@backstage/backend-app-api 0.6.3-next.0 → 0.7.0-next.1

package/dist/index.cjs.js

@@ -22,13 +22,15 @@ var winston = require('winston');
 var backendPluginApi = require('@backstage/backend-plugin-api');
 var alpha = require('@backstage/backend-plugin-api/alpha');
 var jose = require('jose');
+var pluginAuthNode = require('@backstage/plugin-auth-node');
+var uuid = require('uuid');
+var luxon = require('luxon');
 var backendCommon = require('@backstage/backend-common');
 var backendAppApi = require('@backstage/backend-app-api');
 var cookie = require('cookie');
-var PromiseRouter = require('express-promise-router');
+var Router = require('express-promise-router');
 var types = require('@backstage/types');
 var pathToRegexp = require('path-to-regexp');
-var pluginAuthNode = require('@backstage/plugin-auth-node');
 var pluginPermissionNode = require('@backstage/plugin-permission-node');
 var express = require('express');
 var trimEnd = require('lodash/trimEnd');
@@ -64,22 +66,22 @@ var cors__default = /*#__PURE__*/_interopDefaultCompat(cors);
 var helmet__default = /*#__PURE__*/_interopDefaultCompat(helmet);
 var morgan__default = /*#__PURE__*/_interopDefaultCompat(morgan);
 var compression__default = /*#__PURE__*/_interopDefaultCompat(compression);
-var PromiseRouter__default = /*#__PURE__*/_interopDefaultCompat(PromiseRouter);
+var Router__default = /*#__PURE__*/_interopDefaultCompat(Router);
 var express__default = /*#__PURE__*/_interopDefaultCompat(express);
 var trimEnd__default = /*#__PURE__*/_interopDefaultCompat(trimEnd);
 
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => {
-  __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+var __defProp$1 = Object.defineProperty;
+var __defNormalProp$1 = (obj, key, value) => key in obj ? __defProp$1(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField$1 = (obj, key, value) => {
+  __defNormalProp$1(obj, typeof key !== "symbol" ? key + "" : key, value);
   return value;
 };
 class ObservableConfigProxy {
   constructor(parent, parentKey) {
     this.parent = parent;
     this.parentKey = parentKey;
-    __publicField(this, "config", new config.ConfigReader({}));
-    __publicField(this, "subscribers", []);
+    __publicField$1(this, "config", new config.ConfigReader({}));
+    __publicField$1(this, "subscribers", []);
     if (parent && !parentKey) {
       throw new Error("parentKey is required if parent is set");
     }
@@ -610,31 +612,31 @@ function applyInternalErrorFilter(error, logger) {
   return error;
 }
 
-var __accessCheck$a = (obj, member, msg) => {
+var __accessCheck$c = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$9 = (obj, member, getter) => {
-  __accessCheck$a(obj, member, "read from private field");
+var __privateGet$b = (obj, member, getter) => {
+  __accessCheck$c(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$a = (obj, member, value) => {
+var __privateAdd$c = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$9 = (obj, member, value, setter) => {
-  __accessCheck$a(obj, member, "write to private field");
+var __privateSet$b = (obj, member, value, setter) => {
+  __accessCheck$c(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
 var _config, _logger;
 const _MiddlewareFactory = class _MiddlewareFactory {
   constructor(options) {
-    __privateAdd$a(this, _config, void 0);
-    __privateAdd$a(this, _logger, void 0);
-    __privateSet$9(this, _config, options.config);
-    __privateSet$9(this, _logger, options.logger);
+    __privateAdd$c(this, _config, void 0);
+    __privateAdd$c(this, _logger, void 0);
+    __privateSet$b(this, _config, options.config);
+    __privateSet$b(this, _logger, options.logger);
   }
   /**
    * Creates a new {@link MiddlewareFactory}.
@@ -680,7 +682,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
    * @returns An Express request handler
    */
   logging() {
-    const logger = __privateGet$9(this, _logger).child({
+    const logger = __privateGet$b(this, _logger).child({
       type: "incomingRequest"
     });
     return morgan__default.default("combined", {
@@ -704,7 +706,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
    * @returns An Express request handler
    */
   helmet() {
-    return helmet__default.default(readHelmetOptions(__privateGet$9(this, _config).getOptionalConfig("backend")));
+    return helmet__default.default(readHelmetOptions(__privateGet$b(this, _config).getOptionalConfig("backend")));
   }
   /**
    * Returns a middleware that implements the cors library.
@@ -719,7 +721,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
    * @returns An Express request handler
    */
   cors() {
-    return cors__default.default(readCorsOptions(__privateGet$9(this, _config).getOptionalConfig("backend")));
+    return cors__default.default(readCorsOptions(__privateGet$b(this, _config).getOptionalConfig("backend")));
   }
   /**
    * Express middleware to handle errors during request processing.
@@ -744,7 +746,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
   error(options = {}) {
     var _a;
     const showStackTraces = (_a = options.showStackTraces) != null ? _a : process.env.NODE_ENV === "development";
-    const logger = __privateGet$9(this, _logger).child({
+    const logger = __privateGet$b(this, _logger).child({
       type: "errorHandler"
     });
     return (rawError, req, res, next) => {
@@ -803,31 +805,31 @@ const escapeRegExp = (text) => {
   return text.replace(/[.*+?^${}(\)|[\]\\]/g, "\\$&");
 };
 
-var __accessCheck$9 = (obj, member, msg) => {
+var __accessCheck$b = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$8 = (obj, member, getter) => {
-  __accessCheck$9(obj, member, "read from private field");
+var __privateGet$a = (obj, member, getter) => {
+  __accessCheck$b(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$9 = (obj, member, value) => {
+var __privateAdd$b = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$8 = (obj, member, value, setter) => {
-  __accessCheck$9(obj, member, "write to private field");
+var __privateSet$a = (obj, member, value, setter) => {
+  __accessCheck$b(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
 var _winston, _addRedactions;
 const _WinstonLogger = class _WinstonLogger {
   constructor(winston, addRedactions) {
-    __privateAdd$9(this, _winston, void 0);
-    __privateAdd$9(this, _addRedactions, void 0);
-    __privateSet$8(this, _winston, winston);
-    __privateSet$8(this, _addRedactions, addRedactions);
+    __privateAdd$b(this, _winston, void 0);
+    __privateAdd$b(this, _addRedactions, void 0);
+    __privateSet$a(this, _winston, winston);
+    __privateSet$a(this, _addRedactions, addRedactions);
   }
   /**
    * Creates a {@link WinstonLogger} instance.
@@ -912,44 +914,44 @@ const _WinstonLogger = class _WinstonLogger {
     );
   }
   error(message, meta) {
-    __privateGet$8(this, _winston).error(message, meta);
+    __privateGet$a(this, _winston).error(message, meta);
   }
   warn(message, meta) {
-    __privateGet$8(this, _winston).warn(message, meta);
+    __privateGet$a(this, _winston).warn(message, meta);
   }
   info(message, meta) {
-    __privateGet$8(this, _winston).info(message, meta);
+    __privateGet$a(this, _winston).info(message, meta);
   }
   debug(message, meta) {
-    __privateGet$8(this, _winston).debug(message, meta);
+    __privateGet$a(this, _winston).debug(message, meta);
   }
   child(meta) {
-    return new _WinstonLogger(__privateGet$8(this, _winston).child(meta));
+    return new _WinstonLogger(__privateGet$a(this, _winston).child(meta));
   }
   addRedactions(redactions) {
     var _a;
-    (_a = __privateGet$8(this, _addRedactions)) == null ? void 0 : _a.call(this, redactions);
+    (_a = __privateGet$a(this, _addRedactions)) == null ? void 0 : _a.call(this, redactions);
   }
 };
 _winston = new WeakMap();
 _addRedactions = new WeakMap();
 let WinstonLogger = _WinstonLogger;
 
-var __accessCheck$8 = (obj, member, msg) => {
+var __accessCheck$a = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$7 = (obj, member, getter) => {
-  __accessCheck$8(obj, member, "read from private field");
+var __privateGet$9 = (obj, member, getter) => {
+  __accessCheck$a(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$8 = (obj, member, value) => {
+var __privateAdd$a = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$7 = (obj, member, value, setter) => {
-  __accessCheck$8(obj, member, "write to private field");
+var __privateSet$9 = (obj, member, value, setter) => {
+  __accessCheck$a(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
@@ -957,25 +959,25 @@ var _hasStarted$1, _startupTasks$1, _hasShutdown, _shutdownTasks;
 class BackendLifecycleImpl {
   constructor(logger) {
     this.logger = logger;
-    __privateAdd$8(this, _hasStarted$1, false);
-    __privateAdd$8(this, _startupTasks$1, []);
-    __privateAdd$8(this, _hasShutdown, false);
-    __privateAdd$8(this, _shutdownTasks, []);
+    __privateAdd$a(this, _hasStarted$1, false);
+    __privateAdd$a(this, _startupTasks$1, []);
+    __privateAdd$a(this, _hasShutdown, false);
+    __privateAdd$a(this, _shutdownTasks, []);
   }
   addStartupHook(hook, options) {
-    if (__privateGet$7(this, _hasStarted$1)) {
+    if (__privateGet$9(this, _hasStarted$1)) {
       throw new Error("Attempted to add startup hook after startup");
     }
-    __privateGet$7(this, _startupTasks$1).push({ hook, options });
+    __privateGet$9(this, _startupTasks$1).push({ hook, options });
   }
   async startup() {
-    if (__privateGet$7(this, _hasStarted$1)) {
+    if (__privateGet$9(this, _hasStarted$1)) {
       return;
     }
-    __privateSet$7(this, _hasStarted$1, true);
-    this.logger.debug(`Running ${__privateGet$7(this, _startupTasks$1).length} startup tasks...`);
+    __privateSet$9(this, _hasStarted$1, true);
+    this.logger.debug(`Running ${__privateGet$9(this, _startupTasks$1).length} startup tasks...`);
     await Promise.all(
-      __privateGet$7(this, _startupTasks$1).map(async ({ hook, options }) => {
+      __privateGet$9(this, _startupTasks$1).map(async ({ hook, options }) => {
         var _a;
         const logger = (_a = options == null ? void 0 : options.logger) != null ? _a : this.logger;
         try {
@@ -988,21 +990,21 @@ class BackendLifecycleImpl {
     );
   }
   addShutdownHook(hook, options) {
-    if (__privateGet$7(this, _hasShutdown)) {
+    if (__privateGet$9(this, _hasShutdown)) {
       throw new Error("Attempted to add shutdown hook after shutdown");
     }
-    __privateGet$7(this, _shutdownTasks).push({ hook, options });
+    __privateGet$9(this, _shutdownTasks).push({ hook, options });
   }
   async shutdown() {
-    if (__privateGet$7(this, _hasShutdown)) {
+    if (__privateGet$9(this, _hasShutdown)) {
       return;
     }
-    __privateSet$7(this, _hasShutdown, true);
+    __privateSet$9(this, _hasShutdown, true);
     this.logger.debug(
-      `Running ${__privateGet$7(this, _shutdownTasks).length} shutdown tasks...`
+      `Running ${__privateGet$9(this, _shutdownTasks).length} shutdown tasks...`
     );
     await Promise.all(
-      __privateGet$7(this, _shutdownTasks).map(async ({ hook, options }) => {
+      __privateGet$9(this, _shutdownTasks).map(async ({ hook, options }) => {
         var _a;
         const logger = (_a = options == null ? void 0 : options.logger) != null ? _a : this.logger;
         try {
@@ -1029,21 +1031,21 @@ const rootLifecycleServiceFactory = backendPluginApi.createServiceFactory({
   }
 });
 
-var __accessCheck$7 = (obj, member, msg) => {
+var __accessCheck$9 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$6 = (obj, member, getter) => {
-  __accessCheck$7(obj, member, "read from private field");
+var __privateGet$8 = (obj, member, getter) => {
+  __accessCheck$9(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$7 = (obj, member, value) => {
+var __privateAdd$9 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$6 = (obj, member, value, setter) => {
-  __accessCheck$7(obj, member, "write to private field");
+var __privateSet$8 = (obj, member, value, setter) => {
+  __accessCheck$9(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
@@ -1053,25 +1055,25 @@ class BackendPluginLifecycleImpl {
     this.logger = logger;
     this.rootLifecycle = rootLifecycle;
     this.pluginMetadata = pluginMetadata;
-    __privateAdd$7(this, _hasStarted, false);
-    __privateAdd$7(this, _startupTasks, []);
+    __privateAdd$9(this, _hasStarted, false);
+    __privateAdd$9(this, _startupTasks, []);
   }
   addStartupHook(hook, options) {
-    if (__privateGet$6(this, _hasStarted)) {
+    if (__privateGet$8(this, _hasStarted)) {
       throw new Error("Attempted to add startup hook after startup");
     }
-    __privateGet$6(this, _startupTasks).push({ hook, options });
+    __privateGet$8(this, _startupTasks).push({ hook, options });
   }
   async startup() {
-    if (__privateGet$6(this, _hasStarted)) {
+    if (__privateGet$8(this, _hasStarted)) {
       return;
     }
-    __privateSet$6(this, _hasStarted, true);
+    __privateSet$8(this, _hasStarted, true);
     this.logger.debug(
-      `Running ${__privateGet$6(this, _startupTasks).length} plugin startup tasks...`
+      `Running ${__privateGet$8(this, _startupTasks).length} plugin startup tasks...`
     );
     await Promise.all(
-      __privateGet$6(this, _startupTasks).map(async ({ hook, options }) => {
+      __privateGet$8(this, _startupTasks).map(async ({ hook, options }) => {
         var _a;
         const logger = (_a = options == null ? void 0 : options.logger) != null ? _a : this.logger;
         try {
@@ -1109,26 +1111,26 @@ const lifecycleServiceFactory = backendPluginApi.createServiceFactory({
   }
 });
 
-var __accessCheck$6 = (obj, member, msg) => {
+var __accessCheck$8 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$5 = (obj, member, getter) => {
-  __accessCheck$6(obj, member, "read from private field");
+var __privateGet$7 = (obj, member, getter) => {
+  __accessCheck$8(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$6 = (obj, member, value) => {
+var __privateAdd$8 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$5 = (obj, member, value, setter) => {
-  __accessCheck$6(obj, member, "write to private field");
+var __privateSet$7 = (obj, member, value, setter) => {
+  __accessCheck$8(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
-var __privateMethod$5 = (obj, member, method) => {
-  __accessCheck$6(obj, member, "access private method");
+var __privateMethod$6 = (obj, member, method) => {
+  __accessCheck$8(obj, member, "access private method");
   return method;
 };
 var _nodeIds, _cycleKeys, _getCycleKey, getCycleKey_fn, _nodes, _allProvided;
@@ -1148,21 +1150,21 @@ class Node {
 }
 const _CycleKeySet = class _CycleKeySet {
   constructor(nodes) {
-    __privateAdd$6(this, _getCycleKey);
-    __privateAdd$6(this, _nodeIds, void 0);
-    __privateAdd$6(this, _cycleKeys, void 0);
-    __privateSet$5(this, _nodeIds, new Map(nodes.map((n, i) => [n.value, i])));
-    __privateSet$5(this, _cycleKeys, /* @__PURE__ */ new Set());
+    __privateAdd$8(this, _getCycleKey);
+    __privateAdd$8(this, _nodeIds, void 0);
+    __privateAdd$8(this, _cycleKeys, void 0);
+    __privateSet$7(this, _nodeIds, new Map(nodes.map((n, i) => [n.value, i])));
+    __privateSet$7(this, _cycleKeys, /* @__PURE__ */ new Set());
   }
   static from(nodes) {
     return new _CycleKeySet(nodes);
   }
   tryAdd(path) {
-    const cycleKey = __privateMethod$5(this, _getCycleKey, getCycleKey_fn).call(this, path);
-    if (__privateGet$5(this, _cycleKeys).has(cycleKey)) {
+    const cycleKey = __privateMethod$6(this, _getCycleKey, getCycleKey_fn).call(this, path);
+    if (__privateGet$7(this, _cycleKeys).has(cycleKey)) {
       return false;
     }
-    __privateGet$5(this, _cycleKeys).add(cycleKey);
+    __privateGet$7(this, _cycleKeys).add(cycleKey);
     return true;
   }
 };
@@ -1170,18 +1172,18 @@ _nodeIds = new WeakMap();
 _cycleKeys = new WeakMap();
 _getCycleKey = new WeakSet();
 getCycleKey_fn = function(path) {
-  return path.map((n) => __privateGet$5(this, _nodeIds).get(n)).sort().join(",");
+  return path.map((n) => __privateGet$7(this, _nodeIds).get(n)).sort().join(",");
 };
 let CycleKeySet = _CycleKeySet;
 const _DependencyGraph = class _DependencyGraph {
   constructor(nodes) {
-    __privateAdd$6(this, _nodes, void 0);
-    __privateAdd$6(this, _allProvided, void 0);
-    __privateSet$5(this, _nodes, nodes);
-    __privateSet$5(this, _allProvided, /* @__PURE__ */ new Set());
-    for (const node of __privateGet$5(this, _nodes).values()) {
+    __privateAdd$8(this, _nodes, void 0);
+    __privateAdd$8(this, _allProvided, void 0);
+    __privateSet$7(this, _nodes, nodes);
+    __privateSet$7(this, _allProvided, /* @__PURE__ */ new Set());
+    for (const node of __privateGet$7(this, _nodes).values()) {
       for (const produced of node.provides) {
-        __privateGet$5(this, _allProvided).add(produced);
+        __privateGet$7(this, _allProvided).add(produced);
       }
     }
   }
@@ -1205,9 +1207,9 @@ const _DependencyGraph = class _DependencyGraph {
    */
   findUnsatisfiedDeps() {
     const unsatisfiedDependencies = [];
-    for (const node of __privateGet$5(this, _nodes).values()) {
+    for (const node of __privateGet$7(this, _nodes).values()) {
       const unsatisfied = Array.from(node.consumes).filter(
-        (id) => !__privateGet$5(this, _allProvided).has(id)
+        (id) => !__privateGet$7(this, _allProvided).has(id)
       );
       if (unsatisfied.length > 0) {
         unsatisfiedDependencies.push({ value: node.value, unsatisfied });
@@ -1227,8 +1229,8 @@ const _DependencyGraph = class _DependencyGraph {
    * form a cycle, with the same node as the first and last element of the array.
    */
   *detectCircularDependencies() {
-    const cycleKeys = CycleKeySet.from(__privateGet$5(this, _nodes));
-    for (const startNode of __privateGet$5(this, _nodes)) {
+    const cycleKeys = CycleKeySet.from(__privateGet$7(this, _nodes));
+    for (const startNode of __privateGet$7(this, _nodes)) {
       const visited = /* @__PURE__ */ new Set();
       const stack = new Array([
         startNode,
@@ -1241,7 +1243,7 @@ const _DependencyGraph = class _DependencyGraph {
         }
         visited.add(node);
         for (const consumed of node.consumes) {
-          const providerNodes = __privateGet$5(this, _nodes).filter(
+          const providerNodes = __privateGet$7(this, _nodes).filter(
             (other) => other.provides.has(consumed)
           );
           for (const provider of providerNodes) {
@@ -1270,9 +1272,9 @@ const _DependencyGraph = class _DependencyGraph {
    * Dependencies of nodes that are not produced by any other nodes will be ignored.
    */
   async parallelTopologicalTraversal(fn) {
-    const allProvided = __privateGet$5(this, _allProvided);
+    const allProvided = __privateGet$7(this, _allProvided);
     const producedSoFar = /* @__PURE__ */ new Set();
-    const waiting = new Set(__privateGet$5(this, _nodes).values());
+    const waiting = new Set(__privateGet$7(this, _nodes).values());
     const visited = /* @__PURE__ */ new Set();
     const results = new Array();
     let inFlight = 0;
@@ -1318,26 +1320,26 @@ _nodes = new WeakMap();
 _allProvided = new WeakMap();
 let DependencyGraph = _DependencyGraph;
 
-var __accessCheck$5 = (obj, member, msg) => {
+var __accessCheck$7 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$4 = (obj, member, getter) => {
-  __accessCheck$5(obj, member, "read from private field");
+var __privateGet$6 = (obj, member, getter) => {
+  __accessCheck$7(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$5 = (obj, member, value) => {
+var __privateAdd$7 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$4 = (obj, member, value, setter) => {
-  __accessCheck$5(obj, member, "write to private field");
+var __privateSet$6 = (obj, member, value, setter) => {
+  __accessCheck$7(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
-var __privateMethod$4 = (obj, member, method) => {
-  __accessCheck$5(obj, member, "access private method");
+var __privateMethod$5 = (obj, member, method) => {
+  __accessCheck$7(obj, member, "access private method");
   return method;
 };
 var _providedFactories, _loadedDefaultFactories, _implementations, _rootServiceImplementations, _addedFactoryIds, _instantiatedFactories, _resolveFactory, resolveFactory_fn, _checkForMissingDeps, checkForMissingDeps_fn;
@@ -1360,19 +1362,19 @@ const pluginMetadataServiceFactory = backendPluginApi.createServiceFactory(
 );
 const _ServiceRegistry = class _ServiceRegistry {
   constructor(factories) {
-    __privateAdd$5(this, _resolveFactory);
-    __privateAdd$5(this, _checkForMissingDeps);
-    __privateAdd$5(this, _providedFactories, void 0);
-    __privateAdd$5(this, _loadedDefaultFactories, void 0);
-    __privateAdd$5(this, _implementations, void 0);
-    __privateAdd$5(this, _rootServiceImplementations, /* @__PURE__ */ new Map());
-    __privateAdd$5(this, _addedFactoryIds, /* @__PURE__ */ new Set());
-    __privateAdd$5(this, _instantiatedFactories, /* @__PURE__ */ new Set());
-    __privateSet$4(this, _providedFactories, new Map(
+    __privateAdd$7(this, _resolveFactory);
+    __privateAdd$7(this, _checkForMissingDeps);
+    __privateAdd$7(this, _providedFactories, void 0);
+    __privateAdd$7(this, _loadedDefaultFactories, void 0);
+    __privateAdd$7(this, _implementations, void 0);
+    __privateAdd$7(this, _rootServiceImplementations, /* @__PURE__ */ new Map());
+    __privateAdd$7(this, _addedFactoryIds, /* @__PURE__ */ new Set());
+    __privateAdd$7(this, _instantiatedFactories, /* @__PURE__ */ new Set());
+    __privateSet$6(this, _providedFactories, new Map(
       factories.map((sf) => [sf.service.id, toInternalServiceFactory(sf)])
     ));
-    __privateSet$4(this, _loadedDefaultFactories, /* @__PURE__ */ new Map());
-    __privateSet$4(this, _implementations, /* @__PURE__ */ new Map());
+    __privateSet$6(this, _loadedDefaultFactories, /* @__PURE__ */ new Map());
+    __privateSet$6(this, _implementations, /* @__PURE__ */ new Map());
   }
   static create(factories) {
     const registry = new _ServiceRegistry(factories);
@@ -1381,7 +1383,7 @@ const _ServiceRegistry = class _ServiceRegistry {
   }
   checkForCircularDeps() {
     const graph = DependencyGraph.fromIterable(
-      Array.from(__privateGet$4(this, _providedFactories)).map(
+      Array.from(__privateGet$6(this, _providedFactories)).map(
         ([serviceId, serviceFactory]) => ({
           value: serviceId,
           provides: [serviceId],
@@ -1403,30 +1405,38 @@ const _ServiceRegistry = class _ServiceRegistry {
         `The ${backendPluginApi.coreServices.pluginMetadata.id} service cannot be overridden`
       );
     }
-    if (__privateGet$4(this, _addedFactoryIds).has(factoryId)) {
+    if (__privateGet$6(this, _addedFactoryIds).has(factoryId)) {
       throw new Error(
         `Duplicate service implementations provided for ${factoryId}`
       );
     }
-    if (__privateGet$4(this, _instantiatedFactories).has(factoryId)) {
+    if (__privateGet$6(this, _instantiatedFactories).has(factoryId)) {
       throw new Error(
         `Unable to set service factory with id ${factoryId}, service has already been instantiated`
       );
     }
-    __privateGet$4(this, _addedFactoryIds).add(factoryId);
-    __privateGet$4(this, _providedFactories).set(factoryId, toInternalServiceFactory(factory));
+    __privateGet$6(this, _addedFactoryIds).add(factoryId);
+    __privateGet$6(this, _providedFactories).set(factoryId, toInternalServiceFactory(factory));
   }
-  getServiceRefs() {
-    return Array.from(__privateGet$4(this, _providedFactories).values()).map((f) => f.service);
+  async initializeEagerServicesWithScope(scope, pluginId = "root") {
+    for (const factory of __privateGet$6(this, _providedFactories).values()) {
+      if (factory.service.scope === scope) {
+        if (scope === "root" && factory.initialization !== "lazy") {
+          await this.get(factory.service, pluginId);
+        } else if (scope === "plugin" && factory.initialization === "always") {
+          await this.get(factory.service, pluginId);
+        }
+      }
+    }
   }
   get(ref, pluginId) {
     var _a;
-    __privateGet$4(this, _instantiatedFactories).add(ref.id);
-    return (_a = __privateMethod$4(this, _resolveFactory, resolveFactory_fn).call(this, ref, pluginId)) == null ? void 0 : _a.then((factory) => {
+    __privateGet$6(this, _instantiatedFactories).add(ref.id);
+    return (_a = __privateMethod$5(this, _resolveFactory, resolveFactory_fn).call(this, ref, pluginId)) == null ? void 0 : _a.then((factory) => {
       if (factory.service.scope === "root") {
-        let existing = __privateGet$4(this, _rootServiceImplementations).get(factory);
+        let existing = __privateGet$6(this, _rootServiceImplementations).get(factory);
         if (!existing) {
-          __privateMethod$4(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
+          __privateMethod$5(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
           const rootDeps = new Array();
           for (const [name, serviceRef] of Object.entries(factory.deps)) {
             if (serviceRef.scope !== "root") {
@@ -1440,13 +1450,13 @@ const _ServiceRegistry = class _ServiceRegistry {
           existing = Promise.all(rootDeps).then(
             (entries) => factory.factory(Object.fromEntries(entries), void 0)
           );
-          __privateGet$4(this, _rootServiceImplementations).set(factory, existing);
+          __privateGet$6(this, _rootServiceImplementations).set(factory, existing);
         }
         return existing;
       }
-      let implementation = __privateGet$4(this, _implementations).get(factory);
+      let implementation = __privateGet$6(this, _implementations).get(factory);
       if (!implementation) {
-        __privateMethod$4(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
+        __privateMethod$5(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
         const rootDeps = new Array();
         for (const [name, serviceRef] of Object.entries(factory.deps)) {
           if (serviceRef.scope === "root") {
@@ -1468,7 +1478,7 @@ const _ServiceRegistry = class _ServiceRegistry {
           }),
           byPlugin: /* @__PURE__ */ new Map()
         };
-        __privateGet$4(this, _implementations).set(factory, implementation);
+        __privateGet$6(this, _implementations).set(factory, implementation);
       }
       let result = implementation.byPlugin.get(pluginId);
       if (!result) {
@@ -1506,18 +1516,18 @@ resolveFactory_fn = function(ref, pluginId) {
       toInternalServiceFactory(pluginMetadataServiceFactory({ pluginId }))
     );
   }
-  let resolvedFactory = __privateGet$4(this, _providedFactories).get(ref.id);
+  let resolvedFactory = __privateGet$6(this, _providedFactories).get(ref.id);
   const { __defaultFactory: defaultFactory } = ref;
   if (!resolvedFactory && !defaultFactory) {
     return void 0;
   }
   if (!resolvedFactory) {
-    let loadedFactory = __privateGet$4(this, _loadedDefaultFactories).get(defaultFactory);
+    let loadedFactory = __privateGet$6(this, _loadedDefaultFactories).get(defaultFactory);
     if (!loadedFactory) {
       loadedFactory = Promise.resolve().then(() => defaultFactory(ref)).then(
         (f) => toInternalServiceFactory(typeof f === "function" ? f() : f)
       );
-      __privateGet$4(this, _loadedDefaultFactories).set(defaultFactory, loadedFactory);
+      __privateGet$6(this, _loadedDefaultFactories).set(defaultFactory, loadedFactory);
     }
     resolvedFactory = loadedFactory.catch((error) => {
       throw new Error(
@@ -1535,7 +1545,7 @@ checkForMissingDeps_fn = function(factory, pluginId) {
     if (ref.id === backendPluginApi.coreServices.pluginMetadata.id) {
       return false;
     }
-    if (__privateGet$4(this, _providedFactories).get(ref.id)) {
+    if (__privateGet$6(this, _providedFactories).get(ref.id)) {
       return false;
     }
     return !ref.__defaultFactory;
@@ -1549,52 +1559,52 @@ checkForMissingDeps_fn = function(factory, pluginId) {
 };
 let ServiceRegistry = _ServiceRegistry;
 
-var __accessCheck$4 = (obj, member, msg) => {
+var __accessCheck$6 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$3 = (obj, member, getter) => {
-  __accessCheck$4(obj, member, "read from private field");
+var __privateGet$5 = (obj, member, getter) => {
+  __accessCheck$6(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$4 = (obj, member, value) => {
+var __privateAdd$6 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$3 = (obj, member, value, setter) => {
-  __accessCheck$4(obj, member, "write to private field");
+var __privateSet$5 = (obj, member, value, setter) => {
+  __accessCheck$6(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
-var __privateMethod$3 = (obj, member, method) => {
-  __accessCheck$4(obj, member, "access private method");
+var __privateMethod$4 = (obj, member, method) => {
+  __accessCheck$6(obj, member, "access private method");
   return method;
 };
 var _startPromise, _features, _extensionPoints, _serviceRegistry, _registeredFeatures, _getInitDeps, getInitDeps_fn, _addFeature, addFeature_fn, _doStart, doStart_fn, _getRootLifecycleImpl, getRootLifecycleImpl_fn, _getPluginLifecycleImpl, getPluginLifecycleImpl_fn;
 class BackendInitializer {
   constructor(defaultApiFactories) {
-    __privateAdd$4(this, _getInitDeps);
-    __privateAdd$4(this, _addFeature);
-    __privateAdd$4(this, _doStart);
+    __privateAdd$6(this, _getInitDeps);
+    __privateAdd$6(this, _addFeature);
+    __privateAdd$6(this, _doStart);
     // Bit of a hacky way to grab the lifecycle services, potentially find a nicer way to do this
-    __privateAdd$4(this, _getRootLifecycleImpl);
-    __privateAdd$4(this, _getPluginLifecycleImpl);
-    __privateAdd$4(this, _startPromise, void 0);
-    __privateAdd$4(this, _features, new Array());
-    __privateAdd$4(this, _extensionPoints, /* @__PURE__ */ new Map());
-    __privateAdd$4(this, _serviceRegistry, void 0);
-    __privateAdd$4(this, _registeredFeatures, new Array());
-    __privateSet$3(this, _serviceRegistry, ServiceRegistry.create([...defaultApiFactories]));
+    __privateAdd$6(this, _getRootLifecycleImpl);
+    __privateAdd$6(this, _getPluginLifecycleImpl);
+    __privateAdd$6(this, _startPromise, void 0);
+    __privateAdd$6(this, _features, new Array());
+    __privateAdd$6(this, _extensionPoints, /* @__PURE__ */ new Map());
+    __privateAdd$6(this, _serviceRegistry, void 0);
+    __privateAdd$6(this, _registeredFeatures, new Array());
+    __privateSet$5(this, _serviceRegistry, ServiceRegistry.create([...defaultApiFactories]));
   }
   add(feature) {
-    if (__privateGet$3(this, _startPromise)) {
+    if (__privateGet$5(this, _startPromise)) {
       throw new Error("feature can not be added after the backend has started");
     }
-    __privateGet$3(this, _registeredFeatures).push(Promise.resolve(feature));
+    __privateGet$5(this, _registeredFeatures).push(Promise.resolve(feature));
   }
   async start() {
-    if (__privateGet$3(this, _startPromise)) {
+    if (__privateGet$5(this, _startPromise)) {
       throw new Error("Backend has already started");
     }
     const exitHandler = async () => {
@@ -1612,18 +1622,18 @@ class BackendInitializer {
     process.addListener("SIGTERM", exitHandler);
     process.addListener("SIGINT", exitHandler);
     process.addListener("beforeExit", exitHandler);
-    __privateSet$3(this, _startPromise, __privateMethod$3(this, _doStart, doStart_fn).call(this));
-    await __privateGet$3(this, _startPromise);
+    __privateSet$5(this, _startPromise, __privateMethod$4(this, _doStart, doStart_fn).call(this));
+    await __privateGet$5(this, _startPromise);
   }
   async stop() {
-    if (!__privateGet$3(this, _startPromise)) {
+    if (!__privateGet$5(this, _startPromise)) {
       return;
     }
     try {
-      await __privateGet$3(this, _startPromise);
+      await __privateGet$5(this, _startPromise);
     } catch (error) {
     }
-    const lifecycleService = await __privateMethod$3(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
+    const lifecycleService = await __privateMethod$4(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
     await lifecycleService.shutdown();
   }
 }
@@ -1637,7 +1647,7 @@ getInitDeps_fn = async function(deps, pluginId, moduleId) {
   const result = /* @__PURE__ */ new Map();
   const missingRefs = /* @__PURE__ */ new Set();
   for (const [name, ref] of Object.entries(deps)) {
-    const ep = __privateGet$3(this, _extensionPoints).get(ref.id);
+    const ep = __privateGet$5(this, _extensionPoints).get(ref.id);
     if (ep) {
       if (ep.pluginId !== pluginId) {
         throw new Error(
@@ -1646,7 +1656,7 @@ getInitDeps_fn = async function(deps, pluginId, moduleId) {
       }
       result.set(name, ep.impl);
     } else {
-      const impl = await __privateGet$3(this, _serviceRegistry).get(
+      const impl = await __privateGet$5(this, _serviceRegistry).get(
         ref,
         pluginId
       );
@@ -1673,14 +1683,14 @@ addFeature_fn = function(feature) {
     );
   }
   if (isServiceFactory(feature)) {
-    __privateGet$3(this, _serviceRegistry).add(feature);
+    __privateGet$5(this, _serviceRegistry).add(feature);
   } else if (isInternalBackendFeature(feature)) {
     if (feature.version !== "v1") {
       throw new Error(
         `Failed to add feature, invalid version '${feature.version}'`
       );
     }
-    __privateGet$3(this, _features).push(feature);
+    __privateGet$5(this, _features).push(feature);
   } else {
     throw new Error(
       `Failed to add feature, invalid feature ${JSON.stringify(feature)}`
@@ -1689,39 +1699,35 @@ addFeature_fn = function(feature) {
 };
 _doStart = new WeakSet();
 doStart_fn = async function() {
-  __privateGet$3(this, _serviceRegistry).checkForCircularDeps();
-  for (const feature of __privateGet$3(this, _registeredFeatures)) {
-    __privateMethod$3(this, _addFeature, addFeature_fn).call(this, await feature);
+  __privateGet$5(this, _serviceRegistry).checkForCircularDeps();
+  for (const feature of __privateGet$5(this, _registeredFeatures)) {
+    __privateMethod$4(this, _addFeature, addFeature_fn).call(this, await feature);
   }
-  const featureDiscovery = await __privateGet$3(this, _serviceRegistry).get(
+  const featureDiscovery = await __privateGet$5(this, _serviceRegistry).get(
     alpha.featureDiscoveryServiceRef,
     "root"
   );
   if (featureDiscovery) {
     const { features } = await featureDiscovery.getBackendFeatures();
     for (const feature of features) {
-      __privateMethod$3(this, _addFeature, addFeature_fn).call(this, feature);
-    }
-    __privateGet$3(this, _serviceRegistry).checkForCircularDeps();
-  }
-  for (const ref of __privateGet$3(this, _serviceRegistry).getServiceRefs()) {
-    if (ref.scope === "root") {
-      await __privateGet$3(this, _serviceRegistry).get(ref, "root");
+      __privateMethod$4(this, _addFeature, addFeature_fn).call(this, feature);
     }
+    __privateGet$5(this, _serviceRegistry).checkForCircularDeps();
   }
+  await __privateGet$5(this, _serviceRegistry).initializeEagerServicesWithScope("root");
   const pluginInits = /* @__PURE__ */ new Map();
   const moduleInits = /* @__PURE__ */ new Map();
-  for (const feature of __privateGet$3(this, _features)) {
+  for (const feature of __privateGet$5(this, _features)) {
     for (const r of feature.getRegistrations()) {
       const provides = /* @__PURE__ */ new Set();
       if (r.type === "plugin" || r.type === "module") {
         for (const [extRef, extImpl] of r.extensionPoints) {
-          if (__privateGet$3(this, _extensionPoints).has(extRef.id)) {
+          if (__privateGet$5(this, _extensionPoints).has(extRef.id)) {
             throw new Error(
               `ExtensionPoint with ID '${extRef.id}' is already registered`
             );
           }
-          __privateGet$3(this, _extensionPoints).set(extRef.id, {
+          __privateGet$5(this, _extensionPoints).set(extRef.id, {
             impl: extImpl,
             pluginId: r.pluginId
           });
@@ -1756,11 +1762,13 @@ doStart_fn = async function() {
       }
     }
   }
-  const allPluginIds = [
-    .../* @__PURE__ */ new Set([...pluginInits.keys(), ...moduleInits.keys()])
-  ];
+  const allPluginIds = [...pluginInits.keys()];
   await Promise.all(
     allPluginIds.map(async (pluginId) => {
+      await __privateGet$5(this, _serviceRegistry).initializeEagerServicesWithScope(
+        "plugin",
+        pluginId
+      );
       const modules = moduleInits.get(pluginId);
       if (modules) {
         const tree = DependencyGraph.fromIterable(
@@ -1781,7 +1789,7 @@ doStart_fn = async function() {
         }
         await tree.parallelTopologicalTraversal(
           async ({ moduleId, moduleInit }) => {
-            const moduleDeps = await __privateMethod$3(this, _getInitDeps, getInitDeps_fn).call(this, moduleInit.init.deps, pluginId, moduleId);
+            const moduleDeps = await __privateMethod$4(this, _getInitDeps, getInitDeps_fn).call(this, moduleInit.init.deps, pluginId, moduleId);
             await moduleInit.init.func(moduleDeps).catch((error) => {
               throw new errors.ForwardedError(
                 `Module '${moduleId}' for plugin '${pluginId}' startup failed`,
@@ -1793,7 +1801,7 @@ doStart_fn = async function() {
       }
       const pluginInit = pluginInits.get(pluginId);
       if (pluginInit) {
-        const pluginDeps = await __privateMethod$3(this, _getInitDeps, getInitDeps_fn).call(this, pluginInit.init.deps, pluginId);
+        const pluginDeps = await __privateMethod$4(this, _getInitDeps, getInitDeps_fn).call(this, pluginInit.init.deps, pluginId);
         await pluginInit.init.func(pluginDeps).catch((error) => {
           throw new errors.ForwardedError(
             `Plugin '${pluginId}' startup failed`,
@@ -1801,14 +1809,14 @@ doStart_fn = async function() {
           );
         });
       }
-      const lifecycleService2 = await __privateMethod$3(this, _getPluginLifecycleImpl, getPluginLifecycleImpl_fn).call(this, pluginId);
+      const lifecycleService2 = await __privateMethod$4(this, _getPluginLifecycleImpl, getPluginLifecycleImpl_fn).call(this, pluginId);
       await lifecycleService2.startup();
     })
   );
-  const lifecycleService = await __privateMethod$3(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
+  const lifecycleService = await __privateMethod$4(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
   await lifecycleService.startup();
   if (process.env.NODE_ENV !== "test") {
-    const rootLogger = await __privateGet$3(this, _serviceRegistry).get(
+    const rootLogger = await __privateGet$5(this, _serviceRegistry).get(
       backendPluginApi.coreServices.rootLogger,
       "root"
     );
@@ -1824,7 +1832,7 @@ doStart_fn = async function() {
 };
 _getRootLifecycleImpl = new WeakSet();
 getRootLifecycleImpl_fn = async function() {
-  const lifecycleService = await __privateGet$3(this, _serviceRegistry).get(
+  const lifecycleService = await __privateGet$5(this, _serviceRegistry).get(
     backendPluginApi.coreServices.rootLifecycle,
     "root"
   );
@@ -1835,7 +1843,7 @@ getRootLifecycleImpl_fn = async function() {
 };
 _getPluginLifecycleImpl = new WeakSet();
 getPluginLifecycleImpl_fn = async function(pluginId) {
-  const lifecycleService = await __privateGet$3(this, _serviceRegistry).get(
+  const lifecycleService = await __privateGet$5(this, _serviceRegistry).get(
     backendPluginApi.coreServices.lifecycle,
     pluginId
   );
@@ -1851,42 +1859,42 @@ function isInternalBackendFeature(feature) {
   return typeof feature.getRegistrations === "function";
 }
 
-var __accessCheck$3 = (obj, member, msg) => {
+var __accessCheck$5 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
 };
-var __privateGet$2 = (obj, member, getter) => {
-  __accessCheck$3(obj, member, "read from private field");
+var __privateGet$4 = (obj, member, getter) => {
+  __accessCheck$5(obj, member, "read from private field");
   return getter ? getter.call(obj) : member.get(obj);
 };
-var __privateAdd$3 = (obj, member, value) => {
+var __privateAdd$5 = (obj, member, value) => {
   if (member.has(obj))
     throw TypeError("Cannot add the same private member more than once");
   member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
 };
-var __privateSet$2 = (obj, member, value, setter) => {
-  __accessCheck$3(obj, member, "write to private field");
+var __privateSet$4 = (obj, member, value, setter) => {
+  __accessCheck$5(obj, member, "write to private field");
   setter ? setter.call(obj, value) : member.set(obj, value);
   return value;
 };
 var _initializer;
 class BackstageBackend {
   constructor(defaultServiceFactories) {
-    __privateAdd$3(this, _initializer, void 0);
-    __privateSet$2(this, _initializer, new BackendInitializer(defaultServiceFactories));
+    __privateAdd$5(this, _initializer, void 0);
+    __privateSet$4(this, _initializer, new BackendInitializer(defaultServiceFactories));
   }
   add(feature) {
     if (isPromise(feature)) {
-      __privateGet$2(this, _initializer).add(feature.then((f) => unwrapFeature(f.default)));
+      __privateGet$4(this, _initializer).add(feature.then((f) => unwrapFeature(f.default)));
     } else {
-      __privateGet$2(this, _initializer).add(unwrapFeature(feature));
+      __privateGet$4(this, _initializer).add(unwrapFeature(feature));
     }
   }
   async start() {
-    await __privateGet$2(this, _initializer).start();
+    await __privateGet$4(this, _initializer).start();
   }
   async stop() {
-    await __privateGet$2(this, _initializer).stop();
+    await __privateGet$4(this, _initializer).stop();
   }
 }
 _initializer = new WeakMap();
@@ -1932,6 +1940,450 @@ function createSpecializedBackend(options) {
   return new BackstageBackend(services);
 }
 
+var __accessCheck$4 = (obj, member, msg) => {
+  if (!member.has(obj))
+    throw TypeError("Cannot " + msg);
+};
+var __privateGet$3 = (obj, member, getter) => {
+  __accessCheck$4(obj, member, "read from private field");
+  return getter ? getter.call(obj) : member.get(obj);
+};
+var __privateAdd$4 = (obj, member, value) => {
+  if (member.has(obj))
+    throw TypeError("Cannot add the same private member more than once");
+  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+};
+var __privateSet$3 = (obj, member, value, setter) => {
+  __accessCheck$4(obj, member, "write to private field");
+  setter ? setter.call(obj, value) : member.set(obj, value);
+  return value;
+};
+var _keyStore, _keyStoreUpdated;
+const CLOCK_MARGIN_S = 10;
+class JwksClient {
+  constructor(getEndpoint) {
+    this.getEndpoint = getEndpoint;
+    __privateAdd$4(this, _keyStore, void 0);
+    __privateAdd$4(this, _keyStoreUpdated, 0);
+  }
+  get getKey() {
+    if (!__privateGet$3(this, _keyStore)) {
+      throw new errors.AuthenticationError(
+        "refreshKeyStore must be called before jwksClient.getKey"
+      );
+    }
+    return __privateGet$3(this, _keyStore);
+  }
+  /**
+   * If the last keystore refresh is stale, update the keystore URL to the latest
+   */
+  async refreshKeyStore(rawJwtToken) {
+    const payload = await jose.decodeJwt(rawJwtToken);
+    const header = await jose.decodeProtectedHeader(rawJwtToken);
+    let keyStoreHasKey;
+    try {
+      if (__privateGet$3(this, _keyStore)) {
+        const [_, rawPayload, rawSignature] = rawJwtToken.split(".");
+        keyStoreHasKey = await __privateGet$3(this, _keyStore).call(this, header, {
+          payload: rawPayload,
+          signature: rawSignature
+        });
+      }
+    } catch (error) {
+      keyStoreHasKey = false;
+    }
+    const issuedAfterLastRefresh = (payload == null ? void 0 : payload.iat) && payload.iat > __privateGet$3(this, _keyStoreUpdated) - CLOCK_MARGIN_S;
+    if (!__privateGet$3(this, _keyStore) || !keyStoreHasKey && issuedAfterLastRefresh) {
+      const endpoint = await this.getEndpoint();
+      __privateSet$3(this, _keyStore, jose.createRemoteJWKSet(endpoint));
+      __privateSet$3(this, _keyStoreUpdated, Date.now() / 1e3);
+    }
+  }
+}
+_keyStore = new WeakMap();
+_keyStoreUpdated = new WeakMap();
+
+var __accessCheck$3 = (obj, member, msg) => {
+  if (!member.has(obj))
+    throw TypeError("Cannot " + msg);
+};
+var __privateGet$2 = (obj, member, getter) => {
+  __accessCheck$3(obj, member, "read from private field");
+  return getter ? getter.call(obj) : member.get(obj);
+};
+var __privateAdd$3 = (obj, member, value) => {
+  if (member.has(obj))
+    throw TypeError("Cannot add the same private member more than once");
+  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+};
+var __privateSet$2 = (obj, member, value, setter) => {
+  __accessCheck$3(obj, member, "write to private field");
+  setter ? setter.call(obj, value) : member.set(obj, value);
+  return value;
+};
+var __privateMethod$3 = (obj, member, method) => {
+  __accessCheck$3(obj, member, "access private method");
+  return method;
+};
+var _jwksClient, _algorithms, _getTokenVerificationOptions, getTokenVerificationOptions_fn;
+class UserTokenHandler {
+  constructor(options) {
+    __privateAdd$3(this, _getTokenVerificationOptions);
+    __privateAdd$3(this, _jwksClient, void 0);
+    __privateAdd$3(this, _algorithms, void 0);
+    __privateSet$2(this, _algorithms, ["ES256"]);
+    __privateSet$2(this, _jwksClient, new JwksClient(async () => {
+      const url = await options.discovery.getBaseUrl("auth");
+      return new URL(`${url}/.well-known/jwks.json`);
+    }));
+  }
+  async verifyToken(token) {
+    const verifyOpts = __privateMethod$3(this, _getTokenVerificationOptions, getTokenVerificationOptions_fn).call(this, token);
+    if (!verifyOpts) {
+      return void 0;
+    }
+    await __privateGet$2(this, _jwksClient).refreshKeyStore(token);
+    const { payload } = await jose.jwtVerify(
+      token,
+      __privateGet$2(this, _jwksClient).getKey,
+      verifyOpts
+    ).catch((e) => {
+      throw new errors.AuthenticationError("Invalid token", e);
+    });
+    const userEntityRef = payload.sub;
+    if (!userEntityRef) {
+      throw new errors.AuthenticationError("No user sub found in token");
+    }
+    return { userEntityRef };
+  }
+  createLimitedUserToken(backstageToken) {
+    const [headerRaw, payloadRaw] = backstageToken.split(".");
+    const header = JSON.parse(
+      new TextDecoder().decode(jose.base64url.decode(headerRaw))
+    );
+    const payload = JSON.parse(
+      new TextDecoder().decode(jose.base64url.decode(payloadRaw))
+    );
+    const tokenType = header.typ;
+    if (!tokenType || tokenType === pluginAuthNode.tokenTypes.limitedUser.typParam) {
+      return { token: backstageToken, expiresAt: new Date(payload.exp * 1e3) };
+    }
+    if (tokenType !== pluginAuthNode.tokenTypes.user.typParam) {
+      throw new errors.AuthenticationError(
+        "Failed to create limited user token, invalid token type"
+      );
+    }
+    const limitedUserToken = [
+      jose.base64url.encode(
+        JSON.stringify({
+          typ: pluginAuthNode.tokenTypes.limitedUser.typParam,
+          alg: header.alg,
+          kid: header.kid
+        })
+      ),
+      jose.base64url.encode(
+        JSON.stringify({
+          sub: payload.sub,
+          ent: payload.ent,
+          iat: payload.iat,
+          exp: payload.exp
+        })
+      ),
+      payload.uip
+    ].join(".");
+    return { token: limitedUserToken, expiresAt: new Date(payload.exp * 1e3) };
+  }
+  isLimitedUserToken(token) {
+    try {
+      const { typ } = jose.decodeProtectedHeader(token);
+      return typ === pluginAuthNode.tokenTypes.limitedUser.typParam;
+    } catch {
+      return false;
+    }
+  }
+}
+_jwksClient = new WeakMap();
+_algorithms = new WeakMap();
+_getTokenVerificationOptions = new WeakSet();
+getTokenVerificationOptions_fn = function(token) {
+  try {
+    const { typ } = jose.decodeProtectedHeader(token);
+    if (typ === pluginAuthNode.tokenTypes.user.typParam) {
+      return {
+        algorithms: __privateGet$2(this, _algorithms),
+        requiredClaims: ["iat", "exp", "sub"],
+        typ: pluginAuthNode.tokenTypes.user.typParam
+      };
+    }
+    if (typ === pluginAuthNode.tokenTypes.limitedUser.typParam) {
+      return {
+        algorithms: __privateGet$2(this, _algorithms),
+        requiredClaims: ["iat", "exp", "sub"],
+        typ: pluginAuthNode.tokenTypes.limitedUser.typParam
+      };
+    }
+    const { aud } = jose.decodeJwt(token);
+    if (aud === pluginAuthNode.tokenTypes.user.audClaim) {
+      return {
+        algorithms: __privateGet$2(this, _algorithms),
+        audience: pluginAuthNode.tokenTypes.user.audClaim
+      };
+    }
+  } catch {
+  }
+  return void 0;
+};
+
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => {
+  __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+  return value;
+};
+const KEY_EXPIRATION_MARGIN_FACTOR = 3;
+const SECONDS_IN_MS = 1e3;
+const ALLOWED_PLUGIN_ID_PATTERN = /^[a-z0-9_-]+$/i;
+class PluginTokenHandler {
+  constructor(logger, ownPluginId, publicKeyStore, keyDurationSeconds, algorithm, discovery) {
+    this.logger = logger;
+    this.ownPluginId = ownPluginId;
+    this.publicKeyStore = publicKeyStore;
+    this.keyDurationSeconds = keyDurationSeconds;
+    this.algorithm = algorithm;
+    this.discovery = discovery;
+    __publicField(this, "privateKeyPromise");
+    __publicField(this, "keyExpiry");
+    __publicField(this, "jwksMap", /* @__PURE__ */ new Map());
+    // Tracking state for isTargetPluginSupported
+    __publicField(this, "supportedTargetPlugins", /* @__PURE__ */ new Set());
+    __publicField(this, "targetPluginInflightChecks", /* @__PURE__ */ new Map());
+  }
+  static create(options) {
+    var _a;
+    return new PluginTokenHandler(
+      options.logger,
+      options.ownPluginId,
+      options.publicKeyStore,
+      options.keyDurationSeconds,
+      (_a = options.algorithm) != null ? _a : "ES256",
+      options.discovery
+    );
+  }
+  async verifyToken(token) {
+    try {
+      const { typ } = jose.decodeProtectedHeader(token);
+      if (typ !== pluginAuthNode.tokenTypes.plugin.typParam) {
+        return void 0;
+      }
+    } catch {
+      return void 0;
+    }
+    const pluginId = String(jose.decodeJwt(token).sub);
+    if (!pluginId) {
+      throw new errors.AuthenticationError("Invalid plugin token: missing subject");
+    }
+    if (!ALLOWED_PLUGIN_ID_PATTERN.test(pluginId)) {
+      throw new errors.AuthenticationError(
+        "Invalid plugin token: forbidden subject format"
+      );
+    }
+    const jwksClient = await this.getJwksClient(pluginId);
+    await jwksClient.refreshKeyStore(token);
+    const { payload } = await jose.jwtVerify(
+      token,
+      jwksClient.getKey,
+      {
+        typ: pluginAuthNode.tokenTypes.plugin.typParam,
+        audience: this.ownPluginId,
+        requiredClaims: ["iat", "exp", "sub", "aud"]
+      }
+    ).catch((e) => {
+      throw new errors.AuthenticationError("Invalid plugin token", e);
+    });
+    return { subject: `plugin:${payload.sub}`, limitedUserToken: payload.obo };
+  }
+  async issueToken(options) {
+    const { pluginId, targetPluginId, onBehalfOf } = options;
+    const key = await this.getKey();
+    const sub = pluginId;
+    const aud = targetPluginId;
+    const iat = Math.floor(Date.now() / SECONDS_IN_MS);
+    const ourExp = iat + this.keyDurationSeconds;
+    const exp = onBehalfOf ? Math.min(
+      ourExp,
+      Math.floor(onBehalfOf.expiresAt.getTime() / SECONDS_IN_MS)
+    ) : ourExp;
+    const claims = { sub, aud, iat, exp, obo: onBehalfOf == null ? void 0 : onBehalfOf.token };
+    const token = await new jose.SignJWT(claims).setProtectedHeader({
+      typ: pluginAuthNode.tokenTypes.plugin.typParam,
+      alg: this.algorithm,
+      kid: key.kid
+    }).setAudience(aud).setSubject(sub).setIssuedAt(iat).setExpirationTime(exp).sign(await jose.importJWK(key));
+    return { token };
+  }
+  async isTargetPluginSupported(targetPluginId) {
+    if (this.supportedTargetPlugins.has(targetPluginId)) {
+      return true;
+    }
+    const inFlight = this.targetPluginInflightChecks.get(targetPluginId);
+    if (inFlight) {
+      return inFlight;
+    }
+    const doCheck = async () => {
+      try {
+        const res = await fetch(
+          `${await this.discovery.getBaseUrl(
+            targetPluginId
+          )}/.backstage/auth/v1/jwks.json`
+        );
+        if (res.status === 404) {
+          return false;
+        }
+        if (!res.ok) {
+          throw new Error(`Failed to fetch jwks.json, ${res.status}`);
+        }
+        const data = await res.json();
+        if (!data.keys) {
+          throw new Error(`Invalid jwks.json response, missing keys`);
+        }
+        this.supportedTargetPlugins.add(targetPluginId);
+        return true;
+      } catch (error) {
+        this.logger.error("Unexpected failure for target JWKS check", error);
+        return false;
+      } finally {
+        this.targetPluginInflightChecks.delete(targetPluginId);
+      }
+    };
+    const check = doCheck();
+    this.targetPluginInflightChecks.set(targetPluginId, check);
+    return check;
+  }
+  async getJwksClient(pluginId) {
+    const client = this.jwksMap.get(pluginId);
+    if (client) {
+      return client;
+    }
+    if (!await this.isTargetPluginSupported(pluginId)) {
+      throw new errors.AuthenticationError(
+        `Received a plugin token where the source '${pluginId}' plugin unexpectedly does not have a JWKS endpoint`
+      );
+    }
+    const newClient = new JwksClient(async () => {
+      return new URL(
+        `${await this.discovery.getBaseUrl(
+          pluginId
+        )}/.backstage/auth/v1/jwks.json`
+      );
+    });
+    this.jwksMap.set(pluginId, newClient);
+    return newClient;
+  }
+  async getKey() {
+    if (this.privateKeyPromise) {
+      if (this.keyExpiry && this.keyExpiry.getTime() > Date.now()) {
+        return this.privateKeyPromise;
+      }
+      this.logger.info(`Signing key has expired, generating new key`);
+      delete this.privateKeyPromise;
+    }
+    this.keyExpiry = new Date(
+      Date.now() + this.keyDurationSeconds * SECONDS_IN_MS
+    );
+    const promise = (async () => {
+      const kid = uuid.v4();
+      const key = await jose.generateKeyPair(this.algorithm);
+      const publicKey = await jose.exportJWK(key.publicKey);
+      const privateKey = await jose.exportJWK(key.privateKey);
+      publicKey.kid = privateKey.kid = kid;
+      publicKey.alg = privateKey.alg = this.algorithm;
+      this.logger.info(`Created new signing key ${kid}`);
+      await this.publicKeyStore.addKey({
+        id: kid,
+        key: publicKey,
+        expiresAt: new Date(
+          Date.now() + this.keyDurationSeconds * SECONDS_IN_MS * KEY_EXPIRATION_MARGIN_FACTOR
+        )
+      });
+      return privateKey;
+    })();
+    this.privateKeyPromise = promise;
+    try {
+      await promise;
+    } catch (error) {
+      this.logger.error(`Failed to generate new signing key, ${error}`);
+      delete this.keyExpiry;
+      delete this.privateKeyPromise;
+    }
+    return promise;
+  }
+}
+
+const MIGRATIONS_TABLE = "backstage_backend_public_keys__knex_migrations";
+const TABLE = "backstage_backend_public_keys__keys";
+function applyDatabaseMigrations(knex) {
+  const migrationsDir = backendCommon.resolvePackagePath(
+    "@backstage/backend-app-api",
+    "migrations"
+  );
+  return knex.migrate.latest({
+    directory: migrationsDir,
+    tableName: MIGRATIONS_TABLE
+  });
+}
+class DatabaseKeyStore {
+  constructor(client, logger) {
+    this.client = client;
+    this.logger = logger;
+  }
+  static async create(options) {
+    var _a;
+    const { database, logger } = options;
+    const client = await database.getClient();
+    if (!((_a = database.migrations) == null ? void 0 : _a.skip)) {
+      await applyDatabaseMigrations(client);
+    }
+    return new DatabaseKeyStore(client, logger);
+  }
+  async addKey(options) {
+    await this.client(TABLE).insert({
+      id: options.key.kid,
+      key: JSON.stringify(options.key),
+      expires_at: options.expiresAt.toISOString()
+    });
+  }
+  async listKeys() {
+    const rows = await this.client(TABLE).select();
+    const keys = rows.map((row) => ({
+      id: row.id,
+      key: JSON.parse(row.key),
+      expiresAt: new Date(row.expires_at)
+    }));
+    const validKeys = [];
+    const expiredKeys = [];
+    for (const key of keys) {
+      if (luxon.DateTime.fromJSDate(key.expiresAt) < luxon.DateTime.local()) {
+        expiredKeys.push(key);
+      } else {
+        validKeys.push(key);
+      }
+    }
+    if (expiredKeys.length > 0) {
+      const kids = expiredKeys.map(({ key }) => key.kid);
+      this.logger.info(
+        `Removing expired plugin service keys, '${kids.join("', '")}'`
+      );
+      this.client(TABLE).delete().whereIn("id", kids).catch((error) => {
+        this.logger.error(
+          "Failed to remove expired plugin service keys",
+          error
+        );
+      });
+    }
+    return { keys: validKeys };
+  }
+}
+
 var __accessCheck$2 = (obj, member, msg) => {
   if (!member.has(obj))
     throw TypeError("Cannot " + msg);
@@ -1991,33 +2443,50 @@ function toInternalBackstageCredentials(credentials) {
   return internalCredentials;
 }
 class DefaultAuthService {
-  constructor(tokenManager, identity, pluginId, disableDefaultAuthPolicy) {
+  constructor(tokenManager, userTokenHandler, pluginId, disableDefaultAuthPolicy, publicKeyStore, pluginTokenHandler) {
     this.tokenManager = tokenManager;
-    this.identity = identity;
+    this.userTokenHandler = userTokenHandler;
     this.pluginId = pluginId;
     this.disableDefaultAuthPolicy = disableDefaultAuthPolicy;
+    this.publicKeyStore = publicKeyStore;
+    this.pluginTokenHandler = pluginTokenHandler;
     __privateAdd$2(this, _getJwtExpiration);
   }
   // allowLimitedAccess is currently ignored, since we currently always use the full user tokens
   async authenticate(token) {
+    const pluginResult = await this.pluginTokenHandler.verifyToken(token);
+    if (pluginResult) {
+      if (pluginResult.limitedUserToken) {
+        const userResult2 = await this.userTokenHandler.verifyToken(
+          pluginResult.limitedUserToken
+        );
+        if (!userResult2) {
+          throw new errors.AuthenticationError(
+            "Invalid user token in plugin token obo claim"
+          );
+        }
+        return createCredentialsWithUserPrincipal(
+          userResult2.userEntityRef,
+          pluginResult.limitedUserToken,
+          __privateMethod$2(this, _getJwtExpiration, getJwtExpiration_fn).call(this, pluginResult.limitedUserToken)
+        );
+      }
+      return createCredentialsWithServicePrincipal(pluginResult.subject);
+    }
+    const userResult = await this.userTokenHandler.verifyToken(token);
+    if (userResult) {
+      return createCredentialsWithUserPrincipal(
+        userResult.userEntityRef,
+        token,
+        __privateMethod$2(this, _getJwtExpiration, getJwtExpiration_fn).call(this, token)
+      );
+    }
     const { sub, aud } = jose.decodeJwt(token);
     if (sub === "backstage-server" && !aud) {
       await this.tokenManager.authenticate(token);
       return createCredentialsWithServicePrincipal("external:backstage-plugin");
     }
-    const identity = await this.identity.getIdentity({
-      request: {
-        headers: { authorization: `Bearer ${token}` }
-      }
-    });
-    if (!identity) {
-      throw new errors.AuthenticationError("Invalid user token");
-    }
-    return createCredentialsWithUserPrincipal(
-      identity.identity.userEntityRef,
-      token,
-      __privateMethod$2(this, _getJwtExpiration, getJwtExpiration_fn).call(this, token)
-    );
+    throw new errors.AuthenticationError("Unknown token");
   }
   isPrincipal(credentials, type) {
     const principal = credentials.principal;
@@ -2036,19 +2505,44 @@ class DefaultAuthService {
     return createCredentialsWithServicePrincipal(`plugin:${this.pluginId}`);
   }
   async getPluginRequestToken(options) {
+    const { targetPluginId } = options;
     const internalForward = toInternalBackstageCredentials(options.onBehalfOf);
     const { type } = internalForward.principal;
     if (type === "none" && this.disableDefaultAuthPolicy) {
       return { token: "" };
     }
+    const targetSupportsNewAuth = await this.pluginTokenHandler.isTargetPluginSupported(targetPluginId);
     switch (type) {
       case "service":
+        if (targetSupportsNewAuth) {
+          return this.pluginTokenHandler.issueToken({
+            pluginId: this.pluginId,
+            targetPluginId
+          });
+        }
         return this.tokenManager.getToken();
-      case "user":
-        if (!internalForward.token) {
+      case "user": {
+        const { token } = internalForward;
+        if (!token) {
           throw new Error("User credentials is unexpectedly missing token");
         }
-        return { token: internalForward.token };
+        if (targetSupportsNewAuth) {
+          const onBehalfOf = await this.userTokenHandler.createLimitedUserToken(
+            token
+          );
+          return this.pluginTokenHandler.issueToken({
+            pluginId: this.pluginId,
+            targetPluginId,
+            onBehalfOf
+          });
+        }
+        if (this.userTokenHandler.isLimitedUserToken(token)) {
+          throw new errors.AuthenticationError(
+            `Unable to call '${targetPluginId}' plugin on behalf of user, because the target plugin does not support on-behalf-of tokens`
+          );
+        }
+        return { token };
+      }
       default:
         throw new errors.AuthenticationError(
           `Refused to issue service token for credential type '${type}'`
@@ -2056,14 +2550,17 @@ class DefaultAuthService {
     }
   }
   async getLimitedUserToken(credentials) {
-    const internalCredentials = toInternalBackstageCredentials(credentials);
-    const { token } = internalCredentials;
-    if (!token) {
+    const { token: backstageToken } = toInternalBackstageCredentials(credentials);
+    if (!backstageToken) {
       throw new errors.AuthenticationError(
         "User credentials is unexpectedly missing token"
       );
     }
-    return { token, expiresAt: __privateMethod$2(this, _getJwtExpiration, getJwtExpiration_fn).call(this, token) };
+    return this.userTokenHandler.createLimitedUserToken(backstageToken);
+  }
+  async listPublicServiceKeys() {
+    const { keys } = await this.publicKeyStore.listKeys();
+    return { keys: keys.map(({ key }) => key) };
   }
 }
 _getJwtExpiration = new WeakSet();
@@ -2079,25 +2576,35 @@ const authServiceFactory = backendPluginApi.createServiceFactory({
   deps: {
     config: backendPluginApi.coreServices.rootConfig,
     logger: backendPluginApi.coreServices.rootLogger,
+    discovery: backendPluginApi.coreServices.discovery,
     plugin: backendPluginApi.coreServices.pluginMetadata,
-    identity: backendPluginApi.coreServices.identity,
+    database: backendPluginApi.coreServices.database,
     // Re-using the token manager makes sure that we use the same generated keys for
     // development as plugins that have not yet been migrated. It's important that this
     // keeps working as long as there are plugins that have not been migrated to the
     // new auth services in the new backend system.
     tokenManager: backendPluginApi.coreServices.tokenManager
   },
-  async factory({ config, plugin, identity, tokenManager }) {
+  async factory({ config, discovery, plugin, tokenManager, logger, database }) {
     const disableDefaultAuthPolicy = Boolean(
       config.getOptionalBoolean(
         "backend.auth.dangerouslyDisableDefaultAuthPolicy"
       )
     );
+    const publicKeyStore = await DatabaseKeyStore.create({ database, logger });
     return new DefaultAuthService(
       tokenManager,
-      identity,
+      new UserTokenHandler({ discovery }),
       plugin.getId(),
-      disableDefaultAuthPolicy
+      disableDefaultAuthPolicy,
+      publicKeyStore,
+      PluginTokenHandler.create({
+        ownPluginId: plugin.getId(),
+        keyDurationSeconds: 60 * 60,
+        logger,
+        publicKeyStore,
+        discovery
+      })
     );
   }
 });
@@ -2269,7 +2776,7 @@ var __privateMethod$1 = (obj, member, method) => {
   __accessCheck$1(obj, member, "access private method");
   return method;
 };
-var _auth, _discovery, _pluginId, _extractCredentialsFromRequest, extractCredentialsFromRequest_fn, _extractLimitedCredentialsFromRequest, extractLimitedCredentialsFromRequest_fn, _getCredentials, getCredentials_fn, _getLimitedCredentials, getLimitedCredentials_fn, _existingCookieExpiration, existingCookieExpiration_fn;
+var _auth, _discovery, _pluginId, _extractCredentialsFromRequest, extractCredentialsFromRequest_fn, _extractLimitedCredentialsFromRequest, extractLimitedCredentialsFromRequest_fn, _getCredentials, getCredentials_fn, _getLimitedCredentials, getLimitedCredentials_fn, _getCookieOptions, getCookieOptions_fn, _existingCookieExpiration, existingCookieExpiration_fn;
 const FIVE_MINUTES_MS = 5 * 60 * 1e3;
 const BACKSTAGE_AUTH_COOKIE = "backstage-auth";
 function getTokenFromRequest(req) {
@@ -2305,6 +2812,7 @@ class DefaultHttpAuthService {
     __privateAdd$1(this, _extractLimitedCredentialsFromRequest);
     __privateAdd$1(this, _getCredentials);
     __privateAdd$1(this, _getLimitedCredentials);
+    __privateAdd$1(this, _getCookieOptions);
     __privateAdd$1(this, _existingCookieExpiration);
     __privateAdd$1(this, _auth, void 0);
     __privateAdd$1(this, _discovery, void 0);
@@ -2349,6 +2857,13 @@ class DefaultHttpAuthService {
     }
     let credentials;
     if (options == null ? void 0 : options.credentials) {
+      if (__privateGet$1(this, _auth).isPrincipal(options.credentials, "none")) {
+        res.clearCookie(
+          BACKSTAGE_AUTH_COOKIE,
+          await __privateMethod$1(this, _getCookieOptions, getCookieOptions_fn).call(this, res.req)
+        );
+        return { expiresAt: /* @__PURE__ */ new Date() };
+      }
       if (!__privateGet$1(this, _auth).isPrincipal(options.credentials, "user")) {
         throw new errors.AuthenticationError(
           "Refused to issue cookie for non-user principal"
@@ -2362,26 +2877,15 @@ class DefaultHttpAuthService {
     if (existingExpiresAt && !willExpireSoon(existingExpiresAt)) {
       return { expiresAt: existingExpiresAt };
     }
-    const originHeader = res.req.headers.origin;
-    const origin = !originHeader || originHeader === "null" ? void 0 : originHeader;
-    const externalBaseUrlStr = await __privateGet$1(this, _discovery).getExternalBaseUrl(
-      __privateGet$1(this, _pluginId)
-    );
-    const externalBaseUrl = new URL(origin != null ? origin : externalBaseUrlStr);
     const { token, expiresAt } = await __privateGet$1(this, _auth).getLimitedUserToken(
       credentials
     );
     if (!token) {
       throw new Error("User credentials is unexpectedly missing token");
     }
-    const secure = externalBaseUrl.protocol === "https:" || externalBaseUrl.hostname === "localhost";
     res.cookie(BACKSTAGE_AUTH_COOKIE, token, {
-      domain: externalBaseUrl.hostname,
-      httpOnly: true,
-      expires: expiresAt,
-      secure,
-      priority: "high",
-      sameSite: secure ? "none" : "lax"
+      ...await __privateMethod$1(this, _getCookieOptions, getCookieOptions_fn).call(this, res.req),
+      expires: expiresAt
     });
     return { expiresAt };
   }
@@ -2423,6 +2927,23 @@ getLimitedCredentials_fn = async function(req) {
   var _a;
   return (_a = req[limitedCredentialsSymbol]) != null ? _a : req[limitedCredentialsSymbol] = __privateMethod$1(this, _extractLimitedCredentialsFromRequest, extractLimitedCredentialsFromRequest_fn).call(this, req);
 };
+_getCookieOptions = new WeakSet();
+getCookieOptions_fn = async function(req) {
+  const originHeader = req.headers.origin;
+  const origin = !originHeader || originHeader === "null" ? void 0 : originHeader;
+  const externalBaseUrlStr = await __privateGet$1(this, _discovery).getExternalBaseUrl(
+    __privateGet$1(this, _pluginId)
+  );
+  const externalBaseUrl = new URL(origin != null ? origin : externalBaseUrlStr);
+  const secure = externalBaseUrl.protocol === "https:" || externalBaseUrl.hostname === "localhost";
+  return {
+    domain: externalBaseUrl.hostname,
+    httpOnly: true,
+    secure,
+    priority: "high",
+    sameSite: secure ? "none" : "lax"
+  };
+};
 _existingCookieExpiration = new WeakSet();
 existingCookieExpiration_fn = async function(req) {
   const existingCookie = getCookieFromRequest(req);
@@ -2559,25 +3080,71 @@ function createCredentialsBarrier(options) {
   return { middleware, addAuthPolicy };
 }
 
+function createAuthIntegrationRouter(options) {
+  const router = Router__default.default();
+  router.get("/.backstage/auth/v1/jwks.json", async (_req, res) => {
+    const { keys } = await options.auth.listPublicServiceKeys();
+    res.json({ keys });
+  });
+  return router;
+}
+
+const WELL_KNOWN_COOKIE_PATH_V1 = "/.backstage/auth/v1/cookie";
+function createCookieAuthRefreshMiddleware(options) {
+  const { auth, httpAuth } = options;
+  const router = Router__default.default();
+  router.get(WELL_KNOWN_COOKIE_PATH_V1, async (_, res) => {
+    const { expiresAt } = await httpAuth.issueUserCookie(res);
+    res.json({ expiresAt: expiresAt.toISOString() });
+  });
+  router.delete(WELL_KNOWN_COOKIE_PATH_V1, async (_, res) => {
+    const credentials = await auth.getNoneCredentials();
+    await httpAuth.issueUserCookie(res, { credentials });
+    res.status(204).end();
+  });
+  return router;
+}
+
 const httpRouterServiceFactory = backendPluginApi.createServiceFactory(
   (options) => ({
     service: backendPluginApi.coreServices.httpRouter,
+    initialization: "always",
     deps: {
       plugin: backendPluginApi.coreServices.pluginMetadata,
       config: backendPluginApi.coreServices.rootConfig,
+      logger: backendPluginApi.coreServices.logger,
       lifecycle: backendPluginApi.coreServices.lifecycle,
       rootHttpRouter: backendPluginApi.coreServices.rootHttpRouter,
+      auth: backendPluginApi.coreServices.auth,
       httpAuth: backendPluginApi.coreServices.httpAuth
     },
-    async factory({ httpAuth, config, plugin, rootHttpRouter, lifecycle }) {
+    async factory({
+      auth,
+      httpAuth,
+      config,
+      logger,
+      plugin,
+      rootHttpRouter,
+      lifecycle
+    }) {
       var _a;
+      if (options == null ? void 0 : options.getPath) {
+        logger.warn(
+          `DEPRECATION WARNING: The 'getPath' option for HttpRouterService is deprecated. The ability to reconfigure the '/api/' path prefix for plugins will be removed in the future.`
+        );
+      }
       const getPath = (_a = options == null ? void 0 : options.getPath) != null ? _a : (id) => `/api/${id}`;
       const path = getPath(plugin.getId());
-      const router = PromiseRouter__default.default();
+      const router = Router__default.default();
       rootHttpRouter.use(path, router);
-      const credentialsBarrier = createCredentialsBarrier({ httpAuth, config });
+      const credentialsBarrier = createCredentialsBarrier({
+        httpAuth,
+        config
+      });
       router.use(createLifecycleMiddleware({ lifecycle }));
+      router.use(createAuthIntegrationRouter({ auth }));
       router.use(credentialsBarrier.middleware);
+      router.use(createCookieAuthRefreshMiddleware({ auth, httpAuth }));
       return {
         use(handler) {
           router.use(handler);
@@ -2666,6 +3233,9 @@ const _DefaultRootHttpRouter = class _DefaultRootHttpRouter {
     __privateAdd(this, _existingPaths, new Array());
     __privateSet(this, _indexPath, indexPath);
     __privateGet(this, _router).use(__privateGet(this, _namedRoutes));
+    __privateGet(this, _router).use("/api/", (_req, _res, next) => {
+      next("router");
+    });
     if (__privateGet(this, _indexPath)) {
       __privateGet(this, _router).use(__privateGet(this, _indexRouter));
     }