 = (obj, member, value) => {
+var __privateAdd$9 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$7 = (obj, member, value, setter) => {
-  __accessCheck$8(obj, member, "write to private field");
+var __privateSet$8 = (obj, member, value, setter) => {
+  __accessCheck$9(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
@@ -959,25 +960,25 @@ var _hasStarted$1, _startupTasks$1, _hasShutdown, _shutdownTasks;
 class BackendLifecycleImpl {
   constructor(logger) {
     this.logger = logger;
-    __privateAdd$8(this, _hasStarted$1, false);
-    __privateAdd$8(this, _startupTasks$1, []);
-    __privateAdd$8(this, _hasShutdown, false);
-    __privateAdd$8(this, _shutdownTasks, []);
+    __privateAdd$9(this, _hasStarted$1, false);
+    __privateAdd$9(this, _startupTasks$1, []);
+    __privateAdd$9(this, _hasShutdown, false);
+    __privateAdd$9(this, _shutdownTasks, []);
   }
   addStartupHook(hook, options) {
-    if (__privateGet$7(this, _hasStarted$1)) {
+    if (__privateGet$8(this, _hasStarted$1)) {
       throw new Error("Attempted to add startup hook after startup");
     }
-    __privateGet$7(this, _startupTasks$1).push({ hook, options });
+    __privateGet$8(this, _startupTasks$1).push({ hook, options });
   }
   async startup() {
-    if (__privateGet$7(this, _hasStarted$1)) {
+    if (__privateGet$8(this, _hasStarted$1)) {
       return;
     }
-    __privateSet$7(this, _hasStarted$1, true);
-    this.logger.debug(`Running ${__privateGet$7(this, _startupTasks$1).length} startup tasks...`);
+    __privateSet$8(this, _hasStarted$1, true);
+    this.logger.debug(`Running ${__privateGet$8(this, _startupTasks$1).length} startup tasks...`);
     await Promise.all(
-      __privateGet$7(this, _startupTasks$1).map(async ({ hook, options }) => {
+      __privateGet$8(this, _startupTasks$1).map(async ({ hook, options }) => {
         var _a;
         const logger = (_a = options == null ? void 0 : options.logger) != null ? _a : this.logger;
         try {
@@ -990,21 +991,21 @@ class BackendLifecycleImpl {
     );
   }
   addShutdownHook(hook, options) {
-    if (__privateGet$7(this, _hasShutdown)) {
+    if (__privateGet$8(this, _hasShutdown)) {
       throw new Error("Attempted to add shutdown hook after shutdown");
     }
-    __privateGet$7(this, _shutdownTasks).push({ hook, options });
+    __privateGet$8(this, _shutdownTasks).push({ hook, options });
   }
   async shutdown() {
-    if (__privateGet$7(this, _hasShutdown)) {
+    if (__privateGet$8(this, _hasShutdown)) {
       return;
     }
-    __privateSet$7(this, _hasShutdown, true);
+    __privateSet$8(this, _hasShutdown, true);
     this.logger.debug(
-      `Running ${__privateGet$7(this, _shutdownTasks).length} shutdown tasks...`
+      `Running ${__privateGet$8(this, _shutdownTasks).length} shutdown tasks...`
     );
     await Promise.all(
-      __privateGet$7(this, _shutdownTasks).map(async ({ hook, options }) => {
+      __privateGet$8(this, _shutdownTasks).map(async ({ hook, options }) => {
         var _a;
         const logger = (_a = options == null ? void 0 : options.logger) != null ? _a : this.logger;
         try {
@@ -1031,21 +1032,21 @@ const rootLifecycleServiceFactory = backendPluginApi.createServiceFactory({
   }
 });
 
-var __accessCheck$7 = (obj, member, msg) => {
+var __accessCheck$8 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$6 = (obj, member, getter) => {
-  __accessCheck$7(obj, member, "read from private field");
+var __privateGet$7 = (obj, member, getter) => {
+  __accessCheck$8(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$7 = (obj, member, value) => {
+var __privateAdd$8 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$6 = (obj, member, value, setter) => {
-  __accessCheck$7(obj, member, "write to private field");
+var __privateSet$7 = (obj, member, value, setter) => {
+  __accessCheck$8(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
@@ -1055,25 +1056,25 @@ class BackendPluginLifecycleImpl {
     this.logger = logger;
     this.rootLifecycle = rootLifecycle;
     this.pluginMetadata = pluginMetadata;
-    __privateAdd$7(this, _hasStarted, false);
-    __privateAdd$7(this, _startupTasks, []);
+    __privateAdd$8(this, _hasStarted, false);
+    __privateAdd$8(this, _startupTasks, []);
   }
   addStartupHook(hook, options) {
-    if (__privateGet$6(this, _hasStarted)) {
+    if (__privateGet$7(this, _hasStarted)) {
       throw new Error("Attempted to add startup hook after startup");
     }
-    __privateGet$6(this, _startupTasks).push({ hook, options });
+    __privateGet$7(this, _startupTasks).push({ hook, options });
   }
   async startup() {
-    if (__privateGet$6(this, _hasStarted)) {
+    if (__privateGet$7(this, _hasStarted)) {
       return;
     }
-    __privateSet$6(this, _hasStarted, true);
+    __privateSet$7(this, _hasStarted, true);
     this.logger.debug(
-      `Running ${__privateGet$6(this, _startupTasks).length} plugin startup tasks...`
+      `Running ${__privateGet$7(this, _startupTasks).length} plugin startup tasks...`
     );
     await Promise.all(
-      __privateGet$6(this, _startupTasks).map(async ({ hook, options }) => {
+      __privateGet$7(this, _startupTasks).map(async ({ hook, options }) => {
         var _a;
         const logger = (_a = options == null ? void 0 : options.logger) != null ? _a : this.logger;
         try {
@@ -1111,26 +1112,26 @@ const lifecycleServiceFactory = backendPluginApi.createServiceFactory({
   }
 });
 
-var __accessCheck$6 = (obj, member, msg) => {
+var __accessCheck$7 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$5 = (obj, member, getter) => {
-  __accessCheck$6(obj, member, "read from private field");
+var __privateGet$6 = (obj, member, getter) => {
+  __accessCheck$7(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$6 = (obj, member, value) => {
+var __privateAdd$7 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$5 = (obj, member, value, setter) => {
-  __accessCheck$6(obj, member, "write to private field");
+var __privateSet$6 = (obj, member, value, setter) => {
+  __accessCheck$7(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
-var __privateMethod$5 = (obj, member, method) => {
-  __accessCheck$6(obj, member, "access private method");
+var __privateMethod$6 = (obj, member, method) => {
+  __accessCheck$7(obj, member, "access private method");
   return method;
 };
 var _nodeIds, _cycleKeys, _getCycleKey, getCycleKey_fn, _nodes, _allProvided;
@@ -1150,21 +1151,21 @@ class Node {
 }
 const _CycleKeySet = class _CycleKeySet {
   constructor(nodes) {
-    __privateAdd$6(this, _getCycleKey);
-    __privateAdd$6(this, _nodeIds, void 0);
-    __privateAdd$6(this, _cycleKeys, void 0);
-    __privateSet$5(this, _nodeIds, new Map(nodes.map((n, i) => [n.value, i])));
-    __privateSet$5(this, _cycleKeys, /* @__PURE__ */ new Set());
+    __privateAdd$7(this, _getCycleKey);
+    __privateAdd$7(this, _nodeIds, void 0);
+    __privateAdd$7(this, _cycleKeys, void 0);
+    __privateSet$6(this, _nodeIds, new Map(nodes.map((n, i) => [n.value, i])));
+    __privateSet$6(this, _cycleKeys, /* @__PURE__ */ new Set());
   }
   static from(nodes) {
     return new _CycleKeySet(nodes);
   }
   tryAdd(path) {
-    const cycleKey = __privateMethod$5(this, _getCycleKey, getCycleKey_fn).call(this, path);
-    if (__privateGet$5(this, _cycleKeys).has(cycleKey)) {
+    const cycleKey = __privateMethod$6(this, _getCycleKey, getCycleKey_fn).call(this, path);
+    if (__privateGet$6(this, _cycleKeys).has(cycleKey)) {
       return false;
     }
-    __privateGet$5(this, _cycleKeys).add(cycleKey);
+    __privateGet$6(this, _cycleKeys).add(cycleKey);
     return true;
   }
 };
@@ -1172,18 +1173,18 @@ _nodeIds = new WeakMap();
 _cycleKeys = new WeakMap();
 _getCycleKey = new WeakSet();
 getCycleKey_fn = function(path) {
-  return path.map((n) => __privateGet$5(this, _nodeIds).get(n)).sort().join(",");
+  return path.map((n) => __privateGet$6(this, _nodeIds).get(n)).sort().join(",");
 };
 let CycleKeySet = _CycleKeySet;
 const _DependencyGraph = class _DependencyGraph {
   constructor(nodes) {
-    __privateAdd$6(this, _nodes, void 0);
-    __privateAdd$6(this, _allProvided, void 0);
-    __privateSet$5(this, _nodes, nodes);
-    __privateSet$5(this, _allProvided, /* @__PURE__ */ new Set());
-    for (const node of __privateGet$5(this, _nodes).values()) {
+    __privateAdd$7(this, _nodes, void 0);
+    __privateAdd$7(this, _allProvided, void 0);
+    __privateSet$6(this, _nodes, nodes);
+    __privateSet$6(this, _allProvided, /* @__PURE__ */ new Set());
+    for (const node of __privateGet$6(this, _nodes).values()) {
       for (const produced of node.provides) {
-        __privateGet$5(this, _allProvided).add(produced);
+        __privateGet$6(this, _allProvided).add(produced);
       }
     }
   }
@@ -1207,9 +1208,9 @@ const _DependencyGraph = class _DependencyGraph {
    */
   findUnsatisfiedDeps() {
     const unsatisfiedDependencies = [];
-    for (const node of __privateGet$5(this, _nodes).values()) {
+    for (const node of __privateGet$6(this, _nodes).values()) {
       const unsatisfied = Array.from(node.consumes).filter(
-        (id) => !__privateGet$5(this, _allProvided).has(id)
+        (id) => !__privateGet$6(this, _allProvided).has(id)
       );
       if (unsatisfied.length > 0) {
         unsatisfiedDependencies.push({ value: node.value, unsatisfied });
@@ -1229,8 +1230,8 @@ const _DependencyGraph = class _DependencyGraph {
    * form a cycle, with the same node as the first and last element of the array.
    */
   *detectCircularDependencies() {
-    const cycleKeys = CycleKeySet.from(__privateGet$5(this, _nodes));
-    for (const startNode of __privateGet$5(this, _nodes)) {
+    const cycleKeys = CycleKeySet.from(__privateGet$6(this, _nodes));
+    for (const startNode of __privateGet$6(this, _nodes)) {
       const visited = /* @__PURE__ */ new Set();
       const stack = new Array([
         startNode,
@@ -1243,7 +1244,7 @@ const _DependencyGraph = class _DependencyGraph {
         }
         visited.add(node);
         for (const consumed of node.consumes) {
-          const providerNodes = __privateGet$5(this, _nodes).filter(
+          const providerNodes = __privateGet$6(this, _nodes).filter(
             (other) => other.provides.has(consumed)
           );
           for (const provider of providerNodes) {
@@ -1272,9 +1273,9 @@ const _DependencyGraph = class _DependencyGraph {
    * Dependencies of nodes that are not produced by any other nodes will be ignored.
    */
   async parallelTopologicalTraversal(fn) {
-    const allProvided = __privateGet$5(this, _allProvided);
+    const allProvided = __privateGet$6(this, _allProvided);
     const producedSoFar = /* @__PURE__ */ new Set();
-    const waiting = new Set(__privateGet$5(this, _nodes).values());
+    const waiting = new Set(__privateGet$6(this, _nodes).values());
     const visited = /* @__PURE__ */ new Set();
     const results = new Array();
     let inFlight = 0;
@@ -1320,26 +1321,26 @@ _nodes = new WeakMap();
 _allProvided = new WeakMap();
 let DependencyGraph = _DependencyGraph;
 
-var __accessCheck$5 = (obj, member, msg) => {
+var __accessCheck$6 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$4 = (obj, member, getter) => {
-  __accessCheck$5(obj, member, "read from private field");
+var __privateGet$5 = (obj, member, getter) => {
+  __accessCheck$6(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$5 = (obj, member, value) => {
+var __privateAdd$6 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$4 = (obj, member, value, setter) => {
-  __accessCheck$5(obj, member, "write to private field");
+var __privateSet$5 = (obj, member, value, setter) => {
+  __accessCheck$6(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
-var __privateMethod$4 = (obj, member, method) => {
-  __accessCheck$5(obj, member, "access private method");
+var __privateMethod$5 = (obj, member, method) => {
+  __accessCheck$6(obj, member, "access private method");
   return method;
 };
 var _providedFactories, _loadedDefaultFactories, _implementations, _rootServiceImplementations, _addedFactoryIds, _instantiatedFactories, _resolveFactory, resolveFactory_fn, _checkForMissingDeps, checkForMissingDeps_fn;
@@ -1362,19 +1363,19 @@ const pluginMetadataServiceFactory = backendPluginApi.createServiceFactory(
 );
 const _ServiceRegistry = class _ServiceRegistry {
   constructor(factories) {
-    __privateAdd$5(this, _resolveFactory);
-    __privateAdd$5(this, _checkForMissingDeps);
-    __privateAdd$5(this, _providedFactories, void 0);
-    __privateAdd$5(this, _loadedDefaultFactories, void 0);
-    __privateAdd$5(this, _implementations, void 0);
-    __privateAdd$5(this, _rootServiceImplementations, /* @__PURE__ */ new Map());
-    __privateAdd$5(this, _addedFactoryIds, /* @__PURE__ */ new Set());
-    __privateAdd$5(this, _instantiatedFactories, /* @__PURE__ */ new Set());
-    __privateSet$4(this, _providedFactories, new Map(
+    __privateAdd$6(this, _resolveFactory);
+    __privateAdd$6(this, _checkForMissingDeps);
+    __privateAdd$6(this, _providedFactories, void 0);
+    __privateAdd$6(this, _loadedDefaultFactories, void 0);
+    __privateAdd$6(this, _implementations, void 0);
+    __privateAdd$6(this, _rootServiceImplementations, /* @__PURE__ */ new Map());
+    __privateAdd$6(this, _addedFactoryIds, /* @__PURE__ */ new Set());
+    __privateAdd$6(this, _instantiatedFactories, /* @__PURE__ */ new Set());
+    __privateSet$5(this, _providedFactories, new Map(
       factories.map((sf) => [sf.service.id, toInternalServiceFactory(sf)])
     ));
-    __privateSet$4(this, _loadedDefaultFactories, /* @__PURE__ */ new Map());
-    __privateSet$4(this, _implementations, /* @__PURE__ */ new Map());
+    __privateSet$5(this, _loadedDefaultFactories, /* @__PURE__ */ new Map());
+    __privateSet$5(this, _implementations, /* @__PURE__ */ new Map());
   }
   static create(factories) {
     const registry = new _ServiceRegistry(factories);
@@ -1383,7 +1384,7 @@ const _ServiceRegistry = class _ServiceRegistry {
   }
   checkForCircularDeps() {
     const graph = DependencyGraph.fromIterable(
-      Array.from(__privateGet$4(this, _providedFactories)).map(
+      Array.from(__privateGet$5(this, _providedFactories)).map(
         ([serviceId, serviceFactory]) => ({
           value: serviceId,
           provides: [serviceId],
@@ -1405,30 +1406,30 @@ const _ServiceRegistry = class _ServiceRegistry {
         `The ${backendPluginApi.coreServices.pluginMetadata.id} service cannot be overridden`
       );
     }
-    if (__privateGet$4(this, _addedFactoryIds).has(factoryId)) {
+    if (__privateGet$5(this, _addedFactoryIds).has(factoryId)) {
       throw new Error(
         `Duplicate service implementations provided for ${factoryId}`
       );
     }
-    if (__privateGet$4(this, _instantiatedFactories).has(factoryId)) {
+    if (__privateGet$5(this, _instantiatedFactories).has(factoryId)) {
       throw new Error(
         `Unable to set service factory with id ${factoryId}, service has already been instantiated`
       );
     }
-    __privateGet$4(this, _addedFactoryIds).add(factoryId);
-    __privateGet$4(this, _providedFactories).set(factoryId, toInternalServiceFactory(factory));
+    __privateGet$5(this, _addedFactoryIds).add(factoryId);
+    __privateGet$5(this, _providedFactories).set(factoryId, toInternalServiceFactory(factory));
   }
   getServiceRefs() {
-    return Array.from(__privateGet$4(this, _providedFactories).values()).map((f) => f.service);
+    return Array.from(__privateGet$5(this, _providedFactories).values()).map((f) => f.service);
   }
   get(ref, pluginId) {
     var _a;
-    __privateGet$4(this, _instantiatedFactories).add(ref.id);
-    return (_a = __privateMethod$4(this, _resolveFactory, resolveFactory_fn).call(this, ref, pluginId)) == null ? void 0 : _a.then((factory) => {
+    __privateGet$5(this, _instantiatedFactories).add(ref.id);
+    return (_a = __privateMethod$5(this, _resolveFactory, resolveFactory_fn).call(this, ref, pluginId)) == null ? void 0 : _a.then((factory) => {
       if (factory.service.scope === "root") {
-        let existing = __privateGet$4(this, _rootServiceImplementations).get(factory);
+        let existing = __privateGet$5(this, _rootServiceImplementations).get(factory);
         if (!existing) {
-          __privateMethod$4(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
+          __privateMethod$5(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
           const rootDeps = new Array();
           for (const [name, serviceRef] of Object.entries(factory.deps)) {
             if (serviceRef.scope !== "root") {
@@ -1442,13 +1443,13 @@ const _ServiceRegistry = class _ServiceRegistry {
           existing = Promise.all(rootDeps).then(
             (entries) => factory.factory(Object.fromEntries(entries), void 0)
           );
-          __privateGet$4(this, _rootServiceImplementations).set(factory, existing);
+          __privateGet$5(this, _rootServiceImplementations).set(factory, existing);
         }
         return existing;
       }
-      let implementation = __privateGet$4(this, _implementations).get(factory);
+      let implementation = __privateGet$5(this, _implementations).get(factory);
       if (!implementation) {
-        __privateMethod$4(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
+        __privateMethod$5(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
         const rootDeps = new Array();
         for (const [name, serviceRef] of Object.entries(factory.deps)) {
           if (serviceRef.scope === "root") {
@@ -1470,7 +1471,7 @@ const _ServiceRegistry = class _ServiceRegistry {
           }),
           byPlugin: /* @__PURE__ */ new Map()
         };
-        __privateGet$4(this, _implementations).set(factory, implementation);
+        __privateGet$5(this, _implementations).set(factory, implementation);
       }
       let result = implementation.byPlugin.get(pluginId);
       if (!result) {
@@ -1508,18 +1509,18 @@ resolveFactory_fn = function(ref, pluginId) {
       toInternalServiceFactory(pluginMetadataServiceFactory({ pluginId }))
     );
   }
-  let resolvedFactory = __privateGet$4(this, _providedFactories).get(ref.id);
+  let resolvedFactory = __privateGet$5(this, _providedFactories).get(ref.id);
   const { __defaultFactory: defaultFactory } = ref;
   if (!resolvedFactory && !defaultFactory) {
     return void 0;
   }
   if (!resolvedFactory) {
-    let loadedFactory = __privateGet$4(this, _loadedDefaultFactories).get(defaultFactory);
+    let loadedFactory = __privateGet$5(this, _loadedDefaultFactories).get(defaultFactory);
     if (!loadedFactory) {
       loadedFactory = Promise.resolve().then(() => defaultFactory(ref)).then(
         (f) => toInternalServiceFactory(typeof f === "function" ? f() : f)
       );
-      __privateGet$4(this, _loadedDefaultFactories).set(defaultFactory, loadedFactory);
+      __privateGet$5(this, _loadedDefaultFactories).set(defaultFactory, loadedFactory);
     }
     resolvedFactory = loadedFactory.catch((error) => {
       throw new Error(
@@ -1537,7 +1538,7 @@ checkForMissingDeps_fn = function(factory, pluginId) {
     if (ref.id === backendPluginApi.coreServices.pluginMetadata.id) {
       return false;
     }
-    if (__privateGet$4(this, _providedFactories).get(ref.id)) {
+    if (__privateGet$5(this, _providedFactories).get(ref.id)) {
       return false;
     }
     return !ref.__defaultFactory;
@@ -1551,52 +1552,52 @@ checkForMissingDeps_fn = function(factory, pluginId) {
 };
 let ServiceRegistry = _ServiceRegistry;
 
-var __accessCheck$4 = (obj, member, msg) => {
+var __accessCheck$5 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$3 = (obj, member, getter) => {
-  __accessCheck$4(obj, member, "read from private field");
+var __privateGet$4 = (obj, member, getter) => {
+  __accessCheck$5(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$4 = (obj, member, value) => {
+var __privateAdd$5 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$3 = (obj, member, value, setter) => {
-  __accessCheck$4(obj, member, "write to private field");
+var __privateSet$4 = (obj, member, value, setter) => {
+  __accessCheck$5(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
-var __privateMethod$3 = (obj, member, method) => {
-  __accessCheck$4(obj, member, "access private method");
+var __privateMethod$4 = (obj, member, method) => {
+  __accessCheck$5(obj, member, "access private method");
   return method;
 };
 var _startPromise, _features, _extensionPoints, _serviceRegistry, _registeredFeatures, _getInitDeps, getInitDeps_fn, _addFeature, addFeature_fn, _doStart, doStart_fn, _getRootLifecycleImpl, getRootLifecycleImpl_fn, _getPluginLifecycleImpl, getPluginLifecycleImpl_fn;
 class BackendInitializer {
   constructor(defaultApiFactories) {
-    __privateAdd$4(this, _getInitDeps);
-    __privateAdd$4(this, _addFeature);
-    __privateAdd$4(this, _doStart);
+    __privateAdd$5(this, _getInitDeps);
+    __privateAdd$5(this, _addFeature);
+    __privateAdd$5(this, _doStart);
     // Bit of a hacky way to grab the lifecycle services, potentially find a nicer way to do this
-    __privateAdd$4(this, _getRootLifecycleImpl);
-    __privateAdd$4(this, _getPluginLifecycleImpl);
-    __privateAdd$4(this, _startPromise, void 0);
-    __privateAdd$4(this, _features, new Array());
-    __privateAdd$4(this, _extensionPoints, /* @__PURE__ */ new Map());
-    __privateAdd$4(this, _serviceRegistry, void 0);
-    __privateAdd$4(this, _registeredFeatures, new Array());
-    __privateSet$3(this, _serviceRegistry, ServiceRegistry.create([...defaultApiFactories]));
+    __privateAdd$5(this, _getRootLifecycleImpl);
+    __privateAdd$5(this, _getPluginLifecycleImpl);
+    __privateAdd$5(this, _startPromise, void 0);
+    __privateAdd$5(this, _features, new Array());
+    __privateAdd$5(this, _extensionPoints, /* @__PURE__ */ new Map());
+    __privateAdd$5(this, _serviceRegistry, void 0);
+    __privateAdd$5(this, _registeredFeatures, new Array());
+    __privateSet$4(this, _serviceRegistry, ServiceRegistry.create([...defaultApiFactories]));
   }
   add(feature) {
-    if (__privateGet$3(this, _startPromise)) {
+    if (__privateGet$4(this, _startPromise)) {
       throw new Error("feature can not be added after the backend has started");
     }
-    __privateGet$3(this, _registeredFeatures).push(Promise.resolve(feature));
+    __privateGet$4(this, _registeredFeatures).push(Promise.resolve(feature));
   }
   async start() {
-    if (__privateGet$3(this, _startPromise)) {
+    if (__privateGet$4(this, _startPromise)) {
       throw new Error("Backend has already started");
     }
     const exitHandler = async () => {
@@ -1614,18 +1615,18 @@ class BackendInitializer {
     process.addListener("SIGTERM", exitHandler);
     process.addListener("SIGINT", exitHandler);
     process.addListener("beforeExit", exitHandler);
-    __privateSet$3(this, _startPromise, __privateMethod$3(this, _doStart, doStart_fn).call(this));
-    await __privateGet$3(this, _startPromise);
+    __privateSet$4(this, _startPromise, __privateMethod$4(this, _doStart, doStart_fn).call(this));
+    await __privateGet$4(this, _startPromise);
   }
   async stop() {
-    if (!__privateGet$3(this, _startPromise)) {
+    if (!__privateGet$4(this, _startPromise)) {
       return;
     }
     try {
-      await __privateGet$3(this, _startPromise);
+      await __privateGet$4(this, _startPromise);
     } catch (error) {
     }
-    const lifecycleService = await __privateMethod$3(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
+    const lifecycleService = await __privateMethod$4(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
     await lifecycleService.shutdown();
   }
 }
@@ -1639,7 +1640,7 @@ getInitDeps_fn = async function(deps, pluginId, moduleId) {
   const result = /* @__PURE__ */ new Map();
   const missingRefs = /* @__PURE__ */ new Set();
   for (const [name, ref] of Object.entries(deps)) {
-    const ep = __privateGet$3(this, _extensionPoints).get(ref.id);
+    const ep = __privateGet$4(this, _extensionPoints).get(ref.id);
     if (ep) {
       if (ep.pluginId !== pluginId) {
         throw new Error(
@@ -1648,7 +1649,7 @@ getInitDeps_fn = async function(deps, pluginId, moduleId) {
       }
       result.set(name, ep.impl);
     } else {
-      const impl = await __privateGet$3(this, _serviceRegistry).get(
+      const impl = await __privateGet$4(this, _serviceRegistry).get(
         ref,
         pluginId
       );
@@ -1675,14 +1676,14 @@ addFeature_fn = function(feature) {
     );
   }
   if (isServiceFactory(feature)) {
-    __privateGet$3(this, _serviceRegistry).add(feature);
+    __privateGet$4(this, _serviceRegistry).add(feature);
   } else if (isInternalBackendFeature(feature)) {
     if (feature.version !== "v1") {
       throw new Error(
         `Failed to add feature, invalid version '${feature.version}'`
       );
     }
-    __privateGet$3(this, _features).push(feature);
+    __privateGet$4(this, _features).push(feature);
   } else {
     throw new Error(
       `Failed to add feature, invalid feature ${JSON.stringify(feature)}`
@@ -1691,39 +1692,39 @@ addFeature_fn = function(feature) {
 };
 _doStart = new WeakSet();
 doStart_fn = async function() {
-  __privateGet$3(this, _serviceRegistry).checkForCircularDeps();
-  for (const feature of __privateGet$3(this, _registeredFeatures)) {
-    __privateMethod$3(this, _addFeature, addFeature_fn).call(this, await feature);
+  __privateGet$4(this, _serviceRegistry).checkForCircularDeps();
+  for (const feature of __privateGet$4(this, _registeredFeatures)) {
+    __privateMethod$4(this, _addFeature, addFeature_fn).call(this, await feature);
   }
-  const featureDiscovery = await __privateGet$3(this, _serviceRegistry).get(
+  const featureDiscovery = await __privateGet$4(this, _serviceRegistry).get(
     alpha.featureDiscoveryServiceRef,
     "root"
   );
   if (featureDiscovery) {
     const { features } = await featureDiscovery.getBackendFeatures();
     for (const feature of features) {
-      __privateMethod$3(this, _addFeature, addFeature_fn).call(this, feature);
+      __privateMethod$4(this, _addFeature, addFeature_fn).call(this, feature);
     }
-    __privateGet$3(this, _serviceRegistry).checkForCircularDeps();
+    __privateGet$4(this, _serviceRegistry).checkForCircularDeps();
   }
-  for (const ref of __privateGet$3(this, _serviceRegistry).getServiceRefs()) {
+  for (const ref of __privateGet$4(this, _serviceRegistry).getServiceRefs()) {
     if (ref.scope === "root") {
-      await __privateGet$3(this, _serviceRegistry).get(ref, "root");
+      await __privateGet$4(this, _serviceRegistry).get(ref, "root");
     }
   }
   const pluginInits = /* @__PURE__ */ new Map();
   const moduleInits = /* @__PURE__ */ new Map();
-  for (const feature of __privateGet$3(this, _features)) {
+  for (const feature of __privateGet$4(this, _features)) {
     for (const r of feature.getRegistrations()) {
       const provides = /* @__PURE__ */ new Set();
       if (r.type === "plugin" || r.type === "module") {
         for (const [extRef, extImpl] of r.extensionPoints) {
-          if (__privateGet$3(this, _extensionPoints).has(extRef.id)) {
+          if (__privateGet$4(this, _extensionPoints).has(extRef.id)) {
             throw new Error(
               `ExtensionPoint with ID '${extRef.id}' is already registered`
             );
           }
-          __privateGet$3(this, _extensionPoints).set(extRef.id, {
+          __privateGet$4(this, _extensionPoints).set(extRef.id, {
             impl: extImpl,
             pluginId: r.pluginId
           });
@@ -1783,7 +1784,7 @@ doStart_fn = async function() {
         }
         await tree.parallelTopologicalTraversal(
           async ({ moduleId, moduleInit }) => {
-            const moduleDeps = await __privateMethod$3(this, _getInitDeps, getInitDeps_fn).call(this, moduleInit.init.deps, pluginId, moduleId);
+            const moduleDeps = await __privateMethod$4(this, _getInitDeps, getInitDeps_fn).call(this, moduleInit.init.deps, pluginId, moduleId);
             await moduleInit.init.func(moduleDeps).catch((error) => {
               throw new errors.ForwardedError(
                 `Module '${moduleId}' for plugin '${pluginId}' startup failed`,
@@ -1795,7 +1796,7 @@ doStart_fn = async function() {
       }
       const pluginInit = pluginInits.get(pluginId);
       if (pluginInit) {
-        const pluginDeps = await __privateMethod$3(this, _getInitDeps, getInitDeps_fn).call(this, pluginInit.init.deps, pluginId);
+        const pluginDeps = await __privateMethod$4(this, _getInitDeps, getInitDeps_fn).call(this, pluginInit.init.deps, pluginId);
         await pluginInit.init.func(pluginDeps).catch((error) => {
           throw new errors.ForwardedError(
             `Plugin '${pluginId}' startup failed`,
@@ -1803,14 +1804,14 @@ doStart_fn = async function() {
           );
         });
       }
-      const lifecycleService2 = await __privateMethod$3(this, _getPluginLifecycleImpl, getPluginLifecycleImpl_fn).call(this, pluginId);
+      const lifecycleService2 = await __privateMethod$4(this, _getPluginLifecycleImpl, getPluginLifecycleImpl_fn).call(this, pluginId);
       await lifecycleService2.startup();
     })
   );
-  const lifecycleService = await __privateMethod$3(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
+  const lifecycleService = await __privateMethod$4(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
   await lifecycleService.startup();
   if (process.env.NODE_ENV !== "test") {
-    const rootLogger = await __privateGet$3(this, _serviceRegistry).get(
+    const rootLogger = await __privateGet$4(this, _serviceRegistry).get(
       backendPluginApi.coreServices.rootLogger,
       "root"
     );
@@ -1826,7 +1827,7 @@ doStart_fn = async function() {
 };
 _getRootLifecycleImpl = new WeakSet();
 getRootLifecycleImpl_fn = async function() {
-  const lifecycleService = await __privateGet$3(this, _serviceRegistry).get(
+  const lifecycleService = await __privateGet$4(this, _serviceRegistry).get(
     backendPluginApi.coreServices.rootLifecycle,
     "root"
   );
@@ -1837,7 +1838,7 @@ getRootLifecycleImpl_fn = async function() {
 };
 _getPluginLifecycleImpl = new WeakSet();
 getPluginLifecycleImpl_fn = async function(pluginId) {
-  const lifecycleService = await __privateGet$3(this, _serviceRegistry).get(
+  const lifecycleService = await __privateGet$4(this, _serviceRegistry).get(
     backendPluginApi.coreServices.lifecycle,
     pluginId
   );
@@ -1853,42 +1854,42 @@ function isInternalBackendFeature(feature) {
   return typeof feature.getRegistrations === "function";
 }
 
-var __accessCheck$3 = (obj, member, msg) => {
+var __accessCheck$4 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$2 = (obj, member, getter) => {
-  __accessCheck$3(obj, member, "read from private field");
+var __privateGet$3 = (obj, member, getter) => {
+  __accessCheck$4(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$3 = (obj, member, value) => {
+var __privateAdd$4 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$2 = (obj, member, value, setter) => {
-  __accessCheck$3(obj, member, "write to private field");
+var __privateSet$3 = (obj, member, value, setter) => {
+  __accessCheck$4(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
 var _initializer;
 class BackstageBackend {
   constructor(defaultServiceFactories) {
-    __privateAdd$3(this, _initializer, void 0);
-    __privateSet$2(this, _initializer, new BackendInitializer(defaultServiceFactories));
+    __privateAdd$4(this, _initializer, void 0);
+    __privateSet$3(this, _initializer, new BackendInitializer(defaultServiceFactories));
   }
   add(feature) {
     if (isPromise(feature)) {
-      __privateGet$2(this, _initializer).add(feature.then((f) => unwrapFeature(f.default)));
+      __privateGet$3(this, _initializer).add(feature.then((f) => unwrapFeature(f.default)));
     } else {
-      __privateGet$2(this, _initializer).add(unwrapFeature(feature));
+      __privateGet$3(this, _initializer).add(unwrapFeature(feature));
     }
   }
   async start() {
-    await __privateGet$2(this, _initializer).start();
+    await __privateGet$3(this, _initializer).start();
   }
   async stop() {
-    await __privateGet$2(this, _initializer).stop();
+    await __privateGet$3(this, _initializer).stop();
   }
 }
 _initializer = new WeakMap();
@@ -1934,17 +1935,17 @@ function createSpecializedBackend(options) {
   return new BackstageBackend(services);
 }
 
-var __accessCheck$2 = (obj, member, msg) => {
+var __accessCheck$3 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateAdd$2 = (obj, member, value) => {
+var __privateAdd$3 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateMethod$2 = (obj, member, method) => {
-  __accessCheck$2(obj, member, "access private method");
+var __privateMethod$3 = (obj, member, method) => {
+  __accessCheck$3(obj, member, "access private method");
   return method;
 };
 var _getJwtExpiration, getJwtExpiration_fn;
@@ -1998,7 +1999,7 @@ class DefaultAuthService {
     this.identity = identity;
     this.pluginId = pluginId;
     this.disableDefaultAuthPolicy = disableDefaultAuthPolicy;
-    __privateAdd$2(this, _getJwtExpiration);
+    __privateAdd$3(this, _getJwtExpiration);
   }
   // allowLimitedAccess is currently ignored, since we currently always use the full user tokens
   async authenticate(token) {
@@ -2018,7 +2019,7 @@ class DefaultAuthService {
     return createCredentialsWithUserPrincipal(
       identity.identity.userEntityRef,
       token,
-      __privateMethod$2(this, _getJwtExpiration, getJwtExpiration_fn).call(this, token)
+      __privateMethod$3(this, _getJwtExpiration, getJwtExpiration_fn).call(this, token)
     );
   }
   isPrincipal(credentials, type) {
@@ -2065,7 +2066,7 @@ class DefaultAuthService {
         "User credentials is unexpectedly missing token"
       );
     }
-    return { token, expiresAt: __privateMethod$2(this, _getJwtExpiration, getJwtExpiration_fn).call(this, token) };
+    return { token, expiresAt: __privateMethod$3(this, _getJwtExpiration, getJwtExpiration_fn).call(this, token) };
   }
 }
 _getJwtExpiration = new WeakSet();
@@ -2249,26 +2250,26 @@ const discoveryServiceFactory = backendPluginApi.createServiceFactory({
   }
 });
 
-var __accessCheck$1 = (obj, member, msg) => {
+var __accessCheck$2 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$1 = (obj, member, getter) => {
-  __accessCheck$1(obj, member, "read from private field");
+var __privateGet$2 = (obj, member, getter) => {
+  __accessCheck$2(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$1 = (obj, member, value) => {
+var __privateAdd$2 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$1 = (obj, member, value, setter) => {
-  __accessCheck$1(obj, member, "write to private field");
+var __privateSet$2 = (obj, member, value, setter) => {
+  __accessCheck$2(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
-var __privateMethod$1 = (obj, member, method) => {
-  __accessCheck$1(obj, member, "access private method");
+var __privateMethod$2 = (obj, member, method) => {
+  __accessCheck$2(obj, member, "access private method");
   return method;
 };
 var _auth, _discovery, _pluginId, _extractCredentialsFromRequest, extractCredentialsFromRequest_fn, _extractLimitedCredentialsFromRequest, extractLimitedCredentialsFromRequest_fn, _getCredentials, getCredentials_fn, _getLimitedCredentials, getLimitedCredentials_fn, _existingCookieExpiration, existingCookieExpiration_fn;
@@ -2303,37 +2304,37 @@ const credentialsSymbol = Symbol("backstage-credentials");
 const limitedCredentialsSymbol = Symbol("backstage-limited-credentials");
 class DefaultHttpAuthService {
   constructor(auth, discovery, pluginId) {
-    __privateAdd$1(this, _extractCredentialsFromRequest);
-    __privateAdd$1(this, _extractLimitedCredentialsFromRequest);
-    __privateAdd$1(this, _getCredentials);
-    __privateAdd$1(this, _getLimitedCredentials);
-    __privateAdd$1(this, _existingCookieExpiration);
-    __privateAdd$1(this, _auth, void 0);
-    __privateAdd$1(this, _discovery, void 0);
-    __privateAdd$1(this, _pluginId, void 0);
-    __privateSet$1(this, _auth, auth);
-    __privateSet$1(this, _discovery, discovery);
-    __privateSet$1(this, _pluginId, pluginId);
+    __privateAdd$2(this, _extractCredentialsFromRequest);
+    __privateAdd$2(this, _extractLimitedCredentialsFromRequest);
+    __privateAdd$2(this, _getCredentials);
+    __privateAdd$2(this, _getLimitedCredentials);
+    __privateAdd$2(this, _existingCookieExpiration);
+    __privateAdd$2(this, _auth, void 0);
+    __privateAdd$2(this, _discovery, void 0);
+    __privateAdd$2(this, _pluginId, void 0);
+    __privateSet$2(this, _auth, auth);
+    __privateSet$2(this, _discovery, discovery);
+    __privateSet$2(this, _pluginId, pluginId);
   }
   async credentials(req, options) {
-    const credentials = (options == null ? void 0 : options.allowLimitedAccess) ? await __privateMethod$1(this, _getLimitedCredentials, getLimitedCredentials_fn).call(this, req) : await __privateMethod$1(this, _getCredentials, getCredentials_fn).call(this, req);
+    const credentials = (options == null ? void 0 : options.allowLimitedAccess) ? await __privateMethod$2(this, _getLimitedCredentials, getLimitedCredentials_fn).call(this, req) : await __privateMethod$2(this, _getCredentials, getCredentials_fn).call(this, req);
     const allowed = options == null ? void 0 : options.allow;
     if (!allowed) {
       return credentials;
     }
-    if (__privateGet$1(this, _auth).isPrincipal(credentials, "none")) {
+    if (__privateGet$2(this, _auth).isPrincipal(credentials, "none")) {
       if (allowed.includes("none")) {
         return credentials;
       }
       throw new errors.AuthenticationError("Missing credentials");
-    } else if (__privateGet$1(this, _auth).isPrincipal(credentials, "user")) {
+    } else if (__privateGet$2(this, _auth).isPrincipal(credentials, "user")) {
       if (allowed.includes("user")) {
         return credentials;
       }
       throw new errors.NotAllowedError(
         `This endpoint does not allow 'user' credentials`
       );
-    } else if (__privateGet$1(this, _auth).isPrincipal(credentials, "service")) {
+    } else if (__privateGet$2(this, _auth).isPrincipal(credentials, "service")) {
       if (allowed.includes("service")) {
         return credentials;
       }
@@ -2351,7 +2352,7 @@ class DefaultHttpAuthService {
     }
     let credentials;
     if (options == null ? void 0 : options.credentials) {
-      if (!__privateGet$1(this, _auth).isPrincipal(options.credentials, "user")) {
+      if (!__privateGet$2(this, _auth).isPrincipal(options.credentials, "user")) {
         throw new errors.AuthenticationError(
           "Refused to issue cookie for non-user principal"
         );
@@ -2360,17 +2361,17 @@ class DefaultHttpAuthService {
     } else {
       credentials = await this.credentials(res.req, { allow: ["user"] });
     }
-    const existingExpiresAt = await __privateMethod$1(this, _existingCookieExpiration, existingCookieExpiration_fn).call(this, res.req);
+    const existingExpiresAt = await __privateMethod$2(this, _existingCookieExpiration, existingCookieExpiration_fn).call(this, res.req);
     if (existingExpiresAt && !willExpireSoon(existingExpiresAt)) {
       return { expiresAt: existingExpiresAt };
     }
     const originHeader = res.req.headers.origin;
     const origin = !originHeader || originHeader === "null" ? void 0 : originHeader;
-    const externalBaseUrlStr = await __privateGet$1(this, _discovery).getExternalBaseUrl(
-      __privateGet$1(this, _pluginId)
+    const externalBaseUrlStr = await __privateGet$2(this, _discovery).getExternalBaseUrl(
+      __privateGet$2(this, _pluginId)
     );
     const externalBaseUrl = new URL(origin != null ? origin : externalBaseUrlStr);
-    const { token, expiresAt } = await __privateGet$1(this, _auth).getLimitedUserToken(
+    const { token, expiresAt } = await __privateGet$2(this, _auth).getLimitedUserToken(
       credentials
     );
     if (!token) {
@@ -2395,35 +2396,35 @@ _extractCredentialsFromRequest = new WeakSet();
 extractCredentialsFromRequest_fn = async function(req) {
   const token = getTokenFromRequest(req);
   if (!token) {
-    return await __privateGet$1(this, _auth).getNoneCredentials();
+    return await __privateGet$2(this, _auth).getNoneCredentials();
   }
-  return await __privateGet$1(this, _auth).authenticate(token);
+  return await __privateGet$2(this, _auth).authenticate(token);
 };
 _extractLimitedCredentialsFromRequest = new WeakSet();
 extractLimitedCredentialsFromRequest_fn = async function(req) {
   const token = getTokenFromRequest(req);
   if (token) {
-    return await __privateGet$1(this, _auth).authenticate(token, {
+    return await __privateGet$2(this, _auth).authenticate(token, {
       allowLimitedAccess: true
     });
   }
   const cookie = getCookieFromRequest(req);
   if (cookie) {
-    return await __privateGet$1(this, _auth).authenticate(cookie, {
+    return await __privateGet$2(this, _auth).authenticate(cookie, {
       allowLimitedAccess: true
     });
   }
-  return await __privateGet$1(this, _auth).getNoneCredentials();
+  return await __privateGet$2(this, _auth).getNoneCredentials();
 };
 _getCredentials = new WeakSet();
 getCredentials_fn = async function(req) {
   var _a;
-  return (_a = req[credentialsSymbol]) != null ? _a : req[credentialsSymbol] = __privateMethod$1(this, _extractCredentialsFromRequest, extractCredentialsFromRequest_fn).call(this, req);
+  return (_a = req[credentialsSymbol]) != null ? _a : req[credentialsSymbol] = __privateMethod$2(this, _extractCredentialsFromRequest, extractCredentialsFromRequest_fn).call(this, req);
 };
 _getLimitedCredentials = new WeakSet();
 getLimitedCredentials_fn = async function(req) {
   var _a;
-  return (_a = req[limitedCredentialsSymbol]) != null ? _a : req[limitedCredentialsSymbol] = __privateMethod$1(this, _extractLimitedCredentialsFromRequest, extractLimitedCredentialsFromRequest_fn).call(this, req);
+  return (_a = req[limitedCredentialsSymbol]) != null ? _a : req[limitedCredentialsSymbol] = __privateMethod$2(this, _extractLimitedCredentialsFromRequest, extractLimitedCredentialsFromRequest_fn).call(this, req);
 };
 _existingCookieExpiration = new WeakSet();
 existingCookieExpiration_fn = async function(req) {
@@ -2431,10 +2432,10 @@ existingCookieExpiration_fn = async function(req) {
   if (!existingCookie) {
     return void 0;
   }
-  const existingCredentials = await __privateGet$1(this, _auth).authenticate(existingCookie, {
+  const existingCredentials = await __privateGet$2(this, _auth).authenticate(existingCookie, {
     allowLimitedAccess: true
   });
-  if (!__privateGet$1(this, _auth).isPrincipal(existingCredentials, "user")) {
+  if (!__privateGet$2(this, _auth).isPrincipal(existingCredentials, "user")) {
     return void 0;
   }
   return existingCredentials.expiresAt;
@@ -2495,6 +2496,105 @@ function createLifecycleMiddleware(options) {
   };
 }
 
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => {
+  __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
+var __accessCheck$1 = (obj, member, msg) => {
+  if (!member.has(obj))
+    throw TypeError("Cannot " + msg);
+};
+var __privateGet$1 = (obj, member, getter) => {
+  __accessCheck$1(obj, member, "read from private field");
+  return getter ? getter.call(obj) : member.get(obj);
+};
+var __privateAdd$1 = (obj, member, value) => {
+  if (member.has(obj))
+    throw TypeError("Cannot add the same private member more than once");
+  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+};
+var __privateSet$1 = (obj, member, value, setter) => {
+  __accessCheck$1(obj, member, "write to private field");
+  setter ? setter.call(obj, value) : member.set(obj, value);
+  return value;
+};
+var __privateMethod$1 = (obj, member, method) => {
+  __accessCheck$1(obj, member, "access private method");
+  return method;
+};
+var _cache, _getDefaultValue, getDefaultValue_fn;
+const _RateLimitStore = class _RateLimitStore {
+  constructor(options) {
+    __privateAdd$1(this, _getDefaultValue);
+    /**
+     * The duration of time before which all hit counts are reset (in milliseconds).
+     * default: 60 requests per minute
+     */
+    __publicField(this, "windowMs", 1 * 60 * 1e3);
+    __publicField(this, "prefix");
+    __privateAdd$1(this, _cache, void 0);
+    var _a;
+    this.prefix = (_a = options.prefix) != null ? _a : "unauthorized_rate_limit_";
+    __privateSet$1(this, _cache, options.cache);
+  }
+  static fromOptions(options) {
+    return new _RateLimitStore(options);
+  }
+  init(options) {
+    if (options.windowMs) {
+      this.windowMs = options.windowMs;
+    }
+  }
+  prefixKey(key) {
+    return `${this.prefix}${key}`;
+  }
+  async get(key) {
+    var _a;
+    const value = (_a = await __privateGet$1(this, _cache).get(this.prefixKey(key))) != null ? _a : __privateMethod$1(this, _getDefaultValue, getDefaultValue_fn).call(this);
+    return {
+      totalHits: value.totalHits,
+      resetTime: new Date(value.resetTime)
+    };
+  }
+  async increment(key) {
+    var _a;
+    const value = (_a = await __privateGet$1(this, _cache).get(this.prefixKey(key))) != null ? _a : __privateMethod$1(this, _getDefaultValue, getDefaultValue_fn).call(this);
+    const totalHits = value.totalHits + 1;
+    const resetTime = value.resetTime;
+    await __privateGet$1(this, _cache).set(
+      this.prefixKey(key),
+      { totalHits, resetTime },
+      { ttl: this.windowMs }
+    );
+    return {
+      totalHits,
+      resetTime: new Date(resetTime)
+    };
+  }
+  async decrement(key) {
+    var _a;
+    const value = (_a = await __privateGet$1(this, _cache).get(this.prefixKey(key))) != null ? _a : __privateMethod$1(this, _getDefaultValue, getDefaultValue_fn).call(this);
+    const totalHits = value.totalHits > 0 ? value.totalHits - 1 : 0;
+    const resetTime = value.resetTime;
+    await __privateGet$1(this, _cache).set(
+      this.prefixKey(key),
+      { totalHits, resetTime },
+      { ttl: this.windowMs }
+    );
+  }
+  async resetKey(key) {
+    await __privateGet$1(this, _cache).delete(this.prefixKey(key));
+  }
+};
+_cache = new WeakMap();
+_getDefaultValue = new WeakSet();
+getDefaultValue_fn = function() {
+  return { totalHits: 0, resetTime: Date.now() + this.windowMs };
+};
+let RateLimitStore = _RateLimitStore;
+
 function createPathPolicyPredicate(policyPath) {
   if (policyPath === "/" || policyPath === "*") {
     return () => true;
@@ -2507,8 +2607,8 @@ function createPathPolicyPredicate(policyPath) {
   };
 }
 function createCredentialsBarrier(options) {
-  const { httpAuth, config } = options;
-  const disableDefaultAuthPolicy = config.getOptionalBoolean(
+  const { httpAuth, config: config$1, cache } = options;
+  const disableDefaultAuthPolicy = config$1.getOptionalBoolean(
     "backend.auth.dangerouslyDisableDefaultAuthPolicy"
   );
   if (disableDefaultAuthPolicy) {
@@ -2520,12 +2620,31 @@ function createCredentialsBarrier(options) {
   }
   const unauthenticatedPredicates = new Array();
   const cookiePredicates = new Array();
-  const middleware = (req, _, next) => {
+  const rateLimitConfig = config$1.getOptional("backend.rateLimit.unauthorized");
+  const disabled = rateLimitConfig === false || typeof rateLimitConfig === "object" && (config$1 == null ? void 0 : config$1.getOptionalBoolean("backend.rateLimit.unauthorized.disabled")) === true;
+  const duration = typeof rateLimitConfig === "object" && (config$1 == null ? void 0 : config$1.has("backend.rateLimit.unauthorized.window")) ? config.readDurationFromConfig(
+    config$1.getConfig("backend.rateLimit.unauthorized.window")
+  ) : void 0;
+  const windowMs = duration ? types.durationToMilliseconds(duration) : 1 * 60 * 1e3;
+  const max = typeof rateLimitConfig === "object" && (config$1 == null ? void 0 : config$1.has("backend.rateLimit.unauthorized.max")) ? config$1.getNumber("backend.rateLimit.unauthorized.max") : 60;
+  const limiter = expressRateLimit.rateLimit({
+    windowMs,
+    limit: max,
+    standardHeaders: true,
+    // Return rate limit info in the `RateLimit-*` headers
+    legacyHeaders: false,
+    // Disable the `X-RateLimit-*` headers,
+    store: RateLimitStore.fromOptions({ cache }),
+    skip() {
+      return disabled;
+    }
+  });
+  const middleware = (req, res, next) => {
     const allowsUnauthenticated = unauthenticatedPredicates.some(
       (predicate) => predicate(req.path)
     );
     if (allowsUnauthenticated) {
-      next();
+      limiter(req, res, next);
       return;
     }
     const allowsCookie = cookiePredicates.some(
@@ -2555,19 +2674,31 @@ const httpRouterServiceFactory = backendPluginApi.createServiceFactory(
   (options) => ({
     service: backendPluginApi.coreServices.httpRouter,
     deps: {
+      cache: backendPluginApi.coreServices.cache,
       plugin: backendPluginApi.coreServices.pluginMetadata,
       config: backendPluginApi.coreServices.rootConfig,
       lifecycle: backendPluginApi.coreServices.lifecycle,
       rootHttpRouter: backendPluginApi.coreServices.rootHttpRouter,
       httpAuth: backendPluginApi.coreServices.httpAuth
     },
-    async factory({ httpAuth, config, plugin, rootHttpRouter, lifecycle }) {
+    async factory({
+      httpAuth,
+      config,
+      cache,
+      plugin,
+      rootHttpRouter,
+      lifecycle
+    }) {
       var _a;
       const getPath = (_a = options == null ? void 0 : options.getPath) != null ? _a : (id) => `/api/${id}`;
       const path = getPath(plugin.getId());
       const router = PromiseRouter__default["default"]();
       rootHttpRouter.use(path, router);
-      const credentialsBarrier = createCredentialsBarrier({ httpAuth, config });
+      const credentialsBarrier = createCredentialsBarrier({
+        httpAuth,
+        config,
+        cache
+      });
       router.use(createLifecycleMiddleware({ lifecycle }));
       router.use(credentialsBarrier.middleware);
       return {