@backstage/backend-app-api 0.7.5 → 0.7.6-next.1

package/dist/index.cjs.js

@@ -73,22 +73,16 @@ var Router__default = /*#__PURE__*/_interopDefaultCompat(Router);
 var express__default = /*#__PURE__*/_interopDefaultCompat(express);
 var trimEnd__default = /*#__PURE__*/_interopDefaultCompat(trimEnd);
 
-var __defProp$1 = Object.defineProperty;
-var __defNormalProp$1 = (obj, key, value) => key in obj ? __defProp$1(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField$1 = (obj, key, value) => {
-  __defNormalProp$1(obj, typeof key !== "symbol" ? key + "" : key, value);
-  return value;
-};
 class ObservableConfigProxy {
   constructor(parent, parentKey) {
     this.parent = parent;
     this.parentKey = parentKey;
-    __publicField$1(this, "config", new config.ConfigReader({}));
-    __publicField$1(this, "subscribers", []);
     if (parent && !parentKey) {
       throw new Error("parentKey is required if parent is set");
     }
   }
+  config = new config.ConfigReader({});
+  subscribers = [];
   setConfig(config) {
     if (this.parent) {
       throw new Error("immutable");
@@ -117,36 +111,31 @@ class ObservableConfigProxy {
     };
   }
   select(required) {
-    var _a;
     if (this.parent && this.parentKey) {
       if (required) {
         return this.parent.select(true).getConfig(this.parentKey);
       }
-      return (_a = this.parent.select(false)) == null ? void 0 : _a.getOptionalConfig(this.parentKey);
+      return this.parent.select(false)?.getOptionalConfig(this.parentKey);
     }
     return this.config;
   }
   has(key) {
-    var _a, _b;
-    return (_b = (_a = this.select(false)) == null ? void 0 : _a.has(key)) != null ? _b : false;
+    return this.select(false)?.has(key) ?? false;
   }
   keys() {
-    var _a, _b;
-    return (_b = (_a = this.select(false)) == null ? void 0 : _a.keys()) != null ? _b : [];
+    return this.select(false)?.keys() ?? [];
   }
   get(key) {
     return this.select(true).get(key);
   }
   getOptional(key) {
-    var _a;
-    return (_a = this.select(false)) == null ? void 0 : _a.getOptional(key);
+    return this.select(false)?.getOptional(key);
   }
   getConfig(key) {
     return new ObservableConfigProxy(this, key);
   }
   getOptionalConfig(key) {
-    var _a;
-    if ((_a = this.select(false)) == null ? void 0 : _a.has(key)) {
+    if (this.select(false)?.has(key)) {
       return new ObservableConfigProxy(this, key);
     }
     return void 0;
@@ -155,36 +144,31 @@ class ObservableConfigProxy {
     return this.select(true).getConfigArray(key);
   }
   getOptionalConfigArray(key) {
-    var _a;
-    return (_a = this.select(false)) == null ? void 0 : _a.getOptionalConfigArray(key);
+    return this.select(false)?.getOptionalConfigArray(key);
   }
   getNumber(key) {
     return this.select(true).getNumber(key);
   }
   getOptionalNumber(key) {
-    var _a;
-    return (_a = this.select(false)) == null ? void 0 : _a.getOptionalNumber(key);
+    return this.select(false)?.getOptionalNumber(key);
   }
   getBoolean(key) {
     return this.select(true).getBoolean(key);
   }
   getOptionalBoolean(key) {
-    var _a;
-    return (_a = this.select(false)) == null ? void 0 : _a.getOptionalBoolean(key);
+    return this.select(false)?.getOptionalBoolean(key);
   }
   getString(key) {
     return this.select(true).getString(key);
   }
   getOptionalString(key) {
-    var _a;
-    return (_a = this.select(false)) == null ? void 0 : _a.getOptionalString(key);
+    return this.select(false)?.getOptionalString(key);
   }
   getStringArray(key) {
     return this.select(true).getStringArray(key);
   }
   getOptionalStringArray(key) {
-    var _a;
-    return (_a = this.select(false)) == null ? void 0 : _a.getOptionalStringArray(key);
+    return this.select(false)?.getOptionalStringArray(key);
   }
 }
 
@@ -198,16 +182,14 @@ function isValidUrl(url) {
 }
 
 async function createConfigSecretEnumerator(options) {
-  var _a;
   const { logger, dir = process.cwd() } = options;
   const { packages } = await getPackages.getPackages(dir);
-  const schema = (_a = options.schema) != null ? _a : await configLoader.loadConfigSchema({
+  const schema = options.schema ?? await configLoader.loadConfigSchema({
     dependencies: packages.map((p) => p.packageJson.name)
   });
   return (config) => {
-    var _a2;
     const [secretsData] = schema.process(
-      [{ data: (_a2 = config.getOptional()) != null ? _a2 : {}, context: "schema-enumerator" }],
+      [{ data: config.getOptional() ?? {}, context: "schema-enumerator" }],
       {
         visibility: ["secret"],
         ignoreSchemaErrors: true
@@ -225,9 +207,8 @@ async function createConfigSecretEnumerator(options) {
   };
 }
 async function loadBackendConfig(options) {
-  var _a, _b;
   const args = parseArgs__default.default(options.argv);
-  const configTargets = [(_a = args.config) != null ? _a : []].flat().map((arg) => isValidUrl(arg) ? { url: arg } : { path: path.resolve(arg) });
+  const configTargets = [args.config ?? []].flat().map((arg) => isValidUrl(arg) ? { url: arg } : { path: path.resolve(arg) });
   const paths = cliCommon.findPaths(__dirname);
   let currentCancelFunc = void 0;
   const config$1 = new ObservableConfigProxy();
@@ -235,7 +216,7 @@ async function loadBackendConfig(options) {
     configRoot: paths.targetRoot,
     configTargets,
     remote: options.remote,
-    watch: ((_b = options.watch) != null ? _b : true) ? {
+    watch: options.watch ?? true ? {
       onChange(newConfigs) {
         console.info(
           `Reloaded config from ${newConfigs.map((c) => c.context).join(", ")}`
@@ -277,8 +258,7 @@ function readHttpServerOptions(config) {
   };
 }
 function readHttpListenOptions(config) {
-  var _a, _b;
-  const listen = config == null ? void 0 : config.getOptional("listen");
+  const listen = config?.getOptional("listen");
   if (typeof listen === "string") {
     const parts = String(listen).split(":");
     const port = parseInt(parts[parts.length - 1], 10);
@@ -294,18 +274,18 @@ function readHttpListenOptions(config) {
       `Unable to parse listen address ${listen}, expected <port> or <host>:<port>`
     );
   }
-  const host = (_a = config == null ? void 0 : config.getOptional("listen.host")) != null ? _a : DEFAULT_HOST;
+  const host = config?.getOptional("listen.host") ?? DEFAULT_HOST;
   if (typeof host !== "string") {
-    config == null ? void 0 : config.getOptionalString("listen.host");
+    config?.getOptionalString("listen.host");
     throw new Error("unreachable");
   }
   return {
-    port: (_b = config == null ? void 0 : config.getOptionalNumber("listen.port")) != null ? _b : DEFAULT_PORT,
+    port: config?.getOptionalNumber("listen.port") ?? DEFAULT_PORT,
     host
   };
 }
 function readHttpsOptions(config) {
-  const https = config == null ? void 0 : config.getOptional("https");
+  const https = config?.getOptional("https");
   if (https === true) {
     const baseUrl = config.getString("baseUrl");
     let hostname;
@@ -316,7 +296,7 @@ function readHttpsOptions(config) {
     }
     return { certificate: { type: "generated", hostname } };
   }
-  const cc = config == null ? void 0 : config.getOptionalConfig("https");
+  const cc = config?.getOptionalConfig("https");
   if (!cc) {
     return void 0;
   }
@@ -519,7 +499,7 @@ function readHelmetOptions(config) {
   };
 }
 function readCspDirectives(config) {
-  const cc = config == null ? void 0 : config.getOptionalConfig("csp");
+  const cc = config?.getOptionalConfig("csp");
   if (!cc) {
     return void 0;
   }
@@ -551,7 +531,7 @@ function applyCspDirectives(directives) {
 }
 
 function readCorsOptions(config) {
-  const cc = config == null ? void 0 : config.getOptionalConfig("cors");
+  const cc = config?.getOptionalConfig("cors");
   if (!cc) {
     return { origin: false };
   }
@@ -590,7 +570,7 @@ function createCorsOriginMatcher(allowedOriginPatterns) {
   return (origin, callback) => {
     return callback(
       null,
-      allowedOriginMatchers.some((pattern) => pattern.match(origin != null ? origin : ""))
+      allowedOriginMatchers.some((pattern) => pattern.match(origin ?? ""))
     );
   };
 }
@@ -616,37 +596,18 @@ function applyInternalErrorFilter(error, logger) {
   return error;
 }
 
-var __accessCheck$e = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateGet$c = (obj, member, getter) => {
-  __accessCheck$e(obj, member, "read from private field");
-  return member.get(obj);
-};
-var __privateAdd$e = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var __privateSet$a = (obj, member, value, setter) => {
-  __accessCheck$e(obj, member, "write to private field");
-  member.set(obj, value);
-  return value;
-};
-var _config, _logger;
-const _MiddlewareFactory = class _MiddlewareFactory {
-  constructor(options) {
-    __privateAdd$e(this, _config, void 0);
-    __privateAdd$e(this, _logger, void 0);
-    __privateSet$a(this, _config, options.config);
-    __privateSet$a(this, _logger, options.logger);
-  }
+class MiddlewareFactory {
+  #config;
+  #logger;
   /**
    * Creates a new {@link MiddlewareFactory}.
    */
   static create(options) {
-    return new _MiddlewareFactory(options);
+    return new MiddlewareFactory(options);
+  }
+  constructor(options) {
+    this.#config = options.config;
+    this.#logger = options.logger;
   }
   /**
    * Returns a middleware that unconditionally produces a 404 error response.
@@ -686,7 +647,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
    * @returns An Express request handler
    */
   logging() {
-    const logger = __privateGet$c(this, _logger).child({
+    const logger = this.#logger.child({
       type: "incomingRequest"
     });
     return morgan__default.default("combined", {
@@ -710,7 +671,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
    * @returns An Express request handler
    */
   helmet() {
-    return helmet__default.default(readHelmetOptions(__privateGet$c(this, _config).getOptionalConfig("backend")));
+    return helmet__default.default(readHelmetOptions(this.#config.getOptionalConfig("backend")));
   }
   /**
    * Returns a middleware that implements the cors library.
@@ -725,7 +686,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
    * @returns An Express request handler
    */
   cors() {
-    return cors__default.default(readCorsOptions(__privateGet$c(this, _config).getOptionalConfig("backend")));
+    return cors__default.default(readCorsOptions(this.#config.getOptionalConfig("backend")));
   }
   /**
    * Express middleware to handle errors during request processing.
@@ -748,9 +709,8 @@ const _MiddlewareFactory = class _MiddlewareFactory {
    * @returns An Express error request handler
    */
   error(options = {}) {
-    var _a;
-    const showStackTraces = (_a = options.showStackTraces) != null ? _a : process.env.NODE_ENV === "development";
-    const logger = __privateGet$c(this, _logger).child({
+    const showStackTraces = options.showStackTraces ?? process.env.NODE_ENV === "development";
+    const logger = this.#logger.child({
       type: "errorHandler"
     });
     return (rawError, req, res, next) => {
@@ -771,10 +731,7 @@ const _MiddlewareFactory = class _MiddlewareFactory {
       res.status(statusCode).json(body);
     };
   }
-};
-_config = new WeakMap();
-_logger = new WeakMap();
-let MiddlewareFactory = _MiddlewareFactory;
+}
 function getStatusCode(error) {
   const knownStatusCodeFields = ["statusCode", "status"];
   for (const field of knownStatusCodeFields) {
@@ -809,51 +766,27 @@ const escapeRegExp = (text) => {
   return text.replace(/[.*+?^${}(\)|[\]\\]/g, "\\$&");
 };
 
-var __accessCheck$d = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateGet$b = (obj, member, getter) => {
-  __accessCheck$d(obj, member, "read from private field");
-  return member.get(obj);
-};
-var __privateAdd$d = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var __privateSet$9 = (obj, member, value, setter) => {
-  __accessCheck$d(obj, member, "write to private field");
-  member.set(obj, value);
-  return value;
-};
-var _winston, _addRedactions;
-const _WinstonLogger = class _WinstonLogger {
-  constructor(winston, addRedactions) {
-    __privateAdd$d(this, _winston, void 0);
-    __privateAdd$d(this, _addRedactions, void 0);
-    __privateSet$9(this, _winston, winston);
-    __privateSet$9(this, _addRedactions, addRedactions);
-  }
+class WinstonLogger {
+  #winston;
+  #addRedactions;
   /**
    * Creates a {@link WinstonLogger} instance.
    */
   static create(options) {
-    var _a, _b;
-    const redacter = _WinstonLogger.redacter();
-    const defaultFormatter = process.env.NODE_ENV === "production" ? winston.format.json() : _WinstonLogger.colorFormat();
+    const redacter = WinstonLogger.redacter();
+    const defaultFormatter = process.env.NODE_ENV === "production" ? winston.format.json() : WinstonLogger.colorFormat();
     let logger = winston.createLogger({
       level: process.env.LOG_LEVEL || options.level || "info",
       format: winston.format.combine(
-        (_a = options.format) != null ? _a : defaultFormatter,
+        options.format ?? defaultFormatter,
         redacter.format
       ),
-      transports: (_b = options.transports) != null ? _b : new winston.transports.Console()
+      transports: options.transports ?? new winston.transports.Console()
     });
     if (options.meta) {
       logger = logger.child(options.meta);
     }
-    return new _WinstonLogger(logger, redacter.add);
+    return new WinstonLogger(logger, redacter.add);
   }
   /**
    * Creates a winston log formatter for redacting secrets.
@@ -863,11 +796,10 @@ const _WinstonLogger = class _WinstonLogger {
     let redactionPattern = void 0;
     return {
       format: winston.format((obj) => {
-        var _a, _b;
         if (!redactionPattern || !obj) {
           return obj;
         }
-        obj[tripleBeam.MESSAGE] = (_b = (_a = obj[tripleBeam.MESSAGE]) == null ? void 0 : _a.replace) == null ? void 0 : _b.call(_a, redactionPattern, "[REDACTED]");
+        obj[tripleBeam.MESSAGE] = obj[tripleBeam.MESSAGE]?.replace?.(redactionPattern, "***");
         return obj;
       })(),
       add(newRedactions) {
@@ -916,227 +848,30 @@ const _WinstonLogger = class _WinstonLogger {
       })
     );
   }
+  constructor(winston, addRedactions) {
+    this.#winston = winston;
+    this.#addRedactions = addRedactions;
+  }
   error(message, meta) {
-    __privateGet$b(this, _winston).error(message, meta);
+    this.#winston.error(message, meta);
   }
   warn(message, meta) {
-    __privateGet$b(this, _winston).warn(message, meta);
+    this.#winston.warn(message, meta);
   }
   info(message, meta) {
-    __privateGet$b(this, _winston).info(message, meta);
+    this.#winston.info(message, meta);
   }
   debug(message, meta) {
-    __privateGet$b(this, _winston).debug(message, meta);
+    this.#winston.debug(message, meta);
   }
   child(meta) {
-    return new _WinstonLogger(__privateGet$b(this, _winston).child(meta));
+    return new WinstonLogger(this.#winston.child(meta));
   }
   addRedactions(redactions) {
-    var _a;
-    (_a = __privateGet$b(this, _addRedactions)) == null ? void 0 : _a.call(this, redactions);
-  }
-};
-_winston = new WeakMap();
-_addRedactions = new WeakMap();
-let WinstonLogger = _WinstonLogger;
-
-var __accessCheck$c = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateGet$a = (obj, member, getter) => {
-  __accessCheck$c(obj, member, "read from private field");
-  return member.get(obj);
-};
-var __privateAdd$c = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var __privateSet$8 = (obj, member, value, setter) => {
-  __accessCheck$c(obj, member, "write to private field");
-  member.set(obj, value);
-  return value;
-};
-var _hasStarted$1, _startupTasks$1, _hasShutdown, _shutdownTasks;
-class BackendLifecycleImpl {
-  constructor(logger) {
-    this.logger = logger;
-    __privateAdd$c(this, _hasStarted$1, false);
-    __privateAdd$c(this, _startupTasks$1, []);
-    __privateAdd$c(this, _hasShutdown, false);
-    __privateAdd$c(this, _shutdownTasks, []);
-  }
-  addStartupHook(hook, options) {
-    if (__privateGet$a(this, _hasStarted$1)) {
-      throw new Error("Attempted to add startup hook after startup");
-    }
-    __privateGet$a(this, _startupTasks$1).push({ hook, options });
-  }
-  async startup() {
-    if (__privateGet$a(this, _hasStarted$1)) {
-      return;
-    }
-    __privateSet$8(this, _hasStarted$1, true);
-    this.logger.debug(`Running ${__privateGet$a(this, _startupTasks$1).length} startup tasks...`);
-    await Promise.all(
-      __privateGet$a(this, _startupTasks$1).map(async ({ hook, options }) => {
-        var _a;
-        const logger = (_a = options == null ? void 0 : options.logger) != null ? _a : this.logger;
-        try {
-          await hook();
-          logger.debug(`Startup hook succeeded`);
-        } catch (error) {
-          logger.error(`Startup hook failed, ${error}`);
-        }
-      })
-    );
-  }
-  addShutdownHook(hook, options) {
-    if (__privateGet$a(this, _hasShutdown)) {
-      throw new Error("Attempted to add shutdown hook after shutdown");
-    }
-    __privateGet$a(this, _shutdownTasks).push({ hook, options });
-  }
-  async shutdown() {
-    if (__privateGet$a(this, _hasShutdown)) {
-      return;
-    }
-    __privateSet$8(this, _hasShutdown, true);
-    this.logger.debug(
-      `Running ${__privateGet$a(this, _shutdownTasks).length} shutdown tasks...`
-    );
-    await Promise.all(
-      __privateGet$a(this, _shutdownTasks).map(async ({ hook, options }) => {
-        var _a;
-        const logger = (_a = options == null ? void 0 : options.logger) != null ? _a : this.logger;
-        try {
-          await hook();
-          logger.debug(`Shutdown hook succeeded`);
-        } catch (error) {
-          logger.error(`Shutdown hook failed, ${error}`);
-        }
-      })
-    );
-  }
-}
-_hasStarted$1 = new WeakMap();
-_startupTasks$1 = new WeakMap();
-_hasShutdown = new WeakMap();
-_shutdownTasks = new WeakMap();
-const rootLifecycleServiceFactory = backendPluginApi.createServiceFactory({
-  service: backendPluginApi.coreServices.rootLifecycle,
-  deps: {
-    logger: backendPluginApi.coreServices.rootLogger
-  },
-  async factory({ logger }) {
-    return new BackendLifecycleImpl(logger);
-  }
-});
-
-var __accessCheck$b = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateGet$9 = (obj, member, getter) => {
-  __accessCheck$b(obj, member, "read from private field");
-  return member.get(obj);
-};
-var __privateAdd$b = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var __privateSet$7 = (obj, member, value, setter) => {
-  __accessCheck$b(obj, member, "write to private field");
-  member.set(obj, value);
-  return value;
-};
-var _hasStarted, _startupTasks;
-class BackendPluginLifecycleImpl {
-  constructor(logger, rootLifecycle, pluginMetadata) {
-    this.logger = logger;
-    this.rootLifecycle = rootLifecycle;
-    this.pluginMetadata = pluginMetadata;
-    __privateAdd$b(this, _hasStarted, false);
-    __privateAdd$b(this, _startupTasks, []);
-  }
-  addStartupHook(hook, options) {
-    if (__privateGet$9(this, _hasStarted)) {
-      throw new Error("Attempted to add startup hook after startup");
-    }
-    __privateGet$9(this, _startupTasks).push({ hook, options });
-  }
-  async startup() {
-    if (__privateGet$9(this, _hasStarted)) {
-      return;
-    }
-    __privateSet$7(this, _hasStarted, true);
-    this.logger.debug(
-      `Running ${__privateGet$9(this, _startupTasks).length} plugin startup tasks...`
-    );
-    await Promise.all(
-      __privateGet$9(this, _startupTasks).map(async ({ hook, options }) => {
-        var _a;
-        const logger = (_a = options == null ? void 0 : options.logger) != null ? _a : this.logger;
-        try {
-          await hook();
-          logger.debug(`Plugin startup hook succeeded`);
-        } catch (error) {
-          logger.error(`Plugin startup hook failed, ${error}`);
-        }
-      })
-    );
-  }
-  addShutdownHook(hook, options) {
-    var _a, _b;
-    const plugin = this.pluginMetadata.getId();
-    this.rootLifecycle.addShutdownHook(hook, {
-      logger: (_b = (_a = options == null ? void 0 : options.logger) == null ? void 0 : _a.child({ plugin })) != null ? _b : this.logger
-    });
+    this.#addRedactions?.(redactions);
   }
 }
-_hasStarted = new WeakMap();
-_startupTasks = new WeakMap();
-const lifecycleServiceFactory = backendPluginApi.createServiceFactory({
-  service: backendPluginApi.coreServices.lifecycle,
-  deps: {
-    logger: backendPluginApi.coreServices.logger,
-    rootLifecycle: backendPluginApi.coreServices.rootLifecycle,
-    pluginMetadata: backendPluginApi.coreServices.pluginMetadata
-  },
-  async factory({ rootLifecycle, logger, pluginMetadata }) {
-    return new BackendPluginLifecycleImpl(
-      logger,
-      rootLifecycle,
-      pluginMetadata
-    );
-  }
-});
 
-var __accessCheck$a = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateGet$8 = (obj, member, getter) => {
-  __accessCheck$a(obj, member, "read from private field");
-  return member.get(obj);
-};
-var __privateAdd$a = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var __privateSet$6 = (obj, member, value, setter) => {
-  __accessCheck$a(obj, member, "write to private field");
-  member.set(obj, value);
-  return value;
-};
-var __privateMethod$7 = (obj, member, method) => {
-  __accessCheck$a(obj, member, "access private method");
-  return method;
-};
-var _nodeIds, _cycleKeys, _getCycleKey, getCycleKey_fn, _nodes, _allProvided;
 class Node {
   constructor(value, consumes, provides) {
     this.value = value;
@@ -1151,45 +886,29 @@ class Node {
     );
   }
 }
-const _CycleKeySet = class _CycleKeySet {
-  constructor(nodes) {
-    __privateAdd$a(this, _getCycleKey);
-    __privateAdd$a(this, _nodeIds, void 0);
-    __privateAdd$a(this, _cycleKeys, void 0);
-    __privateSet$6(this, _nodeIds, new Map(nodes.map((n, i) => [n.value, i])));
-    __privateSet$6(this, _cycleKeys, /* @__PURE__ */ new Set());
-  }
+class CycleKeySet {
   static from(nodes) {
-    return new _CycleKeySet(nodes);
+    return new CycleKeySet(nodes);
+  }
+  #nodeIds;
+  #cycleKeys;
+  constructor(nodes) {
+    this.#nodeIds = new Map(nodes.map((n, i) => [n.value, i]));
+    this.#cycleKeys = /* @__PURE__ */ new Set();
   }
   tryAdd(path) {
-    const cycleKey = __privateMethod$7(this, _getCycleKey, getCycleKey_fn).call(this, path);
-    if (__privateGet$8(this, _cycleKeys).has(cycleKey)) {
+    const cycleKey = this.#getCycleKey(path);
+    if (this.#cycleKeys.has(cycleKey)) {
       return false;
     }
-    __privateGet$8(this, _cycleKeys).add(cycleKey);
+    this.#cycleKeys.add(cycleKey);
     return true;
   }
-};
-_nodeIds = new WeakMap();
-_cycleKeys = new WeakMap();
-_getCycleKey = new WeakSet();
-getCycleKey_fn = function(path) {
-  return path.map((n) => __privateGet$8(this, _nodeIds).get(n)).sort().join(",");
-};
-let CycleKeySet = _CycleKeySet;
-const _DependencyGraph = class _DependencyGraph {
-  constructor(nodes) {
-    __privateAdd$a(this, _nodes, void 0);
-    __privateAdd$a(this, _allProvided, void 0);
-    __privateSet$6(this, _nodes, nodes);
-    __privateSet$6(this, _allProvided, /* @__PURE__ */ new Set());
-    for (const node of __privateGet$8(this, _nodes).values()) {
-      for (const produced of node.provides) {
-        __privateGet$8(this, _allProvided).add(produced);
-      }
-    }
+  #getCycleKey(path) {
+    return path.map((n) => this.#nodeIds.get(n)).sort().join(",");
   }
+}
+class DependencyGraph {
   static fromMap(nodes) {
     return this.fromIterable(
       Object.entries(nodes).map(([key, node]) => ({
@@ -1203,16 +922,27 @@ const _DependencyGraph = class _DependencyGraph {
     for (const nodeInput of nodeInputs) {
       nodes.push(Node.from(nodeInput));
     }
-    return new _DependencyGraph(nodes);
+    return new DependencyGraph(nodes);
+  }
+  #nodes;
+  #allProvided;
+  constructor(nodes) {
+    this.#nodes = nodes;
+    this.#allProvided = /* @__PURE__ */ new Set();
+    for (const node of this.#nodes.values()) {
+      for (const produced of node.provides) {
+        this.#allProvided.add(produced);
+      }
+    }
   }
   /**
    * Find all nodes that consume dependencies that are not provided by any other node.
    */
   findUnsatisfiedDeps() {
     const unsatisfiedDependencies = [];
-    for (const node of __privateGet$8(this, _nodes).values()) {
+    for (const node of this.#nodes.values()) {
       const unsatisfied = Array.from(node.consumes).filter(
-        (id) => !__privateGet$8(this, _allProvided).has(id)
+        (id) => !this.#allProvided.has(id)
       );
       if (unsatisfied.length > 0) {
         unsatisfiedDependencies.push({ value: node.value, unsatisfied });
@@ -1232,8 +962,8 @@ const _DependencyGraph = class _DependencyGraph {
    * form a cycle, with the same node as the first and last element of the array.
    */
   *detectCircularDependencies() {
-    const cycleKeys = CycleKeySet.from(__privateGet$8(this, _nodes));
-    for (const startNode of __privateGet$8(this, _nodes)) {
+    const cycleKeys = CycleKeySet.from(this.#nodes);
+    for (const startNode of this.#nodes) {
       const visited = /* @__PURE__ */ new Set();
       const stack = new Array([
         startNode,
@@ -1246,7 +976,7 @@ const _DependencyGraph = class _DependencyGraph {
         }
         visited.add(node);
         for (const consumed of node.consumes) {
-          const providerNodes = __privateGet$8(this, _nodes).filter(
+          const providerNodes = this.#nodes.filter(
             (other) => other.provides.has(consumed)
           );
           for (const provider of providerNodes) {
@@ -1275,9 +1005,9 @@ const _DependencyGraph = class _DependencyGraph {
    * Dependencies of nodes that are not produced by any other nodes will be ignored.
    */
   async parallelTopologicalTraversal(fn) {
-    const allProvided = __privateGet$8(this, _allProvided);
+    const allProvided = this.#allProvided;
     const producedSoFar = /* @__PURE__ */ new Set();
-    const waiting = new Set(__privateGet$8(this, _nodes).values());
+    const waiting = new Set(this.#nodes.values());
     const visited = /* @__PURE__ */ new Set();
     const results = new Array();
     let inFlight = 0;
@@ -1318,34 +1048,8 @@ const _DependencyGraph = class _DependencyGraph {
     await processMoreNodes();
     return results;
   }
-};
-_nodes = new WeakMap();
-_allProvided = new WeakMap();
-let DependencyGraph = _DependencyGraph;
+}
 
-var __accessCheck$9 = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateGet$7 = (obj, member, getter) => {
-  __accessCheck$9(obj, member, "read from private field");
-  return member.get(obj);
-};
-var __privateAdd$9 = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var __privateSet$5 = (obj, member, value, setter) => {
-  __accessCheck$9(obj, member, "write to private field");
-  member.set(obj, value);
-  return value;
-};
-var __privateMethod$6 = (obj, member, method) => {
-  __accessCheck$9(obj, member, "access private method");
-  return method;
-};
-var _providedFactories, _loadedDefaultFactories, _implementations, _rootServiceImplementations, _addedFactoryIds, _instantiatedFactories, _resolveFactory, resolveFactory_fn, _checkForMissingDeps, checkForMissingDeps_fn;
 function toInternalServiceFactory(factory) {
   const f = factory;
   if (f.$$type !== "@backstage/BackendFeature") {
@@ -1360,33 +1064,77 @@ const pluginMetadataServiceFactory = backendPluginApi.createServiceFactory(
   (options) => ({
     service: backendPluginApi.coreServices.pluginMetadata,
     deps: {},
-    factory: async () => ({ getId: () => options == null ? void 0 : options.pluginId })
+    factory: async () => ({ getId: () => options?.pluginId })
   })
 );
-const _ServiceRegistry = class _ServiceRegistry {
-  constructor(factories) {
-    __privateAdd$9(this, _resolveFactory);
-    __privateAdd$9(this, _checkForMissingDeps);
-    __privateAdd$9(this, _providedFactories, void 0);
-    __privateAdd$9(this, _loadedDefaultFactories, void 0);
-    __privateAdd$9(this, _implementations, void 0);
-    __privateAdd$9(this, _rootServiceImplementations, /* @__PURE__ */ new Map());
-    __privateAdd$9(this, _addedFactoryIds, /* @__PURE__ */ new Set());
-    __privateAdd$9(this, _instantiatedFactories, /* @__PURE__ */ new Set());
-    __privateSet$5(this, _providedFactories, new Map(
-      factories.map((sf) => [sf.service.id, toInternalServiceFactory(sf)])
-    ));
-    __privateSet$5(this, _loadedDefaultFactories, /* @__PURE__ */ new Map());
-    __privateSet$5(this, _implementations, /* @__PURE__ */ new Map());
-  }
+class ServiceRegistry {
   static create(factories) {
-    const registry = new _ServiceRegistry(factories);
+    const registry = new ServiceRegistry(factories);
     registry.checkForCircularDeps();
     return registry;
   }
+  #providedFactories;
+  #loadedDefaultFactories;
+  #implementations;
+  #rootServiceImplementations = /* @__PURE__ */ new Map();
+  #addedFactoryIds = /* @__PURE__ */ new Set();
+  #instantiatedFactories = /* @__PURE__ */ new Set();
+  constructor(factories) {
+    this.#providedFactories = new Map(
+      factories.map((sf) => [sf.service.id, toInternalServiceFactory(sf)])
+    );
+    this.#loadedDefaultFactories = /* @__PURE__ */ new Map();
+    this.#implementations = /* @__PURE__ */ new Map();
+  }
+  #resolveFactory(ref, pluginId) {
+    if (ref.id === backendPluginApi.coreServices.pluginMetadata.id) {
+      return Promise.resolve(
+        toInternalServiceFactory(pluginMetadataServiceFactory({ pluginId }))
+      );
+    }
+    let resolvedFactory = this.#providedFactories.get(ref.id);
+    const { __defaultFactory: defaultFactory } = ref;
+    if (!resolvedFactory && !defaultFactory) {
+      return void 0;
+    }
+    if (!resolvedFactory) {
+      let loadedFactory = this.#loadedDefaultFactories.get(defaultFactory);
+      if (!loadedFactory) {
+        loadedFactory = Promise.resolve().then(() => defaultFactory(ref)).then(
+          (f) => toInternalServiceFactory(typeof f === "function" ? f() : f)
+        );
+        this.#loadedDefaultFactories.set(defaultFactory, loadedFactory);
+      }
+      resolvedFactory = loadedFactory.catch((error) => {
+        throw new Error(
+          `Failed to instantiate service '${ref.id}' because the default factory loader threw an error, ${errors.stringifyError(
+            error
+          )}`
+        );
+      });
+    }
+    return Promise.resolve(resolvedFactory);
+  }
+  #checkForMissingDeps(factory, pluginId) {
+    const missingDeps = Object.values(factory.deps).filter((ref) => {
+      if (ref.id === backendPluginApi.coreServices.pluginMetadata.id) {
+        return false;
+      }
+      if (this.#providedFactories.get(ref.id)) {
+        return false;
+      }
+      return !ref.__defaultFactory;
+    });
+    if (missingDeps.length) {
+      const missing = missingDeps.map((r) => `'${r.id}'`).join(", ");
+      throw new Error(
+        `Failed to instantiate service '${factory.service.id}' for '${pluginId}' because the following dependent services are missing: ${missing}`
+      );
+    }
+  }
   checkForCircularDeps() {
     const graph = DependencyGraph.fromIterable(
-      Array.from(__privateGet$7(this, _providedFactories)).map(
+      Array.from(this.#providedFactories).map(
         ([serviceId, serviceFactory]) => ({
           value: serviceId,
           provides: [serviceId],
@@ -1408,21 +1156,21 @@ const _ServiceRegistry = class _ServiceRegistry {
         `The ${backendPluginApi.coreServices.pluginMetadata.id} service cannot be overridden`
       );
     }
-    if (__privateGet$7(this, _addedFactoryIds).has(factoryId)) {
+    if (this.#addedFactoryIds.has(factoryId)) {
       throw new Error(
         `Duplicate service implementations provided for ${factoryId}`
       );
     }
-    if (__privateGet$7(this, _instantiatedFactories).has(factoryId)) {
+    if (this.#instantiatedFactories.has(factoryId)) {
       throw new Error(
         `Unable to set service factory with id ${factoryId}, service has already been instantiated`
       );
     }
-    __privateGet$7(this, _addedFactoryIds).add(factoryId);
-    __privateGet$7(this, _providedFactories).set(factoryId, toInternalServiceFactory(factory));
+    this.#addedFactoryIds.add(factoryId);
+    this.#providedFactories.set(factoryId, toInternalServiceFactory(factory));
   }
   async initializeEagerServicesWithScope(scope, pluginId = "root") {
-    for (const factory of __privateGet$7(this, _providedFactories).values()) {
+    for (const factory of this.#providedFactories.values()) {
       if (factory.service.scope === scope) {
         if (scope === "root" && factory.initialization !== "lazy") {
           await this.get(factory.service, pluginId);
@@ -1433,13 +1181,12 @@ const _ServiceRegistry = class _ServiceRegistry {
     }
   }
   get(ref, pluginId) {
-    var _a;
-    __privateGet$7(this, _instantiatedFactories).add(ref.id);
-    return (_a = __privateMethod$6(this, _resolveFactory, resolveFactory_fn).call(this, ref, pluginId)) == null ? void 0 : _a.then((factory) => {
+    this.#instantiatedFactories.add(ref.id);
+    return this.#resolveFactory(ref, pluginId)?.then((factory) => {
       if (factory.service.scope === "root") {
-        let existing = __privateGet$7(this, _rootServiceImplementations).get(factory);
+        let existing = this.#rootServiceImplementations.get(factory);
         if (!existing) {
-          __privateMethod$6(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
+          this.#checkForMissingDeps(factory, pluginId);
           const rootDeps = new Array();
           for (const [name, serviceRef] of Object.entries(factory.deps)) {
             if (serviceRef.scope !== "root") {
@@ -1453,13 +1200,13 @@ const _ServiceRegistry = class _ServiceRegistry {
           existing = Promise.all(rootDeps).then(
             (entries) => factory.factory(Object.fromEntries(entries), void 0)
           );
-          __privateGet$7(this, _rootServiceImplementations).set(factory, existing);
+          this.#rootServiceImplementations.set(factory, existing);
         }
         return existing;
       }
-      let implementation = __privateGet$7(this, _implementations).get(factory);
+      let implementation = this.#implementations.get(factory);
       if (!implementation) {
-        __privateMethod$6(this, _checkForMissingDeps, checkForMissingDeps_fn).call(this, factory, pluginId);
+        this.#checkForMissingDeps(factory, pluginId);
         const rootDeps = new Array();
         for (const [name, serviceRef] of Object.entries(factory.deps)) {
           if (serviceRef.scope === "root") {
@@ -1469,10 +1216,7 @@ const _ServiceRegistry = class _ServiceRegistry {
         }
         implementation = {
           context: Promise.all(rootDeps).then(
-            (entries) => {
-              var _a2;
-              return (_a2 = factory.createRootContext) == null ? void 0 : _a2.call(factory, Object.fromEntries(entries));
-            }
+            (entries) => factory.createRootContext?.(Object.fromEntries(entries))
           ).catch((error) => {
             const cause = errors.stringifyError(error);
             throw new Error(
@@ -1481,7 +1225,7 @@ const _ServiceRegistry = class _ServiceRegistry {
           }),
           byPlugin: /* @__PURE__ */ new Map()
         };
-        __privateGet$7(this, _implementations).set(factory, implementation);
+        this.#implementations.set(factory, implementation);
       }
       let result = implementation.byPlugin.get(pluginId);
       if (!result) {
@@ -1505,72 +1249,17 @@ const _ServiceRegistry = class _ServiceRegistry {
       return result;
     });
   }
-};
-_providedFactories = new WeakMap();
-_loadedDefaultFactories = new WeakMap();
-_implementations = new WeakMap();
-_rootServiceImplementations = new WeakMap();
-_addedFactoryIds = new WeakMap();
-_instantiatedFactories = new WeakMap();
-_resolveFactory = new WeakSet();
-resolveFactory_fn = function(ref, pluginId) {
-  if (ref.id === backendPluginApi.coreServices.pluginMetadata.id) {
-    return Promise.resolve(
-      toInternalServiceFactory(pluginMetadataServiceFactory({ pluginId }))
-    );
-  }
-  let resolvedFactory = __privateGet$7(this, _providedFactories).get(ref.id);
-  const { __defaultFactory: defaultFactory } = ref;
-  if (!resolvedFactory && !defaultFactory) {
-    return void 0;
-  }
-  if (!resolvedFactory) {
-    let loadedFactory = __privateGet$7(this, _loadedDefaultFactories).get(defaultFactory);
-    if (!loadedFactory) {
-      loadedFactory = Promise.resolve().then(() => defaultFactory(ref)).then(
-        (f) => toInternalServiceFactory(typeof f === "function" ? f() : f)
-      );
-      __privateGet$7(this, _loadedDefaultFactories).set(defaultFactory, loadedFactory);
-    }
-    resolvedFactory = loadedFactory.catch((error) => {
-      throw new Error(
-        `Failed to instantiate service '${ref.id}' because the default factory loader threw an error, ${errors.stringifyError(
-          error
-        )}`
-      );
-    });
-  }
-  return Promise.resolve(resolvedFactory);
-};
-_checkForMissingDeps = new WeakSet();
-checkForMissingDeps_fn = function(factory, pluginId) {
-  const missingDeps = Object.values(factory.deps).filter((ref) => {
-    if (ref.id === backendPluginApi.coreServices.pluginMetadata.id) {
-      return false;
-    }
-    if (__privateGet$7(this, _providedFactories).get(ref.id)) {
-      return false;
-    }
-    return !ref.__defaultFactory;
-  });
-  if (missingDeps.length) {
-    const missing = missingDeps.map((r) => `'${r.id}'`).join(", ");
-    throw new Error(
-      `Failed to instantiate service '${factory.service.id}' for '${pluginId}' because the following dependent services are missing: ${missing}`
-    );
-  }
-};
-let ServiceRegistry = _ServiceRegistry;
+}
 
 const LOGGER_INTERVAL_MAX = 6e4;
 function joinIds(ids) {
   return [...ids].map((id) => `'${id}'`).join(", ");
 }
 function createInitializationLogger(pluginIds, rootLogger) {
-  const logger = rootLogger == null ? void 0 : rootLogger.child({ type: "initialization" });
+  const logger = rootLogger?.child({ type: "initialization" });
   const starting = new Set(pluginIds);
   const started = /* @__PURE__ */ new Set();
-  logger == null ? void 0 : logger.info(`Plugin initialization started: ${joinIds(pluginIds)}`);
+  logger?.info(`Plugin initialization started: ${joinIds(pluginIds)}`);
   const getInitStatus = () => {
     let status = "";
     if (started.size > 0) {
@@ -1586,7 +1275,7 @@ function createInitializationLogger(pluginIds, rootLogger) {
   let prevInterval = 0;
   let timeout;
   const onTimeout = () => {
-    logger == null ? void 0 : logger.info(`Plugin initialization in progress${getInitStatus()}`);
+    logger?.info(`Plugin initialization in progress${getInitStatus()}`);
     const nextInterval = Math.min(interval + prevInterval, LOGGER_INTERVAL_MAX);
     prevInterval = interval;
     interval = nextInterval;
@@ -1599,7 +1288,7 @@ function createInitializationLogger(pluginIds, rootLogger) {
       started.add(pluginId);
     },
     onAllStarted() {
-      logger == null ? void 0 : logger.info(`Plugin initialization complete${getInitStatus()}`);
+      logger?.info(`Plugin initialization complete${getInitStatus()}`);
       if (timeout) {
         clearTimeout(timeout);
         timeout = void 0;
@@ -1608,52 +1297,76 @@ function createInitializationLogger(pluginIds, rootLogger) {
   };
 }
 
-var __accessCheck$8 = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateGet$6 = (obj, member, getter) => {
-  __accessCheck$8(obj, member, "read from private field");
-  return member.get(obj);
-};
-var __privateAdd$8 = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var __privateSet$4 = (obj, member, value, setter) => {
-  __accessCheck$8(obj, member, "write to private field");
-  member.set(obj, value);
-  return value;
-};
-var __privateMethod$5 = (obj, member, method) => {
-  __accessCheck$8(obj, member, "access private method");
-  return method;
-};
-var _startPromise, _features, _extensionPoints, _serviceRegistry, _registeredFeatures, _getInitDeps, getInitDeps_fn, _addFeature, addFeature_fn, _doStart, doStart_fn, _getRootLifecycleImpl, getRootLifecycleImpl_fn, _getPluginLifecycleImpl, getPluginLifecycleImpl_fn;
 class BackendInitializer {
+  #startPromise;
+  #features = new Array();
+  #extensionPoints = /* @__PURE__ */ new Map();
+  #serviceRegistry;
+  #registeredFeatures = new Array();
   constructor(defaultApiFactories) {
-    __privateAdd$8(this, _getInitDeps);
-    __privateAdd$8(this, _addFeature);
-    __privateAdd$8(this, _doStart);
-    // Bit of a hacky way to grab the lifecycle services, potentially find a nicer way to do this
-    __privateAdd$8(this, _getRootLifecycleImpl);
-    __privateAdd$8(this, _getPluginLifecycleImpl);
-    __privateAdd$8(this, _startPromise, void 0);
-    __privateAdd$8(this, _features, new Array());
-    __privateAdd$8(this, _extensionPoints, /* @__PURE__ */ new Map());
-    __privateAdd$8(this, _serviceRegistry, void 0);
-    __privateAdd$8(this, _registeredFeatures, new Array());
-    __privateSet$4(this, _serviceRegistry, ServiceRegistry.create([...defaultApiFactories]));
+    this.#serviceRegistry = ServiceRegistry.create([...defaultApiFactories]);
+  }
+  async #getInitDeps(deps, pluginId, moduleId) {
+    const result = /* @__PURE__ */ new Map();
+    const missingRefs = /* @__PURE__ */ new Set();
+    for (const [name, ref] of Object.entries(deps)) {
+      const ep = this.#extensionPoints.get(ref.id);
+      if (ep) {
+        if (ep.pluginId !== pluginId) {
+          throw new Error(
+            `Illegal dependency: Module '${moduleId}' for plugin '${pluginId}' attempted to depend on extension point '${ref.id}' for plugin '${ep.pluginId}'. Extension points can only be used within their plugin's scope.`
+          );
+        }
+        result.set(name, ep.impl);
+      } else {
+        const impl = await this.#serviceRegistry.get(
+          ref,
+          pluginId
+        );
+        if (impl) {
+          result.set(name, impl);
+        } else {
+          missingRefs.add(ref);
+        }
+      }
+    }
+    if (missingRefs.size > 0) {
+      const missing = Array.from(missingRefs).join(", ");
+      throw new Error(
+        `No extension point or service available for the following ref(s): ${missing}`
+      );
+    }
+    return Object.fromEntries(result);
   }
   add(feature) {
-    if (__privateGet$6(this, _startPromise)) {
+    if (this.#startPromise) {
       throw new Error("feature can not be added after the backend has started");
     }
-    __privateGet$6(this, _registeredFeatures).push(Promise.resolve(feature));
+    this.#registeredFeatures.push(Promise.resolve(feature));
+  }
+  #addFeature(feature) {
+    if (feature.$$type !== "@backstage/BackendFeature") {
+      throw new Error(
+        `Failed to add feature, invalid type '${feature.$$type}'`
+      );
+    }
+    if (isServiceFactory(feature)) {
+      this.#serviceRegistry.add(feature);
+    } else if (isInternalBackendFeature(feature)) {
+      if (feature.version !== "v1") {
+        throw new Error(
+          `Failed to add feature, invalid version '${feature.version}'`
+        );
+      }
+      this.#features.push(feature);
+    } else {
+      throw new Error(
+        `Failed to add feature, invalid feature ${JSON.stringify(feature)}`
+      );
+    }
   }
   async start() {
-    if (__privateGet$6(this, _startPromise)) {
+    if (this.#startPromise) {
       throw new Error("Backend has already started");
     }
     const exitHandler = async () => {
@@ -1671,242 +1384,187 @@ class BackendInitializer {
     process.addListener("SIGTERM", exitHandler);
     process.addListener("SIGINT", exitHandler);
     process.addListener("beforeExit", exitHandler);
-    __privateSet$4(this, _startPromise, __privateMethod$5(this, _doStart, doStart_fn).call(this));
-    await __privateGet$6(this, _startPromise);
-  }
-  async stop() {
-    if (!__privateGet$6(this, _startPromise)) {
-      return;
-    }
-    try {
-      await __privateGet$6(this, _startPromise);
-    } catch (error) {
-    }
-    const lifecycleService = await __privateMethod$5(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
-    await lifecycleService.shutdown();
+    this.#startPromise = this.#doStart();
+    await this.#startPromise;
   }
-}
-_startPromise = new WeakMap();
-_features = new WeakMap();
-_extensionPoints = new WeakMap();
-_serviceRegistry = new WeakMap();
-_registeredFeatures = new WeakMap();
-_getInitDeps = new WeakSet();
-getInitDeps_fn = async function(deps, pluginId, moduleId) {
-  const result = /* @__PURE__ */ new Map();
-  const missingRefs = /* @__PURE__ */ new Set();
-  for (const [name, ref] of Object.entries(deps)) {
-    const ep = __privateGet$6(this, _extensionPoints).get(ref.id);
-    if (ep) {
-      if (ep.pluginId !== pluginId) {
-        throw new Error(
-          `Illegal dependency: Module '${moduleId}' for plugin '${pluginId}' attempted to depend on extension point '${ref.id}' for plugin '${ep.pluginId}'. Extension points can only be used within their plugin's scope.`
-        );
-      }
-      result.set(name, ep.impl);
-    } else {
-      const impl = await __privateGet$6(this, _serviceRegistry).get(
-        ref,
-        pluginId
-      );
-      if (impl) {
-        result.set(name, impl);
-      } else {
-        missingRefs.add(ref);
-      }
+  async #doStart() {
+    this.#serviceRegistry.checkForCircularDeps();
+    for (const feature of this.#registeredFeatures) {
+      this.#addFeature(await feature);
     }
-  }
-  if (missingRefs.size > 0) {
-    const missing = Array.from(missingRefs).join(", ");
-    throw new Error(
-      `No extension point or service available for the following ref(s): ${missing}`
+    const featureDiscovery = await this.#serviceRegistry.get(
+      alpha.featureDiscoveryServiceRef,
+      "root"
     );
-  }
-  return Object.fromEntries(result);
-};
-_addFeature = new WeakSet();
-addFeature_fn = function(feature) {
-  if (feature.$$type !== "@backstage/BackendFeature") {
-    throw new Error(
-      `Failed to add feature, invalid type '${feature.$$type}'`
-    );
-  }
-  if (isServiceFactory(feature)) {
-    __privateGet$6(this, _serviceRegistry).add(feature);
-  } else if (isInternalBackendFeature(feature)) {
-    if (feature.version !== "v1") {
-      throw new Error(
-        `Failed to add feature, invalid version '${feature.version}'`
-      );
-    }
-    __privateGet$6(this, _features).push(feature);
-  } else {
-    throw new Error(
-      `Failed to add feature, invalid feature ${JSON.stringify(feature)}`
-    );
-  }
-};
-_doStart = new WeakSet();
-doStart_fn = async function() {
-  __privateGet$6(this, _serviceRegistry).checkForCircularDeps();
-  for (const feature of __privateGet$6(this, _registeredFeatures)) {
-    __privateMethod$5(this, _addFeature, addFeature_fn).call(this, await feature);
-  }
-  const featureDiscovery = await __privateGet$6(this, _serviceRegistry).get(
-    alpha.featureDiscoveryServiceRef,
-    "root"
-  );
-  if (featureDiscovery) {
-    const { features } = await featureDiscovery.getBackendFeatures();
-    for (const feature of features) {
-      __privateMethod$5(this, _addFeature, addFeature_fn).call(this, feature);
-    }
-    __privateGet$6(this, _serviceRegistry).checkForCircularDeps();
-  }
-  await __privateGet$6(this, _serviceRegistry).initializeEagerServicesWithScope("root");
-  const pluginInits = /* @__PURE__ */ new Map();
-  const moduleInits = /* @__PURE__ */ new Map();
-  for (const feature of __privateGet$6(this, _features)) {
-    for (const r of feature.getRegistrations()) {
-      const provides = /* @__PURE__ */ new Set();
-      if (r.type === "plugin" || r.type === "module") {
-        for (const [extRef, extImpl] of r.extensionPoints) {
-          if (__privateGet$6(this, _extensionPoints).has(extRef.id)) {
+    if (featureDiscovery) {
+      const { features } = await featureDiscovery.getBackendFeatures();
+      for (const feature of features) {
+        this.#addFeature(feature);
+      }
+      this.#serviceRegistry.checkForCircularDeps();
+    }
+    await this.#serviceRegistry.initializeEagerServicesWithScope("root");
+    const pluginInits = /* @__PURE__ */ new Map();
+    const moduleInits = /* @__PURE__ */ new Map();
+    for (const feature of this.#features) {
+      for (const r of feature.getRegistrations()) {
+        const provides = /* @__PURE__ */ new Set();
+        if (r.type === "plugin" || r.type === "module") {
+          for (const [extRef, extImpl] of r.extensionPoints) {
+            if (this.#extensionPoints.has(extRef.id)) {
+              throw new Error(
+                `ExtensionPoint with ID '${extRef.id}' is already registered`
+              );
+            }
+            this.#extensionPoints.set(extRef.id, {
+              impl: extImpl,
+              pluginId: r.pluginId
+            });
+            provides.add(extRef);
+          }
+        }
+        if (r.type === "plugin") {
+          if (pluginInits.has(r.pluginId)) {
+            throw new Error(`Plugin '${r.pluginId}' is already registered`);
+          }
+          pluginInits.set(r.pluginId, {
+            provides,
+            consumes: new Set(Object.values(r.init.deps)),
+            init: r.init
+          });
+        } else {
+          let modules = moduleInits.get(r.pluginId);
+          if (!modules) {
+            modules = /* @__PURE__ */ new Map();
+            moduleInits.set(r.pluginId, modules);
+          }
+          if (modules.has(r.moduleId)) {
             throw new Error(
-              `ExtensionPoint with ID '${extRef.id}' is already registered`
+              `Module '${r.moduleId}' for plugin '${r.pluginId}' is already registered`
             );
           }
-          __privateGet$6(this, _extensionPoints).set(extRef.id, {
-            impl: extImpl,
-            pluginId: r.pluginId
+          modules.set(r.moduleId, {
+            provides,
+            consumes: new Set(Object.values(r.init.deps)),
+            init: r.init
           });
-          provides.add(extRef);
         }
       }
-      if (r.type === "plugin") {
-        if (pluginInits.has(r.pluginId)) {
-          throw new Error(`Plugin '${r.pluginId}' is already registered`);
-        }
-        pluginInits.set(r.pluginId, {
-          provides,
-          consumes: new Set(Object.values(r.init.deps)),
-          init: r.init
-        });
-      } else {
-        let modules = moduleInits.get(r.pluginId);
-        if (!modules) {
-          modules = /* @__PURE__ */ new Map();
-          moduleInits.set(r.pluginId, modules);
-        }
-        if (modules.has(r.moduleId)) {
-          throw new Error(
-            `Module '${r.moduleId}' for plugin '${r.pluginId}' is already registered`
-          );
-        }
-        modules.set(r.moduleId, {
-          provides,
-          consumes: new Set(Object.values(r.init.deps)),
-          init: r.init
-        });
-      }
     }
-  }
-  const allPluginIds = [...pluginInits.keys()];
-  const initLogger = createInitializationLogger(
-    allPluginIds,
-    await __privateGet$6(this, _serviceRegistry).get(backendPluginApi.coreServices.rootLogger, "root")
-  );
-  await Promise.all(
-    allPluginIds.map(async (pluginId) => {
-      await __privateGet$6(this, _serviceRegistry).initializeEagerServicesWithScope(
-        "plugin",
-        pluginId
-      );
-      const modules = moduleInits.get(pluginId);
-      if (modules) {
-        const tree = DependencyGraph.fromIterable(
-          Array.from(modules).map(([moduleId, moduleInit]) => ({
-            value: { moduleId, moduleInit },
-            // Relationships are reversed at this point since we're only interested in the extension points.
-            // If a modules provides extension point A we want it to be initialized AFTER all modules
-            // that depend on extension point A, so that they can provide their extensions.
-            consumes: Array.from(moduleInit.provides).map((p) => p.id),
-            provides: Array.from(moduleInit.consumes).map((c) => c.id)
-          }))
+    const allPluginIds = [...pluginInits.keys()];
+    const initLogger = createInitializationLogger(
+      allPluginIds,
+      await this.#serviceRegistry.get(backendPluginApi.coreServices.rootLogger, "root")
+    );
+    await Promise.all(
+      allPluginIds.map(async (pluginId) => {
+        await this.#serviceRegistry.initializeEagerServicesWithScope(
+          "plugin",
+          pluginId
         );
-        const circular = tree.detectCircularDependency();
-        if (circular) {
-          throw new errors.ConflictError(
-            `Circular dependency detected for modules of plugin '${pluginId}', ${circular.map(({ moduleId }) => `'${moduleId}'`).join(" -> ")}`
+        const modules = moduleInits.get(pluginId);
+        if (modules) {
+          const tree = DependencyGraph.fromIterable(
+            Array.from(modules).map(([moduleId, moduleInit]) => ({
+              value: { moduleId, moduleInit },
+              // Relationships are reversed at this point since we're only interested in the extension points.
+              // If a modules provides extension point A we want it to be initialized AFTER all modules
+              // that depend on extension point A, so that they can provide their extensions.
+              consumes: Array.from(moduleInit.provides).map((p) => p.id),
+              provides: Array.from(moduleInit.consumes).map((c) => c.id)
+            }))
           );
-        }
-        await tree.parallelTopologicalTraversal(
-          async ({ moduleId, moduleInit }) => {
-            const moduleDeps = await __privateMethod$5(this, _getInitDeps, getInitDeps_fn).call(this, moduleInit.init.deps, pluginId, moduleId);
-            await moduleInit.init.func(moduleDeps).catch((error) => {
-              throw new errors.ForwardedError(
-                `Module '${moduleId}' for plugin '${pluginId}' startup failed`,
-                error
-              );
-            });
+          const circular = tree.detectCircularDependency();
+          if (circular) {
+            throw new errors.ConflictError(
+              `Circular dependency detected for modules of plugin '${pluginId}', ${circular.map(({ moduleId }) => `'${moduleId}'`).join(" -> ")}`
+            );
           }
-        );
-      }
-      const pluginInit = pluginInits.get(pluginId);
-      if (pluginInit) {
-        const pluginDeps = await __privateMethod$5(this, _getInitDeps, getInitDeps_fn).call(this, pluginInit.init.deps, pluginId);
-        await pluginInit.init.func(pluginDeps).catch((error) => {
-          throw new errors.ForwardedError(
-            `Plugin '${pluginId}' startup failed`,
-            error
+          await tree.parallelTopologicalTraversal(
+            async ({ moduleId, moduleInit }) => {
+              const moduleDeps = await this.#getInitDeps(
+                moduleInit.init.deps,
+                pluginId,
+                moduleId
+              );
+              await moduleInit.init.func(moduleDeps).catch((error) => {
+                throw new errors.ForwardedError(
+                  `Module '${moduleId}' for plugin '${pluginId}' startup failed`,
+                  error
+                );
+              });
+            }
           );
-        });
-      }
-      initLogger.onPluginStarted(pluginId);
-      const lifecycleService2 = await __privateMethod$5(this, _getPluginLifecycleImpl, getPluginLifecycleImpl_fn).call(this, pluginId);
-      await lifecycleService2.startup();
-    })
-  );
-  const lifecycleService = await __privateMethod$5(this, _getRootLifecycleImpl, getRootLifecycleImpl_fn).call(this);
-  await lifecycleService.startup();
-  initLogger.onAllStarted();
-  if (process.env.NODE_ENV !== "test") {
-    const rootLogger = await __privateGet$6(this, _serviceRegistry).get(
-      backendPluginApi.coreServices.rootLogger,
-      "root"
+        }
+        const pluginInit = pluginInits.get(pluginId);
+        if (pluginInit) {
+          const pluginDeps = await this.#getInitDeps(
+            pluginInit.init.deps,
+            pluginId
+          );
+          await pluginInit.init.func(pluginDeps).catch((error) => {
+            throw new errors.ForwardedError(
+              `Plugin '${pluginId}' startup failed`,
+              error
+            );
+          });
+        }
+        initLogger.onPluginStarted(pluginId);
+        const lifecycleService2 = await this.#getPluginLifecycleImpl(pluginId);
+        await lifecycleService2.startup();
+      })
     );
-    process.on("unhandledRejection", (reason) => {
-      var _a;
-      (_a = rootLogger == null ? void 0 : rootLogger.child({ type: "unhandledRejection" })) == null ? void 0 : _a.error("Unhandled rejection", reason);
-    });
-    process.on("uncaughtException", (error) => {
-      var _a;
-      (_a = rootLogger == null ? void 0 : rootLogger.child({ type: "uncaughtException" })) == null ? void 0 : _a.error("Uncaught exception", error);
-    });
+    const lifecycleService = await this.#getRootLifecycleImpl();
+    await lifecycleService.startup();
+    initLogger.onAllStarted();
+    if (process.env.NODE_ENV !== "test") {
+      const rootLogger = await this.#serviceRegistry.get(
+        backendPluginApi.coreServices.rootLogger,
+        "root"
+      );
+      process.on("unhandledRejection", (reason) => {
+        rootLogger?.child({ type: "unhandledRejection" })?.error("Unhandled rejection", reason);
+      });
+      process.on("uncaughtException", (error) => {
+        rootLogger?.child({ type: "uncaughtException" })?.error("Uncaught exception", error);
+      });
+    }
   }
-};
-_getRootLifecycleImpl = new WeakSet();
-getRootLifecycleImpl_fn = async function() {
-  const lifecycleService = await __privateGet$6(this, _serviceRegistry).get(
-    backendPluginApi.coreServices.rootLifecycle,
-    "root"
-  );
-  if (lifecycleService instanceof BackendLifecycleImpl) {
-    return lifecycleService;
+  async stop() {
+    if (!this.#startPromise) {
+      return;
+    }
+    try {
+      await this.#startPromise;
+    } catch (error) {
+    }
+    const lifecycleService = await this.#getRootLifecycleImpl();
+    await lifecycleService.shutdown();
   }
-  throw new Error("Unexpected root lifecycle service implementation");
-};
-_getPluginLifecycleImpl = new WeakSet();
-getPluginLifecycleImpl_fn = async function(pluginId) {
-  const lifecycleService = await __privateGet$6(this, _serviceRegistry).get(
-    backendPluginApi.coreServices.lifecycle,
-    pluginId
-  );
-  if (lifecycleService instanceof BackendPluginLifecycleImpl) {
-    return lifecycleService;
+  // Bit of a hacky way to grab the lifecycle services, potentially find a nicer way to do this
+  async #getRootLifecycleImpl() {
+    const lifecycleService = await this.#serviceRegistry.get(
+      backendPluginApi.coreServices.rootLifecycle,
+      "root"
+    );
+    const service = lifecycleService;
+    if (service && typeof service.startup === "function" && typeof service.shutdown === "function") {
+      return service;
+    }
+    throw new Error("Unexpected root lifecycle service implementation");
   }
-  throw new Error("Unexpected plugin lifecycle service implementation");
-};
+  async #getPluginLifecycleImpl(pluginId) {
+    const lifecycleService = await this.#serviceRegistry.get(
+      backendPluginApi.coreServices.lifecycle,
+      pluginId
+    );
+    const service = lifecycleService;
+    if (service && typeof service.startup === "function") {
+      return service;
+    }
+    throw new Error("Unexpected plugin lifecycle service implementation");
+  }
+}
 function isServiceFactory(feature) {
   return !!feature.service;
 }
@@ -1914,45 +1572,25 @@ function isInternalBackendFeature(feature) {
   return typeof feature.getRegistrations === "function";
 }
 
-var __accessCheck$7 = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateGet$5 = (obj, member, getter) => {
-  __accessCheck$7(obj, member, "read from private field");
-  return member.get(obj);
-};
-var __privateAdd$7 = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var __privateSet$3 = (obj, member, value, setter) => {
-  __accessCheck$7(obj, member, "write to private field");
-  member.set(obj, value);
-  return value;
-};
-var _initializer;
 class BackstageBackend {
+  #initializer;
   constructor(defaultServiceFactories) {
-    __privateAdd$7(this, _initializer, void 0);
-    __privateSet$3(this, _initializer, new BackendInitializer(defaultServiceFactories));
+    this.#initializer = new BackendInitializer(defaultServiceFactories);
   }
   add(feature) {
     if (isPromise(feature)) {
-      __privateGet$5(this, _initializer).add(feature.then((f) => unwrapFeature(f.default)));
+      this.#initializer.add(feature.then((f) => unwrapFeature(f.default)));
     } else {
-      __privateGet$5(this, _initializer).add(unwrapFeature(feature));
+      this.#initializer.add(unwrapFeature(feature));
     }
   }
   async start() {
-    await __privateGet$5(this, _initializer).start();
+    await this.#initializer.start();
   }
   async stop() {
-    await __privateGet$5(this, _initializer).stop();
+    await this.#initializer.stop();
   }
 }
-_initializer = new WeakMap();
 function isPromise(value) {
   return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
 }
@@ -2013,10 +1651,9 @@ class DatabaseKeyStore {
     this.logger = logger;
   }
   static async create(options) {
-    var _a;
     const { database, logger } = options;
     const client = await database.getClient();
-    if (!((_a = database.migrations) == null ? void 0 : _a.skip)) {
+    if (!database.migrations?.skip) {
       await applyDatabaseMigrations(client);
     }
     return new DatabaseKeyStore(client, logger);
@@ -2060,14 +1697,15 @@ class DatabaseKeyStore {
   }
 }
 
-function createCredentialsWithServicePrincipal(sub, token) {
+function createCredentialsWithServicePrincipal(sub, token, accessRestrictions) {
   return {
     $$type: "@backstage/BackstageCredentials",
     version: "v1",
     token,
     principal: {
       type: "service",
-      subject: sub
+      subject: sub,
+      accessRestrictions
     }
   };
 }
@@ -2105,20 +1743,6 @@ function toInternalBackstageCredentials(credentials) {
   return internalCredentials;
 }
 
-var __accessCheck$6 = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateAdd$6 = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var __privateMethod$4 = (obj, member, method) => {
-  __accessCheck$6(obj, member, "access private method");
-  return method;
-};
-var _getJwtExpiration, getJwtExpiration_fn;
 class DefaultAuthService {
   constructor(userTokenHandler, pluginTokenHandler, externalTokenHandler, tokenManager, pluginId, disableDefaultAuthPolicy, publicKeyStore) {
     this.userTokenHandler = userTokenHandler;
@@ -2128,7 +1752,6 @@ class DefaultAuthService {
     this.pluginId = pluginId;
     this.disableDefaultAuthPolicy = disableDefaultAuthPolicy;
     this.publicKeyStore = publicKeyStore;
-    __privateAdd$6(this, _getJwtExpiration);
   }
   // allowLimitedAccess is currently ignored, since we currently always use the full user tokens
   async authenticate(token) {
@@ -2146,7 +1769,7 @@ class DefaultAuthService {
         return createCredentialsWithUserPrincipal(
           userResult2.userEntityRef,
           pluginResult.limitedUserToken,
-          __privateMethod$4(this, _getJwtExpiration, getJwtExpiration_fn).call(this, pluginResult.limitedUserToken)
+          this.#getJwtExpiration(pluginResult.limitedUserToken)
         );
       }
       return createCredentialsWithServicePrincipal(pluginResult.subject);
@@ -2156,12 +1779,16 @@ class DefaultAuthService {
       return createCredentialsWithUserPrincipal(
         userResult.userEntityRef,
         token,
-        __privateMethod$4(this, _getJwtExpiration, getJwtExpiration_fn).call(this, token)
+        this.#getJwtExpiration(token)
       );
     }
     const externalResult = await this.externalTokenHandler.verifyToken(token);
     if (externalResult) {
-      return createCredentialsWithServicePrincipal(externalResult.subject);
+      return createCredentialsWithServicePrincipal(
+        externalResult.subject,
+        void 0,
+        externalResult.accessRestrictions
+      );
     }
     throw new errors.AuthenticationError("Illegal token");
   }
@@ -2244,49 +1871,29 @@ class DefaultAuthService {
     const { keys } = await this.publicKeyStore.listKeys();
     return { keys: keys.map(({ key }) => key) };
   }
-}
-_getJwtExpiration = new WeakSet();
-getJwtExpiration_fn = function(token) {
-  const { exp } = jose.decodeJwt(token);
-  if (!exp) {
-    throw new errors.AuthenticationError("User token is missing expiration");
+  #getJwtExpiration(token) {
+    const { exp } = jose.decodeJwt(token);
+    if (!exp) {
+      throw new errors.AuthenticationError("User token is missing expiration");
+    }
+    return new Date(exp * 1e3);
   }
-  return new Date(exp * 1e3);
-};
+}
 
-var __accessCheck$5 = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateGet$4 = (obj, member, getter) => {
-  __accessCheck$5(obj, member, "read from private field");
-  return member.get(obj);
-};
-var __privateAdd$5 = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var __privateSet$2 = (obj, member, value, setter) => {
-  __accessCheck$5(obj, member, "write to private field");
-  member.set(obj, value);
-  return value;
-};
-var _keyStore, _keyStoreUpdated;
 const CLOCK_MARGIN_S = 10;
 class JwksClient {
   constructor(getEndpoint) {
     this.getEndpoint = getEndpoint;
-    __privateAdd$5(this, _keyStore, void 0);
-    __privateAdd$5(this, _keyStoreUpdated, 0);
   }
+  #keyStore;
+  #keyStoreUpdated = 0;
   get getKey() {
-    if (!__privateGet$4(this, _keyStore)) {
+    if (!this.#keyStore) {
       throw new errors.AuthenticationError(
         "refreshKeyStore must be called before jwksClient.getKey"
       );
     }
-    return __privateGet$4(this, _keyStore);
+    return this.#keyStore;
   }
   /**
    * If the last keystore refresh is stale, update the keystore URL to the latest
@@ -2296,9 +1903,9 @@ class JwksClient {
     const header = await jose.decodeProtectedHeader(rawJwtToken);
     let keyStoreHasKey;
     try {
-      if (__privateGet$4(this, _keyStore)) {
+      if (this.#keyStore) {
         const [_, rawPayload, rawSignature] = rawJwtToken.split(".");
-        keyStoreHasKey = await __privateGet$4(this, _keyStore).call(this, header, {
+        keyStoreHasKey = await this.#keyStore(header, {
           payload: rawPayload,
           signature: rawSignature
         });
@@ -2306,23 +1913,15 @@ class JwksClient {
     } catch (error) {
       keyStoreHasKey = false;
     }
-    const issuedAfterLastRefresh = (payload == null ? void 0 : payload.iat) && payload.iat > __privateGet$4(this, _keyStoreUpdated) - CLOCK_MARGIN_S;
-    if (!__privateGet$4(this, _keyStore) || !keyStoreHasKey && issuedAfterLastRefresh) {
+    const issuedAfterLastRefresh = payload?.iat && payload.iat > this.#keyStoreUpdated - CLOCK_MARGIN_S;
+    if (!this.#keyStore || !keyStoreHasKey && issuedAfterLastRefresh) {
       const endpoint = await this.getEndpoint();
-      __privateSet$2(this, _keyStore, jose.createRemoteJWKSet(endpoint));
-      __privateSet$2(this, _keyStoreUpdated, Date.now() / 1e3);
+      this.#keyStore = jose.createRemoteJWKSet(endpoint);
+      this.#keyStoreUpdated = Date.now() / 1e3;
     }
   }
 }
-_keyStore = new WeakMap();
-_keyStoreUpdated = new WeakMap();
 
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => {
-  __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
-  return value;
-};
 const KEY_EXPIRATION_MARGIN_FACTOR = 3;
 const SECONDS_IN_MS = 1e3;
 const ALLOWED_PLUGIN_ID_PATTERN = /^[a-z0-9_-]+$/i;
@@ -2334,21 +1933,20 @@ class PluginTokenHandler {
     this.keyDurationSeconds = keyDurationSeconds;
     this.algorithm = algorithm;
     this.discovery = discovery;
-    __publicField(this, "privateKeyPromise");
-    __publicField(this, "keyExpiry");
-    __publicField(this, "jwksMap", /* @__PURE__ */ new Map());
-    // Tracking state for isTargetPluginSupported
-    __publicField(this, "supportedTargetPlugins", /* @__PURE__ */ new Set());
-    __publicField(this, "targetPluginInflightChecks", /* @__PURE__ */ new Map());
   }
+  privateKeyPromise;
+  keyExpiry;
+  jwksMap = /* @__PURE__ */ new Map();
+  // Tracking state for isTargetPluginSupported
+  supportedTargetPlugins = /* @__PURE__ */ new Set();
+  targetPluginInflightChecks = /* @__PURE__ */ new Map();
   static create(options) {
-    var _a;
     return new PluginTokenHandler(
       options.logger,
       options.ownPluginId,
       options.publicKeyStore,
       Math.round(types.durationToMilliseconds(options.keyDuration) / 1e3),
-      (_a = options.algorithm) != null ? _a : "ES256",
+      options.algorithm ?? "ES256",
       options.discovery
     );
   }
@@ -2396,7 +1994,7 @@ class PluginTokenHandler {
       ourExp,
       Math.floor(onBehalfOf.expiresAt.getTime() / SECONDS_IN_MS)
     ) : ourExp;
-    const claims = { sub, aud, iat, exp, obo: onBehalfOf == null ? void 0 : onBehalfOf.token };
+    const claims = { sub, aud, iat, exp, obo: onBehalfOf?.token };
     const token = await new jose.SignJWT(claims).setProtectedHeader({
       typ: pluginAuthNode.tokenTypes.plugin.typParam,
       alg: this.algorithm,
@@ -2502,34 +2100,19 @@ class PluginTokenHandler {
   }
 }
 
-var __accessCheck$4 = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateAdd$4 = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var __privateMethod$3 = (obj, member, method) => {
-  __accessCheck$4(obj, member, "access private method");
-  return method;
-};
-var _getTokenVerificationOptions, getTokenVerificationOptions_fn;
-const _UserTokenHandler = class _UserTokenHandler {
+class UserTokenHandler {
   constructor(jwksClient) {
     this.jwksClient = jwksClient;
-    __privateAdd$4(this, _getTokenVerificationOptions);
   }
   static create(options) {
     const jwksClient = new JwksClient(async () => {
       const url = await options.discovery.getBaseUrl("auth");
       return new URL(`${url}/.well-known/jwks.json`);
     });
-    return new _UserTokenHandler(jwksClient);
+    return new UserTokenHandler(jwksClient);
   }
   async verifyToken(token) {
-    const verifyOpts = __privateMethod$3(this, _getTokenVerificationOptions, getTokenVerificationOptions_fn).call(this, token);
+    const verifyOpts = this.#getTokenVerificationOptions(token);
     if (!verifyOpts) {
       return void 0;
     }
@@ -2547,6 +2130,31 @@ const _UserTokenHandler = class _UserTokenHandler {
     }
     return { userEntityRef };
   }
+  #getTokenVerificationOptions(token) {
+    try {
+      const { typ } = jose.decodeProtectedHeader(token);
+      if (typ === pluginAuthNode.tokenTypes.user.typParam) {
+        return {
+          requiredClaims: ["iat", "exp", "sub"],
+          typ: pluginAuthNode.tokenTypes.user.typParam
+        };
+      }
+      if (typ === pluginAuthNode.tokenTypes.limitedUser.typParam) {
+        return {
+          requiredClaims: ["iat", "exp", "sub"],
+          typ: pluginAuthNode.tokenTypes.limitedUser.typParam
+        };
+      }
+      const { aud } = jose.decodeJwt(token);
+      if (aud === pluginAuthNode.tokenTypes.user.audClaim) {
+        return {
+          audience: pluginAuthNode.tokenTypes.user.audClaim
+        };
+      }
+    } catch {
+    }
+    return void 0;
+  }
   createLimitedUserToken(backstageToken) {
     const [headerRaw, payloadRaw] = backstageToken.split(".");
     const header = JSON.parse(
@@ -2592,64 +2200,133 @@ const _UserTokenHandler = class _UserTokenHandler {
       return false;
     }
   }
-};
-_getTokenVerificationOptions = new WeakSet();
-getTokenVerificationOptions_fn = function(token) {
-  try {
-    const { typ } = jose.decodeProtectedHeader(token);
-    if (typ === pluginAuthNode.tokenTypes.user.typParam) {
-      return {
-        requiredClaims: ["iat", "exp", "sub"],
-        typ: pluginAuthNode.tokenTypes.user.typParam
-      };
+}
+
+function readAccessRestrictionsFromConfig(externalAccessEntryConfig) {
+  const configs = externalAccessEntryConfig.getOptionalConfigArray("accessRestrictions") ?? [];
+  const result = /* @__PURE__ */ new Map();
+  for (const config of configs) {
+    const validKeys = ["plugin", "permission", "permissionAttribute"];
+    for (const key of config.keys()) {
+      if (!validKeys.includes(key)) {
+        const valid = validKeys.map((k) => `'${k}'`).join(", ");
+        throw new Error(
+          `Invalid key '${key}' in 'accessRestrictions' config, expected one of ${valid}`
+        );
+      }
     }
-    if (typ === pluginAuthNode.tokenTypes.limitedUser.typParam) {
-      return {
-        requiredClaims: ["iat", "exp", "sub"],
-        typ: pluginAuthNode.tokenTypes.limitedUser.typParam
-      };
+    const pluginId = config.getString("plugin");
+    const permissionNames = readPermissionNames(config);
+    const permissionAttributes = readPermissionAttributes(config);
+    if (result.has(pluginId)) {
+      throw new Error(
+        `Attempted to declare 'accessRestrictions' twice for plugin '${pluginId}', which is not permitted`
+      );
     }
-    const { aud } = jose.decodeJwt(token);
-    if (aud === pluginAuthNode.tokenTypes.user.audClaim) {
-      return {
-        audience: pluginAuthNode.tokenTypes.user.audClaim
-      };
+    result.set(pluginId, {
+      ...permissionNames ? { permissionNames } : {},
+      ...permissionAttributes ? { permissionAttributes } : {}
+    });
+  }
+  return result.size ? result : void 0;
+}
+function readStringOrStringArrayFromConfig(root, key, validValues) {
+  if (!root.has(key)) {
+    return void 0;
+  }
+  const rawValues = Array.isArray(root.get(key)) ? root.getStringArray(key) : [root.getString(key)];
+  const values = [
+    ...new Set(
+      rawValues.map((v) => v.split(/[ ,]/)).flat().filter(Boolean)
+    )
+  ];
+  if (!values.length) {
+    return void 0;
+  }
+  if (validValues?.length) {
+    for (const value of values) {
+      if (!validValues.includes(value)) {
+        const valid = validValues.map((k) => `'${k}'`).join(", ");
+        throw new Error(
+          `Invalid value '${value}' at '${key}' in 'permissionAttributes' config, valid values are ${valid}`
+        );
+      }
     }
-  } catch {
   }
-  return void 0;
-};
-let UserTokenHandler = _UserTokenHandler;
+  return values;
+}
+function readPermissionNames(externalAccessEntryConfig) {
+  return readStringOrStringArrayFromConfig(
+    externalAccessEntryConfig,
+    "permission"
+  );
+}
+function readPermissionAttributes(externalAccessEntryConfig) {
+  const config = externalAccessEntryConfig.getOptionalConfig(
+    "permissionAttribute"
+  );
+  if (!config) {
+    return void 0;
+  }
+  const validKeys = ["action"];
+  for (const key of config.keys()) {
+    if (!validKeys.includes(key)) {
+      const valid = validKeys.map((k) => `'${k}'`).join(", ");
+      throw new Error(
+        `Invalid key '${key}' in 'permissionAttribute' config, expected ${valid}`
+      );
+    }
+  }
+  const action = readStringOrStringArrayFromConfig(config, "action", [
+    "create",
+    "read",
+    "update",
+    "delete"
+  ]);
+  const result = {
+    ...action ? { action } : {}
+  };
+  return Object.keys(result).length ? result : void 0;
+}
 
-var __accessCheck$3 = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateGet$3 = (obj, member, getter) => {
-  __accessCheck$3(obj, member, "read from private field");
-  return member.get(obj);
-};
-var __privateAdd$3 = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var __privateMethod$2 = (obj, member, method) => {
-  __accessCheck$3(obj, member, "access private method");
-  return method;
-};
-var _entries$1, _doAdd, doAdd_fn;
 class LegacyTokenHandler {
-  constructor() {
-    __privateAdd$3(this, _doAdd);
-    __privateAdd$3(this, _entries$1, []);
-  }
-  add(options) {
-    __privateMethod$2(this, _doAdd, doAdd_fn).call(this, options.getString("secret"), options.getString("subject"));
+  #entries = new Array();
+  add(config) {
+    const allAccessRestrictions = readAccessRestrictionsFromConfig(config);
+    this.#doAdd(
+      config.getString("options.secret"),
+      config.getString("options.subject"),
+      allAccessRestrictions
+    );
   }
   // used only for the old backend.auth.keys array
-  addOld(options) {
-    __privateMethod$2(this, _doAdd, doAdd_fn).call(this, options.getString("secret"), "external:backstage-plugin");
+  addOld(config) {
+    this.#doAdd(config.getString("secret"), "external:backstage-plugin");
+  }
+  #doAdd(secret, subject, allAccessRestrictions) {
+    if (!secret.match(/^\S+$/)) {
+      throw new Error("Illegal secret, must be a valid base64 string");
+    } else if (!subject.match(/^\S+$/)) {
+      throw new Error("Illegal subject, must be a set of non-space characters");
+    }
+    let key;
+    try {
+      key = jose.base64url.decode(secret);
+    } catch {
+      throw new Error("Illegal secret, must be a valid base64 string");
+    }
+    if (this.#entries.some((e) => e.key === key)) {
+      throw new Error(
+        "Legacy externalAccess token was declared more than once"
+      );
+    }
+    this.#entries.push({
+      key,
+      result: {
+        subject,
+        allAccessRestrictions
+      }
+    });
   }
   async verifyToken(token) {
     try {
@@ -2664,10 +2341,10 @@ class LegacyTokenHandler {
     } catch (e) {
       return void 0;
     }
-    for (const entry of __privateGet$3(this, _entries$1)) {
+    for (const { key, result } of this.#entries) {
       try {
-        await jose.jwtVerify(token, entry.key);
-        return { subject: entry.subject };
+        await jose.jwtVerify(token, key);
+        return result;
       } catch (e) {
         if (e.code !== "ERR_JWS_SIGNATURE_VERIFICATION_FAILED") {
           throw e;
@@ -2677,85 +2354,109 @@ class LegacyTokenHandler {
     return void 0;
   }
 }
-_entries$1 = new WeakMap();
-_doAdd = new WeakSet();
-doAdd_fn = function(secret, subject) {
-  if (!secret.match(/^\S+$/)) {
-    throw new Error("Illegal secret, must be a valid base64 string");
-  }
-  let key;
-  try {
-    key = jose.base64url.decode(secret);
-  } catch {
-    throw new Error("Illegal secret, must be a valid base64 string");
-  }
-  if (!subject.match(/^\S+$/)) {
-    throw new Error("Illegal subject, must be a set of non-space characters");
-  }
-  __privateGet$3(this, _entries$1).push({ key, subject });
-};
 
-var __accessCheck$2 = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateGet$2 = (obj, member, getter) => {
-  __accessCheck$2(obj, member, "read from private field");
-  return member.get(obj);
-};
-var __privateAdd$2 = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var _entries;
 const MIN_TOKEN_LENGTH = 8;
 class StaticTokenHandler {
-  constructor() {
-    __privateAdd$2(this, _entries, []);
-  }
-  add(options) {
-    const token = options.getString("token");
+  #entries = /* @__PURE__ */ new Map();
+  add(config) {
+    const token = config.getString("options.token");
+    const subject = config.getString("options.subject");
+    const allAccessRestrictions = readAccessRestrictionsFromConfig(config);
     if (!token.match(/^\S+$/)) {
       throw new Error("Illegal token, must be a set of non-space characters");
-    }
-    if (token.length < MIN_TOKEN_LENGTH) {
+    } else if (token.length < MIN_TOKEN_LENGTH) {
       throw new Error(
         `Illegal token, must be at least ${MIN_TOKEN_LENGTH} characters length`
       );
-    }
-    const subject = options.getString("subject");
-    if (!subject.match(/^\S+$/)) {
+    } else if (!subject.match(/^\S+$/)) {
       throw new Error("Illegal subject, must be a set of non-space characters");
+    } else if (this.#entries.has(token)) {
+      throw new Error(
+        "Static externalAccess token was declared more than once"
+      );
     }
-    __privateGet$2(this, _entries).push({ token, subject });
+    this.#entries.set(token, { subject, allAccessRestrictions });
   }
   async verifyToken(token) {
-    const entry = __privateGet$2(this, _entries).find((e) => e.token === token);
-    if (!entry) {
-      return void 0;
+    return this.#entries.get(token);
+  }
+}
+
+class JWKSHandler {
+  #entries = [];
+  add(config) {
+    if (!config.getString("options.url").match(/^\S+$/)) {
+      throw new Error(
+        "Illegal JWKS URL, must be a set of non-space characters"
+      );
     }
-    return { subject: entry.subject };
+    const algorithms = readStringOrStringArrayFromConfig(
+      config,
+      "options.algorithm"
+    );
+    const issuers = readStringOrStringArrayFromConfig(config, "options.issuer");
+    const audiences = readStringOrStringArrayFromConfig(
+      config,
+      "options.audience"
+    );
+    const subjectPrefix = config.getOptionalString("options.subjectPrefix");
+    const url = new URL(config.getString("options.url"));
+    const jwks = jose.createRemoteJWKSet(url);
+    const allAccessRestrictions = readAccessRestrictionsFromConfig(config);
+    this.#entries.push({
+      algorithms,
+      audiences,
+      issuers,
+      jwks,
+      subjectPrefix,
+      url,
+      allAccessRestrictions
+    });
+  }
+  async verifyToken(token) {
+    for (const entry of this.#entries) {
+      try {
+        const {
+          payload: { sub }
+        } = await jose.jwtVerify(token, entry.jwks, {
+          algorithms: entry.algorithms,
+          issuer: entry.issuers,
+          audience: entry.audiences
+        });
+        if (sub) {
+          const prefix = entry.subjectPrefix ? `external:${entry.subjectPrefix}:` : "external:";
+          return {
+            subject: `${prefix}${sub}`,
+            allAccessRestrictions: entry.allAccessRestrictions
+          };
+        }
+      } catch {
+        continue;
+      }
+    }
+    return void 0;
   }
 }
-_entries = new WeakMap();
 
 const NEW_CONFIG_KEY = "backend.auth.externalAccess";
 const OLD_CONFIG_KEY = "backend.auth.keys";
+let loggedDeprecationWarning = false;
 class ExternalTokenHandler {
-  constructor(handlers) {
+  constructor(ownPluginId, handlers) {
+    this.ownPluginId = ownPluginId;
     this.handlers = handlers;
   }
   static create(options) {
-    var _a, _b;
-    const { config, logger } = options;
+    const { ownPluginId, config, logger } = options;
     const staticHandler = new StaticTokenHandler();
     const legacyHandler = new LegacyTokenHandler();
+    const jwksHandler = new JWKSHandler();
     const handlers = {
       static: staticHandler,
-      legacy: legacyHandler
+      legacy: legacyHandler,
+      jwks: jwksHandler
     };
-    const handlerConfigs = (_a = config.getOptionalConfigArray(NEW_CONFIG_KEY)) != null ? _a : [];
+    const handlerConfigs = config.getOptionalConfigArray(NEW_CONFIG_KEY) ?? [];
     for (const handlerConfig of handlerConfigs) {
       const type = handlerConfig.getString("type");
       const handler = handlers[type];
@@ -2765,10 +2466,11 @@ class ExternalTokenHandler {
           `Unknown type '${type}' in ${NEW_CONFIG_KEY}, expected one of ${valid}`
         );
       }
-      handler.add(handlerConfig.getConfig("options"));
+      handler.add(handlerConfig);
     }
-    const legacyConfigs = (_b = config.getOptionalConfigArray(OLD_CONFIG_KEY)) != null ? _b : [];
-    if (legacyConfigs.length) {
+    const legacyConfigs = config.getOptionalConfigArray(OLD_CONFIG_KEY) ?? [];
+    if (legacyConfigs.length && !loggedDeprecationWarning) {
+      loggedDeprecationWarning = true;
       logger.warn(
         `DEPRECATION WARNING: The ${OLD_CONFIG_KEY} config has been replaced by ${NEW_CONFIG_KEY}, see https://backstage.io/docs/auth/service-to-service-auth`
       );
@@ -2776,13 +2478,29 @@ class ExternalTokenHandler {
     for (const handlerConfig of legacyConfigs) {
       legacyHandler.addOld(handlerConfig);
     }
-    return new ExternalTokenHandler(Object.values(handlers));
+    return new ExternalTokenHandler(ownPluginId, Object.values(handlers));
   }
   async verifyToken(token) {
     for (const handler of this.handlers) {
       const result = await handler.verifyToken(token);
       if (result) {
-        return result;
+        const { allAccessRestrictions, ...rest } = result;
+        if (allAccessRestrictions) {
+          const accessRestrictions = allAccessRestrictions.get(
+            this.ownPluginId
+          );
+          if (!accessRestrictions) {
+            const valid = [...allAccessRestrictions.keys()].map((k) => `'${k}'`).join(", ");
+            throw new errors.NotAllowedError(
+              `This token's access is restricted to plugin(s) ${valid}`
+            );
+          }
+          return {
+            ...rest,
+            accessRestrictions
+          };
+        }
+        return rest;
       }
     }
     return void 0;
@@ -2803,16 +2521,7 @@ const authServiceFactory = backendPluginApi.createServiceFactory({
     // new auth services in the new backend system.
     tokenManager: backendPluginApi.coreServices.tokenManager
   },
-  async createRootContext({ config, logger }) {
-    const externalTokens = ExternalTokenHandler.create({
-      config,
-      logger
-    });
-    return {
-      externalTokens
-    };
-  },
-  async factory({ config, discovery, plugin, tokenManager, logger, database }, { externalTokens }) {
+  async factory({ config, discovery, plugin, tokenManager, logger, database }) {
     const disableDefaultAuthPolicy = Boolean(
       config.getOptionalBoolean(
         "backend.auth.dangerouslyDisableDefaultAuthPolicy"
@@ -2832,6 +2541,11 @@ const authServiceFactory = backendPluginApi.createServiceFactory({
       publicKeyStore,
       discovery
     });
+    const externalTokens = ExternalTokenHandler.create({
+      ownPluginId: plugin.getId(),
+      config,
+      logger
+    });
     return new DefaultAuthService(
       userTokens,
       pluginTokens,
@@ -2848,10 +2562,11 @@ const cacheServiceFactory = backendPluginApi.createServiceFactory({
   service: backendPluginApi.coreServices.cache,
   deps: {
     config: backendPluginApi.coreServices.rootConfig,
+    logger: backendPluginApi.coreServices.rootLogger,
     plugin: backendPluginApi.coreServices.pluginMetadata
   },
-  async createRootContext({ config }) {
-    return backendCommon.CacheManager.fromConfig(config);
+  async createRootContext({ config, logger }) {
+    return backendCommon.CacheManager.fromConfig(config, { logger });
   },
   async factory({ plugin }, manager) {
     return manager.forPlugin(plugin.getId()).getClient();
@@ -2864,9 +2579,9 @@ const rootConfigServiceFactory = backendPluginApi.createServiceFactory(
     deps: {},
     async factory() {
       const source = configLoader.ConfigSources.default({
-        argv: options == null ? void 0 : options.argv,
-        remote: options == null ? void 0 : options.remote,
-        watch: options == null ? void 0 : options.watch
+        argv: options?.argv,
+        remote: options?.remote,
+        watch: options?.watch
       });
       console.log(`Loading config from ${source}`);
       return await configLoader.ConfigSources.toConfig(source);
@@ -2929,8 +2644,7 @@ class HostDiscovery {
    * path for the `catalog` plugin will be `http://localhost:7007/api/catalog`.
    */
   static fromConfig(config, options) {
-    var _a;
-    const basePath = (_a = options == null ? void 0 : options.basePath) != null ? _a : "/api";
+    const basePath = options?.basePath ?? "/api";
     const externalBaseUrl = config.getString("backend.baseUrl").replace(/\/+$/, "");
     const {
       listen: { host: listenHost = "::", port: listenPort }
@@ -2953,9 +2667,8 @@ class HostDiscovery {
     );
   }
   getTargetFromConfig(pluginId, type) {
-    var _a, _b;
-    const endpoints = (_a = this.discoveryConfig) == null ? void 0 : _a.getOptionalConfigArray("endpoints");
-    const target = (_b = endpoints == null ? void 0 : endpoints.find((endpoint) => endpoint.getStringArray("plugins").includes(pluginId))) == null ? void 0 : _b.get("target");
+    const endpoints = this.discoveryConfig?.getOptionalConfigArray("endpoints");
+    const target = endpoints?.find((endpoint) => endpoint.getStringArray("plugins").includes(pluginId))?.get("target");
     if (!target) {
       const baseUrl = type === "external" ? this.externalBaseUrl : this.internalBaseUrl;
       return `${baseUrl}/${encodeURIComponent(pluginId)}`;
@@ -2989,36 +2702,13 @@ const discoveryServiceFactory = backendPluginApi.createServiceFactory({
   }
 });
 
-var __accessCheck$1 = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateGet$1 = (obj, member, getter) => {
-  __accessCheck$1(obj, member, "read from private field");
-  return member.get(obj);
-};
-var __privateAdd$1 = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var __privateSet$1 = (obj, member, value, setter) => {
-  __accessCheck$1(obj, member, "write to private field");
-  member.set(obj, value);
-  return value;
-};
-var __privateMethod$1 = (obj, member, method) => {
-  __accessCheck$1(obj, member, "access private method");
-  return method;
-};
-var _auth, _discovery, _pluginId, _extractCredentialsFromRequest, extractCredentialsFromRequest_fn, _extractLimitedCredentialsFromRequest, extractLimitedCredentialsFromRequest_fn, _getCredentials, getCredentials_fn, _getLimitedCredentials, getLimitedCredentials_fn, _getCookieOptions, getCookieOptions_fn, _existingCookieExpiration, existingCookieExpiration_fn;
 const FIVE_MINUTES_MS = 5 * 60 * 1e3;
 const BACKSTAGE_AUTH_COOKIE = "backstage-auth";
 function getTokenFromRequest(req) {
   const authHeader = req.headers.authorization;
   if (typeof authHeader === "string") {
     const matches = authHeader.match(/^Bearer[ ]+(\S+)$/i);
-    const token = matches == null ? void 0 : matches[1];
+    const token = matches?.[1];
     if (token) {
       return token;
     }
@@ -3042,39 +2732,61 @@ function willExpireSoon(expiresAt) {
 const credentialsSymbol = Symbol("backstage-credentials");
 const limitedCredentialsSymbol = Symbol("backstage-limited-credentials");
 class DefaultHttpAuthService {
+  #auth;
+  #discovery;
+  #pluginId;
   constructor(auth, discovery, pluginId) {
-    __privateAdd$1(this, _extractCredentialsFromRequest);
-    __privateAdd$1(this, _extractLimitedCredentialsFromRequest);
-    __privateAdd$1(this, _getCredentials);
-    __privateAdd$1(this, _getLimitedCredentials);
-    __privateAdd$1(this, _getCookieOptions);
-    __privateAdd$1(this, _existingCookieExpiration);
-    __privateAdd$1(this, _auth, void 0);
-    __privateAdd$1(this, _discovery, void 0);
-    __privateAdd$1(this, _pluginId, void 0);
-    __privateSet$1(this, _auth, auth);
-    __privateSet$1(this, _discovery, discovery);
-    __privateSet$1(this, _pluginId, pluginId);
+    this.#auth = auth;
+    this.#discovery = discovery;
+    this.#pluginId = pluginId;
+  }
+  async #extractCredentialsFromRequest(req) {
+    const token = getTokenFromRequest(req);
+    if (!token) {
+      return await this.#auth.getNoneCredentials();
+    }
+    return await this.#auth.authenticate(token);
+  }
+  async #extractLimitedCredentialsFromRequest(req) {
+    const token = getTokenFromRequest(req);
+    if (token) {
+      return await this.#auth.authenticate(token, {
+        allowLimitedAccess: true
+      });
+    }
+    const cookie = getCookieFromRequest(req);
+    if (cookie) {
+      return await this.#auth.authenticate(cookie, {
+        allowLimitedAccess: true
+      });
+    }
+    return await this.#auth.getNoneCredentials();
+  }
+  async #getCredentials(req) {
+    return req[credentialsSymbol] ??= this.#extractCredentialsFromRequest(req);
+  }
+  async #getLimitedCredentials(req) {
+    return req[limitedCredentialsSymbol] ??= this.#extractLimitedCredentialsFromRequest(req);
   }
   async credentials(req, options) {
-    const credentials = (options == null ? void 0 : options.allowLimitedAccess) ? await __privateMethod$1(this, _getLimitedCredentials, getLimitedCredentials_fn).call(this, req) : await __privateMethod$1(this, _getCredentials, getCredentials_fn).call(this, req);
-    const allowed = options == null ? void 0 : options.allow;
+    const credentials = options?.allowLimitedAccess ? await this.#getLimitedCredentials(req) : await this.#getCredentials(req);
+    const allowed = options?.allow;
     if (!allowed) {
       return credentials;
     }
-    if (__privateGet$1(this, _auth).isPrincipal(credentials, "none")) {
+    if (this.#auth.isPrincipal(credentials, "none")) {
       if (allowed.includes("none")) {
         return credentials;
       }
       throw new errors.AuthenticationError("Missing credentials");
-    } else if (__privateGet$1(this, _auth).isPrincipal(credentials, "user")) {
+    } else if (this.#auth.isPrincipal(credentials, "user")) {
       if (allowed.includes("user")) {
         return credentials;
       }
       throw new errors.NotAllowedError(
         `This endpoint does not allow 'user' credentials`
       );
-    } else if (__privateGet$1(this, _auth).isPrincipal(credentials, "service")) {
+    } else if (this.#auth.isPrincipal(credentials, "service")) {
       if (allowed.includes("service")) {
         return credentials;
       }
@@ -3091,15 +2803,15 @@ class DefaultHttpAuthService {
       throw new Error("Failed to issue user cookie, headers were already sent");
     }
     let credentials;
-    if (options == null ? void 0 : options.credentials) {
-      if (__privateGet$1(this, _auth).isPrincipal(options.credentials, "none")) {
+    if (options?.credentials) {
+      if (this.#auth.isPrincipal(options.credentials, "none")) {
         res.clearCookie(
           BACKSTAGE_AUTH_COOKIE,
-          await __privateMethod$1(this, _getCookieOptions, getCookieOptions_fn).call(this, res.req)
+          await this.#getCookieOptions(res.req)
         );
         return { expiresAt: /* @__PURE__ */ new Date() };
       }
-      if (!__privateGet$1(this, _auth).isPrincipal(options.credentials, "user")) {
+      if (!this.#auth.isPrincipal(options.credentials, "user")) {
         throw new errors.AuthenticationError(
           "Refused to issue cookie for non-user principal"
         );
@@ -3108,99 +2820,60 @@ class DefaultHttpAuthService {
     } else {
       credentials = await this.credentials(res.req, { allow: ["user"] });
     }
-    const existingExpiresAt = await __privateMethod$1(this, _existingCookieExpiration, existingCookieExpiration_fn).call(this, res.req);
+    const existingExpiresAt = await this.#existingCookieExpiration(res.req);
     if (existingExpiresAt && !willExpireSoon(existingExpiresAt)) {
       return { expiresAt: existingExpiresAt };
     }
-    const { token, expiresAt } = await __privateGet$1(this, _auth).getLimitedUserToken(
+    const { token, expiresAt } = await this.#auth.getLimitedUserToken(
       credentials
     );
     if (!token) {
       throw new Error("User credentials is unexpectedly missing token");
     }
     res.cookie(BACKSTAGE_AUTH_COOKIE, token, {
-      ...await __privateMethod$1(this, _getCookieOptions, getCookieOptions_fn).call(this, res.req),
+      ...await this.#getCookieOptions(res.req),
       expires: expiresAt
     });
     return { expiresAt };
   }
-}
-_auth = new WeakMap();
-_discovery = new WeakMap();
-_pluginId = new WeakMap();
-_extractCredentialsFromRequest = new WeakSet();
-extractCredentialsFromRequest_fn = async function(req) {
-  const token = getTokenFromRequest(req);
-  if (!token) {
-    return await __privateGet$1(this, _auth).getNoneCredentials();
-  }
-  return await __privateGet$1(this, _auth).authenticate(token);
-};
-_extractLimitedCredentialsFromRequest = new WeakSet();
-extractLimitedCredentialsFromRequest_fn = async function(req) {
-  const token = getTokenFromRequest(req);
-  if (token) {
-    return await __privateGet$1(this, _auth).authenticate(token, {
-      allowLimitedAccess: true
-    });
-  }
-  const cookie = getCookieFromRequest(req);
-  if (cookie) {
-    return await __privateGet$1(this, _auth).authenticate(cookie, {
-      allowLimitedAccess: true
-    });
-  }
-  return await __privateGet$1(this, _auth).getNoneCredentials();
-};
-_getCredentials = new WeakSet();
-getCredentials_fn = async function(req) {
-  var _a;
-  return (_a = req[credentialsSymbol]) != null ? _a : req[credentialsSymbol] = __privateMethod$1(this, _extractCredentialsFromRequest, extractCredentialsFromRequest_fn).call(this, req);
-};
-_getLimitedCredentials = new WeakSet();
-getLimitedCredentials_fn = async function(req) {
-  var _a;
-  return (_a = req[limitedCredentialsSymbol]) != null ? _a : req[limitedCredentialsSymbol] = __privateMethod$1(this, _extractLimitedCredentialsFromRequest, extractLimitedCredentialsFromRequest_fn).call(this, req);
-};
-_getCookieOptions = new WeakSet();
-getCookieOptions_fn = async function(_req) {
-  const externalBaseUrlStr = await __privateGet$1(this, _discovery).getExternalBaseUrl(
-    __privateGet$1(this, _pluginId)
-  );
-  const externalBaseUrl = new URL(externalBaseUrlStr);
-  const secure = externalBaseUrl.protocol === "https:" || externalBaseUrl.hostname === "localhost";
-  return {
-    domain: externalBaseUrl.hostname,
-    httpOnly: true,
-    secure,
-    priority: "high",
-    sameSite: secure ? "none" : "lax"
-  };
-};
-_existingCookieExpiration = new WeakSet();
-existingCookieExpiration_fn = async function(req) {
-  const existingCookie = getCookieFromRequest(req);
-  if (!existingCookie) {
-    return void 0;
-  }
-  try {
-    const existingCredentials = await __privateGet$1(this, _auth).authenticate(
-      existingCookie,
-      {
-        allowLimitedAccess: true
-      }
+  async #getCookieOptions(_req) {
+    const externalBaseUrlStr = await this.#discovery.getExternalBaseUrl(
+      this.#pluginId
     );
-    if (!__privateGet$1(this, _auth).isPrincipal(existingCredentials, "user")) {
+    const externalBaseUrl = new URL(externalBaseUrlStr);
+    const secure = externalBaseUrl.protocol === "https:" || externalBaseUrl.hostname === "localhost";
+    return {
+      domain: externalBaseUrl.hostname,
+      httpOnly: true,
+      secure,
+      priority: "high",
+      sameSite: secure ? "none" : "lax"
+    };
+  }
+  async #existingCookieExpiration(req) {
+    const existingCookie = getCookieFromRequest(req);
+    if (!existingCookie) {
       return void 0;
     }
-    return existingCredentials.expiresAt;
-  } catch (error) {
-    if (error.name === "AuthenticationError") {
-      return void 0;
+    try {
+      const existingCredentials = await this.#auth.authenticate(
+        existingCookie,
+        {
+          allowLimitedAccess: true
+        }
+      );
+      if (!this.#auth.isPrincipal(existingCredentials, "user")) {
+        return void 0;
+      }
+      return existingCredentials.expiresAt;
+    } catch (error) {
+      if (error.name === "AuthenticationError") {
+        return void 0;
+      }
+      throw error;
     }
-    throw error;
   }
-};
+}
 const httpAuthServiceFactory = backendPluginApi.createServiceFactory({
   service: backendPluginApi.coreServices.httpAuth,
   deps: {
@@ -3360,13 +3033,12 @@ const httpRouterServiceFactory = backendPluginApi.createServiceFactory(
       rootHttpRouter,
       lifecycle
     }) {
-      var _a;
-      if (options == null ? void 0 : options.getPath) {
+      if (options?.getPath) {
         logger.warn(
           `DEPRECATION WARNING: The 'getPath' option for HttpRouterService is deprecated. The ability to reconfigure the '/api/' path prefix for plugins will be removed in the future.`
         );
       }
-      const getPath = (_a = options == null ? void 0 : options.getPath) != null ? _a : (id) => `/api/${id}`;
+      const getPath = options?.getPath ?? ((id) => `/api/${id}`);
       const path = getPath(plugin.getId());
       const router = Router__default.default();
       rootHttpRouter.use(path, router);
@@ -3402,6 +3074,63 @@ const identityServiceFactory = backendPluginApi.createServiceFactory(
   })
 );
 
+class BackendPluginLifecycleImpl {
+  constructor(logger, rootLifecycle, pluginMetadata) {
+    this.logger = logger;
+    this.rootLifecycle = rootLifecycle;
+    this.pluginMetadata = pluginMetadata;
+  }
+  #hasStarted = false;
+  #startupTasks = [];
+  addStartupHook(hook, options) {
+    if (this.#hasStarted) {
+      throw new Error("Attempted to add startup hook after startup");
+    }
+    this.#startupTasks.push({ hook, options });
+  }
+  async startup() {
+    if (this.#hasStarted) {
+      return;
+    }
+    this.#hasStarted = true;
+    this.logger.debug(
+      `Running ${this.#startupTasks.length} plugin startup tasks...`
+    );
+    await Promise.all(
+      this.#startupTasks.map(async ({ hook, options }) => {
+        const logger = options?.logger ?? this.logger;
+        try {
+          await hook();
+          logger.debug(`Plugin startup hook succeeded`);
+        } catch (error) {
+          logger.error(`Plugin startup hook failed, ${error}`);
+        }
+      })
+    );
+  }
+  addShutdownHook(hook, options) {
+    const plugin = this.pluginMetadata.getId();
+    this.rootLifecycle.addShutdownHook(hook, {
+      logger: options?.logger?.child({ plugin }) ?? this.logger
+    });
+  }
+}
+const lifecycleServiceFactory = backendPluginApi.createServiceFactory({
+  service: backendPluginApi.coreServices.lifecycle,
+  deps: {
+    logger: backendPluginApi.coreServices.logger,
+    rootLifecycle: backendPluginApi.coreServices.rootLifecycle,
+    pluginMetadata: backendPluginApi.coreServices.pluginMetadata
+  },
+  async factory({ rootLifecycle, logger, pluginMetadata }) {
+    return new BackendPluginLifecycleImpl(
+      logger,
+      rootLifecycle,
+      pluginMetadata
+    );
+  }
+});
+
 const loggerServiceFactory = backendPluginApi.createServiceFactory({
   service: backendPluginApi.coreServices.logger,
   deps: {
@@ -3430,102 +3159,71 @@ const permissionsServiceFactory = backendPluginApi.createServiceFactory({
   }
 });
 
-var __accessCheck = (obj, member, msg) => {
-  if (!member.has(obj))
-    throw TypeError("Cannot " + msg);
-};
-var __privateGet = (obj, member, getter) => {
-  __accessCheck(obj, member, "read from private field");
-  return member.get(obj);
-};
-var __privateAdd = (obj, member, value) => {
-  if (member.has(obj))
-    throw TypeError("Cannot add the same private member more than once");
-  member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-};
-var __privateSet = (obj, member, value, setter) => {
-  __accessCheck(obj, member, "write to private field");
-  member.set(obj, value);
-  return value;
-};
-var __privateMethod = (obj, member, method) => {
-  __accessCheck(obj, member, "access private method");
-  return method;
-};
-var _indexPath, _router, _namedRoutes, _indexRouter, _existingPaths, _findConflictingPath, findConflictingPath_fn;
 function normalizePath(path) {
   return `${trimEnd__default.default(path, "/")}/`;
 }
-const _DefaultRootHttpRouter = class _DefaultRootHttpRouter {
-  constructor(indexPath) {
-    __privateAdd(this, _findConflictingPath);
-    __privateAdd(this, _indexPath, void 0);
-    __privateAdd(this, _router, express.Router());
-    __privateAdd(this, _namedRoutes, express.Router());
-    __privateAdd(this, _indexRouter, express.Router());
-    __privateAdd(this, _existingPaths, new Array());
-    __privateSet(this, _indexPath, indexPath);
-    __privateGet(this, _router).use(__privateGet(this, _namedRoutes));
-    __privateGet(this, _router).use("/api/", (_req, _res, next) => {
-      next("router");
-    });
-    if (__privateGet(this, _indexPath)) {
-      __privateGet(this, _router).use(__privateGet(this, _indexRouter));
-    }
-  }
+class DefaultRootHttpRouter {
+  #indexPath;
+  #router = express.Router();
+  #namedRoutes = express.Router();
+  #indexRouter = express.Router();
+  #existingPaths = new Array();
   static create(options) {
     let indexPath;
-    if ((options == null ? void 0 : options.indexPath) === false) {
+    if (options?.indexPath === false) {
       indexPath = void 0;
-    } else if ((options == null ? void 0 : options.indexPath) === void 0) {
+    } else if (options?.indexPath === void 0) {
       indexPath = "/api/app";
-    } else if ((options == null ? void 0 : options.indexPath) === "") {
+    } else if (options?.indexPath === "") {
       throw new Error("indexPath option may not be an empty string");
     } else {
       indexPath = options.indexPath;
     }
-    return new _DefaultRootHttpRouter(indexPath);
+    return new DefaultRootHttpRouter(indexPath);
+  }
+  constructor(indexPath) {
+    this.#indexPath = indexPath;
+    this.#router.use(this.#namedRoutes);
+    this.#router.use("/api/", (_req, _res, next) => {
+      next("router");
+    });
+    if (this.#indexPath) {
+      this.#router.use(this.#indexRouter);
+    }
   }
   use(path, handler) {
     if (path.match(/^[/\s]*$/)) {
       throw new Error(`Root router path may not be empty`);
     }
-    const conflictingPath = __privateMethod(this, _findConflictingPath, findConflictingPath_fn).call(this, path);
+    const conflictingPath = this.#findConflictingPath(path);
     if (conflictingPath) {
       throw new Error(
         `Path ${path} conflicts with the existing path ${conflictingPath}`
       );
     }
-    __privateGet(this, _existingPaths).push(path);
-    __privateGet(this, _namedRoutes).use(path, handler);
-    if (__privateGet(this, _indexPath) === path) {
-      __privateGet(this, _indexRouter).use(handler);
+    this.#existingPaths.push(path);
+    this.#namedRoutes.use(path, handler);
+    if (this.#indexPath === path) {
+      this.#indexRouter.use(handler);
     }
   }
   handler() {
-    return __privateGet(this, _router);
-  }
-};
-_indexPath = new WeakMap();
-_router = new WeakMap();
-_namedRoutes = new WeakMap();
-_indexRouter = new WeakMap();
-_existingPaths = new WeakMap();
-_findConflictingPath = new WeakSet();
-findConflictingPath_fn = function(newPath) {
-  const normalizedNewPath = normalizePath(newPath);
-  for (const path of __privateGet(this, _existingPaths)) {
-    const normalizedPath = normalizePath(path);
-    if (normalizedPath.startsWith(normalizedNewPath)) {
-      return path;
-    }
-    if (normalizedNewPath.startsWith(normalizedPath)) {
-      return path;
+    return this.#router;
+  }
+  #findConflictingPath(newPath) {
+    const normalizedNewPath = normalizePath(newPath);
+    for (const path of this.#existingPaths) {
+      const normalizedPath = normalizePath(path);
+      if (normalizedPath.startsWith(normalizedNewPath)) {
+        return path;
+      }
+      if (normalizedNewPath.startsWith(normalizedPath)) {
+        return path;
+      }
     }
+    return void 0;
   }
-  return void 0;
-};
-let DefaultRootHttpRouter = _DefaultRootHttpRouter;
+}
 
 function defaultConfigure({ applyDefaults }) {
   applyDefaults();
@@ -3539,7 +3237,7 @@ const rootHttpRouterServiceFactory = backendPluginApi.createServiceFactory(
       lifecycle: backendPluginApi.coreServices.rootLifecycle
     },
     async factory({ config, rootLogger, lifecycle }) {
-      const { indexPath, configure = defaultConfigure } = options != null ? options : {};
+      const { indexPath, configure = defaultConfigure } = options ?? {};
       const logger = rootLogger.child({ service: "rootHttpRouter" });
       const app = express__default.default();
       const router = DefaultRootHttpRouter.create({ indexPath });
@@ -3575,13 +3273,81 @@ const rootHttpRouterServiceFactory = backendPluginApi.createServiceFactory(
   })
 );
 
+class BackendLifecycleImpl {
+  constructor(logger) {
+    this.logger = logger;
+  }
+  #hasStarted = false;
+  #startupTasks = [];
+  addStartupHook(hook, options) {
+    if (this.#hasStarted) {
+      throw new Error("Attempted to add startup hook after startup");
+    }
+    this.#startupTasks.push({ hook, options });
+  }
+  async startup() {
+    if (this.#hasStarted) {
+      return;
+    }
+    this.#hasStarted = true;
+    this.logger.debug(`Running ${this.#startupTasks.length} startup tasks...`);
+    await Promise.all(
+      this.#startupTasks.map(async ({ hook, options }) => {
+        const logger = options?.logger ?? this.logger;
+        try {
+          await hook();
+          logger.debug(`Startup hook succeeded`);
+        } catch (error) {
+          logger.error(`Startup hook failed, ${error}`);
+        }
+      })
+    );
+  }
+  #hasShutdown = false;
+  #shutdownTasks = [];
+  addShutdownHook(hook, options) {
+    if (this.#hasShutdown) {
+      throw new Error("Attempted to add shutdown hook after shutdown");
+    }
+    this.#shutdownTasks.push({ hook, options });
+  }
+  async shutdown() {
+    if (this.#hasShutdown) {
+      return;
+    }
+    this.#hasShutdown = true;
+    this.logger.debug(
+      `Running ${this.#shutdownTasks.length} shutdown tasks...`
+    );
+    await Promise.all(
+      this.#shutdownTasks.map(async ({ hook, options }) => {
+        const logger = options?.logger ?? this.logger;
+        try {
+          await hook();
+          logger.debug(`Shutdown hook succeeded`);
+        } catch (error) {
+          logger.error(`Shutdown hook failed, ${error}`);
+        }
+      })
+    );
+  }
+}
+const rootLifecycleServiceFactory = backendPluginApi.createServiceFactory({
+  service: backendPluginApi.coreServices.rootLifecycle,
+  deps: {
+    logger: backendPluginApi.coreServices.rootLogger
+  },
+  async factory({ logger }) {
+    return new BackendLifecycleImpl(logger);
+  }
+});
+
 const rootLoggerServiceFactory = backendPluginApi.createServiceFactory({
   service: backendPluginApi.coreServices.rootLogger,
   deps: {
     config: backendPluginApi.coreServices.rootConfig
   },
   async factory({ config }) {
-    var _a;
     const logger = WinstonLogger.create({
       meta: {
         service: "backstage"
@@ -3592,27 +3358,11 @@ const rootLoggerServiceFactory = backendPluginApi.createServiceFactory({
     });
     const secretEnumerator = await createConfigSecretEnumerator({ logger });
     logger.addRedactions(secretEnumerator(config));
-    (_a = config.subscribe) == null ? void 0 : _a.call(config, () => logger.addRedactions(secretEnumerator(config)));
+    config.subscribe?.(() => logger.addRedactions(secretEnumerator(config)));
     return logger;
   }
 });
 
-const schedulerServiceFactory = backendPluginApi.createServiceFactory({
-  service: backendPluginApi.coreServices.scheduler,
-  deps: {
-    plugin: backendPluginApi.coreServices.pluginMetadata,
-    databaseManager: backendPluginApi.coreServices.database,
-    logger: backendPluginApi.coreServices.logger
-  },
-  async factory({ plugin, databaseManager, logger }) {
-    return backendTasks.TaskScheduler.forPlugin({
-      pluginId: plugin.getId(),
-      databaseManager,
-      logger
-    });
-  }
-});
-
 const tokenManagerServiceFactory = backendPluginApi.createServiceFactory({
   service: backendPluginApi.coreServices.tokenManager,
   deps: {
@@ -3673,6 +3423,22 @@ const userInfoServiceFactory = backendPluginApi.createServiceFactory({
   }
 });
 
+const schedulerServiceFactory = backendPluginApi.createServiceFactory({
+  service: backendPluginApi.coreServices.scheduler,
+  deps: {
+    plugin: backendPluginApi.coreServices.pluginMetadata,
+    databaseManager: backendPluginApi.coreServices.database,
+    logger: backendPluginApi.coreServices.logger
+  },
+  async factory({ plugin, databaseManager, logger }) {
+    return backendTasks.TaskScheduler.forPlugin({
+      pluginId: plugin.getId(),
+      databaseManager,
+      logger
+    });
+  }
+});
+
 exports.DefaultRootHttpRouter = DefaultRootHttpRouter;
 exports.HostDiscovery = HostDiscovery;
 exports.MiddlewareFactory = MiddlewareFactory;