@backstage/plugin-scaffolder-backend 3.5.0-next.1 → 4.0.0-next.2

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @backstage/plugin-scaffolder-backend
 
+## 4.0.0-next.2
+
+### Major Changes
+
+- c78b3b6: Add explicit memory management to SecureTemplater usage
+
+### Minor Changes
+
+- 8006acf: The template parameter schema response now exposes a `formDecorators` field
+  instead of `EXPERIMENTAL_formDecorators`. Templates that still declare
+  `spec.EXPERIMENTAL_formDecorators` are read transparently and surfaced under
+  the new field.
+
+### Patch Changes
+
+- 1ecc3ca: Fixed spelling mistakes in internal code
+- Updated dependencies
+  - @backstage/backend-plugin-api@1.9.1-next.1
+  - @backstage/plugin-scaffolder-common@2.2.0-next.1
+  - @backstage/plugin-scaffolder-node@0.13.3-next.2
+
 ## 3.5.0-next.1
 
 ### Minor Changes

package/dist/lib/templating/SecureTemplater.cjs.js

@@ -1,8 +1,8 @@
 'use strict';
 
-var isolatedVm = require('isolated-vm');
 var backendPluginApi = require('@backstage/backend-plugin-api');
 var fs = require('fs-extra');
+var isolatedVm = require('isolated-vm');
 var helpers = require('./helpers.cjs.js');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
@@ -157,8 +157,10 @@ class SecureTemplater {
     );
     await nunjucksScript.run(context);
     const render = (template, values) => {
-      if (!context) {
-        throw new Error("SecureTemplater has not been initialized");
+      if (!context || isolate.isDisposed) {
+        throw new Error(
+          "SecureTemplater has not been initialized or has been disposed"
+        );
       }
       contextGlobal.setSync("templateStr", String(template));
       contextGlobal.setSync("templateValues", JSON.stringify(values));
@@ -167,7 +169,18 @@ class SecureTemplater {
       }
       return context.evalSync(`render(templateStr, templateValues)`);
     };
-    return render;
+    return {
+      render,
+      dispose: () => {
+        if (context && !isolate.isDisposed) {
+          try {
+            context.release();
+            isolate.dispose();
+          } catch (error) {
+          }
+        }
+      }
+    };
   }
 }
 

package/dist/lib/templating/SecureTemplater.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecureTemplater.cjs.js","sources":["../../../src/lib/templating/SecureTemplater.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Isolate } from 'isolated-vm';\nimport { resolvePackagePath } from '@backstage/backend-plugin-api';\nimport {\n  TemplateFilter,\n  TemplateGlobal,\n} from '@backstage/plugin-scaffolder-node';\nimport fs from 'fs-extra';\nimport { JsonValue } from '@backstage/types';\nimport { getMajorNodeVersion, isNoNodeSnapshotOptionProvided } from './helpers';\n\n// language=JavaScript\nconst mkScript = (nunjucksSource: string) => `\nconst { render, renderCompat } = (() => {\n  const module = {};\n  const process = { env: {} };\n  const require = (pkg) => { if (pkg === 'events') { return function (){}; }};\n\n  ${nunjucksSource}\n\n  const env = module.exports.configure({\n    autoescape: false,\n    ...JSON.parse(nunjucksConfigs),\n    tags: {\n      variableStart: '\\${{',\n      variableEnd: '}}',\n    },\n  });\n\n  const compatEnv = module.exports.configure({\n    autoescape: false,\n    ...JSON.parse(nunjucksConfigs),\n    tags: {\n      variableStart: '{{',\n      variableEnd: '}}',\n    },\n  });\n  compatEnv.addFilter('jsonify', compatEnv.getFilter('dump'));\n\n  const handleFunctionResult = (value) => {\n    return value === '' ? undefined : JSON.parse(value);\n  };\n  for (const name of JSON.parse(availableTemplateFilters)) {\n    env.addFilter(name, (...args) => handleFunctionResult(callFilter(name, args)));\n  }\n  for (const [name, value] of Object.entries(JSON.parse(availableTemplateGlobals))) {\n    env.addGlobal(name, value);\n  }\n  for (const name of JSON.parse(availableTemplateCallbacks)) {\n    env.addGlobal(name, (...args) => handleFunctionResult(callGlobal(name, args)));\n  }\n\n  let uninstallCompat = undefined;\n\n  function render(str, values) {\n    try {\n      if (uninstallCompat) {\n        uninstallCompat();\n        uninstallCompat = undefined;\n      }\n      return env.renderString(str, JSON.parse(values));\n    } catch (error) {\n      // Make sure errors don't leak anything\n      throw new Error(String(error.message));\n    }\n  }\n\n  function renderCompat(str, values) {\n    try {\n      if (!uninstallCompat) {\n        uninstallCompat = module.exports.installJinjaCompat();\n      }\n      return compatEnv.renderString(str, JSON.parse(values));\n    } catch (error) {\n      // Make sure errors don't leak anything\n      throw new Error(String(error.message));\n    }\n  }\n\n  return { render, renderCompat };\n})();\n`;\n\ninterface SecureTemplaterOptions {\n  /* Enables jinja compatibility and the \"jsonify\" filter */\n  cookiecutterCompat?: boolean;\n  /* Extra user-provided nunjucks filters */\n  templateFilters?: Record<string, TemplateFilter>;\n  /* Extra user-provided nunjucks globals */\n  templateGlobals?: Record<string, TemplateGlobal>;\n  nunjucksConfigs?: { trimBlocks?: boolean; lstripBlocks?: boolean };\n}\n\nexport type SecureTemplateRenderer = (\n  template: string,\n  values: unknown,\n) => string;\n\nexport class SecureTemplater {\n  static async loadRenderer(options: SecureTemplaterOptions = {}) {\n    const {\n      cookiecutterCompat,\n      templateFilters = {},\n      templateGlobals = {},\n      nunjucksConfigs = {},\n    } = options;\n\n    const nodeVersion = getMajorNodeVersion();\n    if (nodeVersion >= 20 && !isNoNodeSnapshotOptionProvided()) {\n      throw new Error(\n        `When using Node.js version 20 or newer, the scaffolder backend plugin requires that it be started with the --no-node-snapshot option. \n        Please make sure that you have NODE_OPTIONS=--no-node-snapshot in your environment.`,\n      );\n    }\n\n    const isolate = new Isolate({ memoryLimit: 128 });\n    const context = await isolate.createContext();\n    const contextGlobal = context.global;\n\n    const nunjucksSource = await fs.readFile(\n      resolvePackagePath(\n        '@backstage/plugin-scaffolder-backend',\n        'assets/nunjucks.js.txt',\n      ),\n      'utf-8',\n    );\n\n    const nunjucksScript = await isolate.compileScript(\n      mkScript(nunjucksSource),\n    );\n\n    await contextGlobal.set('nunjucksConfigs', JSON.stringify(nunjucksConfigs));\n\n    const availableFilters = Object.keys(templateFilters);\n\n    await contextGlobal.set(\n      'availableTemplateFilters',\n      JSON.stringify(availableFilters),\n    );\n\n    const globalCallbacks = [];\n    const globalValues: Record<string, unknown> = {};\n    for (const [name, value] of Object.entries(templateGlobals)) {\n      if (typeof value === 'function') {\n        globalCallbacks.push(name);\n      } else {\n        globalValues[name] = value;\n      }\n    }\n\n    await contextGlobal.set(\n      'availableTemplateGlobals',\n      JSON.stringify(globalValues),\n    );\n    await contextGlobal.set(\n      'availableTemplateCallbacks',\n      JSON.stringify(globalCallbacks),\n    );\n\n    await contextGlobal.set(\n      'callFilter',\n      (filterName: string, args: JsonValue[]) => {\n        if (!Object.hasOwn(templateFilters, filterName)) {\n          return '';\n        }\n        const [input, ...rest] = args;\n        const rz = templateFilters[filterName](input, ...rest);\n        return rz === undefined ? '' : JSON.stringify(rz);\n      },\n    );\n\n    await contextGlobal.set(\n      'callGlobal',\n      (globalName: string, args: JsonValue[]) => {\n        if (!Object.hasOwn(templateGlobals, globalName)) {\n          return '';\n        }\n        const global = templateGlobals[globalName];\n        if (typeof global !== 'function') {\n          return '';\n        }\n        const rz = global(...args);\n        return rz === undefined ? '' : JSON.stringify(rz);\n      },\n    );\n\n    await nunjucksScript.run(context);\n\n    const render: SecureTemplateRenderer = (template, values) => {\n      if (!context) {\n        throw new Error('SecureTemplater has not been initialized');\n      }\n\n      contextGlobal.setSync('templateStr', String(template));\n      contextGlobal.setSync('templateValues', JSON.stringify(values));\n\n      if (cookiecutterCompat) {\n        return context.evalSync(`renderCompat(templateStr, templateValues)`);\n      }\n\n      return context.evalSync(`render(templateStr, templateValues)`);\n    };\n    return render;\n  }\n}\n"],"names":["getMajorNodeVersion","isNoNodeSnapshotOptionProvided","Isolate","fs","resolvePackagePath"],"mappings":";;;;;;;;;;;AA2BA,MAAM,QAAA,GAAW,CAAC,cAAA,KAA2B;AAAA;AAAA;AAAA;AAAA;;AAAA,EAAA,EAMzC,cAAc;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA,CAAA;AAgFX,MAAM,eAAA,CAAgB;AAAA,EAC3B,aAAa,YAAA,CAAa,OAAA,GAAkC,EAAC,EAAG;AAC9D,IAAA,MAAM;AAAA,MACJ,kBAAA;AAAA,MACA,kBAAkB,EAAC;AAAA,MACnB,kBAAkB,EAAC;AAAA,MACnB,kBAAkB;AAAC,KACrB,GAAI,OAAA;AAEJ,IAAA,MAAM,cAAcA,2BAAA,EAAoB;AACxC,IAAA,IAAI,WAAA,IAAe,EAAA,IAAM,CAACC,sCAAA,EAA+B,EAAG;AAC1D,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA;AAAA,2FAAA;AAAA,OAEF;AAAA,IACF;AAEA,IAAA,MAAM,UAAU,IAAIC,kBAAA,CAAQ,EAAE,WAAA,EAAa,KAAK,CAAA;AAChD,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,aAAA,EAAc;AAC5C,IAAA,MAAM,gBAAgB,OAAA,CAAQ,MAAA;AAE9B,IAAA,MAAM,cAAA,GAAiB,MAAMC,mBAAA,CAAG,QAAA;AAAA,MAC9BC,mCAAA;AAAA,QACE,sCAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA;AAAA,KACF;AAEA,IAAA,MAAM,cAAA,GAAiB,MAAM,OAAA,CAAQ,aAAA;AAAA,MACnC,SAAS,cAAc;AAAA,KACzB;AAEA,IAAA,MAAM,cAAc,GAAA,CAAI,iBAAA,EAAmB,IAAA,CAAK,SAAA,CAAU,eAAe,CAAC,CAAA;AAE1E,IAAA,MAAM,gBAAA,GAAmB,MAAA,CAAO,IAAA,CAAK,eAAe,CAAA;AAEpD,IAAA,MAAM,aAAA,CAAc,GAAA;AAAA,MAClB,0BAAA;AAAA,MACA,IAAA,CAAK,UAAU,gBAAgB;AAAA,KACjC;AAEA,IAAA,MAAM,kBAAkB,EAAC;AACzB,IAAA,MAAM,eAAwC,EAAC;AAC/C,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,eAAe,CAAA,EAAG;AAC3D,MAAA,IAAI,OAAO,UAAU,UAAA,EAAY;AAC/B,QAAA,eAAA,CAAgB,KAAK,IAAI,CAAA;AAAA,MAC3B,CAAA,MAAO;AACL,QAAA,YAAA,CAAa,IAAI,CAAA,GAAI,KAAA;AAAA,MACvB;AAAA,IACF;AAEA,IAAA,MAAM,aAAA,CAAc,GAAA;AAAA,MAClB,0BAAA;AAAA,MACA,IAAA,CAAK,UAAU,YAAY;AAAA,KAC7B;AACA,IAAA,MAAM,aAAA,CAAc,GAAA;AAAA,MAClB,4BAAA;AAAA,MACA,IAAA,CAAK,UAAU,eAAe;AAAA,KAChC;AAEA,IAAA,MAAM,aAAA,CAAc,GAAA;AAAA,MAClB,YAAA;AAAA,MACA,CAAC,YAAoB,IAAA,KAAsB;AACzC,QAAA,IAAI,CAAC,MAAA,CAAO,MAAA,CAAO,eAAA,EAAiB,UAAU,CAAA,EAAG;AAC/C,UAAA,OAAO,EAAA;AAAA,QACT;AACA,QAAA,MAAM,CAAC,KAAA,EAAO,GAAG,IAAI,CAAA,GAAI,IAAA;AACzB,QAAA,MAAM,KAAK,eAAA,CAAgB,UAAU,CAAA,CAAE,KAAA,EAAO,GAAG,IAAI,CAAA;AACrD,QAAA,OAAO,EAAA,KAAO,MAAA,GAAY,EAAA,GAAK,IAAA,CAAK,UAAU,EAAE,CAAA;AAAA,MAClD;AAAA,KACF;AAEA,IAAA,MAAM,aAAA,CAAc,GAAA;AAAA,MAClB,YAAA;AAAA,MACA,CAAC,YAAoB,IAAA,KAAsB;AACzC,QAAA,IAAI,CAAC,MAAA,CAAO,MAAA,CAAO,eAAA,EAAiB,UAAU,CAAA,EAAG;AAC/C,UAAA,OAAO,EAAA;AAAA,QACT;AACA,QAAA,MAAM,MAAA,GAAS,gBAAgB,UAAU,CAAA;AACzC,QAAA,IAAI,OAAO,WAAW,UAAA,EAAY;AAChC,UAAA,OAAO,EAAA;AAAA,QACT;AACA,QAAA,MAAM,EAAA,GAAK,MAAA,CAAO,GAAG,IAAI,CAAA;AACzB,QAAA,OAAO,EAAA,KAAO,MAAA,GAAY,EAAA,GAAK,IAAA,CAAK,UAAU,EAAE,CAAA;AAAA,MAClD;AAAA,KACF;AAEA,IAAA,MAAM,cAAA,CAAe,IAAI,OAAO,CAAA;AAEhC,IAAA,MAAM,MAAA,GAAiC,CAAC,QAAA,EAAU,MAAA,KAAW;AAC3D,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,MAC5D;AAEA,MAAA,aAAA,CAAc,OAAA,CAAQ,aAAA,EAAe,MAAA,CAAO,QAAQ,CAAC,CAAA;AACrD,MAAA,aAAA,CAAc,OAAA,CAAQ,gBAAA,EAAkB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AAE9D,MAAA,IAAI,kBAAA,EAAoB;AACtB,QAAA,OAAO,OAAA,CAAQ,SAAS,CAAA,yCAAA,CAA2C,CAAA;AAAA,MACrE;AAEA,MAAA,OAAO,OAAA,CAAQ,SAAS,CAAA,mCAAA,CAAqC,CAAA;AAAA,IAC/D,CAAA;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AACF;;;;"}
+{"version":3,"file":"SecureTemplater.cjs.js","sources":["../../../src/lib/templating/SecureTemplater.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { resolvePackagePath } from '@backstage/backend-plugin-api';\nimport {\n  TemplateFilter,\n  TemplateGlobal,\n} from '@backstage/plugin-scaffolder-node';\nimport { JsonValue } from '@backstage/types';\nimport fs from 'fs-extra';\nimport { Isolate } from 'isolated-vm';\nimport { getMajorNodeVersion, isNoNodeSnapshotOptionProvided } from './helpers';\n\n// language=JavaScript\nconst mkScript = (nunjucksSource: string) => `\nconst { render, renderCompat } = (() => {\n  const module = {};\n  const process = { env: {} };\n  const require = (pkg) => { if (pkg === 'events') { return function (){}; }};\n\n  ${nunjucksSource}\n\n  const env = module.exports.configure({\n    autoescape: false,\n    ...JSON.parse(nunjucksConfigs),\n    tags: {\n      variableStart: '\\${{',\n      variableEnd: '}}',\n    },\n  });\n\n  const compatEnv = module.exports.configure({\n    autoescape: false,\n    ...JSON.parse(nunjucksConfigs),\n    tags: {\n      variableStart: '{{',\n      variableEnd: '}}',\n    },\n  });\n  compatEnv.addFilter('jsonify', compatEnv.getFilter('dump'));\n\n  const handleFunctionResult = (value) => {\n    return value === '' ? undefined : JSON.parse(value);\n  };\n  for (const name of JSON.parse(availableTemplateFilters)) {\n    env.addFilter(name, (...args) => handleFunctionResult(callFilter(name, args)));\n  }\n  for (const [name, value] of Object.entries(JSON.parse(availableTemplateGlobals))) {\n    env.addGlobal(name, value);\n  }\n  for (const name of JSON.parse(availableTemplateCallbacks)) {\n    env.addGlobal(name, (...args) => handleFunctionResult(callGlobal(name, args)));\n  }\n\n  let uninstallCompat = undefined;\n\n  function render(str, values) {\n    try {\n      if (uninstallCompat) {\n        uninstallCompat();\n        uninstallCompat = undefined;\n      }\n      return env.renderString(str, JSON.parse(values));\n    } catch (error) {\n      // Make sure errors don't leak anything\n      throw new Error(String(error.message));\n    }\n  }\n\n  function renderCompat(str, values) {\n    try {\n      if (!uninstallCompat) {\n        uninstallCompat = module.exports.installJinjaCompat();\n      }\n      return compatEnv.renderString(str, JSON.parse(values));\n    } catch (error) {\n      // Make sure errors don't leak anything\n      throw new Error(String(error.message));\n    }\n  }\n\n  return { render, renderCompat };\n})();\n`;\n\ninterface SecureTemplaterOptions {\n  /* Enables jinja compatibility and the \"jsonify\" filter */\n  cookiecutterCompat?: boolean;\n  /* Extra user-provided nunjucks filters */\n  templateFilters?: Record<string, TemplateFilter>;\n  /* Extra user-provided nunjucks globals */\n  templateGlobals?: Record<string, TemplateGlobal>;\n  nunjucksConfigs?: { trimBlocks?: boolean; lstripBlocks?: boolean };\n}\n\nexport type SecureTemplateRenderer = (\n  template: string,\n  values: unknown,\n) => string;\n\nexport class SecureTemplater {\n  static async loadRenderer(options: SecureTemplaterOptions = {}) {\n    const {\n      cookiecutterCompat,\n      templateFilters = {},\n      templateGlobals = {},\n      nunjucksConfigs = {},\n    } = options;\n\n    const nodeVersion = getMajorNodeVersion();\n    if (nodeVersion >= 20 && !isNoNodeSnapshotOptionProvided()) {\n      throw new Error(\n        `When using Node.js version 20 or newer, the scaffolder backend plugin requires that it be started with the --no-node-snapshot option. \n        Please make sure that you have NODE_OPTIONS=--no-node-snapshot in your environment.`,\n      );\n    }\n\n    const isolate = new Isolate({ memoryLimit: 128 });\n    const context = await isolate.createContext();\n    const contextGlobal = context.global;\n\n    const nunjucksSource = await fs.readFile(\n      resolvePackagePath(\n        '@backstage/plugin-scaffolder-backend',\n        'assets/nunjucks.js.txt',\n      ),\n      'utf-8',\n    );\n\n    const nunjucksScript = await isolate.compileScript(\n      mkScript(nunjucksSource),\n    );\n\n    await contextGlobal.set('nunjucksConfigs', JSON.stringify(nunjucksConfigs));\n\n    const availableFilters = Object.keys(templateFilters);\n\n    await contextGlobal.set(\n      'availableTemplateFilters',\n      JSON.stringify(availableFilters),\n    );\n\n    const globalCallbacks = [];\n    const globalValues: Record<string, unknown> = {};\n    for (const [name, value] of Object.entries(templateGlobals)) {\n      if (typeof value === 'function') {\n        globalCallbacks.push(name);\n      } else {\n        globalValues[name] = value;\n      }\n    }\n\n    await contextGlobal.set(\n      'availableTemplateGlobals',\n      JSON.stringify(globalValues),\n    );\n    await contextGlobal.set(\n      'availableTemplateCallbacks',\n      JSON.stringify(globalCallbacks),\n    );\n\n    await contextGlobal.set(\n      'callFilter',\n      (filterName: string, args: JsonValue[]) => {\n        if (!Object.hasOwn(templateFilters, filterName)) {\n          return '';\n        }\n        const [input, ...rest] = args;\n        const rz = templateFilters[filterName](input, ...rest);\n        return rz === undefined ? '' : JSON.stringify(rz);\n      },\n    );\n\n    await contextGlobal.set(\n      'callGlobal',\n      (globalName: string, args: JsonValue[]) => {\n        if (!Object.hasOwn(templateGlobals, globalName)) {\n          return '';\n        }\n        const global = templateGlobals[globalName];\n        if (typeof global !== 'function') {\n          return '';\n        }\n        const rz = global(...args);\n        return rz === undefined ? '' : JSON.stringify(rz);\n      },\n    );\n\n    await nunjucksScript.run(context);\n\n    const render: SecureTemplateRenderer = (template, values) => {\n      if (!context || isolate.isDisposed) {\n        throw new Error(\n          'SecureTemplater has not been initialized or has been disposed',\n        );\n      }\n\n      contextGlobal.setSync('templateStr', String(template));\n      contextGlobal.setSync('templateValues', JSON.stringify(values));\n\n      if (cookiecutterCompat) {\n        return context.evalSync(`renderCompat(templateStr, templateValues)`);\n      }\n\n      return context.evalSync(`render(templateStr, templateValues)`);\n    };\n\n    return {\n      render,\n      dispose: () => {\n        if (context && !isolate.isDisposed) {\n          try {\n            context.release();\n            isolate.dispose();\n          } catch (error) {\n            // Ignore errors during dispose, as there's not much we can do about it\n          }\n        }\n      },\n    };\n  }\n}\n"],"names":["getMajorNodeVersion","isNoNodeSnapshotOptionProvided","Isolate","fs","resolvePackagePath"],"mappings":";;;;;;;;;;;AA2BA,MAAM,QAAA,GAAW,CAAC,cAAA,KAA2B;AAAA;AAAA;AAAA;AAAA;;AAAA,EAAA,EAMzC,cAAc;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA,CAAA;AAgFX,MAAM,eAAA,CAAgB;AAAA,EAC3B,aAAa,YAAA,CAAa,OAAA,GAAkC,EAAC,EAAG;AAC9D,IAAA,MAAM;AAAA,MACJ,kBAAA;AAAA,MACA,kBAAkB,EAAC;AAAA,MACnB,kBAAkB,EAAC;AAAA,MACnB,kBAAkB;AAAC,KACrB,GAAI,OAAA;AAEJ,IAAA,MAAM,cAAcA,2BAAA,EAAoB;AACxC,IAAA,IAAI,WAAA,IAAe,EAAA,IAAM,CAACC,sCAAA,EAA+B,EAAG;AAC1D,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA;AAAA,2FAAA;AAAA,OAEF;AAAA,IACF;AAEA,IAAA,MAAM,UAAU,IAAIC,kBAAA,CAAQ,EAAE,WAAA,EAAa,KAAK,CAAA;AAChD,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,aAAA,EAAc;AAC5C,IAAA,MAAM,gBAAgB,OAAA,CAAQ,MAAA;AAE9B,IAAA,MAAM,cAAA,GAAiB,MAAMC,mBAAA,CAAG,QAAA;AAAA,MAC9BC,mCAAA;AAAA,QACE,sCAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA;AAAA,KACF;AAEA,IAAA,MAAM,cAAA,GAAiB,MAAM,OAAA,CAAQ,aAAA;AAAA,MACnC,SAAS,cAAc;AAAA,KACzB;AAEA,IAAA,MAAM,cAAc,GAAA,CAAI,iBAAA,EAAmB,IAAA,CAAK,SAAA,CAAU,eAAe,CAAC,CAAA;AAE1E,IAAA,MAAM,gBAAA,GAAmB,MAAA,CAAO,IAAA,CAAK,eAAe,CAAA;AAEpD,IAAA,MAAM,aAAA,CAAc,GAAA;AAAA,MAClB,0BAAA;AAAA,MACA,IAAA,CAAK,UAAU,gBAAgB;AAAA,KACjC;AAEA,IAAA,MAAM,kBAAkB,EAAC;AACzB,IAAA,MAAM,eAAwC,EAAC;AAC/C,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,eAAe,CAAA,EAAG;AAC3D,MAAA,IAAI,OAAO,UAAU,UAAA,EAAY;AAC/B,QAAA,eAAA,CAAgB,KAAK,IAAI,CAAA;AAAA,MAC3B,CAAA,MAAO;AACL,QAAA,YAAA,CAAa,IAAI,CAAA,GAAI,KAAA;AAAA,MACvB;AAAA,IACF;AAEA,IAAA,MAAM,aAAA,CAAc,GAAA;AAAA,MAClB,0BAAA;AAAA,MACA,IAAA,CAAK,UAAU,YAAY;AAAA,KAC7B;AACA,IAAA,MAAM,aAAA,CAAc,GAAA;AAAA,MAClB,4BAAA;AAAA,MACA,IAAA,CAAK,UAAU,eAAe;AAAA,KAChC;AAEA,IAAA,MAAM,aAAA,CAAc,GAAA;AAAA,MAClB,YAAA;AAAA,MACA,CAAC,YAAoB,IAAA,KAAsB;AACzC,QAAA,IAAI,CAAC,MAAA,CAAO,MAAA,CAAO,eAAA,EAAiB,UAAU,CAAA,EAAG;AAC/C,UAAA,OAAO,EAAA;AAAA,QACT;AACA,QAAA,MAAM,CAAC,KAAA,EAAO,GAAG,IAAI,CAAA,GAAI,IAAA;AACzB,QAAA,MAAM,KAAK,eAAA,CAAgB,UAAU,CAAA,CAAE,KAAA,EAAO,GAAG,IAAI,CAAA;AACrD,QAAA,OAAO,EAAA,KAAO,MAAA,GAAY,EAAA,GAAK,IAAA,CAAK,UAAU,EAAE,CAAA;AAAA,MAClD;AAAA,KACF;AAEA,IAAA,MAAM,aAAA,CAAc,GAAA;AAAA,MAClB,YAAA;AAAA,MACA,CAAC,YAAoB,IAAA,KAAsB;AACzC,QAAA,IAAI,CAAC,MAAA,CAAO,MAAA,CAAO,eAAA,EAAiB,UAAU,CAAA,EAAG;AAC/C,UAAA,OAAO,EAAA;AAAA,QACT;AACA,QAAA,MAAM,MAAA,GAAS,gBAAgB,UAAU,CAAA;AACzC,QAAA,IAAI,OAAO,WAAW,UAAA,EAAY;AAChC,UAAA,OAAO,EAAA;AAAA,QACT;AACA,QAAA,MAAM,EAAA,GAAK,MAAA,CAAO,GAAG,IAAI,CAAA;AACzB,QAAA,OAAO,EAAA,KAAO,MAAA,GAAY,EAAA,GAAK,IAAA,CAAK,UAAU,EAAE,CAAA;AAAA,MAClD;AAAA,KACF;AAEA,IAAA,MAAM,cAAA,CAAe,IAAI,OAAO,CAAA;AAEhC,IAAA,MAAM,MAAA,GAAiC,CAAC,QAAA,EAAU,MAAA,KAAW;AAC3D,MAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,UAAA,EAAY;AAClC,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AAEA,MAAA,aAAA,CAAc,OAAA,CAAQ,aAAA,EAAe,MAAA,CAAO,QAAQ,CAAC,CAAA;AACrD,MAAA,aAAA,CAAc,OAAA,CAAQ,gBAAA,EAAkB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AAE9D,MAAA,IAAI,kBAAA,EAAoB;AACtB,QAAA,OAAO,OAAA,CAAQ,SAAS,CAAA,yCAAA,CAA2C,CAAA;AAAA,MACrE;AAEA,MAAA,OAAO,OAAA,CAAQ,SAAS,CAAA,mCAAA,CAAqC,CAAA;AAAA,IAC/D,CAAA;AAEA,IAAA,OAAO;AAAA,MACL,MAAA;AAAA,MACA,SAAS,MAAM;AACb,QAAA,IAAI,OAAA,IAAW,CAAC,OAAA,CAAQ,UAAA,EAAY;AAClC,UAAA,IAAI;AACF,YAAA,OAAA,CAAQ,OAAA,EAAQ;AAChB,YAAA,OAAA,CAAQ,OAAA,EAAQ;AAAA,UAClB,SAAS,KAAA,EAAO;AAAA,UAEhB;AAAA,QACF;AAAA,MACF;AAAA,KACF;AAAA,EACF;AACF;;;;"}

package/dist/scaffolder/actions/builtin/fetch/templateActionHandler.cjs.js

@@ -57,7 +57,7 @@ async function createTemplateActionHandler(options) {
     `Processing ${allEntriesInTemplate.length} template files/directories with input values`,
     ctx.input.values
   );
-  const renderTemplate = await SecureTemplater.SecureTemplater.loadRenderer({
+  const { render: renderTemplate, dispose } = await SecureTemplater.SecureTemplater.loadRenderer({
     cookiecutterCompat: ctx.input.cookiecutterCompat,
     templateFilters,
     templateGlobals,
@@ -66,57 +66,63 @@ async function createTemplateActionHandler(options) {
       lstripBlocks: ctx.input.lstripBlocks
     }
   });
-  for (const location of allEntriesInTemplate) {
-    let renderContents;
-    let localOutputPath = location;
-    if (extension) {
-      renderContents = path.extname(localOutputPath) === extension;
-      if (renderContents) {
-        localOutputPath = localOutputPath.slice(0, -extension.length);
-      }
-      localOutputPath = renderTemplate(localOutputPath, context);
-    } else {
-      renderContents = !nonTemplatedEntries.has(location);
-      if (renderFilename) {
+  try {
+    for (const location of allEntriesInTemplate) {
+      let renderContents;
+      let localOutputPath = location;
+      if (extension) {
+        renderContents = path.extname(localOutputPath) === extension;
+        if (renderContents) {
+          localOutputPath = localOutputPath.slice(0, -extension.length);
+        }
         localOutputPath = renderTemplate(localOutputPath, context);
       } else {
-        localOutputPath = renderContents ? renderTemplate(localOutputPath, context) : localOutputPath;
+        renderContents = !nonTemplatedEntries.has(location);
+        if (renderFilename) {
+          localOutputPath = renderTemplate(localOutputPath, context);
+        }
       }
-    }
-    if (containsSkippedContent(localOutputPath)) {
-      continue;
-    }
-    const outputPath = backendPluginApi.resolveSafeChildPath(outputDir, localOutputPath);
-    if (fs__default.default.existsSync(outputPath) && !ctx.input.replace) {
-      continue;
-    }
-    if (!renderContents && !extension) {
-      ctx.logger.info(`Copying file/directory ${location} without processing.`);
-    }
-    if (location.endsWith("/")) {
-      ctx.logger.info(`Writing directory ${location} to template output path.`);
-      await fs__default.default.ensureDir(outputPath);
-    } else {
-      const inputFilePath = backendPluginApi.resolveSafeChildPath(templateDir, location);
-      const stats = await fs__default.default.promises.lstat(inputFilePath);
-      if (stats.isSymbolicLink() || await isbinaryfile.isBinaryFile(inputFilePath)) {
+      if (containsSkippedContent(localOutputPath)) {
+        continue;
+      }
+      const outputPath = backendPluginApi.resolveSafeChildPath(outputDir, localOutputPath);
+      if (fs__default.default.existsSync(outputPath) && !ctx.input.replace) {
+        continue;
+      }
+      if (!renderContents && !extension) {
         ctx.logger.info(
-          `Copying file binary or symbolic link at ${location}, to template output path.`
+          `Copying file/directory ${location} without processing.`
         );
-        await fs__default.default.copy(inputFilePath, outputPath);
-      } else {
-        const statsObj = await fs__default.default.stat(inputFilePath);
+      }
+      if (location.endsWith("/")) {
         ctx.logger.info(
-          `Writing file ${location} to template output path with mode ${statsObj.mode}.`
-        );
-        const inputFileContents = await fs__default.default.readFile(inputFilePath, "utf-8");
-        await fs__default.default.outputFile(
-          outputPath,
-          renderContents ? renderTemplate(inputFileContents, context) : inputFileContents,
-          { mode: statsObj.mode }
+          `Writing directory ${location} to template output path.`
         );
+        await fs__default.default.ensureDir(outputPath);
+      } else {
+        const inputFilePath = backendPluginApi.resolveSafeChildPath(templateDir, location);
+        const stats = await fs__default.default.promises.lstat(inputFilePath);
+        if (stats.isSymbolicLink() || await isbinaryfile.isBinaryFile(inputFilePath)) {
+          ctx.logger.info(
+            `Copying file binary or symbolic link at ${location}, to template output path.`
+          );
+          await fs__default.default.copy(inputFilePath, outputPath);
+        } else {
+          const statsObj = await fs__default.default.stat(inputFilePath);
+          ctx.logger.info(
+            `Writing file ${location} to template output path with mode ${statsObj.mode}.`
+          );
+          const inputFileContents = await fs__default.default.readFile(inputFilePath, "utf-8");
+          await fs__default.default.outputFile(
+            outputPath,
+            renderContents ? renderTemplate(inputFileContents, context) : inputFileContents,
+            { mode: statsObj.mode }
+          );
+        }
       }
     }
+  } finally {
+    dispose();
   }
   ctx.logger.info(`Template result written to ${outputDir}`);
 }

package/dist/scaffolder/actions/builtin/fetch/templateActionHandler.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"templateActionHandler.cjs.js","sources":["../../../../../src/scaffolder/actions/builtin/fetch/templateActionHandler.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  isChildPath,\n  resolveSafeChildPath,\n} from '@backstage/backend-plugin-api';\nimport { InputError } from '@backstage/errors';\nimport { ScmIntegrations } from '@backstage/integration';\nimport {\n  ActionContext,\n  TemplateFilter,\n  TemplateGlobal,\n} from '@backstage/plugin-scaffolder-node';\nimport fs from 'fs-extra';\nimport globby from 'globby';\nimport { isBinaryFile } from 'isbinaryfile';\nimport { createDefaultFilters } from '../../../../lib/templating/filters/createDefaultFilters';\nimport { convertFiltersToRecord } from '../../../../util/templating';\nimport { SecureTemplater } from '../../../../lib/templating/SecureTemplater';\nimport { extname } from 'node:path';\n\nexport type TemplateActionInput = {\n  targetPath?: string;\n  values: any;\n  templateFileExtension?: string | boolean;\n  copyWithoutTemplating?: string[];\n  cookiecutterCompat?: boolean;\n  replace?: boolean;\n  trimBlocks?: boolean;\n  lstripBlocks?: boolean;\n};\n\nexport async function createTemplateActionHandler<\n  I extends TemplateActionInput,\n>(options: {\n  ctx: ActionContext<I, any, any>;\n  resolveTemplate: () => Promise<string>;\n  integrations: ScmIntegrations;\n  additionalTemplateFilters?: Record<string, TemplateFilter>;\n  additionalTemplateGlobals?: Record<string, TemplateGlobal>;\n}) {\n  const {\n    resolveTemplate,\n    integrations,\n    additionalTemplateFilters,\n    additionalTemplateGlobals: templateGlobals,\n    ctx,\n  } = options;\n\n  const templateFilters = {\n    ...convertFiltersToRecord(createDefaultFilters({ integrations })),\n    ...additionalTemplateFilters,\n  };\n\n  const { outputDir, copyOnlyPatterns, renderFilename, extension } =\n    resolveTemplateActionSettings(ctx);\n\n  const templateDir = await resolveTemplate();\n\n  if (isChildPath(templateDir, outputDir)) {\n    throw new InputError('targetPath must not be within template path');\n  }\n\n  ctx.logger.info('Listing files and directories in template');\n  const allEntriesInTemplate = await globby(`**/*`, {\n    cwd: templateDir,\n    dot: true,\n    onlyFiles: false,\n    markDirectories: true,\n    followSymbolicLinks: false,\n  });\n\n  const nonTemplatedEntries = new Set(\n    await globby(copyOnlyPatterns || [], {\n      cwd: templateDir,\n      dot: true,\n      onlyFiles: false,\n      markDirectories: true,\n      followSymbolicLinks: false,\n    }),\n  );\n\n  // Cookiecutter prefixes all parameters in templates with\n  // `cookiecutter.`. To replicate this, we wrap our parameters\n  // in an object with a `cookiecutter` property when compat\n  // mode is enabled.\n  const { cookiecutterCompat, values } = ctx.input;\n  const context = {\n    [cookiecutterCompat ? 'cookiecutter' : 'values']: values,\n  };\n\n  ctx.logger.info(\n    `Processing ${allEntriesInTemplate.length} template files/directories with input values`,\n    ctx.input.values,\n  );\n\n  const renderTemplate = await SecureTemplater.loadRenderer({\n    cookiecutterCompat: ctx.input.cookiecutterCompat,\n    templateFilters,\n    templateGlobals,\n    nunjucksConfigs: {\n      trimBlocks: ctx.input.trimBlocks,\n      lstripBlocks: ctx.input.lstripBlocks,\n    },\n  });\n\n  for (const location of allEntriesInTemplate) {\n    let renderContents: boolean;\n\n    let localOutputPath = location;\n    if (extension) {\n      renderContents = extname(localOutputPath) === extension;\n      if (renderContents) {\n        localOutputPath = localOutputPath.slice(0, -extension.length);\n      }\n      // extension is mutual exclusive with copyWithoutRender/copyWithoutTemplating,\n      // therefore the output path is always rendered.\n      localOutputPath = renderTemplate(localOutputPath, context);\n    } else {\n      renderContents = !nonTemplatedEntries.has(location);\n      // The logic here is a bit tangled because it depends on two variables.\n      // If renderFilename is true, which means copyWithoutTemplating is used,\n      // then the path is always rendered.\n      // If renderFilename is false, which means copyWithoutRender is used,\n      // then matched file/directory won't be processed, same as before.\n      if (renderFilename) {\n        localOutputPath = renderTemplate(localOutputPath, context);\n      } else {\n        localOutputPath = renderContents\n          ? renderTemplate(localOutputPath, context)\n          : localOutputPath;\n      }\n    }\n\n    if (containsSkippedContent(localOutputPath)) {\n      continue;\n    }\n\n    const outputPath = resolveSafeChildPath(outputDir, localOutputPath);\n    if (fs.existsSync(outputPath) && !ctx.input.replace) {\n      continue;\n    }\n\n    if (!renderContents && !extension) {\n      ctx.logger.info(`Copying file/directory ${location} without processing.`);\n    }\n\n    if (location.endsWith('/')) {\n      ctx.logger.info(`Writing directory ${location} to template output path.`);\n      await fs.ensureDir(outputPath);\n    } else {\n      const inputFilePath = resolveSafeChildPath(templateDir, location);\n      const stats = await fs.promises.lstat(inputFilePath);\n\n      if (stats.isSymbolicLink() || (await isBinaryFile(inputFilePath))) {\n        ctx.logger.info(\n          `Copying file binary or symbolic link at ${location}, to template output path.`,\n        );\n        await fs.copy(inputFilePath, outputPath);\n      } else {\n        const statsObj = await fs.stat(inputFilePath);\n        ctx.logger.info(\n          `Writing file ${location} to template output path with mode ${statsObj.mode}.`,\n        );\n        const inputFileContents = await fs.readFile(inputFilePath, 'utf-8');\n        await fs.outputFile(\n          outputPath,\n          renderContents\n            ? renderTemplate(inputFileContents, context)\n            : inputFileContents,\n          { mode: statsObj.mode },\n        );\n      }\n    }\n  }\n  ctx.logger.info(`Template result written to ${outputDir}`);\n}\n\nfunction resolveTemplateActionSettings<I extends TemplateActionInput>(\n  ctx: ActionContext<I, any, any>,\n): {\n  outputDir: string;\n  copyOnlyPatterns?: string[];\n  renderFilename: boolean;\n  extension: string | false;\n} {\n  const targetPath = ctx.input.targetPath ?? './';\n  const outputDir = resolveSafeChildPath(ctx.workspacePath, targetPath);\n\n  const copyOnlyPatterns = ctx.input.copyWithoutTemplating;\n  const renderFilename = true;\n\n  if (copyOnlyPatterns && !Array.isArray(copyOnlyPatterns)) {\n    throw new InputError(\n      'Fetch action input copyWithoutTemplating must be an Array',\n    );\n  }\n  if (\n    ctx.input.templateFileExtension &&\n    (copyOnlyPatterns || ctx.input.cookiecutterCompat)\n  ) {\n    throw new InputError(\n      'Fetch action input extension incompatible with copyWithoutTemplating and cookiecutterCompat',\n    );\n  }\n  let extension: string | false = false;\n  if (ctx.input.templateFileExtension) {\n    extension =\n      ctx.input.templateFileExtension === true\n        ? '.njk'\n        : ctx.input.templateFileExtension;\n    if (!extension.startsWith('.')) {\n      extension = `.${extension}`;\n    }\n  }\n  return {\n    outputDir,\n    copyOnlyPatterns,\n    renderFilename,\n    extension,\n  };\n}\n\nfunction containsSkippedContent(localOutputPath: string): boolean {\n  // if the path is empty means that there is a file skipped in the root\n  // if the path starts with a separator it means that the root directory has been skipped\n  // if the path includes // means that there is a subdirectory skipped\n  // All paths returned are considered with / separator because of globby returning the linux separator for all os'.\n  return (\n    localOutputPath === '' ||\n    localOutputPath.startsWith('/') ||\n    localOutputPath.includes('//')\n  );\n}\n"],"names":["convertFiltersToRecord","createDefaultFilters","isChildPath","InputError","globby","SecureTemplater","extname","resolveSafeChildPath","fs","isBinaryFile"],"mappings":";;;;;;;;;;;;;;;;;AA6CA,eAAsB,4BAEpB,OAAA,EAMC;AACD,EAAA,MAAM;AAAA,IACJ,eAAA;AAAA,IACA,YAAA;AAAA,IACA,yBAAA;AAAA,IACA,yBAAA,EAA2B,eAAA;AAAA,IAC3B;AAAA,GACF,GAAI,OAAA;AAEJ,EAAA,MAAM,eAAA,GAAkB;AAAA,IACtB,GAAGA,iCAAA,CAAuBC,yCAAA,CAAqB,EAAE,YAAA,EAAc,CAAC,CAAA;AAAA,IAChE,GAAG;AAAA,GACL;AAEA,EAAA,MAAM,EAAE,SAAA,EAAW,gBAAA,EAAkB,gBAAgB,SAAA,EAAU,GAC7D,8BAA8B,GAAG,CAAA;AAEnC,EAAA,MAAM,WAAA,GAAc,MAAM,eAAA,EAAgB;AAE1C,EAAA,IAAIC,4BAAA,CAAY,WAAA,EAAa,SAAS,CAAA,EAAG;AACvC,IAAA,MAAM,IAAIC,kBAAW,6CAA6C,CAAA;AAAA,EACpE;AAEA,EAAA,GAAA,CAAI,MAAA,CAAO,KAAK,2CAA2C,CAAA;AAC3D,EAAA,MAAM,oBAAA,GAAuB,MAAMC,uBAAA,CAAO,CAAA,IAAA,CAAA,EAAQ;AAAA,IAChD,GAAA,EAAK,WAAA;AAAA,IACL,GAAA,EAAK,IAAA;AAAA,IACL,SAAA,EAAW,KAAA;AAAA,IACX,eAAA,EAAiB,IAAA;AAAA,IACjB,mBAAA,EAAqB;AAAA,GACtB,CAAA;AAED,EAAA,MAAM,sBAAsB,IAAI,GAAA;AAAA,IAC9B,MAAMA,uBAAA,CAAO,gBAAA,IAAoB,EAAC,EAAG;AAAA,MACnC,GAAA,EAAK,WAAA;AAAA,MACL,GAAA,EAAK,IAAA;AAAA,MACL,SAAA,EAAW,KAAA;AAAA,MACX,eAAA,EAAiB,IAAA;AAAA,MACjB,mBAAA,EAAqB;AAAA,KACtB;AAAA,GACH;AAMA,EAAA,MAAM,EAAE,kBAAA,EAAoB,MAAA,EAAO,GAAI,GAAA,CAAI,KAAA;AAC3C,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,CAAC,kBAAA,GAAqB,cAAA,GAAiB,QAAQ,GAAG;AAAA,GACpD;AAEA,EAAA,GAAA,CAAI,MAAA,CAAO,IAAA;AAAA,IACT,CAAA,WAAA,EAAc,qBAAqB,MAAM,CAAA,6CAAA,CAAA;AAAA,IACzC,IAAI,KAAA,CAAM;AAAA,GACZ;AAEA,EAAA,MAAM,cAAA,GAAiB,MAAMC,+BAAA,CAAgB,YAAA,CAAa;AAAA,IACxD,kBAAA,EAAoB,IAAI,KAAA,CAAM,kBAAA;AAAA,IAC9B,eAAA;AAAA,IACA,eAAA;AAAA,IACA,eAAA,EAAiB;AAAA,MACf,UAAA,EAAY,IAAI,KAAA,CAAM,UAAA;AAAA,MACtB,YAAA,EAAc,IAAI,KAAA,CAAM;AAAA;AAC1B,GACD,CAAA;AAED,EAAA,KAAA,MAAW,YAAY,oBAAA,EAAsB;AAC3C,IAAA,IAAI,cAAA;AAEJ,IAAA,IAAI,eAAA,GAAkB,QAAA;AACtB,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,cAAA,GAAiBC,YAAA,CAAQ,eAAe,CAAA,KAAM,SAAA;AAC9C,MAAA,IAAI,cAAA,EAAgB;AAClB,QAAA,eAAA,GAAkB,eAAA,CAAgB,KAAA,CAAM,CAAA,EAAG,CAAC,UAAU,MAAM,CAAA;AAAA,MAC9D;AAGA,MAAA,eAAA,GAAkB,cAAA,CAAe,iBAAiB,OAAO,CAAA;AAAA,IAC3D,CAAA,MAAO;AACL,MAAA,cAAA,GAAiB,CAAC,mBAAA,CAAoB,GAAA,CAAI,QAAQ,CAAA;AAMlD,MAAA,IAAI,cAAA,EAAgB;AAClB,QAAA,eAAA,GAAkB,cAAA,CAAe,iBAAiB,OAAO,CAAA;AAAA,MAC3D,CAAA,MAAO;AACL,QAAA,eAAA,GAAkB,cAAA,GACd,cAAA,CAAe,eAAA,EAAiB,OAAO,CAAA,GACvC,eAAA;AAAA,MACN;AAAA,IACF;AAEA,IAAA,IAAI,sBAAA,CAAuB,eAAe,CAAA,EAAG;AAC3C,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,UAAA,GAAaC,qCAAA,CAAqB,SAAA,EAAW,eAAe,CAAA;AAClE,IAAA,IAAIC,oBAAG,UAAA,CAAW,UAAU,KAAK,CAAC,GAAA,CAAI,MAAM,OAAA,EAAS;AACnD,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,cAAA,IAAkB,CAAC,SAAA,EAAW;AACjC,MAAA,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,CAAA,uBAAA,EAA0B,QAAQ,CAAA,oBAAA,CAAsB,CAAA;AAAA,IAC1E;AAEA,IAAA,IAAI,QAAA,CAAS,QAAA,CAAS,GAAG,CAAA,EAAG;AAC1B,MAAA,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,CAAA,kBAAA,EAAqB,QAAQ,CAAA,yBAAA,CAA2B,CAAA;AACxE,MAAA,MAAMA,mBAAA,CAAG,UAAU,UAAU,CAAA;AAAA,IAC/B,CAAA,MAAO;AACL,MAAA,MAAM,aAAA,GAAgBD,qCAAA,CAAqB,WAAA,EAAa,QAAQ,CAAA;AAChE,MAAA,MAAM,KAAA,GAAQ,MAAMC,mBAAA,CAAG,QAAA,CAAS,MAAM,aAAa,CAAA;AAEnD,MAAA,IAAI,MAAM,cAAA,EAAe,IAAM,MAAMC,yBAAA,CAAa,aAAa,CAAA,EAAI;AACjE,QAAA,GAAA,CAAI,MAAA,CAAO,IAAA;AAAA,UACT,2CAA2C,QAAQ,CAAA,0BAAA;AAAA,SACrD;AACA,QAAA,MAAMD,mBAAA,CAAG,IAAA,CAAK,aAAA,EAAe,UAAU,CAAA;AAAA,MACzC,CAAA,MAAO;AACL,QAAA,MAAM,QAAA,GAAW,MAAMA,mBAAA,CAAG,IAAA,CAAK,aAAa,CAAA;AAC5C,QAAA,GAAA,CAAI,MAAA,CAAO,IAAA;AAAA,UACT,CAAA,aAAA,EAAgB,QAAQ,CAAA,mCAAA,EAAsC,QAAA,CAAS,IAAI,CAAA,CAAA;AAAA,SAC7E;AACA,QAAA,MAAM,iBAAA,GAAoB,MAAMA,mBAAA,CAAG,QAAA,CAAS,eAAe,OAAO,CAAA;AAClE,QAAA,MAAMA,mBAAA,CAAG,UAAA;AAAA,UACP,UAAA;AAAA,UACA,cAAA,GACI,cAAA,CAAe,iBAAA,EAAmB,OAAO,CAAA,GACzC,iBAAA;AAAA,UACJ,EAAE,IAAA,EAAM,QAAA,CAAS,IAAA;AAAK,SACxB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,CAAA,2BAAA,EAA8B,SAAS,CAAA,CAAE,CAAA;AAC3D;AAEA,SAAS,8BACP,GAAA,EAMA;AACA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,KAAA,CAAM,UAAA,IAAc,IAAA;AAC3C,EAAA,MAAM,SAAA,GAAYD,qCAAA,CAAqB,GAAA,CAAI,aAAA,EAAe,UAAU,CAAA;AAEpE,EAAA,MAAM,gBAAA,GAAmB,IAAI,KAAA,CAAM,qBAAA;AACnC,EAAA,MAAM,cAAA,GAAiB,IAAA;AAEvB,EAAA,IAAI,gBAAA,IAAoB,CAAC,KAAA,CAAM,OAAA,CAAQ,gBAAgB,CAAA,EAAG;AACxD,IAAA,MAAM,IAAIJ,iBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,IACE,IAAI,KAAA,CAAM,qBAAA,KACT,gBAAA,IAAoB,GAAA,CAAI,MAAM,kBAAA,CAAA,EAC/B;AACA,IAAA,MAAM,IAAIA,iBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,SAAA,GAA4B,KAAA;AAChC,EAAA,IAAI,GAAA,CAAI,MAAM,qBAAA,EAAuB;AACnC,IAAA,SAAA,GACE,IAAI,KAAA,CAAM,qBAAA,KAA0B,IAAA,GAChC,MAAA,GACA,IAAI,KAAA,CAAM,qBAAA;AAChB,IAAA,IAAI,CAAC,SAAA,CAAU,UAAA,CAAW,GAAG,CAAA,EAAG;AAC9B,MAAA,SAAA,GAAY,IAAI,SAAS,CAAA,CAAA;AAAA,IAC3B;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,SAAA;AAAA,IACA,gBAAA;AAAA,IACA,cAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,SAAS,uBAAuB,eAAA,EAAkC;AAKhE,EAAA,OACE,eAAA,KAAoB,MACpB,eAAA,CAAgB,UAAA,CAAW,GAAG,CAAA,IAC9B,eAAA,CAAgB,SAAS,IAAI,CAAA;AAEjC;;;;"}
+{"version":3,"file":"templateActionHandler.cjs.js","sources":["../../../../../src/scaffolder/actions/builtin/fetch/templateActionHandler.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  isChildPath,\n  resolveSafeChildPath,\n} from '@backstage/backend-plugin-api';\nimport { InputError } from '@backstage/errors';\nimport { ScmIntegrations } from '@backstage/integration';\nimport {\n  ActionContext,\n  TemplateFilter,\n  TemplateGlobal,\n} from '@backstage/plugin-scaffolder-node';\nimport fs from 'fs-extra';\nimport globby from 'globby';\nimport { isBinaryFile } from 'isbinaryfile';\nimport { createDefaultFilters } from '../../../../lib/templating/filters/createDefaultFilters';\nimport { convertFiltersToRecord } from '../../../../util/templating';\nimport { SecureTemplater } from '../../../../lib/templating/SecureTemplater';\nimport { extname } from 'node:path';\n\nexport type TemplateActionInput = {\n  targetPath?: string;\n  values: any;\n  templateFileExtension?: string | boolean;\n  copyWithoutTemplating?: string[];\n  cookiecutterCompat?: boolean;\n  replace?: boolean;\n  trimBlocks?: boolean;\n  lstripBlocks?: boolean;\n};\n\nexport async function createTemplateActionHandler<\n  I extends TemplateActionInput,\n>(options: {\n  ctx: ActionContext<I, any, any>;\n  resolveTemplate: () => Promise<string>;\n  integrations: ScmIntegrations;\n  additionalTemplateFilters?: Record<string, TemplateFilter>;\n  additionalTemplateGlobals?: Record<string, TemplateGlobal>;\n}) {\n  const {\n    resolveTemplate,\n    integrations,\n    additionalTemplateFilters,\n    additionalTemplateGlobals: templateGlobals,\n    ctx,\n  } = options;\n\n  const templateFilters = {\n    ...convertFiltersToRecord(createDefaultFilters({ integrations })),\n    ...additionalTemplateFilters,\n  };\n\n  const { outputDir, copyOnlyPatterns, renderFilename, extension } =\n    resolveTemplateActionSettings(ctx);\n\n  const templateDir = await resolveTemplate();\n\n  if (isChildPath(templateDir, outputDir)) {\n    throw new InputError('targetPath must not be within template path');\n  }\n\n  ctx.logger.info('Listing files and directories in template');\n  const allEntriesInTemplate = await globby(`**/*`, {\n    cwd: templateDir,\n    dot: true,\n    onlyFiles: false,\n    markDirectories: true,\n    followSymbolicLinks: false,\n  });\n\n  const nonTemplatedEntries = new Set(\n    await globby(copyOnlyPatterns || [], {\n      cwd: templateDir,\n      dot: true,\n      onlyFiles: false,\n      markDirectories: true,\n      followSymbolicLinks: false,\n    }),\n  );\n\n  // Cookiecutter prefixes all parameters in templates with\n  // `cookiecutter.`. To replicate this, we wrap our parameters\n  // in an object with a `cookiecutter` property when compat\n  // mode is enabled.\n  const { cookiecutterCompat, values } = ctx.input;\n  const context = {\n    [cookiecutterCompat ? 'cookiecutter' : 'values']: values,\n  };\n\n  ctx.logger.info(\n    `Processing ${allEntriesInTemplate.length} template files/directories with input values`,\n    ctx.input.values,\n  );\n\n  const { render: renderTemplate, dispose } =\n    await SecureTemplater.loadRenderer({\n      cookiecutterCompat: ctx.input.cookiecutterCompat,\n      templateFilters,\n      templateGlobals,\n      nunjucksConfigs: {\n        trimBlocks: ctx.input.trimBlocks,\n        lstripBlocks: ctx.input.lstripBlocks,\n      },\n    });\n  try {\n    for (const location of allEntriesInTemplate) {\n      let renderContents: boolean;\n\n      let localOutputPath = location;\n      if (extension) {\n        renderContents = extname(localOutputPath) === extension;\n        if (renderContents) {\n          localOutputPath = localOutputPath.slice(0, -extension.length);\n        }\n        // extension is mutual exclusive with copyWithoutRender/copyWithoutTemplating,\n        // therefore the output path is always rendered.\n        localOutputPath = renderTemplate(localOutputPath, context);\n      } else {\n        renderContents = !nonTemplatedEntries.has(location);\n        // The logic here is a bit tangled because it depends on two variables.\n        // If renderFilename is true, which means copyWithoutTemplating is used,\n        // then the path is always rendered.\n        // If renderFilename is false, which means copyWithoutRender is used,\n        // then matched file/directory won't be processed, same as before.\n        if (renderFilename) {\n          localOutputPath = renderTemplate(localOutputPath, context);\n        } else {\n          localOutputPath = renderContents\n            ? renderTemplate(localOutputPath, context)\n            : localOutputPath;\n        }\n      }\n\n      if (containsSkippedContent(localOutputPath)) {\n        continue;\n      }\n\n      const outputPath = resolveSafeChildPath(outputDir, localOutputPath);\n      if (fs.existsSync(outputPath) && !ctx.input.replace) {\n        continue;\n      }\n\n      if (!renderContents && !extension) {\n        ctx.logger.info(\n          `Copying file/directory ${location} without processing.`,\n        );\n      }\n\n      if (location.endsWith('/')) {\n        ctx.logger.info(\n          `Writing directory ${location} to template output path.`,\n        );\n        await fs.ensureDir(outputPath);\n      } else {\n        const inputFilePath = resolveSafeChildPath(templateDir, location);\n        const stats = await fs.promises.lstat(inputFilePath);\n\n        if (stats.isSymbolicLink() || (await isBinaryFile(inputFilePath))) {\n          ctx.logger.info(\n            `Copying file binary or symbolic link at ${location}, to template output path.`,\n          );\n          await fs.copy(inputFilePath, outputPath);\n        } else {\n          const statsObj = await fs.stat(inputFilePath);\n          ctx.logger.info(\n            `Writing file ${location} to template output path with mode ${statsObj.mode}.`,\n          );\n          const inputFileContents = await fs.readFile(inputFilePath, 'utf-8');\n          await fs.outputFile(\n            outputPath,\n            renderContents\n              ? renderTemplate(inputFileContents, context)\n              : inputFileContents,\n            { mode: statsObj.mode },\n          );\n        }\n      }\n    }\n  } finally {\n    dispose();\n  }\n  ctx.logger.info(`Template result written to ${outputDir}`);\n}\n\nfunction resolveTemplateActionSettings<I extends TemplateActionInput>(\n  ctx: ActionContext<I, any, any>,\n): {\n  outputDir: string;\n  copyOnlyPatterns?: string[];\n  renderFilename: boolean;\n  extension: string | false;\n} {\n  const targetPath = ctx.input.targetPath ?? './';\n  const outputDir = resolveSafeChildPath(ctx.workspacePath, targetPath);\n\n  const copyOnlyPatterns = ctx.input.copyWithoutTemplating;\n  const renderFilename = true;\n\n  if (copyOnlyPatterns && !Array.isArray(copyOnlyPatterns)) {\n    throw new InputError(\n      'Fetch action input copyWithoutTemplating must be an Array',\n    );\n  }\n  if (\n    ctx.input.templateFileExtension &&\n    (copyOnlyPatterns || ctx.input.cookiecutterCompat)\n  ) {\n    throw new InputError(\n      'Fetch action input extension incompatible with copyWithoutTemplating and cookiecutterCompat',\n    );\n  }\n  let extension: string | false = false;\n  if (ctx.input.templateFileExtension) {\n    extension =\n      ctx.input.templateFileExtension === true\n        ? '.njk'\n        : ctx.input.templateFileExtension;\n    if (!extension.startsWith('.')) {\n      extension = `.${extension}`;\n    }\n  }\n  return {\n    outputDir,\n    copyOnlyPatterns,\n    renderFilename,\n    extension,\n  };\n}\n\nfunction containsSkippedContent(localOutputPath: string): boolean {\n  // if the path is empty means that there is a file skipped in the root\n  // if the path starts with a separator it means that the root directory has been skipped\n  // if the path includes // means that there is a subdirectory skipped\n  // All paths returned are considered with / separator because of globby returning the linux separator for all os'.\n  return (\n    localOutputPath === '' ||\n    localOutputPath.startsWith('/') ||\n    localOutputPath.includes('//')\n  );\n}\n"],"names":["convertFiltersToRecord","createDefaultFilters","isChildPath","InputError","globby","SecureTemplater","extname","resolveSafeChildPath","fs","isBinaryFile"],"mappings":";;;;;;;;;;;;;;;;;AA6CA,eAAsB,4BAEpB,OAAA,EAMC;AACD,EAAA,MAAM;AAAA,IACJ,eAAA;AAAA,IACA,YAAA;AAAA,IACA,yBAAA;AAAA,IACA,yBAAA,EAA2B,eAAA;AAAA,IAC3B;AAAA,GACF,GAAI,OAAA;AAEJ,EAAA,MAAM,eAAA,GAAkB;AAAA,IACtB,GAAGA,iCAAA,CAAuBC,yCAAA,CAAqB,EAAE,YAAA,EAAc,CAAC,CAAA;AAAA,IAChE,GAAG;AAAA,GACL;AAEA,EAAA,MAAM,EAAE,SAAA,EAAW,gBAAA,EAAkB,gBAAgB,SAAA,EAAU,GAC7D,8BAA8B,GAAG,CAAA;AAEnC,EAAA,MAAM,WAAA,GAAc,MAAM,eAAA,EAAgB;AAE1C,EAAA,IAAIC,4BAAA,CAAY,WAAA,EAAa,SAAS,CAAA,EAAG;AACvC,IAAA,MAAM,IAAIC,kBAAW,6CAA6C,CAAA;AAAA,EACpE;AAEA,EAAA,GAAA,CAAI,MAAA,CAAO,KAAK,2CAA2C,CAAA;AAC3D,EAAA,MAAM,oBAAA,GAAuB,MAAMC,uBAAA,CAAO,CAAA,IAAA,CAAA,EAAQ;AAAA,IAChD,GAAA,EAAK,WAAA;AAAA,IACL,GAAA,EAAK,IAAA;AAAA,IACL,SAAA,EAAW,KAAA;AAAA,IACX,eAAA,EAAiB,IAAA;AAAA,IACjB,mBAAA,EAAqB;AAAA,GACtB,CAAA;AAED,EAAA,MAAM,sBAAsB,IAAI,GAAA;AAAA,IAC9B,MAAMA,uBAAA,CAAO,gBAAA,IAAoB,EAAC,EAAG;AAAA,MACnC,GAAA,EAAK,WAAA;AAAA,MACL,GAAA,EAAK,IAAA;AAAA,MACL,SAAA,EAAW,KAAA;AAAA,MACX,eAAA,EAAiB,IAAA;AAAA,MACjB,mBAAA,EAAqB;AAAA,KACtB;AAAA,GACH;AAMA,EAAA,MAAM,EAAE,kBAAA,EAAoB,MAAA,EAAO,GAAI,GAAA,CAAI,KAAA;AAC3C,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,CAAC,kBAAA,GAAqB,cAAA,GAAiB,QAAQ,GAAG;AAAA,GACpD;AAEA,EAAA,GAAA,CAAI,MAAA,CAAO,IAAA;AAAA,IACT,CAAA,WAAA,EAAc,qBAAqB,MAAM,CAAA,6CAAA,CAAA;AAAA,IACzC,IAAI,KAAA,CAAM;AAAA,GACZ;AAEA,EAAA,MAAM,EAAE,MAAA,EAAQ,cAAA,EAAgB,SAAQ,GACtC,MAAMC,gCAAgB,YAAA,CAAa;AAAA,IACjC,kBAAA,EAAoB,IAAI,KAAA,CAAM,kBAAA;AAAA,IAC9B,eAAA;AAAA,IACA,eAAA;AAAA,IACA,eAAA,EAAiB;AAAA,MACf,UAAA,EAAY,IAAI,KAAA,CAAM,UAAA;AAAA,MACtB,YAAA,EAAc,IAAI,KAAA,CAAM;AAAA;AAC1B,GACD,CAAA;AACH,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,YAAY,oBAAA,EAAsB;AAC3C,MAAA,IAAI,cAAA;AAEJ,MAAA,IAAI,eAAA,GAAkB,QAAA;AACtB,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,cAAA,GAAiBC,YAAA,CAAQ,eAAe,CAAA,KAAM,SAAA;AAC9C,QAAA,IAAI,cAAA,EAAgB;AAClB,UAAA,eAAA,GAAkB,eAAA,CAAgB,KAAA,CAAM,CAAA,EAAG,CAAC,UAAU,MAAM,CAAA;AAAA,QAC9D;AAGA,QAAA,eAAA,GAAkB,cAAA,CAAe,iBAAiB,OAAO,CAAA;AAAA,MAC3D,CAAA,MAAO;AACL,QAAA,cAAA,GAAiB,CAAC,mBAAA,CAAoB,GAAA,CAAI,QAAQ,CAAA;AAMlD,QAAA,IAAI,cAAA,EAAgB;AAClB,UAAA,eAAA,GAAkB,cAAA,CAAe,iBAAiB,OAAO,CAAA;AAAA,QAC3D;AAIA,MACF;AAEA,MAAA,IAAI,sBAAA,CAAuB,eAAe,CAAA,EAAG;AAC3C,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,UAAA,GAAaC,qCAAA,CAAqB,SAAA,EAAW,eAAe,CAAA;AAClE,MAAA,IAAIC,oBAAG,UAAA,CAAW,UAAU,KAAK,CAAC,GAAA,CAAI,MAAM,OAAA,EAAS;AACnD,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,cAAA,IAAkB,CAAC,SAAA,EAAW;AACjC,QAAA,GAAA,CAAI,MAAA,CAAO,IAAA;AAAA,UACT,0BAA0B,QAAQ,CAAA,oBAAA;AAAA,SACpC;AAAA,MACF;AAEA,MAAA,IAAI,QAAA,CAAS,QAAA,CAAS,GAAG,CAAA,EAAG;AAC1B,QAAA,GAAA,CAAI,MAAA,CAAO,IAAA;AAAA,UACT,qBAAqB,QAAQ,CAAA,yBAAA;AAAA,SAC/B;AACA,QAAA,MAAMA,mBAAA,CAAG,UAAU,UAAU,CAAA;AAAA,MAC/B,CAAA,MAAO;AACL,QAAA,MAAM,aAAA,GAAgBD,qCAAA,CAAqB,WAAA,EAAa,QAAQ,CAAA;AAChE,QAAA,MAAM,KAAA,GAAQ,MAAMC,mBAAA,CAAG,QAAA,CAAS,MAAM,aAAa,CAAA;AAEnD,QAAA,IAAI,MAAM,cAAA,EAAe,IAAM,MAAMC,yBAAA,CAAa,aAAa,CAAA,EAAI;AACjE,UAAA,GAAA,CAAI,MAAA,CAAO,IAAA;AAAA,YACT,2CAA2C,QAAQ,CAAA,0BAAA;AAAA,WACrD;AACA,UAAA,MAAMD,mBAAA,CAAG,IAAA,CAAK,aAAA,EAAe,UAAU,CAAA;AAAA,QACzC,CAAA,MAAO;AACL,UAAA,MAAM,QAAA,GAAW,MAAMA,mBAAA,CAAG,IAAA,CAAK,aAAa,CAAA;AAC5C,UAAA,GAAA,CAAI,MAAA,CAAO,IAAA;AAAA,YACT,CAAA,aAAA,EAAgB,QAAQ,CAAA,mCAAA,EAAsC,QAAA,CAAS,IAAI,CAAA,CAAA;AAAA,WAC7E;AACA,UAAA,MAAM,iBAAA,GAAoB,MAAMA,mBAAA,CAAG,QAAA,CAAS,eAAe,OAAO,CAAA;AAClE,UAAA,MAAMA,mBAAA,CAAG,UAAA;AAAA,YACP,UAAA;AAAA,YACA,cAAA,GACI,cAAA,CAAe,iBAAA,EAAmB,OAAO,CAAA,GACzC,iBAAA;AAAA,YACJ,EAAE,IAAA,EAAM,QAAA,CAAS,IAAA;AAAK,WACxB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA,SAAE;AACA,IAAA,OAAA,EAAQ;AAAA,EACV;AACA,EAAA,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,CAAA,2BAAA,EAA8B,SAAS,CAAA,CAAE,CAAA;AAC3D;AAEA,SAAS,8BACP,GAAA,EAMA;AACA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,KAAA,CAAM,UAAA,IAAc,IAAA;AAC3C,EAAA,MAAM,SAAA,GAAYD,qCAAA,CAAqB,GAAA,CAAI,aAAA,EAAe,UAAU,CAAA;AAEpE,EAAA,MAAM,gBAAA,GAAmB,IAAI,KAAA,CAAM,qBAAA;AACnC,EAAA,MAAM,cAAA,GAAiB,IAAA;AAEvB,EAAA,IAAI,gBAAA,IAAoB,CAAC,KAAA,CAAM,OAAA,CAAQ,gBAAgB,CAAA,EAAG;AACxD,IAAA,MAAM,IAAIJ,iBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,IACE,IAAI,KAAA,CAAM,qBAAA,KACT,gBAAA,IAAoB,GAAA,CAAI,MAAM,kBAAA,CAAA,EAC/B;AACA,IAAA,MAAM,IAAIA,iBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,SAAA,GAA4B,KAAA;AAChC,EAAA,IAAI,GAAA,CAAI,MAAM,qBAAA,EAAuB;AACnC,IAAA,SAAA,GACE,IAAI,KAAA,CAAM,qBAAA,KAA0B,IAAA,GAChC,MAAA,GACA,IAAI,KAAA,CAAM,qBAAA;AAChB,IAAA,IAAI,CAAC,SAAA,CAAU,UAAA,CAAW,GAAG,CAAA,EAAG;AAC9B,MAAA,SAAA,GAAY,IAAI,SAAS,CAAA,CAAA;AAAA,IAC3B;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,SAAA;AAAA,IACA,gBAAA;AAAA,IACA,cAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,SAAS,uBAAuB,eAAA,EAAkC;AAKhE,EAAA,OACE,eAAA,KAAoB,MACpB,eAAA,CAAgB,UAAA,CAAW,GAAG,CAAA,IAC9B,eAAA,CAAgB,SAAS,IAAI,CAAA;AAEjC;;;;"}

package/dist/scaffolder/actions/builtin/fetch/templateFileActionHandler.cjs.js

@@ -1,11 +1,11 @@
 'use strict';
 
-var fs = require('fs-extra');
-var createDefaultFilters = require('../../../../lib/templating/filters/createDefaultFilters.cjs.js');
-var templating = require('../../../../util/templating.cjs.js');
 var backendPluginApi = require('@backstage/backend-plugin-api');
+var fs = require('fs-extra');
 var path = require('node:path');
+var createDefaultFilters = require('../../../../lib/templating/filters/createDefaultFilters.cjs.js');
 var SecureTemplater = require('../../../../lib/templating/SecureTemplater.cjs.js');
+var templating = require('../../../../util/templating.cjs.js');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
@@ -43,7 +43,7 @@ async function createTemplateFileActionHandler(options) {
     `Processing template file with input values`,
     ctx.input.values
   );
-  const renderTemplate = await SecureTemplater.SecureTemplater.loadRenderer({
+  const { render: renderTemplate, dispose } = await SecureTemplater.SecureTemplater.loadRenderer({
     cookiecutterCompat,
     templateFilters,
     templateGlobals,
@@ -52,11 +52,15 @@ async function createTemplateFileActionHandler(options) {
       lstripBlocks: ctx.input.lstripBlocks
     }
   });
-  const contents = await fs__default.default.readFile(filePath, "utf-8");
-  const result = renderTemplate(contents, context);
-  await fs__default.default.ensureDir(path__default.default.dirname(outputPath));
-  await fs__default.default.outputFile(outputPath, result);
-  ctx.logger.info(`Template file has been written to ${outputPath}`);
+  try {
+    const contents = await fs__default.default.readFile(filePath, "utf-8");
+    const result = renderTemplate(contents, context);
+    await fs__default.default.ensureDir(path__default.default.dirname(outputPath));
+    await fs__default.default.outputFile(outputPath, result);
+    ctx.logger.info(`Template file has been written to ${outputPath}`);
+  } finally {
+    dispose();
+  }
 }
 
 exports.createTemplateFileActionHandler = createTemplateFileActionHandler;

package/dist/scaffolder/actions/builtin/fetch/templateFileActionHandler.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"templateFileActionHandler.cjs.js","sources":["../../../../../src/scaffolder/actions/builtin/fetch/templateFileActionHandler.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { ScmIntegrations } from '@backstage/integration';\nimport {\n  ActionContext,\n  TemplateFilter,\n  TemplateGlobal,\n} from '@backstage/plugin-scaffolder-node';\nimport fs from 'fs-extra';\nimport { createDefaultFilters } from '../../../../lib/templating/filters/createDefaultFilters';\nimport { convertFiltersToRecord } from '../../../../util/templating';\nimport { resolveSafeChildPath } from '@backstage/backend-plugin-api';\nimport path from 'node:path';\nimport { SecureTemplater } from '../../../../lib/templating/SecureTemplater';\n\nexport type TemplateFileActionInput = {\n  targetPath: string;\n  values: any;\n  cookiecutterCompat?: boolean;\n  replace?: boolean;\n  trimBlocks?: boolean;\n  lstripBlocks?: boolean;\n};\n\nexport async function createTemplateFileActionHandler<\n  I extends TemplateFileActionInput = TemplateFileActionInput,\n>(options: {\n  ctx: ActionContext<I, any, any>;\n  resolveTemplateFile: () => Promise<string>;\n  integrations: ScmIntegrations;\n  additionalTemplateFilters?: Record<string, TemplateFilter>;\n  additionalTemplateGlobals?: Record<string, TemplateGlobal>;\n}) {\n  const {\n    resolveTemplateFile,\n    integrations,\n    additionalTemplateFilters,\n    additionalTemplateGlobals: templateGlobals,\n    ctx,\n  } = options;\n\n  const templateFilters = {\n    ...convertFiltersToRecord(createDefaultFilters({ integrations })),\n    ...additionalTemplateFilters,\n  };\n\n  const outputPath = resolveSafeChildPath(\n    ctx.workspacePath,\n    ctx.input.targetPath,\n  );\n\n  if (fs.existsSync(outputPath) && !ctx.input.replace) {\n    ctx.logger.info(\n      `File ${ctx.input.targetPath} already exists in workspace, not replacing.`,\n    );\n    return;\n  }\n  const filePath = await resolveTemplateFile();\n\n  const { cookiecutterCompat, values } = ctx.input;\n  const context = {\n    [cookiecutterCompat ? 'cookiecutter' : 'values']: values,\n  };\n\n  ctx.logger.info(\n    `Processing template file with input values`,\n    ctx.input.values,\n  );\n\n  const renderTemplate = await SecureTemplater.loadRenderer({\n    cookiecutterCompat,\n    templateFilters,\n    templateGlobals,\n    nunjucksConfigs: {\n      trimBlocks: ctx.input.trimBlocks,\n      lstripBlocks: ctx.input.lstripBlocks,\n    },\n  });\n\n  const contents = await fs.readFile(filePath, 'utf-8');\n  const result = renderTemplate(contents, context);\n  await fs.ensureDir(path.dirname(outputPath));\n  await fs.outputFile(outputPath, result);\n\n  ctx.logger.info(`Template file has been written to ${outputPath}`);\n}\n"],"names":["convertFiltersToRecord","createDefaultFilters","resolveSafeChildPath","fs","SecureTemplater","path"],"mappings":";;;;;;;;;;;;;;AAqCA,eAAsB,gCAEpB,OAAA,EAMC;AACD,EAAA,MAAM;AAAA,IACJ,mBAAA;AAAA,IACA,YAAA;AAAA,IACA,yBAAA;AAAA,IACA,yBAAA,EAA2B,eAAA;AAAA,IAC3B;AAAA,GACF,GAAI,OAAA;AAEJ,EAAA,MAAM,eAAA,GAAkB;AAAA,IACtB,GAAGA,iCAAA,CAAuBC,yCAAA,CAAqB,EAAE,YAAA,EAAc,CAAC,CAAA;AAAA,IAChE,GAAG;AAAA,GACL;AAEA,EAAA,MAAM,UAAA,GAAaC,qCAAA;AAAA,IACjB,GAAA,CAAI,aAAA;AAAA,IACJ,IAAI,KAAA,CAAM;AAAA,GACZ;AAEA,EAAA,IAAIC,oBAAG,UAAA,CAAW,UAAU,KAAK,CAAC,GAAA,CAAI,MAAM,OAAA,EAAS;AACnD,IAAA,GAAA,CAAI,MAAA,CAAO,IAAA;AAAA,MACT,CAAA,KAAA,EAAQ,GAAA,CAAI,KAAA,CAAM,UAAU,CAAA,4CAAA;AAAA,KAC9B;AACA,IAAA;AAAA,EACF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,EAAoB;AAE3C,EAAA,MAAM,EAAE,kBAAA,EAAoB,MAAA,EAAO,GAAI,GAAA,CAAI,KAAA;AAC3C,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,CAAC,kBAAA,GAAqB,cAAA,GAAiB,QAAQ,GAAG;AAAA,GACpD;AAEA,EAAA,GAAA,CAAI,MAAA,CAAO,IAAA;AAAA,IACT,CAAA,0CAAA,CAAA;AAAA,IACA,IAAI,KAAA,CAAM;AAAA,GACZ;AAEA,EAAA,MAAM,cAAA,GAAiB,MAAMC,+BAAA,CAAgB,YAAA,CAAa;AAAA,IACxD,kBAAA;AAAA,IACA,eAAA;AAAA,IACA,eAAA;AAAA,IACA,eAAA,EAAiB;AAAA,MACf,UAAA,EAAY,IAAI,KAAA,CAAM,UAAA;AAAA,MACtB,YAAA,EAAc,IAAI,KAAA,CAAM;AAAA;AAC1B,GACD,CAAA;AAED,EAAA,MAAM,QAAA,GAAW,MAAMD,mBAAA,CAAG,QAAA,CAAS,UAAU,OAAO,CAAA;AACpD,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,QAAA,EAAU,OAAO,CAAA;AAC/C,EAAA,MAAMA,mBAAA,CAAG,SAAA,CAAUE,qBAAA,CAAK,OAAA,CAAQ,UAAU,CAAC,CAAA;AAC3C,EAAA,MAAMF,mBAAA,CAAG,UAAA,CAAW,UAAA,EAAY,MAAM,CAAA;AAEtC,EAAA,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,CAAA,kCAAA,EAAqC,UAAU,CAAA,CAAE,CAAA;AACnE;;;;"}
+{"version":3,"file":"templateFileActionHandler.cjs.js","sources":["../../../../../src/scaffolder/actions/builtin/fetch/templateFileActionHandler.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { resolveSafeChildPath } from '@backstage/backend-plugin-api';\nimport { ScmIntegrations } from '@backstage/integration';\nimport {\n  ActionContext,\n  TemplateFilter,\n  TemplateGlobal,\n} from '@backstage/plugin-scaffolder-node';\nimport fs from 'fs-extra';\nimport path from 'node:path';\nimport { createDefaultFilters } from '../../../../lib/templating/filters/createDefaultFilters';\nimport { SecureTemplater } from '../../../../lib/templating/SecureTemplater';\nimport { convertFiltersToRecord } from '../../../../util/templating';\n\nexport type TemplateFileActionInput = {\n  targetPath: string;\n  values: any;\n  cookiecutterCompat?: boolean;\n  replace?: boolean;\n  trimBlocks?: boolean;\n  lstripBlocks?: boolean;\n};\n\nexport async function createTemplateFileActionHandler<\n  I extends TemplateFileActionInput = TemplateFileActionInput,\n>(options: {\n  ctx: ActionContext<I, any, any>;\n  resolveTemplateFile: () => Promise<string>;\n  integrations: ScmIntegrations;\n  additionalTemplateFilters?: Record<string, TemplateFilter>;\n  additionalTemplateGlobals?: Record<string, TemplateGlobal>;\n}) {\n  const {\n    resolveTemplateFile,\n    integrations,\n    additionalTemplateFilters,\n    additionalTemplateGlobals: templateGlobals,\n    ctx,\n  } = options;\n\n  const templateFilters = {\n    ...convertFiltersToRecord(createDefaultFilters({ integrations })),\n    ...additionalTemplateFilters,\n  };\n\n  const outputPath = resolveSafeChildPath(\n    ctx.workspacePath,\n    ctx.input.targetPath,\n  );\n\n  if (fs.existsSync(outputPath) && !ctx.input.replace) {\n    ctx.logger.info(\n      `File ${ctx.input.targetPath} already exists in workspace, not replacing.`,\n    );\n    return;\n  }\n  const filePath = await resolveTemplateFile();\n\n  const { cookiecutterCompat, values } = ctx.input;\n  const context = {\n    [cookiecutterCompat ? 'cookiecutter' : 'values']: values,\n  };\n\n  ctx.logger.info(\n    `Processing template file with input values`,\n    ctx.input.values,\n  );\n\n  const { render: renderTemplate, dispose } =\n    await SecureTemplater.loadRenderer({\n      cookiecutterCompat,\n      templateFilters,\n      templateGlobals,\n      nunjucksConfigs: {\n        trimBlocks: ctx.input.trimBlocks,\n        lstripBlocks: ctx.input.lstripBlocks,\n      },\n    });\n\n  try {\n    const contents = await fs.readFile(filePath, 'utf-8');\n    const result = renderTemplate(contents, context);\n    await fs.ensureDir(path.dirname(outputPath));\n    await fs.outputFile(outputPath, result);\n\n    ctx.logger.info(`Template file has been written to ${outputPath}`);\n  } finally {\n    dispose();\n  }\n}\n"],"names":["convertFiltersToRecord","createDefaultFilters","resolveSafeChildPath","fs","SecureTemplater","path"],"mappings":";;;;;;;;;;;;;;AAqCA,eAAsB,gCAEpB,OAAA,EAMC;AACD,EAAA,MAAM;AAAA,IACJ,mBAAA;AAAA,IACA,YAAA;AAAA,IACA,yBAAA;AAAA,IACA,yBAAA,EAA2B,eAAA;AAAA,IAC3B;AAAA,GACF,GAAI,OAAA;AAEJ,EAAA,MAAM,eAAA,GAAkB;AAAA,IACtB,GAAGA,iCAAA,CAAuBC,yCAAA,CAAqB,EAAE,YAAA,EAAc,CAAC,CAAA;AAAA,IAChE,GAAG;AAAA,GACL;AAEA,EAAA,MAAM,UAAA,GAAaC,qCAAA;AAAA,IACjB,GAAA,CAAI,aAAA;AAAA,IACJ,IAAI,KAAA,CAAM;AAAA,GACZ;AAEA,EAAA,IAAIC,oBAAG,UAAA,CAAW,UAAU,KAAK,CAAC,GAAA,CAAI,MAAM,OAAA,EAAS;AACnD,IAAA,GAAA,CAAI,MAAA,CAAO,IAAA;AAAA,MACT,CAAA,KAAA,EAAQ,GAAA,CAAI,KAAA,CAAM,UAAU,CAAA,4CAAA;AAAA,KAC9B;AACA,IAAA;AAAA,EACF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,mBAAA,EAAoB;AAE3C,EAAA,MAAM,EAAE,kBAAA,EAAoB,MAAA,EAAO,GAAI,GAAA,CAAI,KAAA;AAC3C,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,CAAC,kBAAA,GAAqB,cAAA,GAAiB,QAAQ,GAAG;AAAA,GACpD;AAEA,EAAA,GAAA,CAAI,MAAA,CAAO,IAAA;AAAA,IACT,CAAA,0CAAA,CAAA;AAAA,IACA,IAAI,KAAA,CAAM;AAAA,GACZ;AAEA,EAAA,MAAM,EAAE,MAAA,EAAQ,cAAA,EAAgB,SAAQ,GACtC,MAAMC,gCAAgB,YAAA,CAAa;AAAA,IACjC,kBAAA;AAAA,IACA,eAAA;AAAA,IACA,eAAA;AAAA,IACA,eAAA,EAAiB;AAAA,MACf,UAAA,EAAY,IAAI,KAAA,CAAM,UAAA;AAAA,MACtB,YAAA,EAAc,IAAI,KAAA,CAAM;AAAA;AAC1B,GACD,CAAA;AAEH,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAMD,mBAAA,CAAG,QAAA,CAAS,UAAU,OAAO,CAAA;AACpD,IAAA,MAAM,MAAA,GAAS,cAAA,CAAe,QAAA,EAAU,OAAO,CAAA;AAC/C,IAAA,MAAMA,mBAAA,CAAG,SAAA,CAAUE,qBAAA,CAAK,OAAA,CAAQ,UAAU,CAAC,CAAA;AAC3C,IAAA,MAAMF,mBAAA,CAAG,UAAA,CAAW,UAAA,EAAY,MAAM,CAAA;AAEtC,IAAA,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,CAAA,kCAAA,EAAqC,UAAU,CAAA,CAAE,CAAA;AAAA,EACnE,CAAA,SAAE;AACA,IAAA,OAAA,EAAQ;AAAA,EACV;AACF;;;;"}

package/dist/scaffolder/tasks/NunjucksWorkflowRunner.cjs.js

@@ -3,20 +3,20 @@
 var errors = require('@backstage/errors');
 var fs = require('fs-extra');
 var jsonschema = require('jsonschema');
-var nunjucks = require('nunjucks');
 var path = require('node:path');
+var nunjucks = require('nunjucks');
 var winston = require('winston');
 var SecureTemplater = require('../../lib/templating/SecureTemplater.cjs.js');
 var helper = require('./helper.cjs.js');
 var pluginPermissionCommon = require('@backstage/plugin-permission-common');
 var pluginPermissionNode = require('@backstage/plugin-permission-node');
 var alpha = require('@backstage/plugin-scaffolder-common/alpha');
+var defaultEnvironment = require('../../lib/defaultEnvironment.cjs.js');
 var createDefaultFilters = require('../../lib/templating/filters/createDefaultFilters.cjs.js');
 var rules = require('../../service/rules.cjs.js');
 var metrics = require('../../util/metrics.cjs.js');
-var logger = require('./logger.cjs.js');
 var templating = require('../../util/templating.cjs.js');
-var defaultEnvironment = require('../../lib/defaultEnvironment.cjs.js');
+var logger = require('./logger.cjs.js');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
@@ -39,8 +39,8 @@ function _interopNamespaceCompat(e) {
 }
 
 var fs__default = /*#__PURE__*/_interopDefaultCompat(fs);
-var nunjucks__default = /*#__PURE__*/_interopDefaultCompat(nunjucks);
 var path__default = /*#__PURE__*/_interopDefaultCompat(path);
+var nunjucks__default = /*#__PURE__*/_interopDefaultCompat(nunjucks);
 var winston__namespace = /*#__PURE__*/_interopNamespaceCompat(winston);
 
 const isValidTaskSpec = (taskSpec) => {
@@ -436,7 +436,7 @@ class NunjucksWorkflowRunner {
     this.environment = await this.getEnvironmentConfig();
     const taskState = { failed: false };
     const statusCheckInvoked = { value: false };
-    const renderTemplate = await SecureTemplater.SecureTemplater.loadRenderer({
+    const { render: renderTemplate, dispose } = await SecureTemplater.SecureTemplater.loadRenderer({
       templateFilters: {
         ...this.defaultTemplateFilters,
         ...additionalTemplateFilters
@@ -545,6 +545,10 @@ ${error.stack}`,
       await task.cleanWorkspace?.();
       return { output };
     } finally {
+      try {
+        dispose();
+      } catch {
+      }
       if (workspacePath) {
         await fs__default.default.remove(workspacePath);
       }
@@ -562,7 +566,7 @@ function scaffoldingTracker(metrics$1) {
     help: "Duration of a task run",
     labelNames: ["template", "result"]
   });
-  const promtStepCount = metrics.createCounterMetric({
+  const promStepCount = metrics.createCounterMetric({
     name: "scaffolder_step_count",
     help: "Count of step runs",
     labelNames: ["template", "step", "result"]
@@ -678,7 +682,7 @@ function scaffoldingTracker(metrics$1) {
         stepId: step.id,
         status: "completed"
       });
-      promtStepCount.inc({
+      promStepCount.inc({
         template,
         step: step.name,
         result: "ok"
@@ -692,7 +696,7 @@ function scaffoldingTracker(metrics$1) {
       });
     }
     async function markCancelled() {
-      promtStepCount.inc({
+      promStepCount.inc({
         template,
         step: step.name,
         result: "cancelled"
@@ -706,7 +710,7 @@ function scaffoldingTracker(metrics$1) {
       });
     }
     async function markFailed() {
-      promtStepCount.inc({
+      promStepCount.inc({
         template,
         step: step.name,
         result: "failed"

package/dist/scaffolder/tasks/NunjucksWorkflowRunner.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"NunjucksWorkflowRunner.cjs.js","sources":["../../../src/scaffolder/tasks/NunjucksWorkflowRunner.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { InputError, NotAllowedError, stringifyError } from '@backstage/errors';\nimport { ScmIntegrations } from '@backstage/integration';\nimport {\n  TaskRecovery,\n  TaskSpec,\n  TaskSpecV1beta3,\n  TaskStep,\n} from '@backstage/plugin-scaffolder-common';\nimport { JsonArray, JsonObject, JsonValue } from '@backstage/types';\nimport fs from 'fs-extra';\nimport { validate as validateJsonSchema } from 'jsonschema';\nimport nunjucks from 'nunjucks';\nimport path from 'node:path';\nimport * as winston from 'winston';\nimport {\n  SecureTemplater,\n  SecureTemplateRenderer,\n} from '../../lib/templating/SecureTemplater';\nimport { TemplateActionRegistry } from '../actions/TemplateActionRegistry';\nimport {\n  filterConditionalItems,\n  generateExampleOutput,\n  isTruthy,\n} from './helper';\nimport { TaskTrackType, WorkflowResponse, WorkflowRunner } from './types';\n\nimport type {\n  AuditorService,\n  LoggerService,\n  PermissionsService,\n} from '@backstage/backend-plugin-api';\nimport type { MetricsService } from '@backstage/backend-plugin-api/alpha';\nimport { UserEntity } from '@backstage/catalog-model';\nimport {\n  AuthorizeResult,\n  PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport { createConditionAuthorizer } from '@backstage/plugin-permission-node';\nimport { actionExecutePermission } from '@backstage/plugin-scaffolder-common/alpha';\nimport {\n  TaskContext,\n  TaskSecrets,\n  TemplateAction,\n  TemplateFilter,\n  TemplateGlobal,\n} from '@backstage/plugin-scaffolder-node';\nimport { createDefaultFilters } from '../../lib/templating/filters/createDefaultFilters';\nimport { scaffolderActionRules } from '../../service/rules';\nimport { createCounterMetric, createHistogramMetric } from '../../util/metrics';\nimport { BackstageLoggerTransport, WinstonLogger } from './logger';\nimport { convertFiltersToRecord } from '../../util/templating';\nimport {\n  CheckpointContext,\n  CheckpointState,\n} from '@backstage/plugin-scaffolder-node/alpha';\nimport { Config } from '@backstage/config';\nimport { resolveDefaultEnvironment } from '../../lib/defaultEnvironment';\n\ntype NunjucksWorkflowRunnerOptions = {\n  workingDirectory: string;\n  actionRegistry: TemplateActionRegistry;\n  integrations: ScmIntegrations;\n  logger: LoggerService;\n  auditor?: AuditorService;\n  additionalTemplateFilters?: Record<string, TemplateFilter>;\n  additionalTemplateGlobals?: Record<string, TemplateGlobal>;\n  permissions?: PermissionsService;\n  config?: Config;\n  metrics: MetricsService;\n};\n\ntype TemplateContext = {\n  parameters: JsonObject;\n  environment: JsonObject;\n  EXPERIMENTAL_recovery?: TaskRecovery;\n  steps: {\n    [stepName: string]: { output: { [outputName: string]: JsonValue } };\n  };\n  secrets?: Record<string, string>;\n  user?: {\n    entity?: UserEntity;\n    ref?: string;\n  };\n  each?: JsonValue;\n  context: {\n    task: {\n      id: string;\n    };\n  };\n};\n\nconst isValidTaskSpec = (taskSpec: TaskSpec): taskSpec is TaskSpecV1beta3 => {\n  return taskSpec.apiVersion === 'scaffolder.backstage.io/v1beta3';\n};\n\nconst createStepLogger = ({\n  task,\n  step,\n  rootLogger,\n  redactions,\n}: {\n  task: TaskContext;\n  step: TaskStep;\n  rootLogger: LoggerService;\n  redactions?: Record<string, string>;\n}) => {\n  const taskLogger = WinstonLogger.create({\n    level: process.env.LOG_LEVEL || 'info',\n    format: winston.format.combine(\n      winston.format.colorize(),\n      winston.format.simple(),\n    ),\n    transports: [new BackstageLoggerTransport(rootLogger, task, step.id)],\n  });\n\n  taskLogger.addRedactions(Object.values(redactions ?? {}));\n\n  return { taskLogger };\n};\n\n/**\n * Recursively compares two rendered objects and returns string values from\n * `withSecrets` that differ from their counterpart in `withoutSecrets`.\n * These are values that were influenced by secret interpolation and should\n * be added as log redactions.\n */\nfunction collectSecretRedactions(\n  withSecrets: unknown,\n  withoutSecrets: unknown,\n): string[] {\n  if (typeof withSecrets === 'string') {\n    return withSecrets !== withoutSecrets ? [withSecrets] : [];\n  }\n  if (Array.isArray(withSecrets)) {\n    const other = Array.isArray(withoutSecrets) ? withoutSecrets : [];\n    return withSecrets.flatMap((val, i) =>\n      collectSecretRedactions(val, other[i]),\n    );\n  }\n  if (withSecrets && typeof withSecrets === 'object') {\n    const other =\n      withoutSecrets && typeof withoutSecrets === 'object'\n        ? (withoutSecrets as Record<string, unknown>)\n        : {};\n    return Object.entries(withSecrets as Record<string, unknown>).flatMap(\n      ([key, val]) => collectSecretRedactions(val, other[key]),\n    );\n  }\n  return [];\n}\n\n/**\n * Extracts all string values from a nested object structure.\n * Used as a fallback when the comparison render fails.\n */\nfunction extractStringValues(obj: unknown): string[] {\n  if (typeof obj === 'string') return [obj];\n  if (Array.isArray(obj)) return obj.flatMap(extractStringValues);\n  if (obj && typeof obj === 'object') {\n    return Object.entries(obj).flatMap(([key, val]) => [\n      key,\n      ...extractStringValues(val),\n    ]);\n  }\n  return [];\n}\n\nconst isActionAuthorized = createConditionAuthorizer(\n  Object.values(scaffolderActionRules),\n);\n\nexport class NunjucksWorkflowRunner implements WorkflowRunner {\n  private readonly defaultTemplateFilters: Record<string, TemplateFilter>;\n  private readonly options: NunjucksWorkflowRunnerOptions;\n  private environment: {\n    parameters: JsonObject;\n    secrets?: Record<string, string>;\n  } = { parameters: {}, secrets: {} };\n\n  private readonly tracker: ReturnType<typeof scaffoldingTracker>;\n\n  constructor(options: NunjucksWorkflowRunnerOptions) {\n    this.options = options;\n    this.defaultTemplateFilters = convertFiltersToRecord(\n      createDefaultFilters({\n        integrations: this.options.integrations,\n      }),\n    );\n    this.tracker = scaffoldingTracker(options.metrics);\n  }\n\n  async getEnvironmentConfig(): Promise<{\n    parameters: JsonObject;\n    secrets?: TaskSecrets;\n  }> {\n    if (this.options.config) {\n      const defaultEnvironment = resolveDefaultEnvironment(this.options.config);\n      return {\n        parameters: defaultEnvironment.parameters,\n        secrets: defaultEnvironment.secrets,\n      };\n    }\n\n    return {\n      parameters: {},\n      secrets: {},\n    };\n  }\n\n  private isSingleTemplateString(input: string) {\n    const { parser, nodes } = nunjucks as unknown as {\n      parser: {\n        parse(\n          template: string,\n          ctx: object,\n          options: nunjucks.ConfigureOptions,\n        ): { children: { children?: unknown[] }[] };\n      };\n      nodes: { TemplateData: Function };\n    };\n\n    const parsed = parser.parse(\n      input,\n      {},\n      {\n        autoescape: false,\n        tags: {\n          variableStart: '${{',\n          variableEnd: '}}',\n        },\n      },\n    );\n\n    return (\n      parsed.children.length === 1 &&\n      !(parsed.children[0]?.children?.[0] instanceof nodes.TemplateData)\n    );\n  }\n\n  private render<T>(\n    input: T,\n    context: TemplateContext,\n    renderTemplate: SecureTemplateRenderer,\n  ): T {\n    return JSON.parse(JSON.stringify(input), (_key, value) => {\n      try {\n        if (typeof value === 'string') {\n          try {\n            if (this.isSingleTemplateString(value)) {\n              // Lets convert ${{ parameters.bob }} to ${{ (parameters.bob) | dump }} so we can keep the input type\n              const wrappedDumped = value.replace(\n                /\\${{(.+)}}/g,\n                '${{ ( $1 ) | dump }}',\n              );\n\n              // Run the templating\n              const templated = renderTemplate(wrappedDumped, context);\n\n              // If there's an empty string returned, then it's undefined\n              if (templated === '') {\n                return undefined;\n              }\n\n              // Reparse the dumped string\n              return JSON.parse(templated);\n            }\n          } catch (ex) {\n            this.options.logger.error(\n              `Failed to parse template string: ${value} with error ${ex.message}`,\n            );\n          }\n\n          // Fallback to default behaviour\n          const templated = renderTemplate(value, context);\n\n          if (templated === '') {\n            return undefined;\n          }\n\n          return templated;\n        }\n      } catch {\n        return value;\n      }\n      return value;\n    });\n  }\n\n  async executeStep(\n    task: TaskContext,\n    step: TaskStep,\n    context: TemplateContext,\n    renderTemplate: (template: string, values: unknown) => string,\n    taskTrack: TaskTrackType,\n    workspacePath: string,\n    decision: PolicyDecision,\n  ) {\n    const stepTrack = await this.tracker.stepStart(task, step);\n\n    if (task.cancelSignal.aborted) {\n      throw new Error(\n        `Step ${step.id} (${step.name}) of task ${task.taskId} has been cancelled.`,\n      );\n    }\n\n    try {\n      if (\n        step.if === false ||\n        (typeof step.if === 'string' &&\n          step.each === undefined &&\n          !isTruthy(this.render(step.if, context, renderTemplate)))\n      ) {\n        await stepTrack.skipFalsy();\n        return;\n      }\n      const action: TemplateAction<JsonObject> =\n        await this.options.actionRegistry.get(step.action, {\n          credentials: await task.getInitiatorCredentials(),\n        });\n      const { taskLogger } = createStepLogger({\n        task,\n        step,\n        rootLogger: this.options.logger,\n        redactions: {\n          ...task.secrets,\n          ...this.environment?.secrets,\n        },\n      });\n\n      if (task.isDryRun) {\n        const redactedSecrets = Object.fromEntries(\n          Object.entries(task.secrets ?? {}).map(secret => [secret[0], '***']),\n        );\n\n        const redactedEnvironmentSecrets = Object.fromEntries(\n          Object.entries(this.environment?.secrets ?? {}).map(secret => [\n            secret[0],\n            '***',\n          ]),\n        );\n        const debugInput =\n          (step.input &&\n            this.render(\n              step.input,\n              {\n                ...context,\n                environment: {\n                  parameters: this.environment?.parameters || {},\n                  secrets: redactedEnvironmentSecrets,\n                },\n                secrets: redactedSecrets,\n              },\n              renderTemplate,\n            )) ??\n          {};\n        taskLogger.info(\n          `Running ${\n            action.id\n          } in dry-run mode with inputs (secrets redacted): ${JSON.stringify(\n            debugInput,\n            undefined,\n            2,\n          )}`,\n        );\n        if (!action.supportsDryRun) {\n          await taskTrack.skipDryRun(step, action);\n          const outputSchema = action.schema?.output;\n          if (outputSchema) {\n            context.steps[step.id] = {\n              output: generateExampleOutput(outputSchema) as {\n                [name in string]: JsonValue;\n              },\n            };\n          } else {\n            context.steps[step.id] = { output: {} };\n          }\n          return;\n        }\n      }\n\n      const preIterationContext = {\n        ...context,\n        environment: {\n          parameters: this.environment?.parameters ?? {},\n          secrets: task.isDryRun ? {} : this.environment?.secrets ?? {},\n        },\n        secrets: task.isDryRun ? {} : task.secrets ?? {},\n      };\n\n      const resolvedEach =\n        step.each &&\n        this.render(step.each, preIterationContext, renderTemplate);\n\n      if (step.each && !resolvedEach) {\n        throw new InputError(\n          `Invalid value on action ${action.id}.each parameter, \"${step.each}\" cannot be resolved to a value`,\n        );\n      }\n\n      const iterations = (\n        resolvedEach\n          ? Object.entries(resolvedEach).map(([key, value]) => ({\n              each: { key, value },\n            }))\n          : [{}]\n      ).map(i => {\n        const fullContext = { ...preIterationContext, ...i };\n        // Evaluate if condition once per iteration, only when using 'each'\n        const shouldRun =\n          !('each' in i) ||\n          !step.if ||\n          isTruthy(this.render(step.if, fullContext, renderTemplate));\n\n        return {\n          ...i,\n          shouldRun,\n          // Secrets are only passed when templating the input to actions for security reasons\n          input: step.input\n            ? this.render(step.input, fullContext, renderTemplate)\n            : {},\n        };\n      });\n      for (const iteration of iterations) {\n        if (!iteration.shouldRun) {\n          // No need to check schema or authorization for iterations that will not run\n          continue;\n        }\n\n        const actionId = `${action.id}${\n          iteration.each ? `[${iteration.each.key}]` : ''\n        }`;\n\n        if (action.schema?.input) {\n          const validateResult = validateJsonSchema(\n            iteration.input,\n            action.schema.input,\n          );\n          if (!validateResult.valid) {\n            const errors = validateResult.errors.join(', ');\n            throw new InputError(\n              `Invalid input passed to action ${actionId}, ${errors}`,\n            );\n          }\n        }\n        if (\n          !isActionAuthorized(decision, {\n            action: action.id,\n            input: iteration.input,\n          })\n        ) {\n          throw new NotAllowedError(\n            `Unauthorized action: ${actionId}. The action is not allowed. Input: ${JSON.stringify(\n              iteration.input,\n              null,\n              2,\n            )}`,\n          );\n        }\n      }\n      const tmpDirs = new Array<string>();\n      const stepOutput: { [outputName: string]: JsonValue } = {};\n      const prevTaskState = await task.getTaskState?.();\n\n      for (const iteration of iterations) {\n        if (iteration.each) {\n          if (!iteration.shouldRun) {\n            taskLogger.info(\n              `Skipping step each: ${JSON.stringify(\n                iteration.each,\n                (k, v) => (k ? String(v) : v),\n                0,\n              )}`,\n            );\n            continue;\n          }\n          taskLogger.info(\n            `Running step each: ${JSON.stringify(\n              iteration.each,\n              (k, v) => (k ? String(v) : v),\n              0,\n            )}`,\n          );\n        }\n\n        // Redact any rendered values that were influenced by secrets.\n        // Re-render the input without secrets and diff against the real render\n        // to find values that changed due to secret interpolation.\n        if (step.input) {\n          const hasSecrets =\n            Object.keys(task.secrets ?? {}).length > 0 ||\n            Object.keys(this.environment?.secrets ?? {}).length > 0;\n\n          if (hasSecrets) {\n            try {\n              const contextNoSecrets = {\n                ...preIterationContext,\n                ...(iteration.each ? { each: iteration.each } : {}),\n                secrets: {},\n                environment: {\n                  ...preIterationContext.environment,\n                  secrets: {},\n                },\n              };\n              const inputWithoutSecrets = this.render(\n                step.input,\n                contextNoSecrets,\n                renderTemplate,\n              );\n              taskLogger.addRedactions(\n                collectSecretRedactions(iteration.input, inputWithoutSecrets),\n              );\n            } catch {\n              taskLogger.addRedactions(extractStringValues(iteration.input));\n            }\n          }\n        }\n\n        await action.handler({\n          input: iteration.input,\n          task: {\n            id: await task.getWorkspaceName(),\n          },\n          secrets: task.secrets ?? {},\n          logger: taskLogger,\n          workspacePath,\n          async checkpoint<T extends JsonValue | void>(\n            opts: CheckpointContext<T>,\n          ) {\n            const { key: checkpointKey, fn } = opts;\n            const key = `v1.task.checkpoint.${step.id}.${checkpointKey}`;\n\n            try {\n              let prevValue: T | undefined;\n\n              if (prevTaskState) {\n                const prevState = (\n                  prevTaskState.state?.checkpoints as CheckpointState\n                )?.[key];\n\n                if (prevState && prevState.status === 'success') {\n                  prevValue = prevState.value as T;\n                }\n              }\n\n              const value = prevValue ? prevValue : await fn();\n\n              if (!prevValue) {\n                task.updateCheckpoint?.({\n                  key,\n                  status: 'success',\n                  value: value ?? {},\n                });\n              }\n              return value;\n            } catch (err) {\n              task.updateCheckpoint?.({\n                key,\n                status: 'failed',\n                reason: stringifyError(err),\n              });\n              throw err;\n            } finally {\n              await task.serializeWorkspace?.({ path: workspacePath });\n            }\n          },\n          createTemporaryDirectory: async () => {\n            const tmpDir = await fs.mkdtemp(\n              `${workspacePath}_step-${step.id}-`,\n            );\n            tmpDirs.push(tmpDir);\n            return tmpDir;\n          },\n          output(name: string, value: JsonValue) {\n            if (step.each) {\n              stepOutput[name] = stepOutput[name] || [];\n              (stepOutput[name] as JsonArray).push(value);\n            } else {\n              stepOutput[name] = value;\n            }\n          },\n          templateInfo: task.spec.templateInfo,\n          user: task.spec.user,\n          isDryRun: task.isDryRun,\n          signal: task.cancelSignal,\n          getInitiatorCredentials: () => task.getInitiatorCredentials(),\n          step: {\n            id: step.id,\n            name: step.name,\n          },\n        });\n      }\n\n      // Remove all temporary directories that were created when executing the action\n      for (const tmpDir of tmpDirs) {\n        await fs.remove(tmpDir);\n      }\n\n      context.steps[step.id] = { output: stepOutput };\n\n      if (task.cancelSignal.aborted) {\n        throw new Error(\n          `Step ${step.id} (${step.name}) of task ${task.taskId} has been cancelled.`,\n        );\n      }\n\n      await stepTrack.markSuccessful();\n    } catch (err) {\n      await taskTrack.markFailed(step, err);\n      await stepTrack.markFailed();\n      throw err;\n    } finally {\n      await task.serializeWorkspace?.({ path: workspacePath });\n    }\n  }\n\n  async execute(task: TaskContext): Promise<WorkflowResponse> {\n    if (!isValidTaskSpec(task.spec)) {\n      throw new InputError(\n        'Wrong template version executed with the workflow engine',\n      );\n    }\n    const taskId = await task.getWorkspaceName();\n\n    const workspacePath = path.join(this.options.workingDirectory, taskId);\n\n    const { additionalTemplateFilters, additionalTemplateGlobals } =\n      this.options;\n\n    this.environment = await this.getEnvironmentConfig();\n\n    // Track whether any step has failed, used by status check functions\n    const taskState = { failed: false };\n\n    // Track whether a status check global (always/failure) was invoked during rendering\n    const statusCheckInvoked = { value: false };\n\n    const renderTemplate = await SecureTemplater.loadRenderer({\n      templateFilters: {\n        ...this.defaultTemplateFilters,\n        ...additionalTemplateFilters,\n      },\n      templateGlobals: {\n        ...additionalTemplateGlobals,\n        always: () => {\n          statusCheckInvoked.value = true;\n          return true;\n        },\n        failure: () => {\n          statusCheckInvoked.value = true;\n          return taskState.failed;\n        },\n      },\n    });\n\n    try {\n      await task.rehydrateWorkspace?.({ taskId, targetPath: workspacePath });\n\n      const taskTrack = await this.tracker.taskStart(task);\n      await fs.ensureDir(workspacePath);\n\n      const context: TemplateContext = {\n        parameters: task.spec.parameters,\n        environment: {\n          parameters: this.environment?.parameters || {},\n          secrets: {},\n        },\n        steps: {},\n        user: task.spec.user,\n        context: {\n          task: {\n            id: taskId,\n          },\n        },\n      };\n\n      const [decision]: PolicyDecision[] =\n        this.options.permissions && task.spec.steps.length\n          ? await this.options.permissions.authorizeConditional(\n              [{ permission: actionExecutePermission }],\n              { credentials: await task.getInitiatorCredentials() },\n            )\n          : [{ result: AuthorizeResult.ALLOW }];\n\n      let firstError: Error | undefined;\n      const allErrors: Array<{ step: TaskStep; error: Error }> = [];\n\n      for (const step of task.spec.steps) {\n        // If a previous step failed, only run steps whose `if` condition\n        // invokes a status check global (${{ always() }} or ${{ failure() }})\n        if (taskState.failed) {\n          if (typeof step.if !== 'string') {\n            await task.emitLog(\n              `Skipping step ${step.id} because a previous step failed`,\n              { stepId: step.id, status: 'skipped' },\n            );\n            continue;\n          }\n\n          // Render the if condition to detect status check function usage\n          statusCheckInvoked.value = false;\n          this.render(step.if, context, renderTemplate);\n\n          if (!statusCheckInvoked.value) {\n            await task.emitLog(\n              `Skipping step ${step.id} because a previous step failed`,\n              { stepId: step.id, status: 'skipped' },\n            );\n            continue;\n          }\n        }\n\n        try {\n          await this.executeStep(\n            task,\n            step,\n            context,\n            renderTemplate,\n            taskTrack,\n            workspacePath,\n            decision,\n          );\n        } catch (err) {\n          const error = err as Error;\n          allErrors.push({ step, error });\n\n          if (!firstError) {\n            firstError = error;\n          } else {\n            // Log subsequent errors to preserve debugging information\n            this.options.logger.error(\n              `Additional error in step ${step.id} (${step.name}): ${error.message}`,\n              error,\n            );\n            await task.emitLog(\n              `Additional error occurred: ${error.message}\\n${error.stack}`,\n              { stepId: step.id, status: 'failed' },\n            );\n          }\n          taskState.failed = true;\n        }\n      }\n\n      if (firstError) {\n        // If there were multiple errors, add context to the first error\n        if (allErrors.length > 1) {\n          const additionalErrorSummary = allErrors\n            .slice(1)\n            .map(({ step }) => `${step.id} (${step.name})`)\n            .join(', ');\n          this.options.logger.warn(\n            `Task failed with ${allErrors.length} errors. First error from step ${allErrors[0].step.id}. Additional failures in: ${additionalErrorSummary}`,\n          );\n        }\n        throw firstError;\n      }\n\n      const output = this.render(task.spec.output, context, renderTemplate);\n\n      // Filter output links and text items based on their `if` condition\n      if (Array.isArray(output?.links)) {\n        output.links = filterConditionalItems(output.links);\n      }\n      if (Array.isArray(output?.text)) {\n        output.text = filterConditionalItems(output.text);\n      }\n\n      await taskTrack.markSuccessful();\n      await task.cleanWorkspace?.();\n\n      return { output };\n    } finally {\n      if (workspacePath) {\n        await fs.remove(workspacePath);\n      }\n    }\n  }\n}\n\nfunction scaffoldingTracker(metrics: MetricsService) {\n  // prom-client metrics are deprecated in favour of OpenTelemetry metrics.\n  const promTaskCount = createCounterMetric({\n    name: 'scaffolder_task_count',\n    help: 'Count of task runs',\n    labelNames: ['template', 'user', 'result'],\n  });\n  const promTaskDuration = createHistogramMetric({\n    name: 'scaffolder_task_duration',\n    help: 'Duration of a task run',\n    labelNames: ['template', 'result'],\n  });\n  const promtStepCount = createCounterMetric({\n    name: 'scaffolder_step_count',\n    help: 'Count of step runs',\n    labelNames: ['template', 'step', 'result'],\n  });\n  const promStepDuration = createHistogramMetric({\n    name: 'scaffolder_step_duration',\n    help: 'Duration of a step runs',\n    labelNames: ['template', 'step', 'result'],\n  });\n\n  const taskCount = metrics.createCounter('scaffolder.task.count', {\n    description: 'Total number of scaffolder tasks executed',\n  });\n\n  const taskDuration = metrics.createHistogram('scaffolder.task.duration', {\n    description: 'Time taken to complete a scaffolder task end-to-end',\n    unit: 's',\n  });\n\n  const stepCount = metrics.createCounter('scaffolder.step.count', {\n    description: 'Total number of individual scaffolder action steps executed',\n  });\n\n  const stepDuration = metrics.createHistogram('scaffolder.step.duration', {\n    description: 'Time taken to complete a single scaffolder action step',\n    unit: 's',\n  });\n\n  async function taskStart(task: TaskContext) {\n    await task.emitLog(`Starting up task with ${task.spec.steps.length} steps`);\n    const template = task.spec.templateInfo?.entityRef || '';\n    const user = task.spec.user?.ref || '';\n\n    const startTime = process.hrtime();\n    const taskTimer = promTaskDuration.startTimer({\n      template,\n    });\n\n    function endTime() {\n      const delta = process.hrtime(startTime);\n      return delta[0] + delta[1] / 1e9;\n    }\n\n    async function skipDryRun(\n      step: TaskStep,\n      action: TemplateAction<JsonObject>,\n    ) {\n      task.emitLog(`Skipping because ${action.id} does not support dry-run`, {\n        stepId: step.id,\n        status: 'skipped',\n      });\n    }\n\n    async function markSuccessful() {\n      promTaskCount.inc({\n        template,\n        user,\n        result: 'ok',\n      });\n      taskTimer({ result: 'ok' });\n\n      taskCount.add(1, { template, user, result: 'ok' });\n      taskDuration.record(endTime(), {\n        template,\n        result: 'ok',\n      });\n    }\n\n    async function markFailed(step: TaskStep, err: Error) {\n      await task.emitLog(String(err.stack), {\n        stepId: step.id,\n        status: 'failed',\n      });\n      promTaskCount.inc({\n        template,\n        user,\n        result: 'failed',\n      });\n      taskTimer({ result: 'failed' });\n\n      taskCount.add(1, { template, user, result: 'failed' });\n      taskDuration.record(endTime(), {\n        template,\n        result: 'failed',\n      });\n    }\n\n    async function markCancelled(step: TaskStep) {\n      await task.emitLog(`Step ${step.id} has been cancelled.`, {\n        stepId: step.id,\n        status: 'cancelled',\n      });\n      promTaskCount.inc({\n        template,\n        user,\n        result: 'cancelled',\n      });\n      taskTimer({ result: 'cancelled' });\n\n      taskCount.add(1, { template, user, result: 'cancelled' });\n      taskDuration.record(endTime(), {\n        template,\n        result: 'cancelled',\n      });\n    }\n\n    return {\n      skipDryRun,\n      markCancelled,\n      markSuccessful,\n      markFailed,\n    };\n  }\n\n  async function stepStart(task: TaskContext, step: TaskStep) {\n    await task.emitLog(`Beginning step ${step.name}`, {\n      stepId: step.id,\n      status: 'processing',\n    });\n    const template = task.spec.templateInfo?.entityRef || '';\n\n    const startTime = process.hrtime();\n    const stepTimer = promStepDuration.startTimer({\n      template,\n      step: step.name,\n    });\n\n    function endTime() {\n      const delta = process.hrtime(startTime);\n      return delta[0] + delta[1] / 1e9;\n    }\n\n    async function markSuccessful() {\n      await task.emitLog(`Finished step ${step.name}`, {\n        stepId: step.id,\n        status: 'completed',\n      });\n      promtStepCount.inc({\n        template,\n        step: step.name,\n        result: 'ok',\n      });\n      stepTimer({ result: 'ok' });\n\n      stepCount.add(1, { template, step: step.name, result: 'ok' });\n      stepDuration.record(endTime(), {\n        template,\n        step: step.name,\n        result: 'ok',\n      });\n    }\n\n    async function markCancelled() {\n      promtStepCount.inc({\n        template,\n        step: step.name,\n        result: 'cancelled',\n      });\n      stepTimer({ result: 'cancelled' });\n\n      stepCount.add(1, { template, step: step.name, result: 'cancelled' });\n      stepDuration.record(endTime(), {\n        template,\n        step: step.name,\n        result: 'cancelled',\n      });\n    }\n\n    async function markFailed() {\n      promtStepCount.inc({\n        template,\n        step: step.name,\n        result: 'failed',\n      });\n      stepTimer({ result: 'failed' });\n\n      stepCount.add(1, { template, step: step.name, result: 'failed' });\n      stepDuration.record(endTime(), {\n        template,\n        step: step.name,\n        result: 'failed',\n      });\n    }\n\n    async function skipFalsy() {\n      await task.emitLog(\n        `Skipping step ${step.id} because its if condition was false`,\n        { stepId: step.id, status: 'skipped' },\n      );\n      stepTimer({ result: 'skipped' });\n\n      stepCount.add(1, { template, step: step.name, result: 'skipped' });\n      stepDuration.record(endTime(), {\n        template,\n        step: step.name,\n        result: 'skipped',\n      });\n    }\n\n    return {\n      markCancelled,\n      markFailed,\n      markSuccessful,\n      skipFalsy,\n    };\n  }\n\n  return {\n    taskStart,\n    stepStart,\n  };\n}\n"],"names":["WinstonLogger","winston","BackstageLoggerTransport","createConditionAuthorizer","scaffolderActionRules","convertFiltersToRecord","createDefaultFilters","defaultEnvironment","resolveDefaultEnvironment","nunjucks","templated","isTruthy","generateExampleOutput","InputError","validateJsonSchema","errors","NotAllowedError","stringifyError","fs","path","SecureTemplater","actionExecutePermission","AuthorizeResult","filterConditionalItems","metrics","createCounterMetric","createHistogramMetric"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2GA,MAAM,eAAA,GAAkB,CAAC,QAAA,KAAoD;AAC3E,EAAA,OAAO,SAAS,UAAA,KAAe,iCAAA;AACjC,CAAA;AAEA,MAAM,mBAAmB,CAAC;AAAA,EACxB,IAAA;AAAA,EACA,IAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA,KAKM;AACJ,EAAA,MAAM,UAAA,GAAaA,qBAAc,MAAA,CAAO;AAAA,IACtC,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,SAAA,IAAa,MAAA;AAAA,IAChC,MAAA,EAAQC,mBAAQ,MAAA,CAAO,OAAA;AAAA,MACrBA,kBAAA,CAAQ,OAAO,QAAA,EAAS;AAAA,MACxBA,kBAAA,CAAQ,OAAO,MAAA;AAAO,KACxB;AAAA,IACA,UAAA,EAAY,CAAC,IAAIC,+BAAA,CAAyB,YAAY,IAAA,EAAM,IAAA,CAAK,EAAE,CAAC;AAAA,GACrE,CAAA;AAED,EAAA,UAAA,CAAW,cAAc,MAAA,CAAO,MAAA,CAAO,UAAA,IAAc,EAAE,CAAC,CAAA;AAExD,EAAA,OAAO,EAAE,UAAA,EAAW;AACtB,CAAA;AAQA,SAAS,uBAAA,CACP,aACA,cAAA,EACU;AACV,EAAA,IAAI,OAAO,gBAAgB,QAAA,EAAU;AACnC,IAAA,OAAO,WAAA,KAAgB,cAAA,GAAiB,CAAC,WAAW,IAAI,EAAC;AAAA,EAC3D;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC9B,IAAA,MAAM,QAAQ,KAAA,CAAM,OAAA,CAAQ,cAAc,CAAA,GAAI,iBAAiB,EAAC;AAChE,IAAA,OAAO,WAAA,CAAY,OAAA;AAAA,MAAQ,CAAC,GAAA,EAAK,CAAA,KAC/B,wBAAwB,GAAA,EAAK,KAAA,CAAM,CAAC,CAAC;AAAA,KACvC;AAAA,EACF;AACA,EAAA,IAAI,WAAA,IAAe,OAAO,WAAA,KAAgB,QAAA,EAAU;AAClD,IAAA,MAAM,QACJ,cAAA,IAAkB,OAAO,cAAA,KAAmB,QAAA,GACvC,iBACD,EAAC;AACP,IAAA,OAAO,MAAA,CAAO,OAAA,CAAQ,WAAsC,CAAA,CAAE,OAAA;AAAA,MAC5D,CAAC,CAAC,GAAA,EAAK,GAAG,MAAM,uBAAA,CAAwB,GAAA,EAAK,KAAA,CAAM,GAAG,CAAC;AAAA,KACzD;AAAA,EACF;AACA,EAAA,OAAO,EAAC;AACV;AAMA,SAAS,oBAAoB,GAAA,EAAwB;AACnD,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,CAAC,GAAG,CAAA;AACxC,EAAA,IAAI,MAAM,OAAA,CAAQ,GAAG,GAAG,OAAO,GAAA,CAAI,QAAQ,mBAAmB,CAAA;AAC9D,EAAA,IAAI,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,EAAU;AAClC,IAAA,OAAO,MAAA,CAAO,QAAQ,GAAG,CAAA,CAAE,QAAQ,CAAC,CAAC,GAAA,EAAK,GAAG,CAAA,KAAM;AAAA,MACjD,GAAA;AAAA,MACA,GAAG,oBAAoB,GAAG;AAAA,KAC3B,CAAA;AAAA,EACH;AACA,EAAA,OAAO,EAAC;AACV;AAEA,MAAM,kBAAA,GAAqBC,8CAAA;AAAA,EACzB,MAAA,CAAO,OAAOC,2BAAqB;AACrC,CAAA;AAEO,MAAM,sBAAA,CAAiD;AAAA,EAC3C,sBAAA;AAAA,EACA,OAAA;AAAA,EACT,cAGJ,EAAE,UAAA,EAAY,EAAC,EAAG,OAAA,EAAS,EAAC,EAAE;AAAA,EAEjB,OAAA;AAAA,EAEjB,YAAY,OAAA,EAAwC;AAClD,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,sBAAA,GAAyBC,iCAAA;AAAA,MAC5BC,yCAAA,CAAqB;AAAA,QACnB,YAAA,EAAc,KAAK,OAAA,CAAQ;AAAA,OAC5B;AAAA,KACH;AACA,IAAA,IAAA,CAAK,OAAA,GAAU,kBAAA,CAAmB,OAAA,CAAQ,OAAO,CAAA;AAAA,EACnD;AAAA,EAEA,MAAM,oBAAA,GAGH;AACD,IAAA,IAAI,IAAA,CAAK,QAAQ,MAAA,EAAQ;AACvB,MAAA,MAAMC,oBAAA,GAAqBC,4CAAA,CAA0B,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAA;AACxE,MAAA,OAAO;AAAA,QACL,YAAYD,oBAAA,CAAmB,UAAA;AAAA,QAC/B,SAASA,oBAAA,CAAmB;AAAA,OAC9B;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,YAAY,EAAC;AAAA,MACb,SAAS;AAAC,KACZ;AAAA,EACF;AAAA,EAEQ,uBAAuB,KAAA,EAAe;AAC5C,IAAA,MAAM,EAAE,MAAA,EAAQ,KAAA,EAAM,GAAIE,yBAAA;AAW1B,IAAA,MAAM,SAAS,MAAA,CAAO,KAAA;AAAA,MACpB,KAAA;AAAA,MACA,EAAC;AAAA,MACD;AAAA,QACE,UAAA,EAAY,KAAA;AAAA,QACZ,IAAA,EAAM;AAAA,UACJ,aAAA,EAAe,KAAA;AAAA,UACf,WAAA,EAAa;AAAA;AACf;AACF,KACF;AAEA,IAAA,OACE,MAAA,CAAO,QAAA,CAAS,MAAA,KAAW,CAAA,IAC3B,EAAE,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,EAAG,QAAA,GAAW,CAAC,CAAA,YAAa,KAAA,CAAM,YAAA,CAAA;AAAA,EAEzD;AAAA,EAEQ,MAAA,CACN,KAAA,EACA,OAAA,EACA,cAAA,EACG;AACH,IAAA,OAAO,IAAA,CAAK,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,EAAG,CAAC,MAAM,KAAA,KAAU;AACxD,MAAA,IAAI;AACF,QAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,UAAA,IAAI;AACF,YAAA,IAAI,IAAA,CAAK,sBAAA,CAAuB,KAAK,CAAA,EAAG;AAEtC,cAAA,MAAM,gBAAgB,KAAA,CAAM,OAAA;AAAA,gBAC1B,aAAA;AAAA,gBACA;AAAA,eACF;AAGA,cAAA,MAAMC,UAAAA,GAAY,cAAA,CAAe,aAAA,EAAe,OAAO,CAAA;AAGvD,cAAA,IAAIA,eAAc,EAAA,EAAI;AACpB,gBAAA,OAAO,KAAA,CAAA;AAAA,cACT;AAGA,cAAA,OAAO,IAAA,CAAK,MAAMA,UAAS,CAAA;AAAA,YAC7B;AAAA,UACF,SAAS,EAAA,EAAI;AACX,YAAA,IAAA,CAAK,QAAQ,MAAA,CAAO,KAAA;AAAA,cAClB,CAAA,iCAAA,EAAoC,KAAK,CAAA,YAAA,EAAe,EAAA,CAAG,OAAO,CAAA;AAAA,aACpE;AAAA,UACF;AAGA,UAAA,MAAM,SAAA,GAAY,cAAA,CAAe,KAAA,EAAO,OAAO,CAAA;AAE/C,UAAA,IAAI,cAAc,EAAA,EAAI;AACpB,YAAA,OAAO,KAAA,CAAA;AAAA,UACT;AAEA,UAAA,OAAO,SAAA;AAAA,QACT;AAAA,MACF,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,OAAO,KAAA;AAAA,IACT,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,YACJ,IAAA,EACA,IAAA,EACA,SACA,cAAA,EACA,SAAA,EACA,eACA,QAAA,EACA;AACA,IAAA,MAAM,YAAY,MAAM,IAAA,CAAK,OAAA,CAAQ,SAAA,CAAU,MAAM,IAAI,CAAA;AAEzD,IAAA,IAAI,IAAA,CAAK,aAAa,OAAA,EAAS;AAC7B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,KAAA,EAAQ,KAAK,EAAE,CAAA,EAAA,EAAK,KAAK,IAAI,CAAA,UAAA,EAAa,KAAK,MAAM,CAAA,oBAAA;AAAA,OACvD;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,IACE,KAAK,EAAA,KAAO,KAAA,IACX,OAAO,IAAA,CAAK,EAAA,KAAO,YAClB,IAAA,CAAK,IAAA,KAAS,UACd,CAACC,eAAA,CAAS,KAAK,MAAA,CAAO,IAAA,CAAK,IAAI,OAAA,EAAS,cAAc,CAAC,CAAA,EACzD;AACA,QAAA,MAAM,UAAU,SAAA,EAAU;AAC1B,QAAA;AAAA,MACF;AACA,MAAA,MAAM,SACJ,MAAM,IAAA,CAAK,QAAQ,cAAA,CAAe,GAAA,CAAI,KAAK,MAAA,EAAQ;AAAA,QACjD,WAAA,EAAa,MAAM,IAAA,CAAK,uBAAA;AAAwB,OACjD,CAAA;AACH,MAAA,MAAM,EAAE,UAAA,EAAW,GAAI,gBAAA,CAAiB;AAAA,QACtC,IAAA;AAAA,QACA,IAAA;AAAA,QACA,UAAA,EAAY,KAAK,OAAA,CAAQ,MAAA;AAAA,QACzB,UAAA,EAAY;AAAA,UACV,GAAG,IAAA,CAAK,OAAA;AAAA,UACR,GAAG,KAAK,WAAA,EAAa;AAAA;AACvB,OACD,CAAA;AAED,MAAA,IAAI,KAAK,QAAA,EAAU;AACjB,QAAA,MAAM,kBAAkB,MAAA,CAAO,WAAA;AAAA,UAC7B,MAAA,CAAO,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA,CAAE,GAAA,CAAI,CAAA,MAAA,KAAU,CAAC,MAAA,CAAO,CAAC,CAAA,EAAG,KAAK,CAAC;AAAA,SACrE;AAEA,QAAA,MAAM,6BAA6B,MAAA,CAAO,WAAA;AAAA,UACxC,MAAA,CAAO,QAAQ,IAAA,CAAK,WAAA,EAAa,WAAW,EAAE,CAAA,CAAE,GAAA,CAAI,CAAA,MAAA,KAAU;AAAA,YAC5D,OAAO,CAAC,CAAA;AAAA,YACR;AAAA,WACD;AAAA,SACH;AACA,QAAA,MAAM,UAAA,GAAA,CACH,IAAA,CAAK,KAAA,IACJ,IAAA,CAAK,MAAA;AAAA,UACH,IAAA,CAAK,KAAA;AAAA,UACL;AAAA,YACE,GAAG,OAAA;AAAA,YACH,WAAA,EAAa;AAAA,cACX,UAAA,EAAY,IAAA,CAAK,WAAA,EAAa,UAAA,IAAc,EAAC;AAAA,cAC7C,OAAA,EAAS;AAAA,aACX;AAAA,YACA,OAAA,EAAS;AAAA,WACX;AAAA,UACA;AAAA,cAEJ,EAAC;AACH,QAAA,UAAA,CAAW,IAAA;AAAA,UACT,CAAA,QAAA,EACE,MAAA,CAAO,EACT,CAAA,iDAAA,EAAoD,IAAA,CAAK,SAAA;AAAA,YACvD,UAAA;AAAA,YACA,KAAA,CAAA;AAAA,YACA;AAAA,WACD,CAAA;AAAA,SACH;AACA,QAAA,IAAI,CAAC,OAAO,cAAA,EAAgB;AAC1B,UAAA,MAAM,SAAA,CAAU,UAAA,CAAW,IAAA,EAAM,MAAM,CAAA;AACvC,UAAA,MAAM,YAAA,GAAe,OAAO,MAAA,EAAQ,MAAA;AACpC,UAAA,IAAI,YAAA,EAAc;AAChB,YAAA,OAAA,CAAQ,KAAA,CAAM,IAAA,CAAK,EAAE,CAAA,GAAI;AAAA,cACvB,MAAA,EAAQC,6BAAsB,YAAY;AAAA,aAG5C;AAAA,UACF,CAAA,MAAO;AACL,YAAA,OAAA,CAAQ,MAAM,IAAA,CAAK,EAAE,IAAI,EAAE,MAAA,EAAQ,EAAC,EAAE;AAAA,UACxC;AACA,UAAA;AAAA,QACF;AAAA,MACF;AAEA,MAAA,MAAM,mBAAA,GAAsB;AAAA,QAC1B,GAAG,OAAA;AAAA,QACH,WAAA,EAAa;AAAA,UACX,UAAA,EAAY,IAAA,CAAK,WAAA,EAAa,UAAA,IAAc,EAAC;AAAA,UAC7C,OAAA,EAAS,KAAK,QAAA,GAAW,KAAK,IAAA,CAAK,WAAA,EAAa,WAAW;AAAC,SAC9D;AAAA,QACA,SAAS,IAAA,CAAK,QAAA,GAAW,EAAC,GAAI,IAAA,CAAK,WAAW;AAAC,OACjD;AAEA,MAAA,MAAM,YAAA,GACJ,KAAK,IAAA,IACL,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA,EAAM,qBAAqB,cAAc,CAAA;AAE5D,MAAA,IAAI,IAAA,CAAK,IAAA,IAAQ,CAAC,YAAA,EAAc;AAC9B,QAAA,MAAM,IAAIC,iBAAA;AAAA,UACR,CAAA,wBAAA,EAA2B,MAAA,CAAO,EAAE,CAAA,kBAAA,EAAqB,KAAK,IAAI,CAAA,+BAAA;AAAA,SACpE;AAAA,MACF;AAEA,MAAA,MAAM,UAAA,GAAA,CACJ,YAAA,GACI,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA,CAAE,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,MAAO;AAAA,QAClD,IAAA,EAAM,EAAE,GAAA,EAAK,KAAA;AAAM,QACnB,CAAA,GACF,CAAC,EAAE,CAAA,EACP,IAAI,CAAA,CAAA,KAAK;AACT,QAAA,MAAM,WAAA,GAAc,EAAE,GAAG,mBAAA,EAAqB,GAAG,CAAA,EAAE;AAEnD,QAAA,MAAM,SAAA,GACJ,EAAE,MAAA,IAAU,CAAA,CAAA,IACZ,CAAC,IAAA,CAAK,EAAA,IACNF,eAAA,CAAS,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,EAAA,EAAI,WAAA,EAAa,cAAc,CAAC,CAAA;AAE5D,QAAA,OAAO;AAAA,UACL,GAAG,CAAA;AAAA,UACH,SAAA;AAAA;AAAA,UAEA,KAAA,EAAO,IAAA,CAAK,KAAA,GACR,IAAA,CAAK,MAAA,CAAO,KAAK,KAAA,EAAO,WAAA,EAAa,cAAc,CAAA,GACnD;AAAC,SACP;AAAA,MACF,CAAC,CAAA;AACD,MAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,QAAA,IAAI,CAAC,UAAU,SAAA,EAAW;AAExB,UAAA;AAAA,QACF;AAEA,QAAA,MAAM,QAAA,GAAW,CAAA,EAAG,MAAA,CAAO,EAAE,CAAA,EAC3B,SAAA,CAAU,IAAA,GAAO,CAAA,CAAA,EAAI,SAAA,CAAU,IAAA,CAAK,GAAG,CAAA,CAAA,CAAA,GAAM,EAC/C,CAAA,CAAA;AAEA,QAAA,IAAI,MAAA,CAAO,QAAQ,KAAA,EAAO;AACxB,UAAA,MAAM,cAAA,GAAiBG,mBAAA;AAAA,YACrB,SAAA,CAAU,KAAA;AAAA,YACV,OAAO,MAAA,CAAO;AAAA,WAChB;AACA,UAAA,IAAI,CAAC,eAAe,KAAA,EAAO;AACzB,YAAA,MAAMC,QAAA,GAAS,cAAA,CAAe,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AAC9C,YAAA,MAAM,IAAIF,iBAAA;AAAA,cACR,CAAA,+BAAA,EAAkC,QAAQ,CAAA,EAAA,EAAKE,QAAM,CAAA;AAAA,aACvD;AAAA,UACF;AAAA,QACF;AACA,QAAA,IACE,CAAC,mBAAmB,QAAA,EAAU;AAAA,UAC5B,QAAQ,MAAA,CAAO,EAAA;AAAA,UACf,OAAO,SAAA,CAAU;AAAA,SAClB,CAAA,EACD;AACA,UAAA,MAAM,IAAIC,sBAAA;AAAA,YACR,CAAA,qBAAA,EAAwB,QAAQ,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAA;AAAA,cAC1E,SAAA,CAAU,KAAA;AAAA,cACV,IAAA;AAAA,cACA;AAAA,aACD,CAAA;AAAA,WACH;AAAA,QACF;AAAA,MACF;AACA,MAAA,MAAM,OAAA,GAAU,IAAI,KAAA,EAAc;AAClC,MAAA,MAAM,aAAkD,EAAC;AACzD,MAAA,MAAM,aAAA,GAAgB,MAAM,IAAA,CAAK,YAAA,IAAe;AAEhD,MAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,QAAA,IAAI,UAAU,IAAA,EAAM;AAClB,UAAA,IAAI,CAAC,UAAU,SAAA,EAAW;AACxB,YAAA,UAAA,CAAW,IAAA;AAAA,cACT,uBAAuB,IAAA,CAAK,SAAA;AAAA,gBAC1B,SAAA,CAAU,IAAA;AAAA,gBACV,CAAC,CAAA,EAAG,CAAA,KAAO,CAAA,GAAI,MAAA,CAAO,CAAC,CAAA,GAAI,CAAA;AAAA,gBAC3B;AAAA,eACD,CAAA;AAAA,aACH;AACA,YAAA;AAAA,UACF;AACA,UAAA,UAAA,CAAW,IAAA;AAAA,YACT,sBAAsB,IAAA,CAAK,SAAA;AAAA,cACzB,SAAA,CAAU,IAAA;AAAA,cACV,CAAC,CAAA,EAAG,CAAA,KAAO,CAAA,GAAI,MAAA,CAAO,CAAC,CAAA,GAAI,CAAA;AAAA,cAC3B;AAAA,aACD,CAAA;AAAA,WACH;AAAA,QACF;AAKA,QAAA,IAAI,KAAK,KAAA,EAAO;AACd,UAAA,MAAM,aACJ,MAAA,CAAO,IAAA,CAAK,KAAK,OAAA,IAAW,EAAE,CAAA,CAAE,MAAA,GAAS,CAAA,IACzC,MAAA,CAAO,KAAK,IAAA,CAAK,WAAA,EAAa,WAAW,EAAE,EAAE,MAAA,GAAS,CAAA;AAExD,UAAA,IAAI,UAAA,EAAY;AACd,YAAA,IAAI;AACF,cAAA,MAAM,gBAAA,GAAmB;AAAA,gBACvB,GAAG,mBAAA;AAAA,gBACH,GAAI,UAAU,IAAA,GAAO,EAAE,MAAM,SAAA,CAAU,IAAA,KAAS,EAAC;AAAA,gBACjD,SAAS,EAAC;AAAA,gBACV,WAAA,EAAa;AAAA,kBACX,GAAG,mBAAA,CAAoB,WAAA;AAAA,kBACvB,SAAS;AAAC;AACZ,eACF;AACA,cAAA,MAAM,sBAAsB,IAAA,CAAK,MAAA;AAAA,gBAC/B,IAAA,CAAK,KAAA;AAAA,gBACL,gBAAA;AAAA,gBACA;AAAA,eACF;AACA,cAAA,UAAA,CAAW,aAAA;AAAA,gBACT,uBAAA,CAAwB,SAAA,CAAU,KAAA,EAAO,mBAAmB;AAAA,eAC9D;AAAA,YACF,CAAA,CAAA,MAAQ;AACN,cAAA,UAAA,CAAW,aAAA,CAAc,mBAAA,CAAoB,SAAA,CAAU,KAAK,CAAC,CAAA;AAAA,YAC/D;AAAA,UACF;AAAA,QACF;AAEA,QAAA,MAAM,OAAO,OAAA,CAAQ;AAAA,UACnB,OAAO,SAAA,CAAU,KAAA;AAAA,UACjB,IAAA,EAAM;AAAA,YACJ,EAAA,EAAI,MAAM,IAAA,CAAK,gBAAA;AAAiB,WAClC;AAAA,UACA,OAAA,EAAS,IAAA,CAAK,OAAA,IAAW,EAAC;AAAA,UAC1B,MAAA,EAAQ,UAAA;AAAA,UACR,aAAA;AAAA,UACA,MAAM,WACJ,IAAA,EACA;AACA,YAAA,MAAM,EAAE,GAAA,EAAK,aAAA,EAAe,EAAA,EAAG,GAAI,IAAA;AACnC,YAAA,MAAM,GAAA,GAAM,CAAA,mBAAA,EAAsB,IAAA,CAAK,EAAE,IAAI,aAAa,CAAA,CAAA;AAE1D,YAAA,IAAI;AACF,cAAA,IAAI,SAAA;AAEJ,cAAA,IAAI,aAAA,EAAe;AACjB,gBAAA,MAAM,SAAA,GACJ,aAAA,CAAc,KAAA,EAAO,WAAA,GACnB,GAAG,CAAA;AAEP,gBAAA,IAAI,SAAA,IAAa,SAAA,CAAU,MAAA,KAAW,SAAA,EAAW;AAC/C,kBAAA,SAAA,GAAY,SAAA,CAAU,KAAA;AAAA,gBACxB;AAAA,cACF;AAEA,cAAA,MAAM,KAAA,GAAQ,SAAA,GAAY,SAAA,GAAY,MAAM,EAAA,EAAG;AAE/C,cAAA,IAAI,CAAC,SAAA,EAAW;AACd,gBAAA,IAAA,CAAK,gBAAA,GAAmB;AAAA,kBACtB,GAAA;AAAA,kBACA,MAAA,EAAQ,SAAA;AAAA,kBACR,KAAA,EAAO,SAAS;AAAC,iBAClB,CAAA;AAAA,cACH;AACA,cAAA,OAAO,KAAA;AAAA,YACT,SAAS,GAAA,EAAK;AACZ,cAAA,IAAA,CAAK,gBAAA,GAAmB;AAAA,gBACtB,GAAA;AAAA,gBACA,MAAA,EAAQ,QAAA;AAAA,gBACR,MAAA,EAAQC,sBAAe,GAAG;AAAA,eAC3B,CAAA;AACD,cAAA,MAAM,GAAA;AAAA,YACR,CAAA,SAAE;AACA,cAAA,MAAM,IAAA,CAAK,kBAAA,GAAqB,EAAE,IAAA,EAAM,eAAe,CAAA;AAAA,YACzD;AAAA,UACF,CAAA;AAAA,UACA,0BAA0B,YAAY;AACpC,YAAA,MAAM,MAAA,GAAS,MAAMC,mBAAA,CAAG,OAAA;AAAA,cACtB,CAAA,EAAG,aAAa,CAAA,MAAA,EAAS,IAAA,CAAK,EAAE,CAAA,CAAA;AAAA,aAClC;AACA,YAAA,OAAA,CAAQ,KAAK,MAAM,CAAA;AACnB,YAAA,OAAO,MAAA;AAAA,UACT,CAAA;AAAA,UACA,MAAA,CAAO,MAAc,KAAA,EAAkB;AACrC,YAAA,IAAI,KAAK,IAAA,EAAM;AACb,cAAA,UAAA,CAAW,IAAI,CAAA,GAAI,UAAA,CAAW,IAAI,KAAK,EAAC;AACxC,cAAC,UAAA,CAAW,IAAI,CAAA,CAAgB,IAAA,CAAK,KAAK,CAAA;AAAA,YAC5C,CAAA,MAAO;AACL,cAAA,UAAA,CAAW,IAAI,CAAA,GAAI,KAAA;AAAA,YACrB;AAAA,UACF,CAAA;AAAA,UACA,YAAA,EAAc,KAAK,IAAA,CAAK,YAAA;AAAA,UACxB,IAAA,EAAM,KAAK,IAAA,CAAK,IAAA;AAAA,UAChB,UAAU,IAAA,CAAK,QAAA;AAAA,UACf,QAAQ,IAAA,CAAK,YAAA;AAAA,UACb,uBAAA,EAAyB,MAAM,IAAA,CAAK,uBAAA,EAAwB;AAAA,UAC5D,IAAA,EAAM;AAAA,YACJ,IAAI,IAAA,CAAK,EAAA;AAAA,YACT,MAAM,IAAA,CAAK;AAAA;AACb,SACD,CAAA;AAAA,MACH;AAGA,MAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,QAAA,MAAMA,mBAAA,CAAG,OAAO,MAAM,CAAA;AAAA,MACxB;AAEA,MAAA,OAAA,CAAQ,MAAM,IAAA,CAAK,EAAE,CAAA,GAAI,EAAE,QAAQ,UAAA,EAAW;AAE9C,MAAA,IAAI,IAAA,CAAK,aAAa,OAAA,EAAS;AAC7B,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,KAAA,EAAQ,KAAK,EAAE,CAAA,EAAA,EAAK,KAAK,IAAI,CAAA,UAAA,EAAa,KAAK,MAAM,CAAA,oBAAA;AAAA,SACvD;AAAA,MACF;AAEA,MAAA,MAAM,UAAU,cAAA,EAAe;AAAA,IACjC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,SAAA,CAAU,UAAA,CAAW,IAAA,EAAM,GAAG,CAAA;AACpC,MAAA,MAAM,UAAU,UAAA,EAAW;AAC3B,MAAA,MAAM,GAAA;AAAA,IACR,CAAA,SAAE;AACA,MAAA,MAAM,IAAA,CAAK,kBAAA,GAAqB,EAAE,IAAA,EAAM,eAAe,CAAA;AAAA,IACzD;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,IAAA,EAA8C;AAC1D,IAAA,IAAI,CAAC,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAA,EAAG;AAC/B,MAAA,MAAM,IAAIL,iBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,gBAAA,EAAiB;AAE3C,IAAA,MAAM,gBAAgBM,qBAAA,CAAK,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,kBAAkB,MAAM,CAAA;AAErE,IAAA,MAAM,EAAE,yBAAA,EAA2B,yBAAA,EAA0B,GAC3D,IAAA,CAAK,OAAA;AAEP,IAAA,IAAA,CAAK,WAAA,GAAc,MAAM,IAAA,CAAK,oBAAA,EAAqB;AAGnD,IAAA,MAAM,SAAA,GAAY,EAAE,MAAA,EAAQ,KAAA,EAAM;AAGlC,IAAA,MAAM,kBAAA,GAAqB,EAAE,KAAA,EAAO,KAAA,EAAM;AAE1C,IAAA,MAAM,cAAA,GAAiB,MAAMC,+BAAA,CAAgB,YAAA,CAAa;AAAA,MACxD,eAAA,EAAiB;AAAA,QACf,GAAG,IAAA,CAAK,sBAAA;AAAA,QACR,GAAG;AAAA,OACL;AAAA,MACA,eAAA,EAAiB;AAAA,QACf,GAAG,yBAAA;AAAA,QACH,QAAQ,MAAM;AACZ,UAAA,kBAAA,CAAmB,KAAA,GAAQ,IAAA;AAC3B,UAAA,OAAO,IAAA;AAAA,QACT,CAAA;AAAA,QACA,SAAS,MAAM;AACb,UAAA,kBAAA,CAAmB,KAAA,GAAQ,IAAA;AAC3B,UAAA,OAAO,SAAA,CAAU,MAAA;AAAA,QACnB;AAAA;AACF,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,kBAAA,GAAqB,EAAE,MAAA,EAAQ,UAAA,EAAY,eAAe,CAAA;AAErE,MAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,OAAA,CAAQ,UAAU,IAAI,CAAA;AACnD,MAAA,MAAMF,mBAAA,CAAG,UAAU,aAAa,CAAA;AAEhC,MAAA,MAAM,OAAA,GAA2B;AAAA,QAC/B,UAAA,EAAY,KAAK,IAAA,CAAK,UAAA;AAAA,QACtB,WAAA,EAAa;AAAA,UACX,UAAA,EAAY,IAAA,CAAK,WAAA,EAAa,UAAA,IAAc,EAAC;AAAA,UAC7C,SAAS;AAAC,SACZ;AAAA,QACA,OAAO,EAAC;AAAA,QACR,IAAA,EAAM,KAAK,IAAA,CAAK,IAAA;AAAA,QAChB,OAAA,EAAS;AAAA,UACP,IAAA,EAAM;AAAA,YACJ,EAAA,EAAI;AAAA;AACN;AACF,OACF;AAEA,MAAA,MAAM,CAAC,QAAQ,CAAA,GACb,IAAA,CAAK,OAAA,CAAQ,WAAA,IAAe,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,MAAA,GACxC,MAAM,IAAA,CAAK,QAAQ,WAAA,CAAY,oBAAA;AAAA,QAC7B,CAAC,EAAE,UAAA,EAAYG,6BAAA,EAAyB,CAAA;AAAA,QACxC,EAAE,WAAA,EAAa,MAAM,IAAA,CAAK,yBAAwB;AAAE,UAEtD,CAAC,EAAE,MAAA,EAAQC,sCAAA,CAAgB,OAAO,CAAA;AAExC,MAAA,IAAI,UAAA;AACJ,MAAA,MAAM,YAAqD,EAAC;AAE5D,MAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,IAAA,CAAK,KAAA,EAAO;AAGlC,QAAA,IAAI,UAAU,MAAA,EAAQ;AACpB,UAAA,IAAI,OAAO,IAAA,CAAK,EAAA,KAAO,QAAA,EAAU;AAC/B,YAAA,MAAM,IAAA,CAAK,OAAA;AAAA,cACT,CAAA,cAAA,EAAiB,KAAK,EAAE,CAAA,+BAAA,CAAA;AAAA,cACxB,EAAE,MAAA,EAAQ,IAAA,CAAK,EAAA,EAAI,QAAQ,SAAA;AAAU,aACvC;AACA,YAAA;AAAA,UACF;AAGA,UAAA,kBAAA,CAAmB,KAAA,GAAQ,KAAA;AAC3B,UAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,EAAA,EAAI,OAAA,EAAS,cAAc,CAAA;AAE5C,UAAA,IAAI,CAAC,mBAAmB,KAAA,EAAO;AAC7B,YAAA,MAAM,IAAA,CAAK,OAAA;AAAA,cACT,CAAA,cAAA,EAAiB,KAAK,EAAE,CAAA,+BAAA,CAAA;AAAA,cACxB,EAAE,MAAA,EAAQ,IAAA,CAAK,EAAA,EAAI,QAAQ,SAAA;AAAU,aACvC;AACA,YAAA;AAAA,UACF;AAAA,QACF;AAEA,QAAA,IAAI;AACF,UAAA,MAAM,IAAA,CAAK,WAAA;AAAA,YACT,IAAA;AAAA,YACA,IAAA;AAAA,YACA,OAAA;AAAA,YACA,cAAA;AAAA,YACA,SAAA;AAAA,YACA,aAAA;AAAA,YACA;AAAA,WACF;AAAA,QACF,SAAS,GAAA,EAAK;AACZ,UAAA,MAAM,KAAA,GAAQ,GAAA;AACd,UAAA,SAAA,CAAU,IAAA,CAAK,EAAE,IAAA,EAAM,KAAA,EAAO,CAAA;AAE9B,UAAA,IAAI,CAAC,UAAA,EAAY;AACf,YAAA,UAAA,GAAa,KAAA;AAAA,UACf,CAAA,MAAO;AAEL,YAAA,IAAA,CAAK,QAAQ,MAAA,CAAO,KAAA;AAAA,cAClB,CAAA,yBAAA,EAA4B,KAAK,EAAE,CAAA,EAAA,EAAK,KAAK,IAAI,CAAA,GAAA,EAAM,MAAM,OAAO,CAAA,CAAA;AAAA,cACpE;AAAA,aACF;AACA,YAAA,MAAM,IAAA,CAAK,OAAA;AAAA,cACT,CAAA,2BAAA,EAA8B,MAAM,OAAO;AAAA,EAAK,MAAM,KAAK,CAAA,CAAA;AAAA,cAC3D,EAAE,MAAA,EAAQ,IAAA,CAAK,EAAA,EAAI,QAAQ,QAAA;AAAS,aACtC;AAAA,UACF;AACA,UAAA,SAAA,CAAU,MAAA,GAAS,IAAA;AAAA,QACrB;AAAA,MACF;AAEA,MAAA,IAAI,UAAA,EAAY;AAEd,QAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACxB,UAAA,MAAM,yBAAyB,SAAA,CAC5B,KAAA,CAAM,CAAC,CAAA,CACP,GAAA,CAAI,CAAC,EAAE,IAAA,OAAW,CAAA,EAAG,IAAA,CAAK,EAAE,CAAA,EAAA,EAAK,IAAA,CAAK,IAAI,CAAA,CAAA,CAAG,CAAA,CAC7C,KAAK,IAAI,CAAA;AACZ,UAAA,IAAA,CAAK,QAAQ,MAAA,CAAO,IAAA;AAAA,YAClB,CAAA,iBAAA,EAAoB,SAAA,CAAU,MAAM,CAAA,+BAAA,EAAkC,SAAA,CAAU,CAAC,CAAA,CAAE,IAAA,CAAK,EAAE,CAAA,0BAAA,EAA6B,sBAAsB,CAAA;AAAA,WAC/I;AAAA,QACF;AACA,QAAA,MAAM,UAAA;AAAA,MACR;AAEA,MAAA,MAAM,SAAS,IAAA,CAAK,MAAA,CAAO,KAAK,IAAA,CAAK,MAAA,EAAQ,SAAS,cAAc,CAAA;AAGpE,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAA,EAAG;AAChC,QAAA,MAAA,CAAO,KAAA,GAAQC,6BAAA,CAAuB,MAAA,CAAO,KAAK,CAAA;AAAA,MACpD;AACA,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,IAAI,CAAA,EAAG;AAC/B,QAAA,MAAA,CAAO,IAAA,GAAOA,6BAAA,CAAuB,MAAA,CAAO,IAAI,CAAA;AAAA,MAClD;AAEA,MAAA,MAAM,UAAU,cAAA,EAAe;AAC/B,MAAA,MAAM,KAAK,cAAA,IAAiB;AAE5B,MAAA,OAAO,EAAE,MAAA,EAAO;AAAA,IAClB,CAAA,SAAE;AACA,MAAA,IAAI,aAAA,EAAe;AACjB,QAAA,MAAML,mBAAA,CAAG,OAAO,aAAa,CAAA;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,mBAAmBM,SAAA,EAAyB;AAEnD,EAAA,MAAM,gBAAgBC,2BAAA,CAAoB;AAAA,IACxC,IAAA,EAAM,uBAAA;AAAA,IACN,IAAA,EAAM,oBAAA;AAAA,IACN,UAAA,EAAY,CAAC,UAAA,EAAY,MAAA,EAAQ,QAAQ;AAAA,GAC1C,CAAA;AACD,EAAA,MAAM,mBAAmBC,6BAAA,CAAsB;AAAA,IAC7C,IAAA,EAAM,0BAAA;AAAA,IACN,IAAA,EAAM,wBAAA;AAAA,IACN,UAAA,EAAY,CAAC,UAAA,EAAY,QAAQ;AAAA,GAClC,CAAA;AACD,EAAA,MAAM,iBAAiBD,2BAAA,CAAoB;AAAA,IACzC,IAAA,EAAM,uBAAA;AAAA,IACN,IAAA,EAAM,oBAAA;AAAA,IACN,UAAA,EAAY,CAAC,UAAA,EAAY,MAAA,EAAQ,QAAQ;AAAA,GAC1C,CAAA;AACD,EAAA,MAAM,mBAAmBC,6BAAA,CAAsB;AAAA,IAC7C,IAAA,EAAM,0BAAA;AAAA,IACN,IAAA,EAAM,yBAAA;AAAA,IACN,UAAA,EAAY,CAAC,UAAA,EAAY,MAAA,EAAQ,QAAQ;AAAA,GAC1C,CAAA;AAED,EAAA,MAAM,SAAA,GAAYF,SAAA,CAAQ,aAAA,CAAc,uBAAA,EAAyB;AAAA,IAC/D,WAAA,EAAa;AAAA,GACd,CAAA;AAED,EAAA,MAAM,YAAA,GAAeA,SAAA,CAAQ,eAAA,CAAgB,0BAAA,EAA4B;AAAA,IACvE,WAAA,EAAa,qDAAA;AAAA,IACb,IAAA,EAAM;AAAA,GACP,CAAA;AAED,EAAA,MAAM,SAAA,GAAYA,SAAA,CAAQ,aAAA,CAAc,uBAAA,EAAyB;AAAA,IAC/D,WAAA,EAAa;AAAA,GACd,CAAA;AAED,EAAA,MAAM,YAAA,GAAeA,SAAA,CAAQ,eAAA,CAAgB,0BAAA,EAA4B;AAAA,IACvE,WAAA,EAAa,wDAAA;AAAA,IACb,IAAA,EAAM;AAAA,GACP,CAAA;AAED,EAAA,eAAe,UAAU,IAAA,EAAmB;AAC1C,IAAA,MAAM,KAAK,OAAA,CAAQ,CAAA,sBAAA,EAAyB,KAAK,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,MAAA,CAAQ,CAAA;AAC1E,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,YAAA,EAAc,SAAA,IAAa,EAAA;AACtD,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,GAAA,IAAO,EAAA;AAEpC,IAAA,MAAM,SAAA,GAAY,QAAQ,MAAA,EAAO;AACjC,IAAA,MAAM,SAAA,GAAY,iBAAiB,UAAA,CAAW;AAAA,MAC5C;AAAA,KACD,CAAA;AAED,IAAA,SAAS,OAAA,GAAU;AACjB,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA;AACtC,MAAA,OAAO,KAAA,CAAM,CAAC,CAAA,GAAI,KAAA,CAAM,CAAC,CAAA,GAAI,GAAA;AAAA,IAC/B;AAEA,IAAA,eAAe,UAAA,CACb,MACA,MAAA,EACA;AACA,MAAA,IAAA,CAAK,OAAA,CAAQ,CAAA,iBAAA,EAAoB,MAAA,CAAO,EAAE,CAAA,yBAAA,CAAA,EAA6B;AAAA,QACrE,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,eAAe,cAAA,GAAiB;AAC9B,MAAA,aAAA,CAAc,GAAA,CAAI;AAAA,QAChB,QAAA;AAAA,QACA,IAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,SAAA,CAAU,EAAE,MAAA,EAAQ,IAAA,EAAM,CAAA;AAE1B,MAAA,SAAA,CAAU,IAAI,CAAA,EAAG,EAAE,UAAU,IAAA,EAAM,MAAA,EAAQ,MAAM,CAAA;AACjD,MAAA,YAAA,CAAa,MAAA,CAAO,SAAQ,EAAG;AAAA,QAC7B,QAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,eAAe,UAAA,CAAW,MAAgB,GAAA,EAAY;AACpD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA,EAAG;AAAA,QACpC,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,aAAA,CAAc,GAAA,CAAI;AAAA,QAChB,QAAA;AAAA,QACA,IAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,SAAA,CAAU,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AAE9B,MAAA,SAAA,CAAU,IAAI,CAAA,EAAG,EAAE,UAAU,IAAA,EAAM,MAAA,EAAQ,UAAU,CAAA;AACrD,MAAA,YAAA,CAAa,MAAA,CAAO,SAAQ,EAAG;AAAA,QAC7B,QAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,eAAe,cAAc,IAAA,EAAgB;AAC3C,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAA,KAAA,EAAQ,IAAA,CAAK,EAAE,CAAA,oBAAA,CAAA,EAAwB;AAAA,QACxD,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,aAAA,CAAc,GAAA,CAAI;AAAA,QAChB,QAAA;AAAA,QACA,IAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,SAAA,CAAU,EAAE,MAAA,EAAQ,WAAA,EAAa,CAAA;AAEjC,MAAA,SAAA,CAAU,IAAI,CAAA,EAAG,EAAE,UAAU,IAAA,EAAM,MAAA,EAAQ,aAAa,CAAA;AACxD,MAAA,YAAA,CAAa,MAAA,CAAO,SAAQ,EAAG;AAAA,QAC7B,QAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,OAAO;AAAA,MACL,UAAA;AAAA,MACA,aAAA;AAAA,MACA,cAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,eAAe,SAAA,CAAU,MAAmB,IAAA,EAAgB;AAC1D,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAA,eAAA,EAAkB,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI;AAAA,MAChD,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,MAAA,EAAQ;AAAA,KACT,CAAA;AACD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,YAAA,EAAc,SAAA,IAAa,EAAA;AAEtD,IAAA,MAAM,SAAA,GAAY,QAAQ,MAAA,EAAO;AACjC,IAAA,MAAM,SAAA,GAAY,iBAAiB,UAAA,CAAW;AAAA,MAC5C,QAAA;AAAA,MACA,MAAM,IAAA,CAAK;AAAA,KACZ,CAAA;AAED,IAAA,SAAS,OAAA,GAAU;AACjB,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA;AACtC,MAAA,OAAO,KAAA,CAAM,CAAC,CAAA,GAAI,KAAA,CAAM,CAAC,CAAA,GAAI,GAAA;AAAA,IAC/B;AAEA,IAAA,eAAe,cAAA,GAAiB;AAC9B,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAA,cAAA,EAAiB,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI;AAAA,QAC/C,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,cAAA,CAAe,GAAA,CAAI;AAAA,QACjB,QAAA;AAAA,QACA,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,SAAA,CAAU,EAAE,MAAA,EAAQ,IAAA,EAAM,CAAA;AAE1B,MAAA,SAAA,CAAU,GAAA,CAAI,GAAG,EAAE,QAAA,EAAU,MAAM,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA;AAC5D,MAAA,YAAA,CAAa,MAAA,CAAO,SAAQ,EAAG;AAAA,QAC7B,QAAA;AAAA,QACA,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,eAAe,aAAA,GAAgB;AAC7B,MAAA,cAAA,CAAe,GAAA,CAAI;AAAA,QACjB,QAAA;AAAA,QACA,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,SAAA,CAAU,EAAE,MAAA,EAAQ,WAAA,EAAa,CAAA;AAEjC,MAAA,SAAA,CAAU,GAAA,CAAI,GAAG,EAAE,QAAA,EAAU,MAAM,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ,WAAA,EAAa,CAAA;AACnE,MAAA,YAAA,CAAa,MAAA,CAAO,SAAQ,EAAG;AAAA,QAC7B,QAAA;AAAA,QACA,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,eAAe,UAAA,GAAa;AAC1B,MAAA,cAAA,CAAe,GAAA,CAAI;AAAA,QACjB,QAAA;AAAA,QACA,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,SAAA,CAAU,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AAE9B,MAAA,SAAA,CAAU,GAAA,CAAI,GAAG,EAAE,QAAA,EAAU,MAAM,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ,QAAA,EAAU,CAAA;AAChE,MAAA,YAAA,CAAa,MAAA,CAAO,SAAQ,EAAG;AAAA,QAC7B,QAAA;AAAA,QACA,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,eAAe,SAAA,GAAY;AACzB,MAAA,MAAM,IAAA,CAAK,OAAA;AAAA,QACT,CAAA,cAAA,EAAiB,KAAK,EAAE,CAAA,mCAAA,CAAA;AAAA,QACxB,EAAE,MAAA,EAAQ,IAAA,CAAK,EAAA,EAAI,QAAQ,SAAA;AAAU,OACvC;AACA,MAAA,SAAA,CAAU,EAAE,MAAA,EAAQ,SAAA,EAAW,CAAA;AAE/B,MAAA,SAAA,CAAU,GAAA,CAAI,GAAG,EAAE,QAAA,EAAU,MAAM,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ,SAAA,EAAW,CAAA;AACjE,MAAA,YAAA,CAAa,MAAA,CAAO,SAAQ,EAAG;AAAA,QAC7B,QAAA;AAAA,QACA,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,OAAO;AAAA,MACL,aAAA;AAAA,MACA,UAAA;AAAA,MACA,cAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,SAAA;AAAA,IACA;AAAA,GACF;AACF;;;;"}
+{"version":3,"file":"NunjucksWorkflowRunner.cjs.js","sources":["../../../src/scaffolder/tasks/NunjucksWorkflowRunner.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { InputError, NotAllowedError, stringifyError } from '@backstage/errors';\nimport { ScmIntegrations } from '@backstage/integration';\nimport {\n  TaskRecovery,\n  TaskSpec,\n  TaskSpecV1beta3,\n  TaskStep,\n} from '@backstage/plugin-scaffolder-common';\nimport { JsonArray, JsonObject, JsonValue } from '@backstage/types';\nimport fs from 'fs-extra';\nimport { validate as validateJsonSchema } from 'jsonschema';\nimport path from 'node:path';\nimport nunjucks from 'nunjucks';\nimport * as winston from 'winston';\nimport {\n  SecureTemplater,\n  SecureTemplateRenderer,\n} from '../../lib/templating/SecureTemplater';\nimport { TemplateActionRegistry } from '../actions/TemplateActionRegistry';\nimport {\n  filterConditionalItems,\n  generateExampleOutput,\n  isTruthy,\n} from './helper';\nimport { TaskTrackType, WorkflowResponse, WorkflowRunner } from './types';\n\nimport type {\n  AuditorService,\n  LoggerService,\n  PermissionsService,\n} from '@backstage/backend-plugin-api';\nimport type { MetricsService } from '@backstage/backend-plugin-api/alpha';\nimport { UserEntity } from '@backstage/catalog-model';\nimport { Config } from '@backstage/config';\nimport {\n  AuthorizeResult,\n  PolicyDecision,\n} from '@backstage/plugin-permission-common';\nimport { createConditionAuthorizer } from '@backstage/plugin-permission-node';\nimport { actionExecutePermission } from '@backstage/plugin-scaffolder-common/alpha';\nimport {\n  TaskContext,\n  TaskSecrets,\n  TemplateAction,\n  TemplateFilter,\n  TemplateGlobal,\n} from '@backstage/plugin-scaffolder-node';\nimport {\n  CheckpointContext,\n  CheckpointState,\n} from '@backstage/plugin-scaffolder-node/alpha';\nimport { resolveDefaultEnvironment } from '../../lib/defaultEnvironment';\nimport { createDefaultFilters } from '../../lib/templating/filters/createDefaultFilters';\nimport { scaffolderActionRules } from '../../service/rules';\nimport { createCounterMetric, createHistogramMetric } from '../../util/metrics';\nimport { convertFiltersToRecord } from '../../util/templating';\nimport { BackstageLoggerTransport, WinstonLogger } from './logger';\n\ntype NunjucksWorkflowRunnerOptions = {\n  workingDirectory: string;\n  actionRegistry: TemplateActionRegistry;\n  integrations: ScmIntegrations;\n  logger: LoggerService;\n  auditor?: AuditorService;\n  additionalTemplateFilters?: Record<string, TemplateFilter>;\n  additionalTemplateGlobals?: Record<string, TemplateGlobal>;\n  permissions?: PermissionsService;\n  config?: Config;\n  metrics: MetricsService;\n};\n\ntype TemplateContext = {\n  parameters: JsonObject;\n  environment: JsonObject;\n  EXPERIMENTAL_recovery?: TaskRecovery;\n  steps: {\n    [stepName: string]: { output: { [outputName: string]: JsonValue } };\n  };\n  secrets?: Record<string, string>;\n  user?: {\n    entity?: UserEntity;\n    ref?: string;\n  };\n  each?: JsonValue;\n  context: {\n    task: {\n      id: string;\n    };\n  };\n};\n\nconst isValidTaskSpec = (taskSpec: TaskSpec): taskSpec is TaskSpecV1beta3 => {\n  return taskSpec.apiVersion === 'scaffolder.backstage.io/v1beta3';\n};\n\nconst createStepLogger = ({\n  task,\n  step,\n  rootLogger,\n  redactions,\n}: {\n  task: TaskContext;\n  step: TaskStep;\n  rootLogger: LoggerService;\n  redactions?: Record<string, string>;\n}) => {\n  const taskLogger = WinstonLogger.create({\n    level: process.env.LOG_LEVEL || 'info',\n    format: winston.format.combine(\n      winston.format.colorize(),\n      winston.format.simple(),\n    ),\n    transports: [new BackstageLoggerTransport(rootLogger, task, step.id)],\n  });\n\n  taskLogger.addRedactions(Object.values(redactions ?? {}));\n\n  return { taskLogger };\n};\n\n/**\n * Recursively compares two rendered objects and returns string values from\n * `withSecrets` that differ from their counterpart in `withoutSecrets`.\n * These are values that were influenced by secret interpolation and should\n * be added as log redactions.\n */\nfunction collectSecretRedactions(\n  withSecrets: unknown,\n  withoutSecrets: unknown,\n): string[] {\n  if (typeof withSecrets === 'string') {\n    return withSecrets !== withoutSecrets ? [withSecrets] : [];\n  }\n  if (Array.isArray(withSecrets)) {\n    const other = Array.isArray(withoutSecrets) ? withoutSecrets : [];\n    return withSecrets.flatMap((val, i) =>\n      collectSecretRedactions(val, other[i]),\n    );\n  }\n  if (withSecrets && typeof withSecrets === 'object') {\n    const other =\n      withoutSecrets && typeof withoutSecrets === 'object'\n        ? (withoutSecrets as Record<string, unknown>)\n        : {};\n    return Object.entries(withSecrets as Record<string, unknown>).flatMap(\n      ([key, val]) => collectSecretRedactions(val, other[key]),\n    );\n  }\n  return [];\n}\n\n/**\n * Extracts all string values from a nested object structure.\n * Used as a fallback when the comparison render fails.\n */\nfunction extractStringValues(obj: unknown): string[] {\n  if (typeof obj === 'string') return [obj];\n  if (Array.isArray(obj)) return obj.flatMap(extractStringValues);\n  if (obj && typeof obj === 'object') {\n    return Object.entries(obj).flatMap(([key, val]) => [\n      key,\n      ...extractStringValues(val),\n    ]);\n  }\n  return [];\n}\n\nconst isActionAuthorized = createConditionAuthorizer(\n  Object.values(scaffolderActionRules),\n);\n\nexport class NunjucksWorkflowRunner implements WorkflowRunner {\n  private readonly defaultTemplateFilters: Record<string, TemplateFilter>;\n  private readonly options: NunjucksWorkflowRunnerOptions;\n  private environment: {\n    parameters: JsonObject;\n    secrets?: Record<string, string>;\n  } = { parameters: {}, secrets: {} };\n\n  private readonly tracker: ReturnType<typeof scaffoldingTracker>;\n\n  constructor(options: NunjucksWorkflowRunnerOptions) {\n    this.options = options;\n    this.defaultTemplateFilters = convertFiltersToRecord(\n      createDefaultFilters({\n        integrations: this.options.integrations,\n      }),\n    );\n    this.tracker = scaffoldingTracker(options.metrics);\n  }\n\n  async getEnvironmentConfig(): Promise<{\n    parameters: JsonObject;\n    secrets?: TaskSecrets;\n  }> {\n    if (this.options.config) {\n      const defaultEnvironment = resolveDefaultEnvironment(this.options.config);\n      return {\n        parameters: defaultEnvironment.parameters,\n        secrets: defaultEnvironment.secrets,\n      };\n    }\n\n    return {\n      parameters: {},\n      secrets: {},\n    };\n  }\n\n  private isSingleTemplateString(input: string) {\n    const { parser, nodes } = nunjucks as unknown as {\n      parser: {\n        parse(\n          template: string,\n          ctx: object,\n          options: nunjucks.ConfigureOptions,\n        ): { children: { children?: unknown[] }[] };\n      };\n      nodes: { TemplateData: Function };\n    };\n\n    const parsed = parser.parse(\n      input,\n      {},\n      {\n        autoescape: false,\n        tags: {\n          variableStart: '${{',\n          variableEnd: '}}',\n        },\n      },\n    );\n\n    return (\n      parsed.children.length === 1 &&\n      !(parsed.children[0]?.children?.[0] instanceof nodes.TemplateData)\n    );\n  }\n\n  private render<T>(\n    input: T,\n    context: TemplateContext,\n    renderTemplate: SecureTemplateRenderer,\n  ): T {\n    return JSON.parse(JSON.stringify(input), (_key, value) => {\n      try {\n        if (typeof value === 'string') {\n          try {\n            if (this.isSingleTemplateString(value)) {\n              // Lets convert ${{ parameters.bob }} to ${{ (parameters.bob) | dump }} so we can keep the input type\n              const wrappedDumped = value.replace(\n                /\\${{(.+)}}/g,\n                '${{ ( $1 ) | dump }}',\n              );\n\n              // Run the templating\n              const templated = renderTemplate(wrappedDumped, context);\n\n              // If there's an empty string returned, then it's undefined\n              if (templated === '') {\n                return undefined;\n              }\n\n              // Reparse the dumped string\n              return JSON.parse(templated);\n            }\n          } catch (ex) {\n            this.options.logger.error(\n              `Failed to parse template string: ${value} with error ${ex.message}`,\n            );\n          }\n\n          // Fallback to default behaviour\n          const templated = renderTemplate(value, context);\n\n          if (templated === '') {\n            return undefined;\n          }\n\n          return templated;\n        }\n      } catch {\n        return value;\n      }\n      return value;\n    });\n  }\n\n  async executeStep(\n    task: TaskContext,\n    step: TaskStep,\n    context: TemplateContext,\n    renderTemplate: (template: string, values: unknown) => string,\n    taskTrack: TaskTrackType,\n    workspacePath: string,\n    decision: PolicyDecision,\n  ) {\n    const stepTrack = await this.tracker.stepStart(task, step);\n\n    if (task.cancelSignal.aborted) {\n      throw new Error(\n        `Step ${step.id} (${step.name}) of task ${task.taskId} has been cancelled.`,\n      );\n    }\n\n    try {\n      if (\n        step.if === false ||\n        (typeof step.if === 'string' &&\n          step.each === undefined &&\n          !isTruthy(this.render(step.if, context, renderTemplate)))\n      ) {\n        await stepTrack.skipFalsy();\n        return;\n      }\n      const action: TemplateAction<JsonObject> =\n        await this.options.actionRegistry.get(step.action, {\n          credentials: await task.getInitiatorCredentials(),\n        });\n      const { taskLogger } = createStepLogger({\n        task,\n        step,\n        rootLogger: this.options.logger,\n        redactions: {\n          ...task.secrets,\n          ...this.environment?.secrets,\n        },\n      });\n\n      if (task.isDryRun) {\n        const redactedSecrets = Object.fromEntries(\n          Object.entries(task.secrets ?? {}).map(secret => [secret[0], '***']),\n        );\n\n        const redactedEnvironmentSecrets = Object.fromEntries(\n          Object.entries(this.environment?.secrets ?? {}).map(secret => [\n            secret[0],\n            '***',\n          ]),\n        );\n        const debugInput =\n          (step.input &&\n            this.render(\n              step.input,\n              {\n                ...context,\n                environment: {\n                  parameters: this.environment?.parameters || {},\n                  secrets: redactedEnvironmentSecrets,\n                },\n                secrets: redactedSecrets,\n              },\n              renderTemplate,\n            )) ??\n          {};\n        taskLogger.info(\n          `Running ${\n            action.id\n          } in dry-run mode with inputs (secrets redacted): ${JSON.stringify(\n            debugInput,\n            undefined,\n            2,\n          )}`,\n        );\n        if (!action.supportsDryRun) {\n          await taskTrack.skipDryRun(step, action);\n          const outputSchema = action.schema?.output;\n          if (outputSchema) {\n            context.steps[step.id] = {\n              output: generateExampleOutput(outputSchema) as {\n                [name in string]: JsonValue;\n              },\n            };\n          } else {\n            context.steps[step.id] = { output: {} };\n          }\n          return;\n        }\n      }\n\n      const preIterationContext = {\n        ...context,\n        environment: {\n          parameters: this.environment?.parameters ?? {},\n          secrets: task.isDryRun ? {} : this.environment?.secrets ?? {},\n        },\n        secrets: task.isDryRun ? {} : task.secrets ?? {},\n      };\n\n      const resolvedEach =\n        step.each &&\n        this.render(step.each, preIterationContext, renderTemplate);\n\n      if (step.each && !resolvedEach) {\n        throw new InputError(\n          `Invalid value on action ${action.id}.each parameter, \"${step.each}\" cannot be resolved to a value`,\n        );\n      }\n\n      const iterations = (\n        resolvedEach\n          ? Object.entries(resolvedEach).map(([key, value]) => ({\n              each: { key, value },\n            }))\n          : [{}]\n      ).map(i => {\n        const fullContext = { ...preIterationContext, ...i };\n        // Evaluate if condition once per iteration, only when using 'each'\n        const shouldRun =\n          !('each' in i) ||\n          !step.if ||\n          isTruthy(this.render(step.if, fullContext, renderTemplate));\n\n        return {\n          ...i,\n          shouldRun,\n          // Secrets are only passed when templating the input to actions for security reasons\n          input: step.input\n            ? this.render(step.input, fullContext, renderTemplate)\n            : {},\n        };\n      });\n      for (const iteration of iterations) {\n        if (!iteration.shouldRun) {\n          // No need to check schema or authorization for iterations that will not run\n          continue;\n        }\n\n        const actionId = `${action.id}${\n          iteration.each ? `[${iteration.each.key}]` : ''\n        }`;\n\n        if (action.schema?.input) {\n          const validateResult = validateJsonSchema(\n            iteration.input,\n            action.schema.input,\n          );\n          if (!validateResult.valid) {\n            const errors = validateResult.errors.join(', ');\n            throw new InputError(\n              `Invalid input passed to action ${actionId}, ${errors}`,\n            );\n          }\n        }\n        if (\n          !isActionAuthorized(decision, {\n            action: action.id,\n            input: iteration.input,\n          })\n        ) {\n          throw new NotAllowedError(\n            `Unauthorized action: ${actionId}. The action is not allowed. Input: ${JSON.stringify(\n              iteration.input,\n              null,\n              2,\n            )}`,\n          );\n        }\n      }\n      const tmpDirs = new Array<string>();\n      const stepOutput: { [outputName: string]: JsonValue } = {};\n      const prevTaskState = await task.getTaskState?.();\n\n      for (const iteration of iterations) {\n        if (iteration.each) {\n          if (!iteration.shouldRun) {\n            taskLogger.info(\n              `Skipping step each: ${JSON.stringify(\n                iteration.each,\n                (k, v) => (k ? String(v) : v),\n                0,\n              )}`,\n            );\n            continue;\n          }\n          taskLogger.info(\n            `Running step each: ${JSON.stringify(\n              iteration.each,\n              (k, v) => (k ? String(v) : v),\n              0,\n            )}`,\n          );\n        }\n\n        // Redact any rendered values that were influenced by secrets.\n        // Re-render the input without secrets and diff against the real render\n        // to find values that changed due to secret interpolation.\n        if (step.input) {\n          const hasSecrets =\n            Object.keys(task.secrets ?? {}).length > 0 ||\n            Object.keys(this.environment?.secrets ?? {}).length > 0;\n\n          if (hasSecrets) {\n            try {\n              const contextNoSecrets = {\n                ...preIterationContext,\n                ...(iteration.each ? { each: iteration.each } : {}),\n                secrets: {},\n                environment: {\n                  ...preIterationContext.environment,\n                  secrets: {},\n                },\n              };\n              const inputWithoutSecrets = this.render(\n                step.input,\n                contextNoSecrets,\n                renderTemplate,\n              );\n              taskLogger.addRedactions(\n                collectSecretRedactions(iteration.input, inputWithoutSecrets),\n              );\n            } catch {\n              taskLogger.addRedactions(extractStringValues(iteration.input));\n            }\n          }\n        }\n\n        await action.handler({\n          input: iteration.input,\n          task: {\n            id: await task.getWorkspaceName(),\n          },\n          secrets: task.secrets ?? {},\n          logger: taskLogger,\n          workspacePath,\n          async checkpoint<T extends JsonValue | void>(\n            opts: CheckpointContext<T>,\n          ) {\n            const { key: checkpointKey, fn } = opts;\n            const key = `v1.task.checkpoint.${step.id}.${checkpointKey}`;\n\n            try {\n              let prevValue: T | undefined;\n\n              if (prevTaskState) {\n                const prevState = (\n                  prevTaskState.state?.checkpoints as CheckpointState\n                )?.[key];\n\n                if (prevState && prevState.status === 'success') {\n                  prevValue = prevState.value as T;\n                }\n              }\n\n              const value = prevValue ? prevValue : await fn();\n\n              if (!prevValue) {\n                task.updateCheckpoint?.({\n                  key,\n                  status: 'success',\n                  value: value ?? {},\n                });\n              }\n              return value;\n            } catch (err) {\n              task.updateCheckpoint?.({\n                key,\n                status: 'failed',\n                reason: stringifyError(err),\n              });\n              throw err;\n            } finally {\n              await task.serializeWorkspace?.({ path: workspacePath });\n            }\n          },\n          createTemporaryDirectory: async () => {\n            const tmpDir = await fs.mkdtemp(\n              `${workspacePath}_step-${step.id}-`,\n            );\n            tmpDirs.push(tmpDir);\n            return tmpDir;\n          },\n          output(name: string, value: JsonValue) {\n            if (step.each) {\n              stepOutput[name] = stepOutput[name] || [];\n              (stepOutput[name] as JsonArray).push(value);\n            } else {\n              stepOutput[name] = value;\n            }\n          },\n          templateInfo: task.spec.templateInfo,\n          user: task.spec.user,\n          isDryRun: task.isDryRun,\n          signal: task.cancelSignal,\n          getInitiatorCredentials: () => task.getInitiatorCredentials(),\n          step: {\n            id: step.id,\n            name: step.name,\n          },\n        });\n      }\n\n      // Remove all temporary directories that were created when executing the action\n      for (const tmpDir of tmpDirs) {\n        await fs.remove(tmpDir);\n      }\n\n      context.steps[step.id] = { output: stepOutput };\n\n      if (task.cancelSignal.aborted) {\n        throw new Error(\n          `Step ${step.id} (${step.name}) of task ${task.taskId} has been cancelled.`,\n        );\n      }\n\n      await stepTrack.markSuccessful();\n    } catch (err) {\n      await taskTrack.markFailed(step, err);\n      await stepTrack.markFailed();\n      throw err;\n    } finally {\n      await task.serializeWorkspace?.({ path: workspacePath });\n    }\n  }\n\n  async execute(task: TaskContext): Promise<WorkflowResponse> {\n    if (!isValidTaskSpec(task.spec)) {\n      throw new InputError(\n        'Wrong template version executed with the workflow engine',\n      );\n    }\n    const taskId = await task.getWorkspaceName();\n\n    const workspacePath = path.join(this.options.workingDirectory, taskId);\n\n    const { additionalTemplateFilters, additionalTemplateGlobals } =\n      this.options;\n\n    this.environment = await this.getEnvironmentConfig();\n\n    // Track whether any step has failed, used by status check functions\n    const taskState = { failed: false };\n\n    // Track whether a status check global (always/failure) was invoked during rendering\n    const statusCheckInvoked = { value: false };\n\n    const { render: renderTemplate, dispose } =\n      await SecureTemplater.loadRenderer({\n        templateFilters: {\n          ...this.defaultTemplateFilters,\n          ...additionalTemplateFilters,\n        },\n        templateGlobals: {\n          ...additionalTemplateGlobals,\n          always: () => {\n            statusCheckInvoked.value = true;\n            return true;\n          },\n          failure: () => {\n            statusCheckInvoked.value = true;\n            return taskState.failed;\n          },\n        },\n      });\n\n    try {\n      await task.rehydrateWorkspace?.({ taskId, targetPath: workspacePath });\n\n      const taskTrack = await this.tracker.taskStart(task);\n      await fs.ensureDir(workspacePath);\n\n      const context: TemplateContext = {\n        parameters: task.spec.parameters,\n        environment: {\n          parameters: this.environment?.parameters || {},\n          secrets: {},\n        },\n        steps: {},\n        user: task.spec.user,\n        context: {\n          task: {\n            id: taskId,\n          },\n        },\n      };\n\n      const [decision]: PolicyDecision[] =\n        this.options.permissions && task.spec.steps.length\n          ? await this.options.permissions.authorizeConditional(\n              [{ permission: actionExecutePermission }],\n              { credentials: await task.getInitiatorCredentials() },\n            )\n          : [{ result: AuthorizeResult.ALLOW }];\n\n      let firstError: Error | undefined;\n      const allErrors: Array<{ step: TaskStep; error: Error }> = [];\n\n      for (const step of task.spec.steps) {\n        // If a previous step failed, only run steps whose `if` condition\n        // invokes a status check global (${{ always() }} or ${{ failure() }})\n        if (taskState.failed) {\n          if (typeof step.if !== 'string') {\n            await task.emitLog(\n              `Skipping step ${step.id} because a previous step failed`,\n              { stepId: step.id, status: 'skipped' },\n            );\n            continue;\n          }\n\n          // Render the if condition to detect status check function usage\n          statusCheckInvoked.value = false;\n          this.render(step.if, context, renderTemplate);\n\n          if (!statusCheckInvoked.value) {\n            await task.emitLog(\n              `Skipping step ${step.id} because a previous step failed`,\n              { stepId: step.id, status: 'skipped' },\n            );\n            continue;\n          }\n        }\n\n        try {\n          await this.executeStep(\n            task,\n            step,\n            context,\n            renderTemplate,\n            taskTrack,\n            workspacePath,\n            decision,\n          );\n        } catch (err) {\n          const error = err as Error;\n          allErrors.push({ step, error });\n\n          if (!firstError) {\n            firstError = error;\n          } else {\n            // Log subsequent errors to preserve debugging information\n            this.options.logger.error(\n              `Additional error in step ${step.id} (${step.name}): ${error.message}`,\n              error,\n            );\n            await task.emitLog(\n              `Additional error occurred: ${error.message}\\n${error.stack}`,\n              { stepId: step.id, status: 'failed' },\n            );\n          }\n          taskState.failed = true;\n        }\n      }\n\n      if (firstError) {\n        // If there were multiple errors, add context to the first error\n        if (allErrors.length > 1) {\n          const additionalErrorSummary = allErrors\n            .slice(1)\n            .map(({ step }) => `${step.id} (${step.name})`)\n            .join(', ');\n          this.options.logger.warn(\n            `Task failed with ${allErrors.length} errors. First error from step ${allErrors[0].step.id}. Additional failures in: ${additionalErrorSummary}`,\n          );\n        }\n        throw firstError;\n      }\n\n      const output = this.render(task.spec.output, context, renderTemplate);\n\n      // Filter output links and text items based on their `if` condition\n      if (Array.isArray(output?.links)) {\n        output.links = filterConditionalItems(output.links);\n      }\n      if (Array.isArray(output?.text)) {\n        output.text = filterConditionalItems(output.text);\n      }\n\n      await taskTrack.markSuccessful();\n      await task.cleanWorkspace?.();\n\n      return { output };\n    } finally {\n      try {\n        dispose();\n      } catch {\n        // Ignore disposal errors so they don't mask the original failure.\n      }\n      if (workspacePath) {\n        await fs.remove(workspacePath);\n      }\n    }\n  }\n}\n\nfunction scaffoldingTracker(metrics: MetricsService) {\n  // prom-client metrics are deprecated in favour of OpenTelemetry metrics.\n  const promTaskCount = createCounterMetric({\n    name: 'scaffolder_task_count',\n    help: 'Count of task runs',\n    labelNames: ['template', 'user', 'result'],\n  });\n  const promTaskDuration = createHistogramMetric({\n    name: 'scaffolder_task_duration',\n    help: 'Duration of a task run',\n    labelNames: ['template', 'result'],\n  });\n  const promStepCount = createCounterMetric({\n    name: 'scaffolder_step_count',\n    help: 'Count of step runs',\n    labelNames: ['template', 'step', 'result'],\n  });\n  const promStepDuration = createHistogramMetric({\n    name: 'scaffolder_step_duration',\n    help: 'Duration of a step runs',\n    labelNames: ['template', 'step', 'result'],\n  });\n\n  const taskCount = metrics.createCounter('scaffolder.task.count', {\n    description: 'Total number of scaffolder tasks executed',\n  });\n\n  const taskDuration = metrics.createHistogram('scaffolder.task.duration', {\n    description: 'Time taken to complete a scaffolder task end-to-end',\n    unit: 's',\n  });\n\n  const stepCount = metrics.createCounter('scaffolder.step.count', {\n    description: 'Total number of individual scaffolder action steps executed',\n  });\n\n  const stepDuration = metrics.createHistogram('scaffolder.step.duration', {\n    description: 'Time taken to complete a single scaffolder action step',\n    unit: 's',\n  });\n\n  async function taskStart(task: TaskContext) {\n    await task.emitLog(`Starting up task with ${task.spec.steps.length} steps`);\n    const template = task.spec.templateInfo?.entityRef || '';\n    const user = task.spec.user?.ref || '';\n\n    const startTime = process.hrtime();\n    const taskTimer = promTaskDuration.startTimer({\n      template,\n    });\n\n    function endTime() {\n      const delta = process.hrtime(startTime);\n      return delta[0] + delta[1] / 1e9;\n    }\n\n    async function skipDryRun(\n      step: TaskStep,\n      action: TemplateAction<JsonObject>,\n    ) {\n      task.emitLog(`Skipping because ${action.id} does not support dry-run`, {\n        stepId: step.id,\n        status: 'skipped',\n      });\n    }\n\n    async function markSuccessful() {\n      promTaskCount.inc({\n        template,\n        user,\n        result: 'ok',\n      });\n      taskTimer({ result: 'ok' });\n\n      taskCount.add(1, { template, user, result: 'ok' });\n      taskDuration.record(endTime(), {\n        template,\n        result: 'ok',\n      });\n    }\n\n    async function markFailed(step: TaskStep, err: Error) {\n      await task.emitLog(String(err.stack), {\n        stepId: step.id,\n        status: 'failed',\n      });\n      promTaskCount.inc({\n        template,\n        user,\n        result: 'failed',\n      });\n      taskTimer({ result: 'failed' });\n\n      taskCount.add(1, { template, user, result: 'failed' });\n      taskDuration.record(endTime(), {\n        template,\n        result: 'failed',\n      });\n    }\n\n    async function markCancelled(step: TaskStep) {\n      await task.emitLog(`Step ${step.id} has been cancelled.`, {\n        stepId: step.id,\n        status: 'cancelled',\n      });\n      promTaskCount.inc({\n        template,\n        user,\n        result: 'cancelled',\n      });\n      taskTimer({ result: 'cancelled' });\n\n      taskCount.add(1, { template, user, result: 'cancelled' });\n      taskDuration.record(endTime(), {\n        template,\n        result: 'cancelled',\n      });\n    }\n\n    return {\n      skipDryRun,\n      markCancelled,\n      markSuccessful,\n      markFailed,\n    };\n  }\n\n  async function stepStart(task: TaskContext, step: TaskStep) {\n    await task.emitLog(`Beginning step ${step.name}`, {\n      stepId: step.id,\n      status: 'processing',\n    });\n    const template = task.spec.templateInfo?.entityRef || '';\n\n    const startTime = process.hrtime();\n    const stepTimer = promStepDuration.startTimer({\n      template,\n      step: step.name,\n    });\n\n    function endTime() {\n      const delta = process.hrtime(startTime);\n      return delta[0] + delta[1] / 1e9;\n    }\n\n    async function markSuccessful() {\n      await task.emitLog(`Finished step ${step.name}`, {\n        stepId: step.id,\n        status: 'completed',\n      });\n      promStepCount.inc({\n        template,\n        step: step.name,\n        result: 'ok',\n      });\n      stepTimer({ result: 'ok' });\n\n      stepCount.add(1, { template, step: step.name, result: 'ok' });\n      stepDuration.record(endTime(), {\n        template,\n        step: step.name,\n        result: 'ok',\n      });\n    }\n\n    async function markCancelled() {\n      promStepCount.inc({\n        template,\n        step: step.name,\n        result: 'cancelled',\n      });\n      stepTimer({ result: 'cancelled' });\n\n      stepCount.add(1, { template, step: step.name, result: 'cancelled' });\n      stepDuration.record(endTime(), {\n        template,\n        step: step.name,\n        result: 'cancelled',\n      });\n    }\n\n    async function markFailed() {\n      promStepCount.inc({\n        template,\n        step: step.name,\n        result: 'failed',\n      });\n      stepTimer({ result: 'failed' });\n\n      stepCount.add(1, { template, step: step.name, result: 'failed' });\n      stepDuration.record(endTime(), {\n        template,\n        step: step.name,\n        result: 'failed',\n      });\n    }\n\n    async function skipFalsy() {\n      await task.emitLog(\n        `Skipping step ${step.id} because its if condition was false`,\n        { stepId: step.id, status: 'skipped' },\n      );\n      stepTimer({ result: 'skipped' });\n\n      stepCount.add(1, { template, step: step.name, result: 'skipped' });\n      stepDuration.record(endTime(), {\n        template,\n        step: step.name,\n        result: 'skipped',\n      });\n    }\n\n    return {\n      markCancelled,\n      markFailed,\n      markSuccessful,\n      skipFalsy,\n    };\n  }\n\n  return {\n    taskStart,\n    stepStart,\n  };\n}\n"],"names":["WinstonLogger","winston","BackstageLoggerTransport","createConditionAuthorizer","scaffolderActionRules","convertFiltersToRecord","createDefaultFilters","defaultEnvironment","resolveDefaultEnvironment","nunjucks","templated","isTruthy","generateExampleOutput","InputError","validateJsonSchema","errors","NotAllowedError","stringifyError","fs","path","SecureTemplater","actionExecutePermission","AuthorizeResult","filterConditionalItems","metrics","createCounterMetric","createHistogramMetric"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2GA,MAAM,eAAA,GAAkB,CAAC,QAAA,KAAoD;AAC3E,EAAA,OAAO,SAAS,UAAA,KAAe,iCAAA;AACjC,CAAA;AAEA,MAAM,mBAAmB,CAAC;AAAA,EACxB,IAAA;AAAA,EACA,IAAA;AAAA,EACA,UAAA;AAAA,EACA;AACF,CAAA,KAKM;AACJ,EAAA,MAAM,UAAA,GAAaA,qBAAc,MAAA,CAAO;AAAA,IACtC,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,SAAA,IAAa,MAAA;AAAA,IAChC,MAAA,EAAQC,mBAAQ,MAAA,CAAO,OAAA;AAAA,MACrBA,kBAAA,CAAQ,OAAO,QAAA,EAAS;AAAA,MACxBA,kBAAA,CAAQ,OAAO,MAAA;AAAO,KACxB;AAAA,IACA,UAAA,EAAY,CAAC,IAAIC,+BAAA,CAAyB,YAAY,IAAA,EAAM,IAAA,CAAK,EAAE,CAAC;AAAA,GACrE,CAAA;AAED,EAAA,UAAA,CAAW,cAAc,MAAA,CAAO,MAAA,CAAO,UAAA,IAAc,EAAE,CAAC,CAAA;AAExD,EAAA,OAAO,EAAE,UAAA,EAAW;AACtB,CAAA;AAQA,SAAS,uBAAA,CACP,aACA,cAAA,EACU;AACV,EAAA,IAAI,OAAO,gBAAgB,QAAA,EAAU;AACnC,IAAA,OAAO,WAAA,KAAgB,cAAA,GAAiB,CAAC,WAAW,IAAI,EAAC;AAAA,EAC3D;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC9B,IAAA,MAAM,QAAQ,KAAA,CAAM,OAAA,CAAQ,cAAc,CAAA,GAAI,iBAAiB,EAAC;AAChE,IAAA,OAAO,WAAA,CAAY,OAAA;AAAA,MAAQ,CAAC,GAAA,EAAK,CAAA,KAC/B,wBAAwB,GAAA,EAAK,KAAA,CAAM,CAAC,CAAC;AAAA,KACvC;AAAA,EACF;AACA,EAAA,IAAI,WAAA,IAAe,OAAO,WAAA,KAAgB,QAAA,EAAU;AAClD,IAAA,MAAM,QACJ,cAAA,IAAkB,OAAO,cAAA,KAAmB,QAAA,GACvC,iBACD,EAAC;AACP,IAAA,OAAO,MAAA,CAAO,OAAA,CAAQ,WAAsC,CAAA,CAAE,OAAA;AAAA,MAC5D,CAAC,CAAC,GAAA,EAAK,GAAG,MAAM,uBAAA,CAAwB,GAAA,EAAK,KAAA,CAAM,GAAG,CAAC;AAAA,KACzD;AAAA,EACF;AACA,EAAA,OAAO,EAAC;AACV;AAMA,SAAS,oBAAoB,GAAA,EAAwB;AACnD,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,CAAC,GAAG,CAAA;AACxC,EAAA,IAAI,MAAM,OAAA,CAAQ,GAAG,GAAG,OAAO,GAAA,CAAI,QAAQ,mBAAmB,CAAA;AAC9D,EAAA,IAAI,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,EAAU;AAClC,IAAA,OAAO,MAAA,CAAO,QAAQ,GAAG,CAAA,CAAE,QAAQ,CAAC,CAAC,GAAA,EAAK,GAAG,CAAA,KAAM;AAAA,MACjD,GAAA;AAAA,MACA,GAAG,oBAAoB,GAAG;AAAA,KAC3B,CAAA;AAAA,EACH;AACA,EAAA,OAAO,EAAC;AACV;AAEA,MAAM,kBAAA,GAAqBC,8CAAA;AAAA,EACzB,MAAA,CAAO,OAAOC,2BAAqB;AACrC,CAAA;AAEO,MAAM,sBAAA,CAAiD;AAAA,EAC3C,sBAAA;AAAA,EACA,OAAA;AAAA,EACT,cAGJ,EAAE,UAAA,EAAY,EAAC,EAAG,OAAA,EAAS,EAAC,EAAE;AAAA,EAEjB,OAAA;AAAA,EAEjB,YAAY,OAAA,EAAwC;AAClD,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,sBAAA,GAAyBC,iCAAA;AAAA,MAC5BC,yCAAA,CAAqB;AAAA,QACnB,YAAA,EAAc,KAAK,OAAA,CAAQ;AAAA,OAC5B;AAAA,KACH;AACA,IAAA,IAAA,CAAK,OAAA,GAAU,kBAAA,CAAmB,OAAA,CAAQ,OAAO,CAAA;AAAA,EACnD;AAAA,EAEA,MAAM,oBAAA,GAGH;AACD,IAAA,IAAI,IAAA,CAAK,QAAQ,MAAA,EAAQ;AACvB,MAAA,MAAMC,oBAAA,GAAqBC,4CAAA,CAA0B,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAA;AACxE,MAAA,OAAO;AAAA,QACL,YAAYD,oBAAA,CAAmB,UAAA;AAAA,QAC/B,SAASA,oBAAA,CAAmB;AAAA,OAC9B;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,YAAY,EAAC;AAAA,MACb,SAAS;AAAC,KACZ;AAAA,EACF;AAAA,EAEQ,uBAAuB,KAAA,EAAe;AAC5C,IAAA,MAAM,EAAE,MAAA,EAAQ,KAAA,EAAM,GAAIE,yBAAA;AAW1B,IAAA,MAAM,SAAS,MAAA,CAAO,KAAA;AAAA,MACpB,KAAA;AAAA,MACA,EAAC;AAAA,MACD;AAAA,QACE,UAAA,EAAY,KAAA;AAAA,QACZ,IAAA,EAAM;AAAA,UACJ,aAAA,EAAe,KAAA;AAAA,UACf,WAAA,EAAa;AAAA;AACf;AACF,KACF;AAEA,IAAA,OACE,MAAA,CAAO,QAAA,CAAS,MAAA,KAAW,CAAA,IAC3B,EAAE,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,EAAG,QAAA,GAAW,CAAC,CAAA,YAAa,KAAA,CAAM,YAAA,CAAA;AAAA,EAEzD;AAAA,EAEQ,MAAA,CACN,KAAA,EACA,OAAA,EACA,cAAA,EACG;AACH,IAAA,OAAO,IAAA,CAAK,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,EAAG,CAAC,MAAM,KAAA,KAAU;AACxD,MAAA,IAAI;AACF,QAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,UAAA,IAAI;AACF,YAAA,IAAI,IAAA,CAAK,sBAAA,CAAuB,KAAK,CAAA,EAAG;AAEtC,cAAA,MAAM,gBAAgB,KAAA,CAAM,OAAA;AAAA,gBAC1B,aAAA;AAAA,gBACA;AAAA,eACF;AAGA,cAAA,MAAMC,UAAAA,GAAY,cAAA,CAAe,aAAA,EAAe,OAAO,CAAA;AAGvD,cAAA,IAAIA,eAAc,EAAA,EAAI;AACpB,gBAAA,OAAO,KAAA,CAAA;AAAA,cACT;AAGA,cAAA,OAAO,IAAA,CAAK,MAAMA,UAAS,CAAA;AAAA,YAC7B;AAAA,UACF,SAAS,EAAA,EAAI;AACX,YAAA,IAAA,CAAK,QAAQ,MAAA,CAAO,KAAA;AAAA,cAClB,CAAA,iCAAA,EAAoC,KAAK,CAAA,YAAA,EAAe,EAAA,CAAG,OAAO,CAAA;AAAA,aACpE;AAAA,UACF;AAGA,UAAA,MAAM,SAAA,GAAY,cAAA,CAAe,KAAA,EAAO,OAAO,CAAA;AAE/C,UAAA,IAAI,cAAc,EAAA,EAAI;AACpB,YAAA,OAAO,KAAA,CAAA;AAAA,UACT;AAEA,UAAA,OAAO,SAAA;AAAA,QACT;AAAA,MACF,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,OAAO,KAAA;AAAA,IACT,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,YACJ,IAAA,EACA,IAAA,EACA,SACA,cAAA,EACA,SAAA,EACA,eACA,QAAA,EACA;AACA,IAAA,MAAM,YAAY,MAAM,IAAA,CAAK,OAAA,CAAQ,SAAA,CAAU,MAAM,IAAI,CAAA;AAEzD,IAAA,IAAI,IAAA,CAAK,aAAa,OAAA,EAAS;AAC7B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,KAAA,EAAQ,KAAK,EAAE,CAAA,EAAA,EAAK,KAAK,IAAI,CAAA,UAAA,EAAa,KAAK,MAAM,CAAA,oBAAA;AAAA,OACvD;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,IACE,KAAK,EAAA,KAAO,KAAA,IACX,OAAO,IAAA,CAAK,EAAA,KAAO,YAClB,IAAA,CAAK,IAAA,KAAS,UACd,CAACC,eAAA,CAAS,KAAK,MAAA,CAAO,IAAA,CAAK,IAAI,OAAA,EAAS,cAAc,CAAC,CAAA,EACzD;AACA,QAAA,MAAM,UAAU,SAAA,EAAU;AAC1B,QAAA;AAAA,MACF;AACA,MAAA,MAAM,SACJ,MAAM,IAAA,CAAK,QAAQ,cAAA,CAAe,GAAA,CAAI,KAAK,MAAA,EAAQ;AAAA,QACjD,WAAA,EAAa,MAAM,IAAA,CAAK,uBAAA;AAAwB,OACjD,CAAA;AACH,MAAA,MAAM,EAAE,UAAA,EAAW,GAAI,gBAAA,CAAiB;AAAA,QACtC,IAAA;AAAA,QACA,IAAA;AAAA,QACA,UAAA,EAAY,KAAK,OAAA,CAAQ,MAAA;AAAA,QACzB,UAAA,EAAY;AAAA,UACV,GAAG,IAAA,CAAK,OAAA;AAAA,UACR,GAAG,KAAK,WAAA,EAAa;AAAA;AACvB,OACD,CAAA;AAED,MAAA,IAAI,KAAK,QAAA,EAAU;AACjB,QAAA,MAAM,kBAAkB,MAAA,CAAO,WAAA;AAAA,UAC7B,MAAA,CAAO,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,EAAE,CAAA,CAAE,GAAA,CAAI,CAAA,MAAA,KAAU,CAAC,MAAA,CAAO,CAAC,CAAA,EAAG,KAAK,CAAC;AAAA,SACrE;AAEA,QAAA,MAAM,6BAA6B,MAAA,CAAO,WAAA;AAAA,UACxC,MAAA,CAAO,QAAQ,IAAA,CAAK,WAAA,EAAa,WAAW,EAAE,CAAA,CAAE,GAAA,CAAI,CAAA,MAAA,KAAU;AAAA,YAC5D,OAAO,CAAC,CAAA;AAAA,YACR;AAAA,WACD;AAAA,SACH;AACA,QAAA,MAAM,UAAA,GAAA,CACH,IAAA,CAAK,KAAA,IACJ,IAAA,CAAK,MAAA;AAAA,UACH,IAAA,CAAK,KAAA;AAAA,UACL;AAAA,YACE,GAAG,OAAA;AAAA,YACH,WAAA,EAAa;AAAA,cACX,UAAA,EAAY,IAAA,CAAK,WAAA,EAAa,UAAA,IAAc,EAAC;AAAA,cAC7C,OAAA,EAAS;AAAA,aACX;AAAA,YACA,OAAA,EAAS;AAAA,WACX;AAAA,UACA;AAAA,cAEJ,EAAC;AACH,QAAA,UAAA,CAAW,IAAA;AAAA,UACT,CAAA,QAAA,EACE,MAAA,CAAO,EACT,CAAA,iDAAA,EAAoD,IAAA,CAAK,SAAA;AAAA,YACvD,UAAA;AAAA,YACA,KAAA,CAAA;AAAA,YACA;AAAA,WACD,CAAA;AAAA,SACH;AACA,QAAA,IAAI,CAAC,OAAO,cAAA,EAAgB;AAC1B,UAAA,MAAM,SAAA,CAAU,UAAA,CAAW,IAAA,EAAM,MAAM,CAAA;AACvC,UAAA,MAAM,YAAA,GAAe,OAAO,MAAA,EAAQ,MAAA;AACpC,UAAA,IAAI,YAAA,EAAc;AAChB,YAAA,OAAA,CAAQ,KAAA,CAAM,IAAA,CAAK,EAAE,CAAA,GAAI;AAAA,cACvB,MAAA,EAAQC,6BAAsB,YAAY;AAAA,aAG5C;AAAA,UACF,CAAA,MAAO;AACL,YAAA,OAAA,CAAQ,MAAM,IAAA,CAAK,EAAE,IAAI,EAAE,MAAA,EAAQ,EAAC,EAAE;AAAA,UACxC;AACA,UAAA;AAAA,QACF;AAAA,MACF;AAEA,MAAA,MAAM,mBAAA,GAAsB;AAAA,QAC1B,GAAG,OAAA;AAAA,QACH,WAAA,EAAa;AAAA,UACX,UAAA,EAAY,IAAA,CAAK,WAAA,EAAa,UAAA,IAAc,EAAC;AAAA,UAC7C,OAAA,EAAS,KAAK,QAAA,GAAW,KAAK,IAAA,CAAK,WAAA,EAAa,WAAW;AAAC,SAC9D;AAAA,QACA,SAAS,IAAA,CAAK,QAAA,GAAW,EAAC,GAAI,IAAA,CAAK,WAAW;AAAC,OACjD;AAEA,MAAA,MAAM,YAAA,GACJ,KAAK,IAAA,IACL,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA,EAAM,qBAAqB,cAAc,CAAA;AAE5D,MAAA,IAAI,IAAA,CAAK,IAAA,IAAQ,CAAC,YAAA,EAAc;AAC9B,QAAA,MAAM,IAAIC,iBAAA;AAAA,UACR,CAAA,wBAAA,EAA2B,MAAA,CAAO,EAAE,CAAA,kBAAA,EAAqB,KAAK,IAAI,CAAA,+BAAA;AAAA,SACpE;AAAA,MACF;AAEA,MAAA,MAAM,UAAA,GAAA,CACJ,YAAA,GACI,MAAA,CAAO,OAAA,CAAQ,YAAY,CAAA,CAAE,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,MAAO;AAAA,QAClD,IAAA,EAAM,EAAE,GAAA,EAAK,KAAA;AAAM,QACnB,CAAA,GACF,CAAC,EAAE,CAAA,EACP,IAAI,CAAA,CAAA,KAAK;AACT,QAAA,MAAM,WAAA,GAAc,EAAE,GAAG,mBAAA,EAAqB,GAAG,CAAA,EAAE;AAEnD,QAAA,MAAM,SAAA,GACJ,EAAE,MAAA,IAAU,CAAA,CAAA,IACZ,CAAC,IAAA,CAAK,EAAA,IACNF,eAAA,CAAS,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,EAAA,EAAI,WAAA,EAAa,cAAc,CAAC,CAAA;AAE5D,QAAA,OAAO;AAAA,UACL,GAAG,CAAA;AAAA,UACH,SAAA;AAAA;AAAA,UAEA,KAAA,EAAO,IAAA,CAAK,KAAA,GACR,IAAA,CAAK,MAAA,CAAO,KAAK,KAAA,EAAO,WAAA,EAAa,cAAc,CAAA,GACnD;AAAC,SACP;AAAA,MACF,CAAC,CAAA;AACD,MAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,QAAA,IAAI,CAAC,UAAU,SAAA,EAAW;AAExB,UAAA;AAAA,QACF;AAEA,QAAA,MAAM,QAAA,GAAW,CAAA,EAAG,MAAA,CAAO,EAAE,CAAA,EAC3B,SAAA,CAAU,IAAA,GAAO,CAAA,CAAA,EAAI,SAAA,CAAU,IAAA,CAAK,GAAG,CAAA,CAAA,CAAA,GAAM,EAC/C,CAAA,CAAA;AAEA,QAAA,IAAI,MAAA,CAAO,QAAQ,KAAA,EAAO;AACxB,UAAA,MAAM,cAAA,GAAiBG,mBAAA;AAAA,YACrB,SAAA,CAAU,KAAA;AAAA,YACV,OAAO,MAAA,CAAO;AAAA,WAChB;AACA,UAAA,IAAI,CAAC,eAAe,KAAA,EAAO;AACzB,YAAA,MAAMC,QAAA,GAAS,cAAA,CAAe,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AAC9C,YAAA,MAAM,IAAIF,iBAAA;AAAA,cACR,CAAA,+BAAA,EAAkC,QAAQ,CAAA,EAAA,EAAKE,QAAM,CAAA;AAAA,aACvD;AAAA,UACF;AAAA,QACF;AACA,QAAA,IACE,CAAC,mBAAmB,QAAA,EAAU;AAAA,UAC5B,QAAQ,MAAA,CAAO,EAAA;AAAA,UACf,OAAO,SAAA,CAAU;AAAA,SAClB,CAAA,EACD;AACA,UAAA,MAAM,IAAIC,sBAAA;AAAA,YACR,CAAA,qBAAA,EAAwB,QAAQ,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAA;AAAA,cAC1E,SAAA,CAAU,KAAA;AAAA,cACV,IAAA;AAAA,cACA;AAAA,aACD,CAAA;AAAA,WACH;AAAA,QACF;AAAA,MACF;AACA,MAAA,MAAM,OAAA,GAAU,IAAI,KAAA,EAAc;AAClC,MAAA,MAAM,aAAkD,EAAC;AACzD,MAAA,MAAM,aAAA,GAAgB,MAAM,IAAA,CAAK,YAAA,IAAe;AAEhD,MAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,QAAA,IAAI,UAAU,IAAA,EAAM;AAClB,UAAA,IAAI,CAAC,UAAU,SAAA,EAAW;AACxB,YAAA,UAAA,CAAW,IAAA;AAAA,cACT,uBAAuB,IAAA,CAAK,SAAA;AAAA,gBAC1B,SAAA,CAAU,IAAA;AAAA,gBACV,CAAC,CAAA,EAAG,CAAA,KAAO,CAAA,GAAI,MAAA,CAAO,CAAC,CAAA,GAAI,CAAA;AAAA,gBAC3B;AAAA,eACD,CAAA;AAAA,aACH;AACA,YAAA;AAAA,UACF;AACA,UAAA,UAAA,CAAW,IAAA;AAAA,YACT,sBAAsB,IAAA,CAAK,SAAA;AAAA,cACzB,SAAA,CAAU,IAAA;AAAA,cACV,CAAC,CAAA,EAAG,CAAA,KAAO,CAAA,GAAI,MAAA,CAAO,CAAC,CAAA,GAAI,CAAA;AAAA,cAC3B;AAAA,aACD,CAAA;AAAA,WACH;AAAA,QACF;AAKA,QAAA,IAAI,KAAK,KAAA,EAAO;AACd,UAAA,MAAM,aACJ,MAAA,CAAO,IAAA,CAAK,KAAK,OAAA,IAAW,EAAE,CAAA,CAAE,MAAA,GAAS,CAAA,IACzC,MAAA,CAAO,KAAK,IAAA,CAAK,WAAA,EAAa,WAAW,EAAE,EAAE,MAAA,GAAS,CAAA;AAExD,UAAA,IAAI,UAAA,EAAY;AACd,YAAA,IAAI;AACF,cAAA,MAAM,gBAAA,GAAmB;AAAA,gBACvB,GAAG,mBAAA;AAAA,gBACH,GAAI,UAAU,IAAA,GAAO,EAAE,MAAM,SAAA,CAAU,IAAA,KAAS,EAAC;AAAA,gBACjD,SAAS,EAAC;AAAA,gBACV,WAAA,EAAa;AAAA,kBACX,GAAG,mBAAA,CAAoB,WAAA;AAAA,kBACvB,SAAS;AAAC;AACZ,eACF;AACA,cAAA,MAAM,sBAAsB,IAAA,CAAK,MAAA;AAAA,gBAC/B,IAAA,CAAK,KAAA;AAAA,gBACL,gBAAA;AAAA,gBACA;AAAA,eACF;AACA,cAAA,UAAA,CAAW,aAAA;AAAA,gBACT,uBAAA,CAAwB,SAAA,CAAU,KAAA,EAAO,mBAAmB;AAAA,eAC9D;AAAA,YACF,CAAA,CAAA,MAAQ;AACN,cAAA,UAAA,CAAW,aAAA,CAAc,mBAAA,CAAoB,SAAA,CAAU,KAAK,CAAC,CAAA;AAAA,YAC/D;AAAA,UACF;AAAA,QACF;AAEA,QAAA,MAAM,OAAO,OAAA,CAAQ;AAAA,UACnB,OAAO,SAAA,CAAU,KAAA;AAAA,UACjB,IAAA,EAAM;AAAA,YACJ,EAAA,EAAI,MAAM,IAAA,CAAK,gBAAA;AAAiB,WAClC;AAAA,UACA,OAAA,EAAS,IAAA,CAAK,OAAA,IAAW,EAAC;AAAA,UAC1B,MAAA,EAAQ,UAAA;AAAA,UACR,aAAA;AAAA,UACA,MAAM,WACJ,IAAA,EACA;AACA,YAAA,MAAM,EAAE,GAAA,EAAK,aAAA,EAAe,EAAA,EAAG,GAAI,IAAA;AACnC,YAAA,MAAM,GAAA,GAAM,CAAA,mBAAA,EAAsB,IAAA,CAAK,EAAE,IAAI,aAAa,CAAA,CAAA;AAE1D,YAAA,IAAI;AACF,cAAA,IAAI,SAAA;AAEJ,cAAA,IAAI,aAAA,EAAe;AACjB,gBAAA,MAAM,SAAA,GACJ,aAAA,CAAc,KAAA,EAAO,WAAA,GACnB,GAAG,CAAA;AAEP,gBAAA,IAAI,SAAA,IAAa,SAAA,CAAU,MAAA,KAAW,SAAA,EAAW;AAC/C,kBAAA,SAAA,GAAY,SAAA,CAAU,KAAA;AAAA,gBACxB;AAAA,cACF;AAEA,cAAA,MAAM,KAAA,GAAQ,SAAA,GAAY,SAAA,GAAY,MAAM,EAAA,EAAG;AAE/C,cAAA,IAAI,CAAC,SAAA,EAAW;AACd,gBAAA,IAAA,CAAK,gBAAA,GAAmB;AAAA,kBACtB,GAAA;AAAA,kBACA,MAAA,EAAQ,SAAA;AAAA,kBACR,KAAA,EAAO,SAAS;AAAC,iBAClB,CAAA;AAAA,cACH;AACA,cAAA,OAAO,KAAA;AAAA,YACT,SAAS,GAAA,EAAK;AACZ,cAAA,IAAA,CAAK,gBAAA,GAAmB;AAAA,gBACtB,GAAA;AAAA,gBACA,MAAA,EAAQ,QAAA;AAAA,gBACR,MAAA,EAAQC,sBAAe,GAAG;AAAA,eAC3B,CAAA;AACD,cAAA,MAAM,GAAA;AAAA,YACR,CAAA,SAAE;AACA,cAAA,MAAM,IAAA,CAAK,kBAAA,GAAqB,EAAE,IAAA,EAAM,eAAe,CAAA;AAAA,YACzD;AAAA,UACF,CAAA;AAAA,UACA,0BAA0B,YAAY;AACpC,YAAA,MAAM,MAAA,GAAS,MAAMC,mBAAA,CAAG,OAAA;AAAA,cACtB,CAAA,EAAG,aAAa,CAAA,MAAA,EAAS,IAAA,CAAK,EAAE,CAAA,CAAA;AAAA,aAClC;AACA,YAAA,OAAA,CAAQ,KAAK,MAAM,CAAA;AACnB,YAAA,OAAO,MAAA;AAAA,UACT,CAAA;AAAA,UACA,MAAA,CAAO,MAAc,KAAA,EAAkB;AACrC,YAAA,IAAI,KAAK,IAAA,EAAM;AACb,cAAA,UAAA,CAAW,IAAI,CAAA,GAAI,UAAA,CAAW,IAAI,KAAK,EAAC;AACxC,cAAC,UAAA,CAAW,IAAI,CAAA,CAAgB,IAAA,CAAK,KAAK,CAAA;AAAA,YAC5C,CAAA,MAAO;AACL,cAAA,UAAA,CAAW,IAAI,CAAA,GAAI,KAAA;AAAA,YACrB;AAAA,UACF,CAAA;AAAA,UACA,YAAA,EAAc,KAAK,IAAA,CAAK,YAAA;AAAA,UACxB,IAAA,EAAM,KAAK,IAAA,CAAK,IAAA;AAAA,UAChB,UAAU,IAAA,CAAK,QAAA;AAAA,UACf,QAAQ,IAAA,CAAK,YAAA;AAAA,UACb,uBAAA,EAAyB,MAAM,IAAA,CAAK,uBAAA,EAAwB;AAAA,UAC5D,IAAA,EAAM;AAAA,YACJ,IAAI,IAAA,CAAK,EAAA;AAAA,YACT,MAAM,IAAA,CAAK;AAAA;AACb,SACD,CAAA;AAAA,MACH;AAGA,MAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,QAAA,MAAMA,mBAAA,CAAG,OAAO,MAAM,CAAA;AAAA,MACxB;AAEA,MAAA,OAAA,CAAQ,MAAM,IAAA,CAAK,EAAE,CAAA,GAAI,EAAE,QAAQ,UAAA,EAAW;AAE9C,MAAA,IAAI,IAAA,CAAK,aAAa,OAAA,EAAS;AAC7B,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,KAAA,EAAQ,KAAK,EAAE,CAAA,EAAA,EAAK,KAAK,IAAI,CAAA,UAAA,EAAa,KAAK,MAAM,CAAA,oBAAA;AAAA,SACvD;AAAA,MACF;AAEA,MAAA,MAAM,UAAU,cAAA,EAAe;AAAA,IACjC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,SAAA,CAAU,UAAA,CAAW,IAAA,EAAM,GAAG,CAAA;AACpC,MAAA,MAAM,UAAU,UAAA,EAAW;AAC3B,MAAA,MAAM,GAAA;AAAA,IACR,CAAA,SAAE;AACA,MAAA,MAAM,IAAA,CAAK,kBAAA,GAAqB,EAAE,IAAA,EAAM,eAAe,CAAA;AAAA,IACzD;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,IAAA,EAA8C;AAC1D,IAAA,IAAI,CAAC,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAA,EAAG;AAC/B,MAAA,MAAM,IAAIL,iBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,gBAAA,EAAiB;AAE3C,IAAA,MAAM,gBAAgBM,qBAAA,CAAK,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,kBAAkB,MAAM,CAAA;AAErE,IAAA,MAAM,EAAE,yBAAA,EAA2B,yBAAA,EAA0B,GAC3D,IAAA,CAAK,OAAA;AAEP,IAAA,IAAA,CAAK,WAAA,GAAc,MAAM,IAAA,CAAK,oBAAA,EAAqB;AAGnD,IAAA,MAAM,SAAA,GAAY,EAAE,MAAA,EAAQ,KAAA,EAAM;AAGlC,IAAA,MAAM,kBAAA,GAAqB,EAAE,KAAA,EAAO,KAAA,EAAM;AAE1C,IAAA,MAAM,EAAE,MAAA,EAAQ,cAAA,EAAgB,SAAQ,GACtC,MAAMC,gCAAgB,YAAA,CAAa;AAAA,MACjC,eAAA,EAAiB;AAAA,QACf,GAAG,IAAA,CAAK,sBAAA;AAAA,QACR,GAAG;AAAA,OACL;AAAA,MACA,eAAA,EAAiB;AAAA,QACf,GAAG,yBAAA;AAAA,QACH,QAAQ,MAAM;AACZ,UAAA,kBAAA,CAAmB,KAAA,GAAQ,IAAA;AAC3B,UAAA,OAAO,IAAA;AAAA,QACT,CAAA;AAAA,QACA,SAAS,MAAM;AACb,UAAA,kBAAA,CAAmB,KAAA,GAAQ,IAAA;AAC3B,UAAA,OAAO,SAAA,CAAU,MAAA;AAAA,QACnB;AAAA;AACF,KACD,CAAA;AAEH,IAAA,IAAI;AACF,MAAA,MAAM,KAAK,kBAAA,GAAqB,EAAE,MAAA,EAAQ,UAAA,EAAY,eAAe,CAAA;AAErE,MAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,OAAA,CAAQ,UAAU,IAAI,CAAA;AACnD,MAAA,MAAMF,mBAAA,CAAG,UAAU,aAAa,CAAA;AAEhC,MAAA,MAAM,OAAA,GAA2B;AAAA,QAC/B,UAAA,EAAY,KAAK,IAAA,CAAK,UAAA;AAAA,QACtB,WAAA,EAAa;AAAA,UACX,UAAA,EAAY,IAAA,CAAK,WAAA,EAAa,UAAA,IAAc,EAAC;AAAA,UAC7C,SAAS;AAAC,SACZ;AAAA,QACA,OAAO,EAAC;AAAA,QACR,IAAA,EAAM,KAAK,IAAA,CAAK,IAAA;AAAA,QAChB,OAAA,EAAS;AAAA,UACP,IAAA,EAAM;AAAA,YACJ,EAAA,EAAI;AAAA;AACN;AACF,OACF;AAEA,MAAA,MAAM,CAAC,QAAQ,CAAA,GACb,IAAA,CAAK,OAAA,CAAQ,WAAA,IAAe,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,MAAA,GACxC,MAAM,IAAA,CAAK,QAAQ,WAAA,CAAY,oBAAA;AAAA,QAC7B,CAAC,EAAE,UAAA,EAAYG,6BAAA,EAAyB,CAAA;AAAA,QACxC,EAAE,WAAA,EAAa,MAAM,IAAA,CAAK,yBAAwB;AAAE,UAEtD,CAAC,EAAE,MAAA,EAAQC,sCAAA,CAAgB,OAAO,CAAA;AAExC,MAAA,IAAI,UAAA;AACJ,MAAA,MAAM,YAAqD,EAAC;AAE5D,MAAA,KAAA,MAAW,IAAA,IAAQ,IAAA,CAAK,IAAA,CAAK,KAAA,EAAO;AAGlC,QAAA,IAAI,UAAU,MAAA,EAAQ;AACpB,UAAA,IAAI,OAAO,IAAA,CAAK,EAAA,KAAO,QAAA,EAAU;AAC/B,YAAA,MAAM,IAAA,CAAK,OAAA;AAAA,cACT,CAAA,cAAA,EAAiB,KAAK,EAAE,CAAA,+BAAA,CAAA;AAAA,cACxB,EAAE,MAAA,EAAQ,IAAA,CAAK,EAAA,EAAI,QAAQ,SAAA;AAAU,aACvC;AACA,YAAA;AAAA,UACF;AAGA,UAAA,kBAAA,CAAmB,KAAA,GAAQ,KAAA;AAC3B,UAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,EAAA,EAAI,OAAA,EAAS,cAAc,CAAA;AAE5C,UAAA,IAAI,CAAC,mBAAmB,KAAA,EAAO;AAC7B,YAAA,MAAM,IAAA,CAAK,OAAA;AAAA,cACT,CAAA,cAAA,EAAiB,KAAK,EAAE,CAAA,+BAAA,CAAA;AAAA,cACxB,EAAE,MAAA,EAAQ,IAAA,CAAK,EAAA,EAAI,QAAQ,SAAA;AAAU,aACvC;AACA,YAAA;AAAA,UACF;AAAA,QACF;AAEA,QAAA,IAAI;AACF,UAAA,MAAM,IAAA,CAAK,WAAA;AAAA,YACT,IAAA;AAAA,YACA,IAAA;AAAA,YACA,OAAA;AAAA,YACA,cAAA;AAAA,YACA,SAAA;AAAA,YACA,aAAA;AAAA,YACA;AAAA,WACF;AAAA,QACF,SAAS,GAAA,EAAK;AACZ,UAAA,MAAM,KAAA,GAAQ,GAAA;AACd,UAAA,SAAA,CAAU,IAAA,CAAK,EAAE,IAAA,EAAM,KAAA,EAAO,CAAA;AAE9B,UAAA,IAAI,CAAC,UAAA,EAAY;AACf,YAAA,UAAA,GAAa,KAAA;AAAA,UACf,CAAA,MAAO;AAEL,YAAA,IAAA,CAAK,QAAQ,MAAA,CAAO,KAAA;AAAA,cAClB,CAAA,yBAAA,EAA4B,KAAK,EAAE,CAAA,EAAA,EAAK,KAAK,IAAI,CAAA,GAAA,EAAM,MAAM,OAAO,CAAA,CAAA;AAAA,cACpE;AAAA,aACF;AACA,YAAA,MAAM,IAAA,CAAK,OAAA;AAAA,cACT,CAAA,2BAAA,EAA8B,MAAM,OAAO;AAAA,EAAK,MAAM,KAAK,CAAA,CAAA;AAAA,cAC3D,EAAE,MAAA,EAAQ,IAAA,CAAK,EAAA,EAAI,QAAQ,QAAA;AAAS,aACtC;AAAA,UACF;AACA,UAAA,SAAA,CAAU,MAAA,GAAS,IAAA;AAAA,QACrB;AAAA,MACF;AAEA,MAAA,IAAI,UAAA,EAAY;AAEd,QAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACxB,UAAA,MAAM,yBAAyB,SAAA,CAC5B,KAAA,CAAM,CAAC,CAAA,CACP,GAAA,CAAI,CAAC,EAAE,IAAA,OAAW,CAAA,EAAG,IAAA,CAAK,EAAE,CAAA,EAAA,EAAK,IAAA,CAAK,IAAI,CAAA,CAAA,CAAG,CAAA,CAC7C,KAAK,IAAI,CAAA;AACZ,UAAA,IAAA,CAAK,QAAQ,MAAA,CAAO,IAAA;AAAA,YAClB,CAAA,iBAAA,EAAoB,SAAA,CAAU,MAAM,CAAA,+BAAA,EAAkC,SAAA,CAAU,CAAC,CAAA,CAAE,IAAA,CAAK,EAAE,CAAA,0BAAA,EAA6B,sBAAsB,CAAA;AAAA,WAC/I;AAAA,QACF;AACA,QAAA,MAAM,UAAA;AAAA,MACR;AAEA,MAAA,MAAM,SAAS,IAAA,CAAK,MAAA,CAAO,KAAK,IAAA,CAAK,MAAA,EAAQ,SAAS,cAAc,CAAA;AAGpE,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAA,EAAG;AAChC,QAAA,MAAA,CAAO,KAAA,GAAQC,6BAAA,CAAuB,MAAA,CAAO,KAAK,CAAA;AAAA,MACpD;AACA,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,IAAI,CAAA,EAAG;AAC/B,QAAA,MAAA,CAAO,IAAA,GAAOA,6BAAA,CAAuB,MAAA,CAAO,IAAI,CAAA;AAAA,MAClD;AAEA,MAAA,MAAM,UAAU,cAAA,EAAe;AAC/B,MAAA,MAAM,KAAK,cAAA,IAAiB;AAE5B,MAAA,OAAO,EAAE,MAAA,EAAO;AAAA,IAClB,CAAA,SAAE;AACA,MAAA,IAAI;AACF,QAAA,OAAA,EAAQ;AAAA,MACV,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,IAAI,aAAA,EAAe;AACjB,QAAA,MAAML,mBAAA,CAAG,OAAO,aAAa,CAAA;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,mBAAmBM,SAAA,EAAyB;AAEnD,EAAA,MAAM,gBAAgBC,2BAAA,CAAoB;AAAA,IACxC,IAAA,EAAM,uBAAA;AAAA,IACN,IAAA,EAAM,oBAAA;AAAA,IACN,UAAA,EAAY,CAAC,UAAA,EAAY,MAAA,EAAQ,QAAQ;AAAA,GAC1C,CAAA;AACD,EAAA,MAAM,mBAAmBC,6BAAA,CAAsB;AAAA,IAC7C,IAAA,EAAM,0BAAA;AAAA,IACN,IAAA,EAAM,wBAAA;AAAA,IACN,UAAA,EAAY,CAAC,UAAA,EAAY,QAAQ;AAAA,GAClC,CAAA;AACD,EAAA,MAAM,gBAAgBD,2BAAA,CAAoB;AAAA,IACxC,IAAA,EAAM,uBAAA;AAAA,IACN,IAAA,EAAM,oBAAA;AAAA,IACN,UAAA,EAAY,CAAC,UAAA,EAAY,MAAA,EAAQ,QAAQ;AAAA,GAC1C,CAAA;AACD,EAAA,MAAM,mBAAmBC,6BAAA,CAAsB;AAAA,IAC7C,IAAA,EAAM,0BAAA;AAAA,IACN,IAAA,EAAM,yBAAA;AAAA,IACN,UAAA,EAAY,CAAC,UAAA,EAAY,MAAA,EAAQ,QAAQ;AAAA,GAC1C,CAAA;AAED,EAAA,MAAM,SAAA,GAAYF,SAAA,CAAQ,aAAA,CAAc,uBAAA,EAAyB;AAAA,IAC/D,WAAA,EAAa;AAAA,GACd,CAAA;AAED,EAAA,MAAM,YAAA,GAAeA,SAAA,CAAQ,eAAA,CAAgB,0BAAA,EAA4B;AAAA,IACvE,WAAA,EAAa,qDAAA;AAAA,IACb,IAAA,EAAM;AAAA,GACP,CAAA;AAED,EAAA,MAAM,SAAA,GAAYA,SAAA,CAAQ,aAAA,CAAc,uBAAA,EAAyB;AAAA,IAC/D,WAAA,EAAa;AAAA,GACd,CAAA;AAED,EAAA,MAAM,YAAA,GAAeA,SAAA,CAAQ,eAAA,CAAgB,0BAAA,EAA4B;AAAA,IACvE,WAAA,EAAa,wDAAA;AAAA,IACb,IAAA,EAAM;AAAA,GACP,CAAA;AAED,EAAA,eAAe,UAAU,IAAA,EAAmB;AAC1C,IAAA,MAAM,KAAK,OAAA,CAAQ,CAAA,sBAAA,EAAyB,KAAK,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA,MAAA,CAAQ,CAAA;AAC1E,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,YAAA,EAAc,SAAA,IAAa,EAAA;AACtD,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,GAAA,IAAO,EAAA;AAEpC,IAAA,MAAM,SAAA,GAAY,QAAQ,MAAA,EAAO;AACjC,IAAA,MAAM,SAAA,GAAY,iBAAiB,UAAA,CAAW;AAAA,MAC5C;AAAA,KACD,CAAA;AAED,IAAA,SAAS,OAAA,GAAU;AACjB,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA;AACtC,MAAA,OAAO,KAAA,CAAM,CAAC,CAAA,GAAI,KAAA,CAAM,CAAC,CAAA,GAAI,GAAA;AAAA,IAC/B;AAEA,IAAA,eAAe,UAAA,CACb,MACA,MAAA,EACA;AACA,MAAA,IAAA,CAAK,OAAA,CAAQ,CAAA,iBAAA,EAAoB,MAAA,CAAO,EAAE,CAAA,yBAAA,CAAA,EAA6B;AAAA,QACrE,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,eAAe,cAAA,GAAiB;AAC9B,MAAA,aAAA,CAAc,GAAA,CAAI;AAAA,QAChB,QAAA;AAAA,QACA,IAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,SAAA,CAAU,EAAE,MAAA,EAAQ,IAAA,EAAM,CAAA;AAE1B,MAAA,SAAA,CAAU,IAAI,CAAA,EAAG,EAAE,UAAU,IAAA,EAAM,MAAA,EAAQ,MAAM,CAAA;AACjD,MAAA,YAAA,CAAa,MAAA,CAAO,SAAQ,EAAG;AAAA,QAC7B,QAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,eAAe,UAAA,CAAW,MAAgB,GAAA,EAAY;AACpD,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA,EAAG;AAAA,QACpC,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,aAAA,CAAc,GAAA,CAAI;AAAA,QAChB,QAAA;AAAA,QACA,IAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,SAAA,CAAU,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AAE9B,MAAA,SAAA,CAAU,IAAI,CAAA,EAAG,EAAE,UAAU,IAAA,EAAM,MAAA,EAAQ,UAAU,CAAA;AACrD,MAAA,YAAA,CAAa,MAAA,CAAO,SAAQ,EAAG;AAAA,QAC7B,QAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,eAAe,cAAc,IAAA,EAAgB;AAC3C,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAA,KAAA,EAAQ,IAAA,CAAK,EAAE,CAAA,oBAAA,CAAA,EAAwB;AAAA,QACxD,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,aAAA,CAAc,GAAA,CAAI;AAAA,QAChB,QAAA;AAAA,QACA,IAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,SAAA,CAAU,EAAE,MAAA,EAAQ,WAAA,EAAa,CAAA;AAEjC,MAAA,SAAA,CAAU,IAAI,CAAA,EAAG,EAAE,UAAU,IAAA,EAAM,MAAA,EAAQ,aAAa,CAAA;AACxD,MAAA,YAAA,CAAa,MAAA,CAAO,SAAQ,EAAG;AAAA,QAC7B,QAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,OAAO;AAAA,MACL,UAAA;AAAA,MACA,aAAA;AAAA,MACA,cAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,eAAe,SAAA,CAAU,MAAmB,IAAA,EAAgB;AAC1D,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAA,eAAA,EAAkB,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI;AAAA,MAChD,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,MAAA,EAAQ;AAAA,KACT,CAAA;AACD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,YAAA,EAAc,SAAA,IAAa,EAAA;AAEtD,IAAA,MAAM,SAAA,GAAY,QAAQ,MAAA,EAAO;AACjC,IAAA,MAAM,SAAA,GAAY,iBAAiB,UAAA,CAAW;AAAA,MAC5C,QAAA;AAAA,MACA,MAAM,IAAA,CAAK;AAAA,KACZ,CAAA;AAED,IAAA,SAAS,OAAA,GAAU;AACjB,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA;AACtC,MAAA,OAAO,KAAA,CAAM,CAAC,CAAA,GAAI,KAAA,CAAM,CAAC,CAAA,GAAI,GAAA;AAAA,IAC/B;AAEA,IAAA,eAAe,cAAA,GAAiB;AAC9B,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,CAAA,cAAA,EAAiB,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI;AAAA,QAC/C,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,aAAA,CAAc,GAAA,CAAI;AAAA,QAChB,QAAA;AAAA,QACA,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,SAAA,CAAU,EAAE,MAAA,EAAQ,IAAA,EAAM,CAAA;AAE1B,MAAA,SAAA,CAAU,GAAA,CAAI,GAAG,EAAE,QAAA,EAAU,MAAM,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA;AAC5D,MAAA,YAAA,CAAa,MAAA,CAAO,SAAQ,EAAG;AAAA,QAC7B,QAAA;AAAA,QACA,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,eAAe,aAAA,GAAgB;AAC7B,MAAA,aAAA,CAAc,GAAA,CAAI;AAAA,QAChB,QAAA;AAAA,QACA,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,SAAA,CAAU,EAAE,MAAA,EAAQ,WAAA,EAAa,CAAA;AAEjC,MAAA,SAAA,CAAU,GAAA,CAAI,GAAG,EAAE,QAAA,EAAU,MAAM,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ,WAAA,EAAa,CAAA;AACnE,MAAA,YAAA,CAAa,MAAA,CAAO,SAAQ,EAAG;AAAA,QAC7B,QAAA;AAAA,QACA,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,eAAe,UAAA,GAAa;AAC1B,MAAA,aAAA,CAAc,GAAA,CAAI;AAAA,QAChB,QAAA;AAAA,QACA,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,SAAA,CAAU,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AAE9B,MAAA,SAAA,CAAU,GAAA,CAAI,GAAG,EAAE,QAAA,EAAU,MAAM,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ,QAAA,EAAU,CAAA;AAChE,MAAA,YAAA,CAAa,MAAA,CAAO,SAAQ,EAAG;AAAA,QAC7B,QAAA;AAAA,QACA,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,eAAe,SAAA,GAAY;AACzB,MAAA,MAAM,IAAA,CAAK,OAAA;AAAA,QACT,CAAA,cAAA,EAAiB,KAAK,EAAE,CAAA,mCAAA,CAAA;AAAA,QACxB,EAAE,MAAA,EAAQ,IAAA,CAAK,EAAA,EAAI,QAAQ,SAAA;AAAU,OACvC;AACA,MAAA,SAAA,CAAU,EAAE,MAAA,EAAQ,SAAA,EAAW,CAAA;AAE/B,MAAA,SAAA,CAAU,GAAA,CAAI,GAAG,EAAE,QAAA,EAAU,MAAM,IAAA,CAAK,IAAA,EAAM,MAAA,EAAQ,SAAA,EAAW,CAAA;AACjE,MAAA,YAAA,CAAa,MAAA,CAAO,SAAQ,EAAG;AAAA,QAC7B,QAAA;AAAA,QACA,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AAEA,IAAA,OAAO;AAAA,MACL,aAAA;AAAA,MACA,UAAA;AAAA,MACA,cAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,SAAA;AAAA,IACA;AAAA,GACF;AACF;;;;"}

package/dist/service/router.cjs.js

@@ -295,7 +295,7 @@ async function createRouter(options) {
             description: schema.description,
             schema
           })),
-          EXPERIMENTAL_formDecorators: template.spec.EXPERIMENTAL_formDecorators
+          formDecorators: template.spec.formDecorators ?? template.spec.EXPERIMENTAL_formDecorators
         });
       } catch (err) {
         await auditorEvent?.fail({ error: err });

package/dist/service/router.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.cjs.js","sources":["../../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  AuditorService,\n  AuditorServiceEvent,\n  AuthService,\n  BackstageCredentials,\n  DatabaseService,\n  HttpAuthService,\n  LifecycleService,\n  LoggerService,\n  PermissionsRegistryService,\n  PermissionsService,\n  resolveSafeChildPath,\n  SchedulerService,\n} from '@backstage/backend-plugin-api';\nimport { validate, ValidatorResult } from 'jsonschema';\nimport {\n  CompoundEntityRef,\n  Entity,\n  parseEntityRef,\n  stringifyEntityRef,\n  UserEntity,\n} from '@backstage/catalog-model';\nimport { Config, readDurationFromConfig } from '@backstage/config';\nimport { InputError, NotFoundError } from '@backstage/errors';\nimport { ScmIntegrations } from '@backstage/integration';\n\nimport { EventsService } from '@backstage/plugin-events-node';\n\nimport {\n  ConditionTransformer,\n  createConditionAuthorizer,\n  createConditionTransformer,\n} from '@backstage/plugin-permission-node';\nimport {\n  TaskSpec,\n  TemplateEntityV1beta3,\n  templateEntityV1beta3Validator,\n} from '@backstage/plugin-scaffolder-common';\nimport {\n  scaffolderActionPermissions,\n  scaffolderTaskPermissions,\n  scaffolderTemplatePermissions,\n  taskCancelPermission,\n  taskCreatePermission,\n  taskReadPermission,\n  templateManagementPermission,\n  templateParameterReadPermission,\n  templateStepReadPermission,\n} from '@backstage/plugin-scaffolder-common/alpha';\nimport {\n  TaskBroker,\n  TaskFilters,\n  TaskStatus,\n  TemplateAction,\n  TemplateFilter,\n  TemplateGlobal,\n} from '@backstage/plugin-scaffolder-node';\nimport {\n  AutocompleteHandler,\n  CreatedTemplateFilter,\n  CreatedTemplateGlobal,\n  scaffolderActionPermissionResourceRef,\n  scaffolderTaskPermissionResourceRef,\n  scaffolderTemplatePermissionResourceRef,\n  WorkspaceProvider,\n} from '@backstage/plugin-scaffolder-node/alpha';\nimport { HumanDuration, JsonObject } from '@backstage/types';\nimport express from 'express';\nimport { Duration } from 'luxon';\nimport { pathToFileURL } from 'node:url';\nimport { randomUUID as uuid } from 'node:crypto';\nimport { z } from 'zod/v3';\nimport {\n  DatabaseTaskStore,\n  DefaultTemplateActionRegistry,\n  TaskWorker,\n} from '../scaffolder';\nimport { createDryRunner } from '../scaffolder/dryrun';\nimport { StorageTaskBroker } from '../scaffolder/tasks/StorageTaskBroker';\nimport { InternalTaskSecrets } from '../scaffolder/tasks/types';\nimport { createOpenApiRouter } from '../schema/openapi';\nimport {\n  checkPermission,\n  checkTaskPermission,\n  getAuthorizeConditions,\n} from '../util/checkPermissions';\nimport {\n  findTemplate,\n  getEntityBaseUrl,\n  getWorkingDirectory,\n  parseStringsParam,\n} from './helpers';\n\nimport {\n  convertFiltersToRecord,\n  convertGlobalsToRecord,\n  extractFilterMetadata,\n  extractGlobalFunctionMetadata,\n  extractGlobalValueMetadata,\n} from '../util/templating';\nimport { createDefaultFilters } from '../lib/templating/filters/createDefaultFilters';\nimport {\n  ActionPermissionRuleInput,\n  isActionPermissionRuleInput,\n  isTaskPermissionRuleInput,\n  isTemplatePermissionRuleInput,\n  ScaffolderPermissionRuleInput,\n  TaskPermissionRuleInput,\n  TemplatePermissionRuleInput,\n} from './permissions';\nimport { CatalogService } from '@backstage/plugin-catalog-node';\n\nimport {\n  scaffolderActionRules,\n  scaffolderTaskRules,\n  scaffolderTemplateRules,\n} from './rules';\nimport {\n  ActionsService,\n  MetricsService,\n} from '@backstage/backend-plugin-api/alpha';\n\n/**\n * RouterOptions\n */\nexport interface RouterOptions {\n  logger: LoggerService;\n  config: Config;\n  lifecycle?: LifecycleService;\n  database: DatabaseService;\n  catalog: CatalogService;\n  scheduler?: SchedulerService;\n  actions?: TemplateAction<any, any, any>[];\n  /**\n   * Sets the number of concurrent tasks that can be run at any given time on the TaskWorker\n   * @defaultValue 10\n   */\n  concurrentTasksLimit?: number;\n  taskBroker?: TaskBroker;\n  additionalTemplateFilters?:\n    | Record<string, TemplateFilter>\n    | CreatedTemplateFilter<any, any>[];\n  additionalTemplateGlobals?:\n    | Record<string, TemplateGlobal>\n    | CreatedTemplateGlobal[];\n  additionalWorkspaceProviders?: Record<string, WorkspaceProvider>;\n  permissions?: PermissionsService;\n  permissionsRegistry: PermissionsRegistryService;\n  permissionRules?: Array<ScaffolderPermissionRuleInput>;\n  auth: AuthService;\n  httpAuth: HttpAuthService;\n  events?: EventsService;\n  auditor?: AuditorService;\n  autocompleteHandlers?: Record<string, AutocompleteHandler>;\n  actionsRegistry: ActionsService;\n  metrics: MetricsService;\n}\n\nfunction isSupportedTemplate(entity: TemplateEntityV1beta3) {\n  return entity.apiVersion === 'scaffolder.backstage.io/v1beta3';\n}\n\nconst readDuration = (\n  config: Config,\n  key: string,\n  defaultValue: HumanDuration,\n) => {\n  if (config.has(key)) {\n    return readDurationFromConfig(config, { key });\n  }\n  return defaultValue;\n};\n\nfunction formatSecretsValidationErrors(result: ValidatorResult) {\n  return result.errors.map(err => {\n    const property = err.property.replace(/^instance/, 'secrets');\n    const secretName = err.argument;\n    const message =\n      err.name === 'required'\n        ? `secrets.${secretName} is required`\n        : `${property} ${err.message}`;\n    return {\n      ...err,\n      property,\n      message,\n      instance: {},\n    };\n  });\n}\n\nasync function validateSecrets(options: {\n  template: TemplateEntityV1beta3;\n  secrets: Record<string, unknown>;\n  res: express.Response;\n  auditorEvent?: AuditorServiceEvent;\n}): Promise<boolean> {\n  const { template, secrets, res, auditorEvent } = options;\n  if (!template.spec.secrets?.schema) {\n    return true;\n  }\n\n  const result = validate(secrets, template.spec.secrets.schema);\n  if (result.valid) {\n    return true;\n  }\n\n  await auditorEvent?.fail({\n    error: new InputError('Secrets validation failed'),\n  });\n\n  res.status(400).json({\n    errors: formatSecretsValidationErrors(result),\n  });\n  return false;\n}\n\n/**\n * A method to create a router for the scaffolder backend plugin.\n */\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const router = await createOpenApiRouter({\n    middleware: [\n      // Be generous in upload size to support a wide range of templates in dry-run mode.\n      express.json({ limit: '10MB' }),\n    ],\n  });\n\n  const {\n    logger: parentLogger,\n    config,\n    database,\n    catalog,\n    actions = [],\n    scheduler,\n    additionalTemplateFilters,\n    additionalTemplateGlobals,\n    additionalWorkspaceProviders,\n    permissions,\n    permissionsRegistry,\n    permissionRules,\n    autocompleteHandlers = {},\n    events: eventsService,\n    auth,\n    httpAuth,\n    auditor,\n    actionsRegistry,\n    metrics,\n  } = options;\n\n  const concurrentTasksLimit =\n    options.concurrentTasksLimit ??\n    options.config.getOptionalNumber('scaffolder.concurrentTasksLimit');\n\n  const logger = parentLogger.child({ plugin: 'scaffolder' });\n\n  const workingDirectory = await getWorkingDirectory(config, logger);\n  const integrations = ScmIntegrations.fromConfig(config);\n\n  let taskBroker: TaskBroker;\n  if (!options.taskBroker) {\n    const databaseTaskStore = await DatabaseTaskStore.create({\n      database,\n      events: eventsService,\n    });\n    taskBroker = new StorageTaskBroker(\n      databaseTaskStore,\n      logger,\n      config,\n      auth,\n      additionalWorkspaceProviders,\n      auditor,\n    );\n\n    if (scheduler && databaseTaskStore.listStaleTasks) {\n      await scheduler.scheduleTask({\n        id: 'close_stale_tasks',\n        frequency: readDuration(\n          config,\n          'scaffolder.taskTimeoutJanitorFrequency',\n          {\n            minutes: 5,\n          },\n        ),\n        timeout: { minutes: 15 },\n        fn: async () => {\n          const { tasks } = await databaseTaskStore.listStaleTasks({\n            timeoutS: Duration.fromObject(\n              readDuration(config, 'scaffolder.taskTimeout', {\n                hours: 24,\n              }),\n            ).as('seconds'),\n          });\n\n          for (const task of tasks) {\n            await databaseTaskStore.shutdownTask(task);\n            logger.info(`Successfully closed stale task ${task.taskId}`);\n          }\n        },\n      });\n    }\n  } else {\n    taskBroker = options.taskBroker;\n  }\n\n  const actionRegistry = new DefaultTemplateActionRegistry(\n    actionsRegistry,\n    logger,\n  );\n\n  const templateExtensions = {\n    additionalTemplateFilters: convertFiltersToRecord(\n      additionalTemplateFilters,\n    ),\n    additionalTemplateGlobals: convertGlobalsToRecord(\n      additionalTemplateGlobals,\n    ),\n  };\n\n  const workers: TaskWorker[] = [];\n  if (concurrentTasksLimit !== 0) {\n    const gracefulShutdown = config.getOptionalBoolean(\n      'scaffolder.EXPERIMENTAL_gracefulShutdown',\n    );\n\n    const worker = await TaskWorker.create({\n      taskBroker,\n      actionRegistry,\n      integrations,\n      logger,\n      auditor,\n      config,\n      workingDirectory,\n      concurrentTasksLimit,\n      permissions,\n      gracefulShutdown,\n      metrics,\n      ...templateExtensions,\n    });\n\n    workers.push(worker);\n  }\n\n  for (const action of actions) {\n    actionRegistry.register(action);\n  }\n\n  const launchWorkers = () => workers.forEach(worker => worker.start());\n\n  const shutdownWorkers = async () => {\n    await Promise.allSettled(workers.map(worker => worker.stop()));\n  };\n\n  if (options.lifecycle) {\n    options.lifecycle.addStartupHook(launchWorkers);\n    options.lifecycle.addShutdownHook(shutdownWorkers);\n  } else {\n    launchWorkers();\n  }\n\n  const dryRunner = createDryRunner({\n    actionRegistry,\n    integrations,\n    logger,\n    auditor,\n    workingDirectory,\n    permissions,\n    config,\n    metrics,\n    ...templateExtensions,\n  });\n\n  const templateRules: TemplatePermissionRuleInput[] = Object.values(\n    scaffolderTemplateRules,\n  );\n  const actionRules: ActionPermissionRuleInput[] = Object.values(\n    scaffolderActionRules,\n  );\n  const taskRules: TaskPermissionRuleInput[] =\n    Object.values(scaffolderTaskRules);\n\n  if (permissionRules) {\n    templateRules.push(\n      ...permissionRules.filter(isTemplatePermissionRuleInput),\n    );\n    actionRules.push(...permissionRules.filter(isActionPermissionRuleInput));\n    taskRules.push(...permissionRules.filter(isTaskPermissionRuleInput));\n  }\n\n  const isTemplateAuthorized = createConditionAuthorizer(\n    Object.values(templateRules),\n  );\n  const isTaskAuthorized = createConditionAuthorizer(Object.values(taskRules));\n\n  const taskTransformConditions: ConditionTransformer<TaskFilters> =\n    createConditionTransformer(Object.values(taskRules));\n\n  permissionsRegistry.addResourceType({\n    resourceRef: scaffolderTemplatePermissionResourceRef,\n    permissions: scaffolderTemplatePermissions,\n    rules: templateRules,\n  });\n\n  permissionsRegistry.addResourceType({\n    resourceRef: scaffolderActionPermissionResourceRef,\n    permissions: scaffolderActionPermissions,\n    rules: actionRules,\n  });\n\n  permissionsRegistry.addResourceType({\n    resourceRef: scaffolderTaskPermissionResourceRef,\n    permissions: scaffolderTaskPermissions,\n    rules: taskRules,\n    getResources: async resourceRefs => {\n      return Promise.all(\n        resourceRefs.map(async taskId => {\n          return await taskBroker.get(taskId);\n        }),\n      );\n    },\n  });\n\n  permissionsRegistry.addPermissions([\n    taskCreatePermission,\n    templateManagementPermission,\n  ]);\n\n  router\n    .get(\n      '/v2/templates/:namespace/:kind/:name/parameter-schema',\n      async (req, res) => {\n        const requestedTemplateRef = `${req.params.kind}:${req.params.namespace}/${req.params.name}`;\n\n        const auditorEvent = await auditor?.createEvent({\n          eventId: 'template-parameter-schema',\n          request: req,\n          meta: { templateRef: requestedTemplateRef },\n        });\n\n        try {\n          const credentials = await httpAuth.credentials(req);\n\n          const template = await authorizeTemplate(req.params, credentials);\n\n          const parameters = [template.spec.parameters ?? []].flat();\n\n          const presentation = template.spec.presentation;\n\n          const templateRef = `${template.kind}:${\n            template.metadata.namespace || 'default'\n          }/${template.metadata.name}`;\n\n          await auditorEvent?.success({ meta: { templateRef: templateRef } });\n\n          res.json({\n            title: template.metadata.title ?? template.metadata.name,\n            ...(presentation ? { presentation } : {}),\n            description: template.metadata.description,\n            'ui:options': template.metadata['ui:options'],\n            steps: parameters.map(schema => ({\n              title:\n                (schema.title as string) ??\n                'Please enter the following information',\n              description: schema.description as string,\n              schema,\n            })),\n            EXPERIMENTAL_formDecorators:\n              template.spec.EXPERIMENTAL_formDecorators,\n          });\n        } catch (err) {\n          await auditorEvent?.fail({ error: err });\n          throw err;\n        }\n      },\n    )\n    .get('/v2/actions', async (req, res) => {\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'action-fetch',\n        request: req,\n      });\n      const credentials = await httpAuth.credentials(req);\n\n      try {\n        const list = await actionRegistry.list({ credentials });\n        const actionsList = Array.from(list.values())\n          .map(action => {\n            return {\n              id: action.id,\n              description: action.description,\n              examples: action.examples,\n              schema: action.schema,\n            };\n          })\n          .sort((a, b) => a.id.localeCompare(b.id));\n\n        await auditorEvent?.success();\n\n        res.json(actionsList);\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    })\n    .post('/v2/tasks', async (req, res) => {\n      const templateRef: string = req.body.templateRef;\n      const { kind, namespace, name } = parseEntityRef(templateRef, {\n        defaultKind: 'template',\n      });\n\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'task',\n        severityLevel: 'medium',\n        request: req,\n        meta: {\n          actionType: 'create',\n          templateRef: templateRef,\n        },\n      });\n\n      try {\n        const credentials = await httpAuth.credentials(req);\n        await checkPermission({\n          credentials,\n          permissions: [taskCreatePermission],\n          permissionService: permissions,\n        });\n\n        const userEntityRef = auth.isPrincipal(credentials, 'user')\n          ? credentials.principal.userEntityRef\n          : undefined;\n\n        const userEntity = userEntityRef\n          ? await catalog.getEntityByRef(userEntityRef, { credentials })\n          : undefined;\n\n        let auditLog = `Scaffolding task for ${templateRef}`;\n        if (userEntityRef) {\n          auditLog += ` created by ${userEntityRef}`;\n        }\n        logger.info(auditLog);\n\n        const values = req.body.values;\n\n        const template = await authorizeTemplate(\n          { kind, namespace, name },\n          credentials,\n        );\n\n        for (const parameters of [template.spec.parameters ?? []].flat()) {\n          const result = validate(values, parameters);\n\n          if (!result.valid) {\n            await auditorEvent?.fail({\n              // TODO(Rugvip): Seems like there aren't proper types for AggregateError yet\n              error: (AggregateError as any)(\n                result.errors,\n                'Could not create entity',\n              ),\n            });\n\n            res.status(400).json({ errors: result.errors });\n            return;\n          }\n        }\n\n        const secretsValid = await validateSecrets({\n          template,\n          secrets: req.body.secrets ?? {},\n          res,\n          auditorEvent,\n        });\n        if (!secretsValid) {\n          return;\n        }\n\n        const baseUrl = getEntityBaseUrl(template);\n\n        const taskSpec: TaskSpec = {\n          apiVersion: template.apiVersion,\n          steps: template.spec.steps.map((step, index) => ({\n            ...step,\n            id: step.id ?? `step-${index + 1}`,\n            name: step.name ?? step.action,\n          })),\n          EXPERIMENTAL_recovery: template.spec.EXPERIMENTAL_recovery,\n          output: template.spec.output ?? {},\n          parameters: values,\n          user: {\n            entity: userEntity as UserEntity,\n            ref: userEntityRef,\n          },\n          templateInfo: {\n            entityRef: stringifyEntityRef({ kind, name, namespace }),\n            baseUrl,\n            entity: {\n              metadata: template.metadata,\n            },\n          },\n        };\n\n        const secrets: InternalTaskSecrets = {\n          ...req.body.secrets,\n          backstageToken: (credentials as any).token,\n          __initiatorCredentials: JSON.stringify({\n            ...credentials,\n            // credentials.token is nonenumerable and will not be serialized, so we need to add it explicitly\n            token: (credentials as any).token,\n          }),\n        };\n\n        const result = await taskBroker.dispatch({\n          spec: taskSpec,\n          createdBy: userEntityRef,\n          secrets,\n        });\n\n        await auditorEvent?.success({ meta: { taskId: result.taskId } });\n\n        res.status(201).json({ id: result.taskId });\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    })\n    .get('/v2/tasks', async (req, res) => {\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'task',\n        request: req,\n        meta: {\n          actionType: 'list',\n        },\n      });\n\n      try {\n        const credentials = await httpAuth.credentials(req);\n\n        if (!taskBroker.list) {\n          throw new Error(\n            'TaskBroker does not support listing tasks, please implement the list method on the TaskBroker.',\n          );\n        }\n\n        const createdBy = parseStringsParam(req.query.createdBy, 'createdBy');\n        const status = parseStringsParam(req.query.status, 'status');\n\n        const order = parseStringsParam(req.query.order, 'order')?.map(item => {\n          const match = item.match(/^(asc|desc):(.+)$/);\n          if (!match) {\n            throw new InputError(\n              `Invalid order parameter \"${item}\", expected \"<asc or desc>:<field name>\"`,\n            );\n          }\n\n          return {\n            order: match[1] as 'asc' | 'desc',\n            field: match[2],\n          };\n        });\n\n        const { limit, offset } = req.query;\n\n        const taskPermissionFilters = await getAuthorizeConditions({\n          credentials: credentials,\n          permission: taskReadPermission,\n          permissionService: permissions,\n          transformConditions: taskTransformConditions,\n        });\n\n        const tasks = await taskBroker.list({\n          filters: {\n            createdBy,\n            status: status ? (status as TaskStatus[]) : undefined,\n          },\n          order,\n          pagination: {\n            limit,\n            offset,\n          },\n          permissionFilters: taskPermissionFilters,\n        });\n\n        await auditorEvent?.success();\n\n        res.status(200).json(tasks);\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    })\n    .get('/v2/tasks/:taskId', async (req, res) => {\n      const { taskId } = req.params;\n\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'task',\n        request: req,\n        meta: {\n          actionType: 'get',\n          taskId: taskId,\n        },\n      });\n\n      try {\n        const credentials = await httpAuth.credentials(req);\n\n        const task = await taskBroker.get(taskId);\n\n        await checkTaskPermission({\n          credentials,\n          permissions: [taskReadPermission],\n          permissionService: permissions,\n          task: task,\n          isTaskAuthorized,\n        });\n\n        if (!task) {\n          throw new NotFoundError(`Task with id ${taskId} does not exist`);\n        }\n\n        await auditorEvent?.success();\n\n        // Do not disclose secrets\n        delete task.secrets;\n        res.status(200).json(task);\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    })\n    .post('/v2/tasks/:taskId/cancel', async (req, res) => {\n      const { taskId } = req.params;\n\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'task',\n        severityLevel: 'medium',\n        request: req,\n        meta: {\n          actionType: 'cancel',\n          taskId: taskId,\n        },\n      });\n\n      try {\n        const credentials = await httpAuth.credentials(req);\n        const task = await taskBroker.get(taskId);\n        // Requires both read and cancel permissions\n        await checkTaskPermission({\n          credentials,\n          permissions: [taskCancelPermission, taskReadPermission],\n          permissionService: permissions,\n          task: task,\n          isTaskAuthorized,\n        });\n\n        await taskBroker.cancel?.(taskId);\n\n        await auditorEvent?.success();\n\n        res.status(200).json({ status: 'cancelled' });\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    })\n    .post('/v2/tasks/:taskId/retry', async (req, res) => {\n      const { taskId } = req.params;\n\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'task',\n        severityLevel: 'medium',\n        request: req,\n        meta: {\n          actionType: 'retry',\n          taskId: taskId,\n        },\n      });\n\n      try {\n        const credentials = await httpAuth.credentials(req);\n        const task = await taskBroker.get(taskId);\n\n        // Requires both read and create permissions\n        await checkPermission({\n          credentials,\n          permissions: [taskCreatePermission],\n          permissionService: permissions,\n        });\n\n        await checkTaskPermission({\n          credentials,\n          permissions: [taskReadPermission],\n          permissionService: permissions,\n          task: task,\n          isTaskAuthorized,\n        });\n\n        // Validate secrets against template schema if defined\n        if (task.spec.templateInfo?.entityRef) {\n          const templateEntityRef = parseEntityRef(\n            task.spec.templateInfo.entityRef,\n            { defaultKind: 'template' },\n          );\n          const template = await authorizeTemplate(\n            templateEntityRef,\n            credentials,\n          );\n\n          const secretsValid = await validateSecrets({\n            template,\n            secrets: req.body.secrets ?? {},\n            res,\n            auditorEvent,\n          });\n          if (!secretsValid) {\n            return;\n          }\n        }\n\n        await auditorEvent?.success();\n\n        const { token } = await auth.getPluginRequestToken({\n          onBehalfOf: credentials,\n          targetPluginId: 'catalog',\n        });\n\n        const secrets: InternalTaskSecrets = {\n          ...req.body.secrets,\n          backstageToken: token,\n          __initiatorCredentials: JSON.stringify({\n            ...credentials,\n            // credentials.token is nonenumerable and will not be serialized, so we need to add it explicitly\n            token: (credentials as any).token,\n          }),\n        };\n\n        await taskBroker.retry?.({ secrets, taskId });\n        res.status(201).json({ id: taskId });\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    });\n  (router as express.Router).get(\n    '/v2/tasks/:taskId/eventstream',\n    async (req, res) => {\n      const { taskId } = req.params;\n\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'task',\n        request: req,\n        meta: {\n          actionType: 'stream',\n          taskId: taskId,\n        },\n      });\n\n      try {\n        const credentials = await httpAuth.credentials(req);\n        const task = await taskBroker.get(taskId);\n\n        await checkTaskPermission({\n          credentials,\n          permissions: [taskReadPermission],\n          permissionService: permissions,\n          task: task,\n          isTaskAuthorized,\n        });\n\n        const after =\n          req.query.after !== undefined ? Number(req.query.after) : undefined;\n\n        logger.debug(`Event stream observing taskId '${taskId}' opened`);\n\n        // Mandatory headers and http status to keep connection open\n        res.writeHead(200, {\n          Connection: 'keep-alive',\n          'Cache-Control': 'no-cache',\n          'Content-Type': 'text/event-stream',\n        });\n\n        // After client opens connection send all events as string\n        const subscription = taskBroker.event$({ taskId, after }).subscribe({\n          error: async error => {\n            logger.error(\n              `Received error from event stream when observing taskId '${taskId}', ${error}`,\n            );\n            await auditorEvent?.fail({ error: error });\n            res.end();\n          },\n          next: ({ events }) => {\n            let shouldUnsubscribe = false;\n            for (const event of events) {\n              res.write(\n                `event: ${event.type}\\ndata: ${JSON.stringify(event)}\\n\\n`,\n              );\n              if (event.type === 'completion' && !event.isTaskRecoverable) {\n                shouldUnsubscribe = true;\n              }\n            }\n            // res.flush() is only available with the compression middleware\n            res.flush?.();\n            if (shouldUnsubscribe) {\n              subscription.unsubscribe();\n              res.end();\n            }\n          },\n        });\n\n        // When client closes connection we update the clients list\n        // avoiding the disconnected one\n        req.on('close', async () => {\n          subscription.unsubscribe();\n          logger.debug(`Event stream observing taskId '${taskId}' closed`);\n          await auditorEvent?.success();\n        });\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    },\n  );\n  router\n    .get('/v2/tasks/:taskId/events', async (req, res) => {\n      const { taskId } = req.params;\n\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'task',\n        request: req,\n        meta: {\n          actionType: 'events',\n          taskId: taskId,\n        },\n      });\n\n      try {\n        const credentials = await httpAuth.credentials(req);\n        const task = await taskBroker.get(taskId);\n\n        await checkTaskPermission({\n          credentials,\n          permissions: [taskReadPermission],\n          permissionService: permissions,\n          task: task,\n          isTaskAuthorized,\n        });\n\n        const after =\n          req.query.after !== undefined ? Number(req.query.after) : undefined;\n\n        // cancel the request after 30 seconds. this aligns with the recommendations of RFC 6202.\n        const timeout = setTimeout(() => {\n          res.json([]);\n        }, 30_000);\n\n        // Get all known events after an id (always includes the completion event) and return the first callback\n        const subscription = taskBroker.event$({ taskId, after }).subscribe({\n          error: async error => {\n            logger.error(\n              `Received error from event stream when observing taskId '${taskId}', ${error}`,\n            );\n            await auditorEvent?.fail({ error: error });\n          },\n          next: async ({ events }) => {\n            clearTimeout(timeout);\n            subscription.unsubscribe();\n            await auditorEvent?.success();\n            res.json(events);\n          },\n        });\n\n        // When client closes connection we update the clients list\n        // avoiding the disconnected one\n        req.on('close', () => {\n          subscription.unsubscribe();\n          clearTimeout(timeout);\n        });\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    })\n    .post('/v2/dry-run', async (req, res) => {\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'task',\n        request: req,\n        meta: {\n          actionType: 'dry-run',\n        },\n      });\n\n      try {\n        const credentials = await httpAuth.credentials(req);\n        await checkPermission({\n          credentials,\n          permissions: [taskCreatePermission],\n          permissionService: permissions,\n        });\n\n        const bodySchema = z.object({\n          template: z.unknown(),\n          values: z.record(z.unknown()),\n          secrets: z.record(z.string()).optional(),\n          directoryContents: z.array(\n            z.object({ path: z.string(), base64Content: z.string() }),\n          ),\n        });\n        const body = await bodySchema.parseAsync(req.body).catch(e => {\n          throw new InputError(`Malformed request: ${e}`);\n        });\n\n        const template = body.template as TemplateEntityV1beta3;\n        if (!(await templateEntityV1beta3Validator.check(template))) {\n          throw new InputError('Input template is not a template');\n        }\n\n        const userEntityRef = auth.isPrincipal(credentials, 'user')\n          ? credentials.principal.userEntityRef\n          : undefined;\n\n        const userEntity = userEntityRef\n          ? await catalog.getEntityByRef(userEntityRef, { credentials })\n          : undefined;\n\n        const templateRef: string = `${template.kind}:${\n          template.metadata.namespace || 'default'\n        }/${template.metadata.name}`;\n\n        for (const parameters of [template.spec.parameters ?? []].flat()) {\n          const result = validate(body.values, parameters);\n          if (!result.valid) {\n            await auditorEvent?.fail({\n              // TODO(Rugvip): Seems like there aren't proper types for AggregateError yet\n              error: (AggregateError as any)(\n                result.errors,\n                'Could not execute dry run',\n              ),\n              meta: {\n                templateRef: templateRef,\n                parameters: template.spec.parameters,\n              },\n            });\n\n            res.status(400).json({ errors: result.errors });\n            return;\n          }\n        }\n\n        const secretsValid = await validateSecrets({\n          template,\n          secrets: body.secrets ?? {},\n          res,\n          auditorEvent,\n        });\n        if (!secretsValid) {\n          return;\n        }\n\n        const steps = template.spec.steps.map((step, index) => ({\n          ...step,\n          id: step.id ?? `step-${index + 1}`,\n          name: step.name ?? step.action,\n        }));\n\n        const dryRunId = uuid();\n        const contentsPath = resolveSafeChildPath(\n          workingDirectory,\n          `dry-run-content-${dryRunId}`,\n        );\n        const templateInfo = {\n          entityRef: 'template:default/dry-run',\n          entity: {\n            metadata: template.metadata,\n          },\n          baseUrl: pathToFileURL(\n            resolveSafeChildPath(contentsPath, 'template.yaml'),\n          ).toString(),\n        };\n\n        const result = await dryRunner({\n          spec: {\n            apiVersion: template.apiVersion,\n            steps,\n            output: template.spec.output ?? {},\n            parameters: body.values as JsonObject,\n            user: {\n              entity: userEntity as UserEntity,\n              ref: userEntityRef,\n            },\n          },\n          templateInfo: templateInfo,\n          directoryContents: (body.directoryContents ?? []).map(file => ({\n            path: file.path,\n            content: Buffer.from(file.base64Content, 'base64'),\n          })),\n          secrets: {\n            ...body.secrets,\n            backstageToken: (credentials as any).token,\n          },\n          credentials,\n        });\n\n        await auditorEvent?.success({\n          meta: {\n            templateRef: templateRef,\n            parameters: template.spec.parameters,\n          },\n        });\n\n        res.status(200).json({\n          ...result,\n          steps,\n          directoryContents: result.directoryContents.map(file => ({\n            path: file.path,\n            executable: file.executable,\n            base64Content: file.content.toString('base64'),\n          })),\n        });\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    })\n    .post('/v2/autocomplete/:provider/:resource', async (req, res) => {\n      const { token, context } = req.body;\n      const { provider, resource } = req.params;\n\n      if (!token) throw new InputError('Missing token query parameter');\n\n      if (!autocompleteHandlers[provider]) {\n        throw new InputError(`Unsupported provider: ${provider}`);\n      }\n\n      const { results } = await autocompleteHandlers[provider]({\n        resource,\n        token,\n        context,\n      });\n\n      res.status(200).json({ results });\n    })\n    .get('/v2/templating-extensions', async (_req, res) => {\n      res.status(200).json({\n        filters: {\n          ...extractFilterMetadata(createDefaultFilters({ integrations })),\n          ...extractFilterMetadata(additionalTemplateFilters),\n        },\n        globals: {\n          functions: extractGlobalFunctionMetadata(additionalTemplateGlobals),\n          values: extractGlobalValueMetadata(additionalTemplateGlobals),\n        },\n      });\n    });\n\n  const app = express();\n  app.set('logger', logger);\n  app.use('/', router);\n\n  async function authorizeTemplate(\n    entityRef: CompoundEntityRef,\n    credentials: BackstageCredentials,\n  ) {\n    const template = await findTemplate({\n      catalog,\n      entityRef,\n      credentials,\n    });\n\n    if (!isSupportedTemplate(template)) {\n      throw new InputError(\n        `Unsupported apiVersion field in schema entity, ${\n          (template as Entity).apiVersion\n        }`,\n      );\n    }\n\n    if (!permissions) {\n      return template;\n    }\n\n    const [parameterDecision, stepDecision] =\n      await permissions.authorizeConditional(\n        [\n          { permission: templateParameterReadPermission },\n          { permission: templateStepReadPermission },\n        ],\n        { credentials },\n      );\n\n    // Authorize parameters\n    if (Array.isArray(template.spec.parameters)) {\n      template.spec.parameters = template.spec.parameters.filter(step =>\n        isTemplateAuthorized(parameterDecision, step),\n      );\n    } else if (\n      template.spec.parameters &&\n      !isTemplateAuthorized(parameterDecision, template.spec.parameters)\n    ) {\n      template.spec.parameters = undefined;\n    }\n\n    // Authorize steps\n    template.spec.steps = template.spec.steps.filter(step =>\n      isTemplateAuthorized(stepDecision, step),\n    );\n\n    return template;\n  }\n\n  return app;\n}\n"],"names":["config","readDurationFromConfig","validate","InputError","router","createOpenApiRouter","express","permissions","getWorkingDirectory","ScmIntegrations","DatabaseTaskStore","StorageTaskBroker","Duration","DefaultTemplateActionRegistry","convertFiltersToRecord","convertGlobalsToRecord","TaskWorker","createDryRunner","scaffolderTemplateRules","scaffolderActionRules","scaffolderTaskRules","isTemplatePermissionRuleInput","isActionPermissionRuleInput","isTaskPermissionRuleInput","createConditionAuthorizer","createConditionTransformer","scaffolderTemplatePermissionResourceRef","scaffolderTemplatePermissions","scaffolderActionPermissionResourceRef","scaffolderActionPermissions","scaffolderTaskPermissionResourceRef","scaffolderTaskPermissions","taskCreatePermission","templateManagementPermission","parseEntityRef","checkPermission","result","getEntityBaseUrl","stringifyEntityRef","parseStringsParam","getAuthorizeConditions","taskReadPermission","checkTaskPermission","NotFoundError","taskCancelPermission","z","templateEntityV1beta3Validator","uuid","resolveSafeChildPath","pathToFileURL","extractFilterMetadata","createDefaultFilters","extractGlobalFunctionMetadata","extractGlobalValueMetadata","findTemplate","templateParameterReadPermission","templateStepReadPermission"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8KA,SAAS,oBAAoB,MAAA,EAA+B;AAC1D,EAAA,OAAO,OAAO,UAAA,KAAe,iCAAA;AAC/B;AAEA,MAAM,YAAA,GAAe,CACnBA,QAAA,EACA,GAAA,EACA,YAAA,KACG;AACH,EAAA,IAAIA,QAAA,CAAO,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,IAAA,OAAOC,6BAAA,CAAuBD,QAAA,EAAQ,EAAE,GAAA,EAAK,CAAA;AAAA,EAC/C;AACA,EAAA,OAAO,YAAA;AACT,CAAA;AAEA,SAAS,8BAA8B,MAAA,EAAyB;AAC9D,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,GAAA,CAAI,CAAA,GAAA,KAAO;AAC9B,IAAA,MAAM,QAAA,GAAW,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,aAAa,SAAS,CAAA;AAC5D,IAAA,MAAM,aAAa,GAAA,CAAI,QAAA;AACvB,IAAA,MAAM,OAAA,GACJ,GAAA,CAAI,IAAA,KAAS,UAAA,GACT,CAAA,QAAA,EAAW,UAAU,CAAA,YAAA,CAAA,GACrB,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,GAAA,CAAI,OAAO,CAAA,CAAA;AAChC,IAAA,OAAO;AAAA,MACL,GAAG,GAAA;AAAA,MACH,QAAA;AAAA,MACA,OAAA;AAAA,MACA,UAAU;AAAC,KACb;AAAA,EACF,CAAC,CAAA;AACH;AAEA,eAAe,gBAAgB,OAAA,EAKV;AACnB,EAAA,MAAM,EAAE,QAAA,EAAU,OAAA,EAAS,GAAA,EAAK,cAAa,GAAI,OAAA;AACjD,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,OAAA,EAAS,MAAA,EAAQ;AAClC,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,SAASE,mBAAA,CAAS,OAAA,EAAS,QAAA,CAAS,IAAA,CAAK,QAAQ,MAAM,CAAA;AAC7D,EAAA,IAAI,OAAO,KAAA,EAAO;AAChB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,cAAc,IAAA,CAAK;AAAA,IACvB,KAAA,EAAO,IAAIC,iBAAA,CAAW,2BAA2B;AAAA,GAClD,CAAA;AAED,EAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,IACnB,MAAA,EAAQ,8BAA8B,MAAM;AAAA,GAC7C,CAAA;AACD,EAAA,OAAO,KAAA;AACT;AAKA,eAAsB,aACpB,OAAA,EACyB;AACzB,EAAA,MAAMC,QAAA,GAAS,MAAMC,0BAAA,CAAoB;AAAA,IACvC,UAAA,EAAY;AAAA;AAAA,MAEVC,wBAAA,CAAQ,IAAA,CAAK,EAAE,KAAA,EAAO,QAAQ;AAAA;AAChC,GACD,CAAA;AAED,EAAA,MAAM;AAAA,IACJ,MAAA,EAAQ,YAAA;AAAA,IACR,MAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAA;AAAA,IACA,UAAU,EAAC;AAAA,IACX,SAAA;AAAA,IACA,yBAAA;AAAA,IACA,yBAAA;AAAA,IACA,4BAAA;AAAA,iBACAC,aAAA;AAAA,IACA,mBAAA;AAAA,IACA,eAAA;AAAA,IACA,uBAAuB,EAAC;AAAA,IACxB,MAAA,EAAQ,aAAA;AAAA,IACR,IAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACF,GAAI,OAAA;AAEJ,EAAA,MAAM,uBACJ,OAAA,CAAQ,oBAAA,IACR,OAAA,CAAQ,MAAA,CAAO,kBAAkB,iCAAiC,CAAA;AAEpE,EAAA,MAAM,SAAS,YAAA,CAAa,KAAA,CAAM,EAAE,MAAA,EAAQ,cAAc,CAAA;AAE1D,EAAA,MAAM,gBAAA,GAAmB,MAAMC,2BAAA,CAAoB,MAAA,EAAQ,MAAM,CAAA;AACjE,EAAA,MAAM,YAAA,GAAeC,2BAAA,CAAgB,UAAA,CAAW,MAAM,CAAA;AAEtD,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI,CAAC,QAAQ,UAAA,EAAY;AACvB,IAAA,MAAM,iBAAA,GAAoB,MAAMC,mCAAA,CAAkB,MAAA,CAAO;AAAA,MACvD,QAAA;AAAA,MACA,MAAA,EAAQ;AAAA,KACT,CAAA;AACD,IAAA,UAAA,GAAa,IAAIC,mCAAA;AAAA,MACf,iBAAA;AAAA,MACA,MAAA;AAAA,MACA,MAAA;AAAA,MACA,IAAA;AAAA,MACA,4BAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,IAAI,SAAA,IAAa,kBAAkB,cAAA,EAAgB;AACjD,MAAA,MAAM,UAAU,YAAA,CAAa;AAAA,QAC3B,EAAA,EAAI,mBAAA;AAAA,QACJ,SAAA,EAAW,YAAA;AAAA,UACT,MAAA;AAAA,UACA,wCAAA;AAAA,UACA;AAAA,YACE,OAAA,EAAS;AAAA;AACX,SACF;AAAA,QACA,OAAA,EAAS,EAAE,OAAA,EAAS,EAAA,EAAG;AAAA,QACvB,IAAI,YAAY;AACd,UAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,kBAAkB,cAAA,CAAe;AAAA,YACvD,UAAUC,cAAA,CAAS,UAAA;AAAA,cACjB,YAAA,CAAa,QAAQ,wBAAA,EAA0B;AAAA,gBAC7C,KAAA,EAAO;AAAA,eACR;AAAA,aACH,CAAE,GAAG,SAAS;AAAA,WACf,CAAA;AAED,UAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,YAAA,MAAM,iBAAA,CAAkB,aAAa,IAAI,CAAA;AACzC,YAAA,MAAA,CAAO,IAAA,CAAK,CAAA,+BAAA,EAAkC,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,UAC7D;AAAA,QACF;AAAA,OACD,CAAA;AAAA,IACH;AAAA,EACF,CAAA,MAAO;AACL,IAAA,UAAA,GAAa,OAAA,CAAQ,UAAA;AAAA,EACvB;AAEA,EAAA,MAAM,iBAAiB,IAAIC,oDAAA;AAAA,IACzB,eAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,MAAM,kBAAA,GAAqB;AAAA,IACzB,yBAAA,EAA2BC,iCAAA;AAAA,MACzB;AAAA,KACF;AAAA,IACA,yBAAA,EAA2BC,iCAAA;AAAA,MACzB;AAAA;AACF,GACF;AAEA,EAAA,MAAM,UAAwB,EAAC;AAC/B,EAAA,IAAI,yBAAyB,CAAA,EAAG;AAC9B,IAAA,MAAM,mBAAmB,MAAA,CAAO,kBAAA;AAAA,MAC9B;AAAA,KACF;AAEA,IAAA,MAAM,MAAA,GAAS,MAAMC,qBAAA,CAAW,MAAA,CAAO;AAAA,MACrC,UAAA;AAAA,MACA,cAAA;AAAA,MACA,YAAA;AAAA,MACA,MAAA;AAAA,MACA,OAAA;AAAA,MACA,MAAA;AAAA,MACA,gBAAA;AAAA,MACA,oBAAA;AAAA,mBACAT,aAAA;AAAA,MACA,gBAAA;AAAA,MACA,OAAA;AAAA,MACA,GAAG;AAAA,KACJ,CAAA;AAED,IAAA,OAAA,CAAQ,KAAK,MAAM,CAAA;AAAA,EACrB;AAEA,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,cAAA,CAAe,SAAS,MAAM,CAAA;AAAA,EAChC;AAEA,EAAA,MAAM,gBAAgB,MAAM,OAAA,CAAQ,QAAQ,CAAA,MAAA,KAAU,MAAA,CAAO,OAAO,CAAA;AAEpE,EAAA,MAAM,kBAAkB,YAAY;AAClC,IAAA,MAAM,OAAA,CAAQ,WAAW,OAAA,CAAQ,GAAA,CAAI,YAAU,MAAA,CAAO,IAAA,EAAM,CAAC,CAAA;AAAA,EAC/D,CAAA;AAEA,EAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,IAAA,OAAA,CAAQ,SAAA,CAAU,eAAe,aAAa,CAAA;AAC9C,IAAA,OAAA,CAAQ,SAAA,CAAU,gBAAgB,eAAe,CAAA;AAAA,EACnD,CAAA,MAAO;AACL,IAAA,aAAA,EAAc;AAAA,EAChB;AAEA,EAAA,MAAM,YAAYU,+BAAA,CAAgB;AAAA,IAChC,cAAA;AAAA,IACA,YAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA;AAAA,IACA,gBAAA;AAAA,iBACAV,aAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA;AAAA,IACA,GAAG;AAAA,GACJ,CAAA;AAED,EAAA,MAAM,gBAA+C,MAAA,CAAO,MAAA;AAAA,IAC1DW;AAAA,GACF;AACA,EAAA,MAAM,cAA2C,MAAA,CAAO,MAAA;AAAA,IACtDC;AAAA,GACF;AACA,EAAA,MAAM,SAAA,GACJ,MAAA,CAAO,MAAA,CAAOC,yBAAmB,CAAA;AAEnC,EAAA,IAAI,eAAA,EAAiB;AACnB,IAAA,aAAA,CAAc,IAAA;AAAA,MACZ,GAAG,eAAA,CAAgB,MAAA,CAAOC,yCAA6B;AAAA,KACzD;AACA,IAAA,WAAA,CAAY,IAAA,CAAK,GAAG,eAAA,CAAgB,MAAA,CAAOC,uCAA2B,CAAC,CAAA;AACvE,IAAA,SAAA,CAAU,IAAA,CAAK,GAAG,eAAA,CAAgB,MAAA,CAAOC,qCAAyB,CAAC,CAAA;AAAA,EACrE;AAEA,EAAA,MAAM,oBAAA,GAAuBC,8CAAA;AAAA,IAC3B,MAAA,CAAO,OAAO,aAAa;AAAA,GAC7B;AACA,EAAA,MAAM,gBAAA,GAAmBA,8CAAA,CAA0B,MAAA,CAAO,MAAA,CAAO,SAAS,CAAC,CAAA;AAE3E,EAAA,MAAM,uBAAA,GACJC,+CAAA,CAA2B,MAAA,CAAO,MAAA,CAAO,SAAS,CAAC,CAAA;AAErD,EAAA,mBAAA,CAAoB,eAAA,CAAgB;AAAA,IAClC,WAAA,EAAaC,+CAAA;AAAA,IACb,WAAA,EAAaC,mCAAA;AAAA,IACb,KAAA,EAAO;AAAA,GACR,CAAA;AAED,EAAA,mBAAA,CAAoB,eAAA,CAAgB;AAAA,IAClC,WAAA,EAAaC,6CAAA;AAAA,IACb,WAAA,EAAaC,iCAAA;AAAA,IACb,KAAA,EAAO;AAAA,GACR,CAAA;AAED,EAAA,mBAAA,CAAoB,eAAA,CAAgB;AAAA,IAClC,WAAA,EAAaC,2CAAA;AAAA,IACb,WAAA,EAAaC,+BAAA;AAAA,IACb,KAAA,EAAO,SAAA;AAAA,IACP,YAAA,EAAc,OAAM,YAAA,KAAgB;AAClC,MAAA,OAAO,OAAA,CAAQ,GAAA;AAAA,QACb,YAAA,CAAa,GAAA,CAAI,OAAM,MAAA,KAAU;AAC/B,UAAA,OAAO,MAAM,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AAAA,QACpC,CAAC;AAAA,OACH;AAAA,IACF;AAAA,GACD,CAAA;AAED,EAAA,mBAAA,CAAoB,cAAA,CAAe;AAAA,IACjCC,0BAAA;AAAA,IACAC;AAAA,GACD,CAAA;AAED,EAAA7B,QAAA,CACG,GAAA;AAAA,IACC,uDAAA;AAAA,IACA,OAAO,KAAK,GAAA,KAAQ;AAClB,MAAA,MAAM,oBAAA,GAAuB,CAAA,EAAG,GAAA,CAAI,MAAA,CAAO,IAAI,CAAA,CAAA,EAAI,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA,CAAA,EAAI,GAAA,CAAI,MAAA,CAAO,IAAI,CAAA,CAAA;AAE1F,MAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,QAC9C,OAAA,EAAS,2BAAA;AAAA,QACT,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM,EAAE,WAAA,EAAa,oBAAA;AAAqB,OAC3C,CAAA;AAED,MAAA,IAAI;AACF,QAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAElD,QAAA,MAAM,QAAA,GAAW,MAAM,iBAAA,CAAkB,GAAA,CAAI,QAAQ,WAAW,CAAA;AAEhE,QAAA,MAAM,UAAA,GAAa,CAAC,QAAA,CAAS,IAAA,CAAK,cAAc,EAAE,EAAE,IAAA,EAAK;AAEzD,QAAA,MAAM,YAAA,GAAe,SAAS,IAAA,CAAK,YAAA;AAEnC,QAAA,MAAM,WAAA,GAAc,CAAA,EAAG,QAAA,CAAS,IAAI,CAAA,CAAA,EAClC,QAAA,CAAS,QAAA,CAAS,SAAA,IAAa,SACjC,CAAA,CAAA,EAAI,QAAA,CAAS,QAAA,CAAS,IAAI,CAAA,CAAA;AAE1B,QAAA,MAAM,cAAc,OAAA,CAAQ,EAAE,MAAM,EAAE,WAAA,IAA4B,CAAA;AAElE,QAAA,GAAA,CAAI,IAAA,CAAK;AAAA,UACP,KAAA,EAAO,QAAA,CAAS,QAAA,CAAS,KAAA,IAAS,SAAS,QAAA,CAAS,IAAA;AAAA,UACpD,GAAI,YAAA,GAAe,EAAE,YAAA,KAAiB,EAAC;AAAA,UACvC,WAAA,EAAa,SAAS,QAAA,CAAS,WAAA;AAAA,UAC/B,YAAA,EAAc,QAAA,CAAS,QAAA,CAAS,YAAY,CAAA;AAAA,UAC5C,KAAA,EAAO,UAAA,CAAW,GAAA,CAAI,CAAA,MAAA,MAAW;AAAA,YAC/B,KAAA,EACG,OAAO,KAAA,IACR,wCAAA;AAAA,YACF,aAAa,MAAA,CAAO,WAAA;AAAA,YACpB;AAAA,WACF,CAAE,CAAA;AAAA,UACF,2BAAA,EACE,SAAS,IAAA,CAAK;AAAA,SACjB,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,GACF,CACC,GAAA,CAAI,aAAA,EAAe,OAAO,KAAK,GAAA,KAAQ;AACtC,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,MAC9C,OAAA,EAAS,cAAA;AAAA,MACT,OAAA,EAAS;AAAA,KACV,CAAA;AACD,IAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAElD,IAAA,IAAI;AACF,MAAA,MAAM,OAAO,MAAM,cAAA,CAAe,IAAA,CAAK,EAAE,aAAa,CAAA;AACtD,MAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,IAAA,CAAK,QAAQ,CAAA,CACzC,IAAI,CAAA,MAAA,KAAU;AACb,QAAA,OAAO;AAAA,UACL,IAAI,MAAA,CAAO,EAAA;AAAA,UACX,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,UAAU,MAAA,CAAO,QAAA;AAAA,UACjB,QAAQ,MAAA,CAAO;AAAA,SACjB;AAAA,MACF,CAAC,CAAA,CACA,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,EAAA,CAAG,aAAA,CAAc,CAAA,CAAE,EAAE,CAAC,CAAA;AAE1C,MAAA,MAAM,cAAc,OAAA,EAAQ;AAE5B,MAAA,GAAA,CAAI,KAAK,WAAW,CAAA;AAAA,IACtB,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA,CACA,IAAA,CAAK,WAAA,EAAa,OAAO,KAAK,GAAA,KAAQ;AACrC,IAAA,MAAM,WAAA,GAAsB,IAAI,IAAA,CAAK,WAAA;AACrC,IAAA,MAAM,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAK,GAAI8B,4BAAe,WAAA,EAAa;AAAA,MAC5D,WAAA,EAAa;AAAA,KACd,CAAA;AAED,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,MAC9C,OAAA,EAAS,MAAA;AAAA,MACT,aAAA,EAAe,QAAA;AAAA,MACf,OAAA,EAAS,GAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACJ,UAAA,EAAY,QAAA;AAAA,QACZ;AAAA;AACF,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAMC,gCAAA,CAAgB;AAAA,QACpB,WAAA;AAAA,QACA,WAAA,EAAa,CAACH,0BAAoB,CAAA;AAAA,QAClC,iBAAA,EAAmBzB;AAAA,OACpB,CAAA;AAED,MAAA,MAAM,aAAA,GAAgB,KAAK,WAAA,CAAY,WAAA,EAAa,MAAM,CAAA,GACtD,WAAA,CAAY,UAAU,aAAA,GACtB,KAAA,CAAA;AAEJ,MAAA,MAAM,UAAA,GAAa,gBACf,MAAM,OAAA,CAAQ,eAAe,aAAA,EAAe,EAAE,WAAA,EAAa,CAAA,GAC3D,KAAA,CAAA;AAEJ,MAAA,IAAI,QAAA,GAAW,wBAAwB,WAAW,CAAA,CAAA;AAClD,MAAA,IAAI,aAAA,EAAe;AACjB,QAAA,QAAA,IAAY,eAAe,aAAa,CAAA,CAAA;AAAA,MAC1C;AACA,MAAA,MAAA,CAAO,KAAK,QAAQ,CAAA;AAEpB,MAAA,MAAM,MAAA,GAAS,IAAI,IAAA,CAAK,MAAA;AAExB,MAAA,MAAM,WAAW,MAAM,iBAAA;AAAA,QACrB,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAK;AAAA,QACxB;AAAA,OACF;AAEA,MAAA,KAAA,MAAW,UAAA,IAAc,CAAC,QAAA,CAAS,IAAA,CAAK,cAAc,EAAE,CAAA,CAAE,IAAA,EAAK,EAAG;AAChE,QAAA,MAAM6B,OAAAA,GAASlC,mBAAA,CAAS,MAAA,EAAQ,UAAU,CAAA;AAE1C,QAAA,IAAI,CAACkC,QAAO,KAAA,EAAO;AACjB,UAAA,MAAM,cAAc,IAAA,CAAK;AAAA;AAAA,YAEvB,KAAA,EAAQ,cAAA;AAAA,cACNA,OAAAA,CAAO,MAAA;AAAA,cACP;AAAA;AACF,WACD,CAAA;AAED,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,MAAA,EAAQA,OAAAA,CAAO,QAAQ,CAAA;AAC9C,UAAA;AAAA,QACF;AAAA,MACF;AAEA,MAAA,MAAM,YAAA,GAAe,MAAM,eAAA,CAAgB;AAAA,QACzC,QAAA;AAAA,QACA,OAAA,EAAS,GAAA,CAAI,IAAA,CAAK,OAAA,IAAW,EAAC;AAAA,QAC9B,GAAA;AAAA,QACA;AAAA,OACD,CAAA;AACD,MAAA,IAAI,CAAC,YAAA,EAAc;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAUC,yBAAiB,QAAQ,CAAA;AAEzC,MAAA,MAAM,QAAA,GAAqB;AAAA,QACzB,YAAY,QAAA,CAAS,UAAA;AAAA,QACrB,OAAO,QAAA,CAAS,IAAA,CAAK,MAAM,GAAA,CAAI,CAAC,MAAM,KAAA,MAAW;AAAA,UAC/C,GAAG,IAAA;AAAA,UACH,EAAA,EAAI,IAAA,CAAK,EAAA,IAAM,CAAA,KAAA,EAAQ,QAAQ,CAAC,CAAA,CAAA;AAAA,UAChC,IAAA,EAAM,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK;AAAA,SAC1B,CAAE,CAAA;AAAA,QACF,qBAAA,EAAuB,SAAS,IAAA,CAAK,qBAAA;AAAA,QACrC,MAAA,EAAQ,QAAA,CAAS,IAAA,CAAK,MAAA,IAAU,EAAC;AAAA,QACjC,UAAA,EAAY,MAAA;AAAA,QACZ,IAAA,EAAM;AAAA,UACJ,MAAA,EAAQ,UAAA;AAAA,UACR,GAAA,EAAK;AAAA,SACP;AAAA,QACA,YAAA,EAAc;AAAA,UACZ,WAAWC,+BAAA,CAAmB,EAAE,IAAA,EAAM,IAAA,EAAM,WAAW,CAAA;AAAA,UACvD,OAAA;AAAA,UACA,MAAA,EAAQ;AAAA,YACN,UAAU,QAAA,CAAS;AAAA;AACrB;AACF,OACF;AAEA,MAAA,MAAM,OAAA,GAA+B;AAAA,QACnC,GAAG,IAAI,IAAA,CAAK,OAAA;AAAA,QACZ,gBAAiB,WAAA,CAAoB,KAAA;AAAA,QACrC,sBAAA,EAAwB,KAAK,SAAA,CAAU;AAAA,UACrC,GAAG,WAAA;AAAA;AAAA,UAEH,OAAQ,WAAA,CAAoB;AAAA,SAC7B;AAAA,OACH;AAEA,MAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,QAAA,CAAS;AAAA,QACvC,IAAA,EAAM,QAAA;AAAA,QACN,SAAA,EAAW,aAAA;AAAA,QACX;AAAA,OACD,CAAA;AAED,MAAA,MAAM,YAAA,EAAc,QAAQ,EAAE,IAAA,EAAM,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAO,EAAG,CAAA;AAE/D,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,EAAA,EAAI,MAAA,CAAO,QAAQ,CAAA;AAAA,IAC5C,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA,CACA,GAAA,CAAI,WAAA,EAAa,OAAO,KAAK,GAAA,KAAQ;AACpC,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,MAC9C,OAAA,EAAS,MAAA;AAAA,MACT,OAAA,EAAS,GAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACJ,UAAA,EAAY;AAAA;AACd,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAElD,MAAA,IAAI,CAAC,WAAW,IAAA,EAAM;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AAEA,MAAA,MAAM,SAAA,GAAYC,yBAAA,CAAkB,GAAA,CAAI,KAAA,CAAM,WAAW,WAAW,CAAA;AACpE,MAAA,MAAM,MAAA,GAASA,yBAAA,CAAkB,GAAA,CAAI,KAAA,CAAM,QAAQ,QAAQ,CAAA;AAE3D,MAAA,MAAM,KAAA,GAAQA,0BAAkB,GAAA,CAAI,KAAA,CAAM,OAAO,OAAO,CAAA,EAAG,IAAI,CAAA,IAAA,KAAQ;AACrE,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,mBAAmB,CAAA;AAC5C,QAAA,IAAI,CAAC,KAAA,EAAO;AACV,UAAA,MAAM,IAAIpC,iBAAA;AAAA,YACR,4BAA4B,IAAI,CAAA,wCAAA;AAAA,WAClC;AAAA,QACF;AAEA,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,MAAM,CAAC,CAAA;AAAA,UACd,KAAA,EAAO,MAAM,CAAC;AAAA,SAChB;AAAA,MACF,CAAC,CAAA;AAED,MAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,GAAA,CAAI,KAAA;AAE9B,MAAA,MAAM,qBAAA,GAAwB,MAAMqC,uCAAA,CAAuB;AAAA,QACzD,WAAA;AAAA,QACA,UAAA,EAAYC,wBAAA;AAAA,QACZ,iBAAA,EAAmBlC,aAAA;AAAA,QACnB,mBAAA,EAAqB;AAAA,OACtB,CAAA;AAED,MAAA,MAAM,KAAA,GAAQ,MAAM,UAAA,CAAW,IAAA,CAAK;AAAA,QAClC,OAAA,EAAS;AAAA,UACP,SAAA;AAAA,UACA,MAAA,EAAQ,SAAU,MAAA,GAA0B,KAAA;AAAA,SAC9C;AAAA,QACA,KAAA;AAAA,QACA,UAAA,EAAY;AAAA,UACV,KAAA;AAAA,UACA;AAAA,SACF;AAAA,QACA,iBAAA,EAAmB;AAAA,OACpB,CAAA;AAED,MAAA,MAAM,cAAc,OAAA,EAAQ;AAE5B,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,KAAK,CAAA;AAAA,IAC5B,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA,CACA,GAAA,CAAI,mBAAA,EAAqB,OAAO,KAAK,GAAA,KAAQ;AAC5C,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,GAAA,CAAI,MAAA;AAEvB,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,MAC9C,OAAA,EAAS,MAAA;AAAA,MACT,OAAA,EAAS,GAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACJ,UAAA,EAAY,KAAA;AAAA,QACZ;AAAA;AACF,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAElD,MAAA,MAAM,IAAA,GAAO,MAAM,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AAExC,MAAA,MAAMmC,oCAAA,CAAoB;AAAA,QACxB,WAAA;AAAA,QACA,WAAA,EAAa,CAACD,wBAAkB,CAAA;AAAA,QAChC,iBAAA,EAAmBlC,aAAA;AAAA,QACnB,IAAA;AAAA,QACA;AAAA,OACD,CAAA;AAED,MAAA,IAAI,CAAC,IAAA,EAAM;AACT,QAAA,MAAM,IAAIoC,oBAAA,CAAc,CAAA,aAAA,EAAgB,MAAM,CAAA,eAAA,CAAiB,CAAA;AAAA,MACjE;AAEA,MAAA,MAAM,cAAc,OAAA,EAAQ;AAG5B,MAAA,OAAO,IAAA,CAAK,OAAA;AACZ,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AAAA,IAC3B,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA,CACA,IAAA,CAAK,0BAAA,EAA4B,OAAO,KAAK,GAAA,KAAQ;AACpD,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,GAAA,CAAI,MAAA;AAEvB,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,MAC9C,OAAA,EAAS,MAAA;AAAA,MACT,aAAA,EAAe,QAAA;AAAA,MACf,OAAA,EAAS,GAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACJ,UAAA,EAAY,QAAA;AAAA,QACZ;AAAA;AACF,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,IAAA,GAAO,MAAM,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AAExC,MAAA,MAAMD,oCAAA,CAAoB;AAAA,QACxB,WAAA;AAAA,QACA,WAAA,EAAa,CAACE,0BAAA,EAAsBH,wBAAkB,CAAA;AAAA,QACtD,iBAAA,EAAmBlC,aAAA;AAAA,QACnB,IAAA;AAAA,QACA;AAAA,OACD,CAAA;AAED,MAAA,MAAM,UAAA,CAAW,SAAS,MAAM,CAAA;AAEhC,MAAA,MAAM,cAAc,OAAA,EAAQ;AAE5B,MAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,MAAA,EAAQ,aAAa,CAAA;AAAA,IAC9C,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA,CACA,IAAA,CAAK,yBAAA,EAA2B,OAAO,KAAK,GAAA,KAAQ;AACnD,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,GAAA,CAAI,MAAA;AAEvB,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,MAC9C,OAAA,EAAS,MAAA;AAAA,MACT,aAAA,EAAe,QAAA;AAAA,MACf,OAAA,EAAS,GAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACJ,UAAA,EAAY,OAAA;AAAA,QACZ;AAAA;AACF,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,IAAA,GAAO,MAAM,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AAGxC,MAAA,MAAM4B,gCAAA,CAAgB;AAAA,QACpB,WAAA;AAAA,QACA,WAAA,EAAa,CAACH,0BAAoB,CAAA;AAAA,QAClC,iBAAA,EAAmBzB;AAAA,OACpB,CAAA;AAED,MAAA,MAAMmC,oCAAA,CAAoB;AAAA,QACxB,WAAA;AAAA,QACA,WAAA,EAAa,CAACD,wBAAkB,CAAA;AAAA,QAChC,iBAAA,EAAmBlC,aAAA;AAAA,QACnB,IAAA;AAAA,QACA;AAAA,OACD,CAAA;AAGD,MAAA,IAAI,IAAA,CAAK,IAAA,CAAK,YAAA,EAAc,SAAA,EAAW;AACrC,QAAA,MAAM,iBAAA,GAAoB2B,2BAAA;AAAA,UACxB,IAAA,CAAK,KAAK,YAAA,CAAa,SAAA;AAAA,UACvB,EAAE,aAAa,UAAA;AAAW,SAC5B;AACA,QAAA,MAAM,WAAW,MAAM,iBAAA;AAAA,UACrB,iBAAA;AAAA,UACA;AAAA,SACF;AAEA,QAAA,MAAM,YAAA,GAAe,MAAM,eAAA,CAAgB;AAAA,UACzC,QAAA;AAAA,UACA,OAAA,EAAS,GAAA,CAAI,IAAA,CAAK,OAAA,IAAW,EAAC;AAAA,UAC9B,GAAA;AAAA,UACA;AAAA,SACD,CAAA;AACD,QAAA,IAAI,CAAC,YAAA,EAAc;AACjB,UAAA;AAAA,QACF;AAAA,MACF;AAEA,MAAA,MAAM,cAAc,OAAA,EAAQ;AAE5B,MAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,KAAK,qBAAA,CAAsB;AAAA,QACjD,UAAA,EAAY,WAAA;AAAA,QACZ,cAAA,EAAgB;AAAA,OACjB,CAAA;AAED,MAAA,MAAM,OAAA,GAA+B;AAAA,QACnC,GAAG,IAAI,IAAA,CAAK,OAAA;AAAA,QACZ,cAAA,EAAgB,KAAA;AAAA,QAChB,sBAAA,EAAwB,KAAK,SAAA,CAAU;AAAA,UACrC,GAAG,WAAA;AAAA;AAAA,UAEH,OAAQ,WAAA,CAAoB;AAAA,SAC7B;AAAA,OACH;AAEA,MAAA,MAAM,UAAA,CAAW,KAAA,GAAQ,EAAE,OAAA,EAAS,QAAQ,CAAA;AAC5C,MAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,EAAA,EAAI,QAAQ,CAAA;AAAA,IACrC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA;AACH,EAAC9B,QAAA,CAA0B,GAAA;AAAA,IACzB,+BAAA;AAAA,IACA,OAAO,KAAK,GAAA,KAAQ;AAClB,MAAA,MAAM,EAAE,MAAA,EAAO,GAAI,GAAA,CAAI,MAAA;AAEvB,MAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,QAC9C,OAAA,EAAS,MAAA;AAAA,QACT,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM;AAAA,UACJ,UAAA,EAAY,QAAA;AAAA,UACZ;AAAA;AACF,OACD,CAAA;AAED,MAAA,IAAI;AACF,QAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,QAAA,MAAM,IAAA,GAAO,MAAM,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AAExC,QAAA,MAAMsC,oCAAA,CAAoB;AAAA,UACxB,WAAA;AAAA,UACA,WAAA,EAAa,CAACD,wBAAkB,CAAA;AAAA,UAChC,iBAAA,EAAmBlC,aAAA;AAAA,UACnB,IAAA;AAAA,UACA;AAAA,SACD,CAAA;AAED,QAAA,MAAM,KAAA,GACJ,IAAI,KAAA,CAAM,KAAA,KAAU,SAAY,MAAA,CAAO,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA,GAAI,KAAA,CAAA;AAE5D,QAAA,MAAA,CAAO,KAAA,CAAM,CAAA,+BAAA,EAAkC,MAAM,CAAA,QAAA,CAAU,CAAA;AAG/D,QAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,UACjB,UAAA,EAAY,YAAA;AAAA,UACZ,eAAA,EAAiB,UAAA;AAAA,UACjB,cAAA,EAAgB;AAAA,SACjB,CAAA;AAGD,QAAA,MAAM,YAAA,GAAe,WAAW,MAAA,CAAO,EAAE,QAAQ,KAAA,EAAO,EAAE,SAAA,CAAU;AAAA,UAClE,KAAA,EAAO,OAAM,KAAA,KAAS;AACpB,YAAA,MAAA,CAAO,KAAA;AAAA,cACL,CAAA,wDAAA,EAA2D,MAAM,CAAA,GAAA,EAAM,KAAK,CAAA;AAAA,aAC9E;AACA,YAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAc,CAAA;AACzC,YAAA,GAAA,CAAI,GAAA,EAAI;AAAA,UACV,CAAA;AAAA,UACA,IAAA,EAAM,CAAC,EAAE,MAAA,EAAO,KAAM;AACpB,YAAA,IAAI,iBAAA,GAAoB,KAAA;AACxB,YAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,cAAA,GAAA,CAAI,KAAA;AAAA,gBACF,CAAA,OAAA,EAAU,MAAM,IAAI;AAAA,MAAA,EAAW,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC;;AAAA;AAAA,eACtD;AACA,cAAA,IAAI,KAAA,CAAM,IAAA,KAAS,YAAA,IAAgB,CAAC,MAAM,iBAAA,EAAmB;AAC3D,gBAAA,iBAAA,GAAoB,IAAA;AAAA,cACtB;AAAA,YACF;AAEA,YAAA,GAAA,CAAI,KAAA,IAAQ;AACZ,YAAA,IAAI,iBAAA,EAAmB;AACrB,cAAA,YAAA,CAAa,WAAA,EAAY;AACzB,cAAA,GAAA,CAAI,GAAA,EAAI;AAAA,YACV;AAAA,UACF;AAAA,SACD,CAAA;AAID,QAAA,GAAA,CAAI,EAAA,CAAG,SAAS,YAAY;AAC1B,UAAA,YAAA,CAAa,WAAA,EAAY;AACzB,UAAA,MAAA,CAAO,KAAA,CAAM,CAAA,+BAAA,EAAkC,MAAM,CAAA,QAAA,CAAU,CAAA;AAC/D,UAAA,MAAM,cAAc,OAAA,EAAQ;AAAA,QAC9B,CAAC,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,GACF;AACA,EAAAH,QAAA,CACG,GAAA,CAAI,0BAAA,EAA4B,OAAO,GAAA,EAAK,GAAA,KAAQ;AACnD,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,GAAA,CAAI,MAAA;AAEvB,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,MAC9C,OAAA,EAAS,MAAA;AAAA,MACT,OAAA,EAAS,GAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACJ,UAAA,EAAY,QAAA;AAAA,QACZ;AAAA;AACF,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,IAAA,GAAO,MAAM,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AAExC,MAAA,MAAMsC,oCAAA,CAAoB;AAAA,QACxB,WAAA;AAAA,QACA,WAAA,EAAa,CAACD,wBAAkB,CAAA;AAAA,QAChC,iBAAA,EAAmBlC,aAAA;AAAA,QACnB,IAAA;AAAA,QACA;AAAA,OACD,CAAA;AAED,MAAA,MAAM,KAAA,GACJ,IAAI,KAAA,CAAM,KAAA,KAAU,SAAY,MAAA,CAAO,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA,GAAI,KAAA,CAAA;AAG5D,MAAA,MAAM,OAAA,GAAU,WAAW,MAAM;AAC/B,QAAA,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA;AAAA,MACb,GAAG,GAAM,CAAA;AAGT,MAAA,MAAM,YAAA,GAAe,WAAW,MAAA,CAAO,EAAE,QAAQ,KAAA,EAAO,EAAE,SAAA,CAAU;AAAA,QAClE,KAAA,EAAO,OAAM,KAAA,KAAS;AACpB,UAAA,MAAA,CAAO,KAAA;AAAA,YACL,CAAA,wDAAA,EAA2D,MAAM,CAAA,GAAA,EAAM,KAAK,CAAA;AAAA,WAC9E;AACA,UAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAc,CAAA;AAAA,QAC3C,CAAA;AAAA,QACA,IAAA,EAAM,OAAO,EAAE,MAAA,EAAO,KAAM;AAC1B,UAAA,YAAA,CAAa,OAAO,CAAA;AACpB,UAAA,YAAA,CAAa,WAAA,EAAY;AACzB,UAAA,MAAM,cAAc,OAAA,EAAQ;AAC5B,UAAA,GAAA,CAAI,KAAK,MAAM,CAAA;AAAA,QACjB;AAAA,OACD,CAAA;AAID,MAAA,GAAA,CAAI,EAAA,CAAG,SAAS,MAAM;AACpB,QAAA,YAAA,CAAa,WAAA,EAAY;AACzB,QAAA,YAAA,CAAa,OAAO,CAAA;AAAA,MACtB,CAAC,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA,CACA,IAAA,CAAK,aAAA,EAAe,OAAO,KAAK,GAAA,KAAQ;AACvC,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,MAC9C,OAAA,EAAS,MAAA;AAAA,MACT,OAAA,EAAS,GAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACJ,UAAA,EAAY;AAAA;AACd,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM4B,gCAAA,CAAgB;AAAA,QACpB,WAAA;AAAA,QACA,WAAA,EAAa,CAACH,0BAAoB,CAAA;AAAA,QAClC,iBAAA,EAAmBzB;AAAA,OACpB,CAAA;AAED,MAAA,MAAM,UAAA,GAAasC,KAAE,MAAA,CAAO;AAAA,QAC1B,QAAA,EAAUA,KAAE,OAAA,EAAQ;AAAA,QACpB,MAAA,EAAQA,IAAA,CAAE,MAAA,CAAOA,IAAA,CAAE,SAAS,CAAA;AAAA,QAC5B,SAASA,IAAA,CAAE,MAAA,CAAOA,KAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,QACvC,mBAAmBA,IAAA,CAAE,KAAA;AAAA,UACnBA,IAAA,CAAE,MAAA,CAAO,EAAE,IAAA,EAAMA,IAAA,CAAE,MAAA,EAAO,EAAG,aAAA,EAAeA,IAAA,CAAE,MAAA,EAAO,EAAG;AAAA;AAC1D,OACD,CAAA;AACD,MAAA,MAAM,IAAA,GAAO,MAAM,UAAA,CAAW,UAAA,CAAW,IAAI,IAAI,CAAA,CAAE,MAAM,CAAA,CAAA,KAAK;AAC5D,QAAA,MAAM,IAAI1C,iBAAA,CAAW,CAAA,mBAAA,EAAsB,CAAC,CAAA,CAAE,CAAA;AAAA,MAChD,CAAC,CAAA;AAED,MAAA,MAAM,WAAW,IAAA,CAAK,QAAA;AACtB,MAAA,IAAI,CAAE,MAAM2C,qDAAA,CAA+B,KAAA,CAAM,QAAQ,CAAA,EAAI;AAC3D,QAAA,MAAM,IAAI3C,kBAAW,kCAAkC,CAAA;AAAA,MACzD;AAEA,MAAA,MAAM,aAAA,GAAgB,KAAK,WAAA,CAAY,WAAA,EAAa,MAAM,CAAA,GACtD,WAAA,CAAY,UAAU,aAAA,GACtB,KAAA,CAAA;AAEJ,MAAA,MAAM,UAAA,GAAa,gBACf,MAAM,OAAA,CAAQ,eAAe,aAAA,EAAe,EAAE,WAAA,EAAa,CAAA,GAC3D,KAAA,CAAA;AAEJ,MAAA,MAAM,WAAA,GAAsB,CAAA,EAAG,QAAA,CAAS,IAAI,CAAA,CAAA,EAC1C,QAAA,CAAS,QAAA,CAAS,SAAA,IAAa,SACjC,CAAA,CAAA,EAAI,QAAA,CAAS,QAAA,CAAS,IAAI,CAAA,CAAA;AAE1B,MAAA,KAAA,MAAW,UAAA,IAAc,CAAC,QAAA,CAAS,IAAA,CAAK,cAAc,EAAE,CAAA,CAAE,IAAA,EAAK,EAAG;AAChE,QAAA,MAAMiC,OAAAA,GAASlC,mBAAA,CAAS,IAAA,CAAK,MAAA,EAAQ,UAAU,CAAA;AAC/C,QAAA,IAAI,CAACkC,QAAO,KAAA,EAAO;AACjB,UAAA,MAAM,cAAc,IAAA,CAAK;AAAA;AAAA,YAEvB,KAAA,EAAQ,cAAA;AAAA,cACNA,OAAAA,CAAO,MAAA;AAAA,cACP;AAAA,aACF;AAAA,YACA,IAAA,EAAM;AAAA,cACJ,WAAA;AAAA,cACA,UAAA,EAAY,SAAS,IAAA,CAAK;AAAA;AAC5B,WACD,CAAA;AAED,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,MAAA,EAAQA,OAAAA,CAAO,QAAQ,CAAA;AAC9C,UAAA;AAAA,QACF;AAAA,MACF;AAEA,MAAA,MAAM,YAAA,GAAe,MAAM,eAAA,CAAgB;AAAA,QACzC,QAAA;AAAA,QACA,OAAA,EAAS,IAAA,CAAK,OAAA,IAAW,EAAC;AAAA,QAC1B,GAAA;AAAA,QACA;AAAA,OACD,CAAA;AACD,MAAA,IAAI,CAAC,YAAA,EAAc;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,QAAQ,QAAA,CAAS,IAAA,CAAK,MAAM,GAAA,CAAI,CAAC,MAAM,KAAA,MAAW;AAAA,QACtD,GAAG,IAAA;AAAA,QACH,EAAA,EAAI,IAAA,CAAK,EAAA,IAAM,CAAA,KAAA,EAAQ,QAAQ,CAAC,CAAA,CAAA;AAAA,QAChC,IAAA,EAAM,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK;AAAA,OAC1B,CAAE,CAAA;AAEF,MAAA,MAAM,WAAWW,sBAAA,EAAK;AACtB,MAAA,MAAM,YAAA,GAAeC,qCAAA;AAAA,QACnB,gBAAA;AAAA,QACA,mBAAmB,QAAQ,CAAA;AAAA,OAC7B;AACA,MAAA,MAAM,YAAA,GAAe;AAAA,QACnB,SAAA,EAAW,0BAAA;AAAA,QACX,MAAA,EAAQ;AAAA,UACN,UAAU,QAAA,CAAS;AAAA,SACrB;AAAA,QACA,OAAA,EAASC,sBAAA;AAAA,UACPD,qCAAA,CAAqB,cAAc,eAAe;AAAA,UAClD,QAAA;AAAS,OACb;AAEA,MAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU;AAAA,QAC7B,IAAA,EAAM;AAAA,UACJ,YAAY,QAAA,CAAS,UAAA;AAAA,UACrB,KAAA;AAAA,UACA,MAAA,EAAQ,QAAA,CAAS,IAAA,CAAK,MAAA,IAAU,EAAC;AAAA,UACjC,YAAY,IAAA,CAAK,MAAA;AAAA,UACjB,IAAA,EAAM;AAAA,YACJ,MAAA,EAAQ,UAAA;AAAA,YACR,GAAA,EAAK;AAAA;AACP,SACF;AAAA,QACA,YAAA;AAAA,QACA,oBAAoB,IAAA,CAAK,iBAAA,IAAqB,EAAC,EAAG,IAAI,CAAA,IAAA,MAAS;AAAA,UAC7D,MAAM,IAAA,CAAK,IAAA;AAAA,UACX,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,eAAe,QAAQ;AAAA,SACnD,CAAE,CAAA;AAAA,QACF,OAAA,EAAS;AAAA,UACP,GAAG,IAAA,CAAK,OAAA;AAAA,UACR,gBAAiB,WAAA,CAAoB;AAAA,SACvC;AAAA,QACA;AAAA,OACD,CAAA;AAED,MAAA,MAAM,cAAc,OAAA,CAAQ;AAAA,QAC1B,IAAA,EAAM;AAAA,UACJ,WAAA;AAAA,UACA,UAAA,EAAY,SAAS,IAAA,CAAK;AAAA;AAC5B,OACD,CAAA;AAED,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,QACnB,GAAG,MAAA;AAAA,QACH,KAAA;AAAA,QACA,iBAAA,EAAmB,MAAA,CAAO,iBAAA,CAAkB,GAAA,CAAI,CAAA,IAAA,MAAS;AAAA,UACvD,MAAM,IAAA,CAAK,IAAA;AAAA,UACX,YAAY,IAAA,CAAK,UAAA;AAAA,UACjB,aAAA,EAAe,IAAA,CAAK,OAAA,CAAQ,QAAA,CAAS,QAAQ;AAAA,SAC/C,CAAE;AAAA,OACH,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA,CACA,IAAA,CAAK,sCAAA,EAAwC,OAAO,KAAK,GAAA,KAAQ;AAChE,IAAA,MAAM,EAAE,KAAA,EAAO,OAAA,EAAQ,GAAI,GAAA,CAAI,IAAA;AAC/B,IAAA,MAAM,EAAE,QAAA,EAAU,QAAA,EAAS,GAAI,GAAA,CAAI,MAAA;AAEnC,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI7C,kBAAW,+BAA+B,CAAA;AAEhE,IAAA,IAAI,CAAC,oBAAA,CAAqB,QAAQ,CAAA,EAAG;AACnC,MAAA,MAAM,IAAIA,iBAAA,CAAW,CAAA,sBAAA,EAAyB,QAAQ,CAAA,CAAE,CAAA;AAAA,IAC1D;AAEA,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,oBAAA,CAAqB,QAAQ,CAAA,CAAE;AAAA,MACvD,QAAA;AAAA,MACA,KAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,SAAS,CAAA;AAAA,EAClC,CAAC,CAAA,CACA,GAAA,CAAI,2BAAA,EAA6B,OAAO,MAAM,GAAA,KAAQ;AACrD,IAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,MACnB,OAAA,EAAS;AAAA,QACP,GAAG+C,gCAAA,CAAsBC,yCAAA,CAAqB,EAAE,YAAA,EAAc,CAAC,CAAA;AAAA,QAC/D,GAAGD,iCAAsB,yBAAyB;AAAA,OACpD;AAAA,MACA,OAAA,EAAS;AAAA,QACP,SAAA,EAAWE,yCAA8B,yBAAyB,CAAA;AAAA,QAClE,MAAA,EAAQC,sCAA2B,yBAAyB;AAAA;AAC9D,KACD,CAAA;AAAA,EACH,CAAC,CAAA;AAEH,EAAA,MAAM,MAAM/C,wBAAA,EAAQ;AACpB,EAAA,GAAA,CAAI,GAAA,CAAI,UAAU,MAAM,CAAA;AACxB,EAAA,GAAA,CAAI,GAAA,CAAI,KAAKF,QAAM,CAAA;AAEnB,EAAA,eAAe,iBAAA,CACb,WACA,WAAA,EACA;AACA,IAAA,MAAM,QAAA,GAAW,MAAMkD,oBAAA,CAAa;AAAA,MAClC,OAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,IAAI,CAAC,mBAAA,CAAoB,QAAQ,CAAA,EAAG;AAClC,MAAA,MAAM,IAAInD,iBAAA;AAAA,QACR,CAAA,+CAAA,EACG,SAAoB,UACvB,CAAA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAI,CAACI,aAAA,EAAa;AAChB,MAAA,OAAO,QAAA;AAAA,IACT;AAEA,IAAA,MAAM,CAAC,iBAAA,EAAmB,YAAY,CAAA,GACpC,MAAMA,aAAA,CAAY,oBAAA;AAAA,MAChB;AAAA,QACE,EAAE,YAAYgD,qCAAA,EAAgC;AAAA,QAC9C,EAAE,YAAYC,gCAAA;AAA2B,OAC3C;AAAA,MACA,EAAE,WAAA;AAAY,KAChB;AAGF,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,QAAA,CAAS,IAAA,CAAK,UAAU,CAAA,EAAG;AAC3C,MAAA,QAAA,CAAS,IAAA,CAAK,UAAA,GAAa,QAAA,CAAS,IAAA,CAAK,UAAA,CAAW,MAAA;AAAA,QAAO,CAAA,IAAA,KACzD,oBAAA,CAAqB,iBAAA,EAAmB,IAAI;AAAA,OAC9C;AAAA,IACF,CAAA,MAAA,IACE,QAAA,CAAS,IAAA,CAAK,UAAA,IACd,CAAC,qBAAqB,iBAAA,EAAmB,QAAA,CAAS,IAAA,CAAK,UAAU,CAAA,EACjE;AACA,MAAA,QAAA,CAAS,KAAK,UAAA,GAAa,MAAA;AAAA,IAC7B;AAGA,IAAA,QAAA,CAAS,IAAA,CAAK,KAAA,GAAQ,QAAA,CAAS,IAAA,CAAK,KAAA,CAAM,MAAA;AAAA,MAAO,CAAA,IAAA,KAC/C,oBAAA,CAAqB,YAAA,EAAc,IAAI;AAAA,KACzC;AAEA,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,OAAO,GAAA;AACT;;;;"}
+{"version":3,"file":"router.cjs.js","sources":["../../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  AuditorService,\n  AuditorServiceEvent,\n  AuthService,\n  BackstageCredentials,\n  DatabaseService,\n  HttpAuthService,\n  LifecycleService,\n  LoggerService,\n  PermissionsRegistryService,\n  PermissionsService,\n  resolveSafeChildPath,\n  SchedulerService,\n} from '@backstage/backend-plugin-api';\nimport { validate, ValidatorResult } from 'jsonschema';\nimport {\n  CompoundEntityRef,\n  Entity,\n  parseEntityRef,\n  stringifyEntityRef,\n  UserEntity,\n} from '@backstage/catalog-model';\nimport { Config, readDurationFromConfig } from '@backstage/config';\nimport { InputError, NotFoundError } from '@backstage/errors';\nimport { ScmIntegrations } from '@backstage/integration';\n\nimport { EventsService } from '@backstage/plugin-events-node';\n\nimport {\n  ConditionTransformer,\n  createConditionAuthorizer,\n  createConditionTransformer,\n} from '@backstage/plugin-permission-node';\nimport {\n  TaskSpec,\n  TemplateEntityV1beta3,\n  templateEntityV1beta3Validator,\n} from '@backstage/plugin-scaffolder-common';\nimport {\n  scaffolderActionPermissions,\n  scaffolderTaskPermissions,\n  scaffolderTemplatePermissions,\n  taskCancelPermission,\n  taskCreatePermission,\n  taskReadPermission,\n  templateManagementPermission,\n  templateParameterReadPermission,\n  templateStepReadPermission,\n} from '@backstage/plugin-scaffolder-common/alpha';\nimport {\n  TaskBroker,\n  TaskFilters,\n  TaskStatus,\n  TemplateAction,\n  TemplateFilter,\n  TemplateGlobal,\n} from '@backstage/plugin-scaffolder-node';\nimport {\n  AutocompleteHandler,\n  CreatedTemplateFilter,\n  CreatedTemplateGlobal,\n  scaffolderActionPermissionResourceRef,\n  scaffolderTaskPermissionResourceRef,\n  scaffolderTemplatePermissionResourceRef,\n  WorkspaceProvider,\n} from '@backstage/plugin-scaffolder-node/alpha';\nimport { HumanDuration, JsonObject } from '@backstage/types';\nimport express from 'express';\nimport { Duration } from 'luxon';\nimport { pathToFileURL } from 'node:url';\nimport { randomUUID as uuid } from 'node:crypto';\nimport { z } from 'zod/v3';\nimport {\n  DatabaseTaskStore,\n  DefaultTemplateActionRegistry,\n  TaskWorker,\n} from '../scaffolder';\nimport { createDryRunner } from '../scaffolder/dryrun';\nimport { StorageTaskBroker } from '../scaffolder/tasks/StorageTaskBroker';\nimport { InternalTaskSecrets } from '../scaffolder/tasks/types';\nimport { createOpenApiRouter } from '../schema/openapi';\nimport {\n  checkPermission,\n  checkTaskPermission,\n  getAuthorizeConditions,\n} from '../util/checkPermissions';\nimport {\n  findTemplate,\n  getEntityBaseUrl,\n  getWorkingDirectory,\n  parseStringsParam,\n} from './helpers';\n\nimport {\n  convertFiltersToRecord,\n  convertGlobalsToRecord,\n  extractFilterMetadata,\n  extractGlobalFunctionMetadata,\n  extractGlobalValueMetadata,\n} from '../util/templating';\nimport { createDefaultFilters } from '../lib/templating/filters/createDefaultFilters';\nimport {\n  ActionPermissionRuleInput,\n  isActionPermissionRuleInput,\n  isTaskPermissionRuleInput,\n  isTemplatePermissionRuleInput,\n  ScaffolderPermissionRuleInput,\n  TaskPermissionRuleInput,\n  TemplatePermissionRuleInput,\n} from './permissions';\nimport { CatalogService } from '@backstage/plugin-catalog-node';\n\nimport {\n  scaffolderActionRules,\n  scaffolderTaskRules,\n  scaffolderTemplateRules,\n} from './rules';\nimport {\n  ActionsService,\n  MetricsService,\n} from '@backstage/backend-plugin-api/alpha';\n\n/**\n * RouterOptions\n */\nexport interface RouterOptions {\n  logger: LoggerService;\n  config: Config;\n  lifecycle?: LifecycleService;\n  database: DatabaseService;\n  catalog: CatalogService;\n  scheduler?: SchedulerService;\n  actions?: TemplateAction<any, any, any>[];\n  /**\n   * Sets the number of concurrent tasks that can be run at any given time on the TaskWorker\n   * @defaultValue 10\n   */\n  concurrentTasksLimit?: number;\n  taskBroker?: TaskBroker;\n  additionalTemplateFilters?:\n    | Record<string, TemplateFilter>\n    | CreatedTemplateFilter<any, any>[];\n  additionalTemplateGlobals?:\n    | Record<string, TemplateGlobal>\n    | CreatedTemplateGlobal[];\n  additionalWorkspaceProviders?: Record<string, WorkspaceProvider>;\n  permissions?: PermissionsService;\n  permissionsRegistry: PermissionsRegistryService;\n  permissionRules?: Array<ScaffolderPermissionRuleInput>;\n  auth: AuthService;\n  httpAuth: HttpAuthService;\n  events?: EventsService;\n  auditor?: AuditorService;\n  autocompleteHandlers?: Record<string, AutocompleteHandler>;\n  actionsRegistry: ActionsService;\n  metrics: MetricsService;\n}\n\nfunction isSupportedTemplate(entity: TemplateEntityV1beta3) {\n  return entity.apiVersion === 'scaffolder.backstage.io/v1beta3';\n}\n\nconst readDuration = (\n  config: Config,\n  key: string,\n  defaultValue: HumanDuration,\n) => {\n  if (config.has(key)) {\n    return readDurationFromConfig(config, { key });\n  }\n  return defaultValue;\n};\n\nfunction formatSecretsValidationErrors(result: ValidatorResult) {\n  return result.errors.map(err => {\n    const property = err.property.replace(/^instance/, 'secrets');\n    const secretName = err.argument;\n    const message =\n      err.name === 'required'\n        ? `secrets.${secretName} is required`\n        : `${property} ${err.message}`;\n    return {\n      ...err,\n      property,\n      message,\n      instance: {},\n    };\n  });\n}\n\nasync function validateSecrets(options: {\n  template: TemplateEntityV1beta3;\n  secrets: Record<string, unknown>;\n  res: express.Response;\n  auditorEvent?: AuditorServiceEvent;\n}): Promise<boolean> {\n  const { template, secrets, res, auditorEvent } = options;\n  if (!template.spec.secrets?.schema) {\n    return true;\n  }\n\n  const result = validate(secrets, template.spec.secrets.schema);\n  if (result.valid) {\n    return true;\n  }\n\n  await auditorEvent?.fail({\n    error: new InputError('Secrets validation failed'),\n  });\n\n  res.status(400).json({\n    errors: formatSecretsValidationErrors(result),\n  });\n  return false;\n}\n\n/**\n * A method to create a router for the scaffolder backend plugin.\n */\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const router = await createOpenApiRouter({\n    middleware: [\n      // Be generous in upload size to support a wide range of templates in dry-run mode.\n      express.json({ limit: '10MB' }),\n    ],\n  });\n\n  const {\n    logger: parentLogger,\n    config,\n    database,\n    catalog,\n    actions = [],\n    scheduler,\n    additionalTemplateFilters,\n    additionalTemplateGlobals,\n    additionalWorkspaceProviders,\n    permissions,\n    permissionsRegistry,\n    permissionRules,\n    autocompleteHandlers = {},\n    events: eventsService,\n    auth,\n    httpAuth,\n    auditor,\n    actionsRegistry,\n    metrics,\n  } = options;\n\n  const concurrentTasksLimit =\n    options.concurrentTasksLimit ??\n    options.config.getOptionalNumber('scaffolder.concurrentTasksLimit');\n\n  const logger = parentLogger.child({ plugin: 'scaffolder' });\n\n  const workingDirectory = await getWorkingDirectory(config, logger);\n  const integrations = ScmIntegrations.fromConfig(config);\n\n  let taskBroker: TaskBroker;\n  if (!options.taskBroker) {\n    const databaseTaskStore = await DatabaseTaskStore.create({\n      database,\n      events: eventsService,\n    });\n    taskBroker = new StorageTaskBroker(\n      databaseTaskStore,\n      logger,\n      config,\n      auth,\n      additionalWorkspaceProviders,\n      auditor,\n    );\n\n    if (scheduler && databaseTaskStore.listStaleTasks) {\n      await scheduler.scheduleTask({\n        id: 'close_stale_tasks',\n        frequency: readDuration(\n          config,\n          'scaffolder.taskTimeoutJanitorFrequency',\n          {\n            minutes: 5,\n          },\n        ),\n        timeout: { minutes: 15 },\n        fn: async () => {\n          const { tasks } = await databaseTaskStore.listStaleTasks({\n            timeoutS: Duration.fromObject(\n              readDuration(config, 'scaffolder.taskTimeout', {\n                hours: 24,\n              }),\n            ).as('seconds'),\n          });\n\n          for (const task of tasks) {\n            await databaseTaskStore.shutdownTask(task);\n            logger.info(`Successfully closed stale task ${task.taskId}`);\n          }\n        },\n      });\n    }\n  } else {\n    taskBroker = options.taskBroker;\n  }\n\n  const actionRegistry = new DefaultTemplateActionRegistry(\n    actionsRegistry,\n    logger,\n  );\n\n  const templateExtensions = {\n    additionalTemplateFilters: convertFiltersToRecord(\n      additionalTemplateFilters,\n    ),\n    additionalTemplateGlobals: convertGlobalsToRecord(\n      additionalTemplateGlobals,\n    ),\n  };\n\n  const workers: TaskWorker[] = [];\n  if (concurrentTasksLimit !== 0) {\n    const gracefulShutdown = config.getOptionalBoolean(\n      'scaffolder.EXPERIMENTAL_gracefulShutdown',\n    );\n\n    const worker = await TaskWorker.create({\n      taskBroker,\n      actionRegistry,\n      integrations,\n      logger,\n      auditor,\n      config,\n      workingDirectory,\n      concurrentTasksLimit,\n      permissions,\n      gracefulShutdown,\n      metrics,\n      ...templateExtensions,\n    });\n\n    workers.push(worker);\n  }\n\n  for (const action of actions) {\n    actionRegistry.register(action);\n  }\n\n  const launchWorkers = () => workers.forEach(worker => worker.start());\n\n  const shutdownWorkers = async () => {\n    await Promise.allSettled(workers.map(worker => worker.stop()));\n  };\n\n  if (options.lifecycle) {\n    options.lifecycle.addStartupHook(launchWorkers);\n    options.lifecycle.addShutdownHook(shutdownWorkers);\n  } else {\n    launchWorkers();\n  }\n\n  const dryRunner = createDryRunner({\n    actionRegistry,\n    integrations,\n    logger,\n    auditor,\n    workingDirectory,\n    permissions,\n    config,\n    metrics,\n    ...templateExtensions,\n  });\n\n  const templateRules: TemplatePermissionRuleInput[] = Object.values(\n    scaffolderTemplateRules,\n  );\n  const actionRules: ActionPermissionRuleInput[] = Object.values(\n    scaffolderActionRules,\n  );\n  const taskRules: TaskPermissionRuleInput[] =\n    Object.values(scaffolderTaskRules);\n\n  if (permissionRules) {\n    templateRules.push(\n      ...permissionRules.filter(isTemplatePermissionRuleInput),\n    );\n    actionRules.push(...permissionRules.filter(isActionPermissionRuleInput));\n    taskRules.push(...permissionRules.filter(isTaskPermissionRuleInput));\n  }\n\n  const isTemplateAuthorized = createConditionAuthorizer(\n    Object.values(templateRules),\n  );\n  const isTaskAuthorized = createConditionAuthorizer(Object.values(taskRules));\n\n  const taskTransformConditions: ConditionTransformer<TaskFilters> =\n    createConditionTransformer(Object.values(taskRules));\n\n  permissionsRegistry.addResourceType({\n    resourceRef: scaffolderTemplatePermissionResourceRef,\n    permissions: scaffolderTemplatePermissions,\n    rules: templateRules,\n  });\n\n  permissionsRegistry.addResourceType({\n    resourceRef: scaffolderActionPermissionResourceRef,\n    permissions: scaffolderActionPermissions,\n    rules: actionRules,\n  });\n\n  permissionsRegistry.addResourceType({\n    resourceRef: scaffolderTaskPermissionResourceRef,\n    permissions: scaffolderTaskPermissions,\n    rules: taskRules,\n    getResources: async resourceRefs => {\n      return Promise.all(\n        resourceRefs.map(async taskId => {\n          return await taskBroker.get(taskId);\n        }),\n      );\n    },\n  });\n\n  permissionsRegistry.addPermissions([\n    taskCreatePermission,\n    templateManagementPermission,\n  ]);\n\n  router\n    .get(\n      '/v2/templates/:namespace/:kind/:name/parameter-schema',\n      async (req, res) => {\n        const requestedTemplateRef = `${req.params.kind}:${req.params.namespace}/${req.params.name}`;\n\n        const auditorEvent = await auditor?.createEvent({\n          eventId: 'template-parameter-schema',\n          request: req,\n          meta: { templateRef: requestedTemplateRef },\n        });\n\n        try {\n          const credentials = await httpAuth.credentials(req);\n\n          const template = await authorizeTemplate(req.params, credentials);\n\n          const parameters = [template.spec.parameters ?? []].flat();\n\n          const presentation = template.spec.presentation;\n\n          const templateRef = `${template.kind}:${\n            template.metadata.namespace || 'default'\n          }/${template.metadata.name}`;\n\n          await auditorEvent?.success({ meta: { templateRef: templateRef } });\n\n          res.json({\n            title: template.metadata.title ?? template.metadata.name,\n            ...(presentation ? { presentation } : {}),\n            description: template.metadata.description,\n            'ui:options': template.metadata['ui:options'],\n            steps: parameters.map(schema => ({\n              title:\n                (schema.title as string) ??\n                'Please enter the following information',\n              description: schema.description as string,\n              schema,\n            })),\n            formDecorators:\n              template.spec.formDecorators ??\n              template.spec.EXPERIMENTAL_formDecorators,\n          });\n        } catch (err) {\n          await auditorEvent?.fail({ error: err });\n          throw err;\n        }\n      },\n    )\n    .get('/v2/actions', async (req, res) => {\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'action-fetch',\n        request: req,\n      });\n      const credentials = await httpAuth.credentials(req);\n\n      try {\n        const list = await actionRegistry.list({ credentials });\n        const actionsList = Array.from(list.values())\n          .map(action => {\n            return {\n              id: action.id,\n              description: action.description,\n              examples: action.examples,\n              schema: action.schema,\n            };\n          })\n          .sort((a, b) => a.id.localeCompare(b.id));\n\n        await auditorEvent?.success();\n\n        res.json(actionsList);\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    })\n    .post('/v2/tasks', async (req, res) => {\n      const templateRef: string = req.body.templateRef;\n      const { kind, namespace, name } = parseEntityRef(templateRef, {\n        defaultKind: 'template',\n      });\n\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'task',\n        severityLevel: 'medium',\n        request: req,\n        meta: {\n          actionType: 'create',\n          templateRef: templateRef,\n        },\n      });\n\n      try {\n        const credentials = await httpAuth.credentials(req);\n        await checkPermission({\n          credentials,\n          permissions: [taskCreatePermission],\n          permissionService: permissions,\n        });\n\n        const userEntityRef = auth.isPrincipal(credentials, 'user')\n          ? credentials.principal.userEntityRef\n          : undefined;\n\n        const userEntity = userEntityRef\n          ? await catalog.getEntityByRef(userEntityRef, { credentials })\n          : undefined;\n\n        let auditLog = `Scaffolding task for ${templateRef}`;\n        if (userEntityRef) {\n          auditLog += ` created by ${userEntityRef}`;\n        }\n        logger.info(auditLog);\n\n        const values = req.body.values;\n\n        const template = await authorizeTemplate(\n          { kind, namespace, name },\n          credentials,\n        );\n\n        for (const parameters of [template.spec.parameters ?? []].flat()) {\n          const result = validate(values, parameters);\n\n          if (!result.valid) {\n            await auditorEvent?.fail({\n              // TODO(Rugvip): Seems like there aren't proper types for AggregateError yet\n              error: (AggregateError as any)(\n                result.errors,\n                'Could not create entity',\n              ),\n            });\n\n            res.status(400).json({ errors: result.errors });\n            return;\n          }\n        }\n\n        const secretsValid = await validateSecrets({\n          template,\n          secrets: req.body.secrets ?? {},\n          res,\n          auditorEvent,\n        });\n        if (!secretsValid) {\n          return;\n        }\n\n        const baseUrl = getEntityBaseUrl(template);\n\n        const taskSpec: TaskSpec = {\n          apiVersion: template.apiVersion,\n          steps: template.spec.steps.map((step, index) => ({\n            ...step,\n            id: step.id ?? `step-${index + 1}`,\n            name: step.name ?? step.action,\n          })),\n          EXPERIMENTAL_recovery: template.spec.EXPERIMENTAL_recovery,\n          output: template.spec.output ?? {},\n          parameters: values,\n          user: {\n            entity: userEntity as UserEntity,\n            ref: userEntityRef,\n          },\n          templateInfo: {\n            entityRef: stringifyEntityRef({ kind, name, namespace }),\n            baseUrl,\n            entity: {\n              metadata: template.metadata,\n            },\n          },\n        };\n\n        const secrets: InternalTaskSecrets = {\n          ...req.body.secrets,\n          backstageToken: (credentials as any).token,\n          __initiatorCredentials: JSON.stringify({\n            ...credentials,\n            // credentials.token is nonenumerable and will not be serialized, so we need to add it explicitly\n            token: (credentials as any).token,\n          }),\n        };\n\n        const result = await taskBroker.dispatch({\n          spec: taskSpec,\n          createdBy: userEntityRef,\n          secrets,\n        });\n\n        await auditorEvent?.success({ meta: { taskId: result.taskId } });\n\n        res.status(201).json({ id: result.taskId });\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    })\n    .get('/v2/tasks', async (req, res) => {\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'task',\n        request: req,\n        meta: {\n          actionType: 'list',\n        },\n      });\n\n      try {\n        const credentials = await httpAuth.credentials(req);\n\n        if (!taskBroker.list) {\n          throw new Error(\n            'TaskBroker does not support listing tasks, please implement the list method on the TaskBroker.',\n          );\n        }\n\n        const createdBy = parseStringsParam(req.query.createdBy, 'createdBy');\n        const status = parseStringsParam(req.query.status, 'status');\n\n        const order = parseStringsParam(req.query.order, 'order')?.map(item => {\n          const match = item.match(/^(asc|desc):(.+)$/);\n          if (!match) {\n            throw new InputError(\n              `Invalid order parameter \"${item}\", expected \"<asc or desc>:<field name>\"`,\n            );\n          }\n\n          return {\n            order: match[1] as 'asc' | 'desc',\n            field: match[2],\n          };\n        });\n\n        const { limit, offset } = req.query;\n\n        const taskPermissionFilters = await getAuthorizeConditions({\n          credentials: credentials,\n          permission: taskReadPermission,\n          permissionService: permissions,\n          transformConditions: taskTransformConditions,\n        });\n\n        const tasks = await taskBroker.list({\n          filters: {\n            createdBy,\n            status: status ? (status as TaskStatus[]) : undefined,\n          },\n          order,\n          pagination: {\n            limit,\n            offset,\n          },\n          permissionFilters: taskPermissionFilters,\n        });\n\n        await auditorEvent?.success();\n\n        res.status(200).json(tasks);\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    })\n    .get('/v2/tasks/:taskId', async (req, res) => {\n      const { taskId } = req.params;\n\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'task',\n        request: req,\n        meta: {\n          actionType: 'get',\n          taskId: taskId,\n        },\n      });\n\n      try {\n        const credentials = await httpAuth.credentials(req);\n\n        const task = await taskBroker.get(taskId);\n\n        await checkTaskPermission({\n          credentials,\n          permissions: [taskReadPermission],\n          permissionService: permissions,\n          task: task,\n          isTaskAuthorized,\n        });\n\n        if (!task) {\n          throw new NotFoundError(`Task with id ${taskId} does not exist`);\n        }\n\n        await auditorEvent?.success();\n\n        // Do not disclose secrets\n        delete task.secrets;\n        res.status(200).json(task);\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    })\n    .post('/v2/tasks/:taskId/cancel', async (req, res) => {\n      const { taskId } = req.params;\n\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'task',\n        severityLevel: 'medium',\n        request: req,\n        meta: {\n          actionType: 'cancel',\n          taskId: taskId,\n        },\n      });\n\n      try {\n        const credentials = await httpAuth.credentials(req);\n        const task = await taskBroker.get(taskId);\n        // Requires both read and cancel permissions\n        await checkTaskPermission({\n          credentials,\n          permissions: [taskCancelPermission, taskReadPermission],\n          permissionService: permissions,\n          task: task,\n          isTaskAuthorized,\n        });\n\n        await taskBroker.cancel?.(taskId);\n\n        await auditorEvent?.success();\n\n        res.status(200).json({ status: 'cancelled' });\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    })\n    .post('/v2/tasks/:taskId/retry', async (req, res) => {\n      const { taskId } = req.params;\n\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'task',\n        severityLevel: 'medium',\n        request: req,\n        meta: {\n          actionType: 'retry',\n          taskId: taskId,\n        },\n      });\n\n      try {\n        const credentials = await httpAuth.credentials(req);\n        const task = await taskBroker.get(taskId);\n\n        // Requires both read and create permissions\n        await checkPermission({\n          credentials,\n          permissions: [taskCreatePermission],\n          permissionService: permissions,\n        });\n\n        await checkTaskPermission({\n          credentials,\n          permissions: [taskReadPermission],\n          permissionService: permissions,\n          task: task,\n          isTaskAuthorized,\n        });\n\n        // Validate secrets against template schema if defined\n        if (task.spec.templateInfo?.entityRef) {\n          const templateEntityRef = parseEntityRef(\n            task.spec.templateInfo.entityRef,\n            { defaultKind: 'template' },\n          );\n          const template = await authorizeTemplate(\n            templateEntityRef,\n            credentials,\n          );\n\n          const secretsValid = await validateSecrets({\n            template,\n            secrets: req.body.secrets ?? {},\n            res,\n            auditorEvent,\n          });\n          if (!secretsValid) {\n            return;\n          }\n        }\n\n        await auditorEvent?.success();\n\n        const { token } = await auth.getPluginRequestToken({\n          onBehalfOf: credentials,\n          targetPluginId: 'catalog',\n        });\n\n        const secrets: InternalTaskSecrets = {\n          ...req.body.secrets,\n          backstageToken: token,\n          __initiatorCredentials: JSON.stringify({\n            ...credentials,\n            // credentials.token is nonenumerable and will not be serialized, so we need to add it explicitly\n            token: (credentials as any).token,\n          }),\n        };\n\n        await taskBroker.retry?.({ secrets, taskId });\n        res.status(201).json({ id: taskId });\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    });\n  (router as express.Router).get(\n    '/v2/tasks/:taskId/eventstream',\n    async (req, res) => {\n      const { taskId } = req.params;\n\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'task',\n        request: req,\n        meta: {\n          actionType: 'stream',\n          taskId: taskId,\n        },\n      });\n\n      try {\n        const credentials = await httpAuth.credentials(req);\n        const task = await taskBroker.get(taskId);\n\n        await checkTaskPermission({\n          credentials,\n          permissions: [taskReadPermission],\n          permissionService: permissions,\n          task: task,\n          isTaskAuthorized,\n        });\n\n        const after =\n          req.query.after !== undefined ? Number(req.query.after) : undefined;\n\n        logger.debug(`Event stream observing taskId '${taskId}' opened`);\n\n        // Mandatory headers and http status to keep connection open\n        res.writeHead(200, {\n          Connection: 'keep-alive',\n          'Cache-Control': 'no-cache',\n          'Content-Type': 'text/event-stream',\n        });\n\n        // After client opens connection send all events as string\n        const subscription = taskBroker.event$({ taskId, after }).subscribe({\n          error: async error => {\n            logger.error(\n              `Received error from event stream when observing taskId '${taskId}', ${error}`,\n            );\n            await auditorEvent?.fail({ error: error });\n            res.end();\n          },\n          next: ({ events }) => {\n            let shouldUnsubscribe = false;\n            for (const event of events) {\n              res.write(\n                `event: ${event.type}\\ndata: ${JSON.stringify(event)}\\n\\n`,\n              );\n              if (event.type === 'completion' && !event.isTaskRecoverable) {\n                shouldUnsubscribe = true;\n              }\n            }\n            // res.flush() is only available with the compression middleware\n            res.flush?.();\n            if (shouldUnsubscribe) {\n              subscription.unsubscribe();\n              res.end();\n            }\n          },\n        });\n\n        // When client closes connection we update the clients list\n        // avoiding the disconnected one\n        req.on('close', async () => {\n          subscription.unsubscribe();\n          logger.debug(`Event stream observing taskId '${taskId}' closed`);\n          await auditorEvent?.success();\n        });\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    },\n  );\n  router\n    .get('/v2/tasks/:taskId/events', async (req, res) => {\n      const { taskId } = req.params;\n\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'task',\n        request: req,\n        meta: {\n          actionType: 'events',\n          taskId: taskId,\n        },\n      });\n\n      try {\n        const credentials = await httpAuth.credentials(req);\n        const task = await taskBroker.get(taskId);\n\n        await checkTaskPermission({\n          credentials,\n          permissions: [taskReadPermission],\n          permissionService: permissions,\n          task: task,\n          isTaskAuthorized,\n        });\n\n        const after =\n          req.query.after !== undefined ? Number(req.query.after) : undefined;\n\n        // cancel the request after 30 seconds. this aligns with the recommendations of RFC 6202.\n        const timeout = setTimeout(() => {\n          res.json([]);\n        }, 30_000);\n\n        // Get all known events after an id (always includes the completion event) and return the first callback\n        const subscription = taskBroker.event$({ taskId, after }).subscribe({\n          error: async error => {\n            logger.error(\n              `Received error from event stream when observing taskId '${taskId}', ${error}`,\n            );\n            await auditorEvent?.fail({ error: error });\n          },\n          next: async ({ events }) => {\n            clearTimeout(timeout);\n            subscription.unsubscribe();\n            await auditorEvent?.success();\n            res.json(events);\n          },\n        });\n\n        // When client closes connection we update the clients list\n        // avoiding the disconnected one\n        req.on('close', () => {\n          subscription.unsubscribe();\n          clearTimeout(timeout);\n        });\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    })\n    .post('/v2/dry-run', async (req, res) => {\n      const auditorEvent = await auditor?.createEvent({\n        eventId: 'task',\n        request: req,\n        meta: {\n          actionType: 'dry-run',\n        },\n      });\n\n      try {\n        const credentials = await httpAuth.credentials(req);\n        await checkPermission({\n          credentials,\n          permissions: [taskCreatePermission],\n          permissionService: permissions,\n        });\n\n        const bodySchema = z.object({\n          template: z.unknown(),\n          values: z.record(z.unknown()),\n          secrets: z.record(z.string()).optional(),\n          directoryContents: z.array(\n            z.object({ path: z.string(), base64Content: z.string() }),\n          ),\n        });\n        const body = await bodySchema.parseAsync(req.body).catch(e => {\n          throw new InputError(`Malformed request: ${e}`);\n        });\n\n        const template = body.template as TemplateEntityV1beta3;\n        if (!(await templateEntityV1beta3Validator.check(template))) {\n          throw new InputError('Input template is not a template');\n        }\n\n        const userEntityRef = auth.isPrincipal(credentials, 'user')\n          ? credentials.principal.userEntityRef\n          : undefined;\n\n        const userEntity = userEntityRef\n          ? await catalog.getEntityByRef(userEntityRef, { credentials })\n          : undefined;\n\n        const templateRef: string = `${template.kind}:${\n          template.metadata.namespace || 'default'\n        }/${template.metadata.name}`;\n\n        for (const parameters of [template.spec.parameters ?? []].flat()) {\n          const result = validate(body.values, parameters);\n          if (!result.valid) {\n            await auditorEvent?.fail({\n              // TODO(Rugvip): Seems like there aren't proper types for AggregateError yet\n              error: (AggregateError as any)(\n                result.errors,\n                'Could not execute dry run',\n              ),\n              meta: {\n                templateRef: templateRef,\n                parameters: template.spec.parameters,\n              },\n            });\n\n            res.status(400).json({ errors: result.errors });\n            return;\n          }\n        }\n\n        const secretsValid = await validateSecrets({\n          template,\n          secrets: body.secrets ?? {},\n          res,\n          auditorEvent,\n        });\n        if (!secretsValid) {\n          return;\n        }\n\n        const steps = template.spec.steps.map((step, index) => ({\n          ...step,\n          id: step.id ?? `step-${index + 1}`,\n          name: step.name ?? step.action,\n        }));\n\n        const dryRunId = uuid();\n        const contentsPath = resolveSafeChildPath(\n          workingDirectory,\n          `dry-run-content-${dryRunId}`,\n        );\n        const templateInfo = {\n          entityRef: 'template:default/dry-run',\n          entity: {\n            metadata: template.metadata,\n          },\n          baseUrl: pathToFileURL(\n            resolveSafeChildPath(contentsPath, 'template.yaml'),\n          ).toString(),\n        };\n\n        const result = await dryRunner({\n          spec: {\n            apiVersion: template.apiVersion,\n            steps,\n            output: template.spec.output ?? {},\n            parameters: body.values as JsonObject,\n            user: {\n              entity: userEntity as UserEntity,\n              ref: userEntityRef,\n            },\n          },\n          templateInfo: templateInfo,\n          directoryContents: (body.directoryContents ?? []).map(file => ({\n            path: file.path,\n            content: Buffer.from(file.base64Content, 'base64'),\n          })),\n          secrets: {\n            ...body.secrets,\n            backstageToken: (credentials as any).token,\n          },\n          credentials,\n        });\n\n        await auditorEvent?.success({\n          meta: {\n            templateRef: templateRef,\n            parameters: template.spec.parameters,\n          },\n        });\n\n        res.status(200).json({\n          ...result,\n          steps,\n          directoryContents: result.directoryContents.map(file => ({\n            path: file.path,\n            executable: file.executable,\n            base64Content: file.content.toString('base64'),\n          })),\n        });\n      } catch (err) {\n        await auditorEvent?.fail({ error: err });\n        throw err;\n      }\n    })\n    .post('/v2/autocomplete/:provider/:resource', async (req, res) => {\n      const { token, context } = req.body;\n      const { provider, resource } = req.params;\n\n      if (!token) throw new InputError('Missing token query parameter');\n\n      if (!autocompleteHandlers[provider]) {\n        throw new InputError(`Unsupported provider: ${provider}`);\n      }\n\n      const { results } = await autocompleteHandlers[provider]({\n        resource,\n        token,\n        context,\n      });\n\n      res.status(200).json({ results });\n    })\n    .get('/v2/templating-extensions', async (_req, res) => {\n      res.status(200).json({\n        filters: {\n          ...extractFilterMetadata(createDefaultFilters({ integrations })),\n          ...extractFilterMetadata(additionalTemplateFilters),\n        },\n        globals: {\n          functions: extractGlobalFunctionMetadata(additionalTemplateGlobals),\n          values: extractGlobalValueMetadata(additionalTemplateGlobals),\n        },\n      });\n    });\n\n  const app = express();\n  app.set('logger', logger);\n  app.use('/', router);\n\n  async function authorizeTemplate(\n    entityRef: CompoundEntityRef,\n    credentials: BackstageCredentials,\n  ) {\n    const template = await findTemplate({\n      catalog,\n      entityRef,\n      credentials,\n    });\n\n    if (!isSupportedTemplate(template)) {\n      throw new InputError(\n        `Unsupported apiVersion field in schema entity, ${\n          (template as Entity).apiVersion\n        }`,\n      );\n    }\n\n    if (!permissions) {\n      return template;\n    }\n\n    const [parameterDecision, stepDecision] =\n      await permissions.authorizeConditional(\n        [\n          { permission: templateParameterReadPermission },\n          { permission: templateStepReadPermission },\n        ],\n        { credentials },\n      );\n\n    // Authorize parameters\n    if (Array.isArray(template.spec.parameters)) {\n      template.spec.parameters = template.spec.parameters.filter(step =>\n        isTemplateAuthorized(parameterDecision, step),\n      );\n    } else if (\n      template.spec.parameters &&\n      !isTemplateAuthorized(parameterDecision, template.spec.parameters)\n    ) {\n      template.spec.parameters = undefined;\n    }\n\n    // Authorize steps\n    template.spec.steps = template.spec.steps.filter(step =>\n      isTemplateAuthorized(stepDecision, step),\n    );\n\n    return template;\n  }\n\n  return app;\n}\n"],"names":["config","readDurationFromConfig","validate","InputError","router","createOpenApiRouter","express","permissions","getWorkingDirectory","ScmIntegrations","DatabaseTaskStore","StorageTaskBroker","Duration","DefaultTemplateActionRegistry","convertFiltersToRecord","convertGlobalsToRecord","TaskWorker","createDryRunner","scaffolderTemplateRules","scaffolderActionRules","scaffolderTaskRules","isTemplatePermissionRuleInput","isActionPermissionRuleInput","isTaskPermissionRuleInput","createConditionAuthorizer","createConditionTransformer","scaffolderTemplatePermissionResourceRef","scaffolderTemplatePermissions","scaffolderActionPermissionResourceRef","scaffolderActionPermissions","scaffolderTaskPermissionResourceRef","scaffolderTaskPermissions","taskCreatePermission","templateManagementPermission","parseEntityRef","checkPermission","result","getEntityBaseUrl","stringifyEntityRef","parseStringsParam","getAuthorizeConditions","taskReadPermission","checkTaskPermission","NotFoundError","taskCancelPermission","z","templateEntityV1beta3Validator","uuid","resolveSafeChildPath","pathToFileURL","extractFilterMetadata","createDefaultFilters","extractGlobalFunctionMetadata","extractGlobalValueMetadata","findTemplate","templateParameterReadPermission","templateStepReadPermission"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8KA,SAAS,oBAAoB,MAAA,EAA+B;AAC1D,EAAA,OAAO,OAAO,UAAA,KAAe,iCAAA;AAC/B;AAEA,MAAM,YAAA,GAAe,CACnBA,QAAA,EACA,GAAA,EACA,YAAA,KACG;AACH,EAAA,IAAIA,QAAA,CAAO,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,IAAA,OAAOC,6BAAA,CAAuBD,QAAA,EAAQ,EAAE,GAAA,EAAK,CAAA;AAAA,EAC/C;AACA,EAAA,OAAO,YAAA;AACT,CAAA;AAEA,SAAS,8BAA8B,MAAA,EAAyB;AAC9D,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,GAAA,CAAI,CAAA,GAAA,KAAO;AAC9B,IAAA,MAAM,QAAA,GAAW,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,aAAa,SAAS,CAAA;AAC5D,IAAA,MAAM,aAAa,GAAA,CAAI,QAAA;AACvB,IAAA,MAAM,OAAA,GACJ,GAAA,CAAI,IAAA,KAAS,UAAA,GACT,CAAA,QAAA,EAAW,UAAU,CAAA,YAAA,CAAA,GACrB,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,GAAA,CAAI,OAAO,CAAA,CAAA;AAChC,IAAA,OAAO;AAAA,MACL,GAAG,GAAA;AAAA,MACH,QAAA;AAAA,MACA,OAAA;AAAA,MACA,UAAU;AAAC,KACb;AAAA,EACF,CAAC,CAAA;AACH;AAEA,eAAe,gBAAgB,OAAA,EAKV;AACnB,EAAA,MAAM,EAAE,QAAA,EAAU,OAAA,EAAS,GAAA,EAAK,cAAa,GAAI,OAAA;AACjD,EAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,OAAA,EAAS,MAAA,EAAQ;AAClC,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,SAASE,mBAAA,CAAS,OAAA,EAAS,QAAA,CAAS,IAAA,CAAK,QAAQ,MAAM,CAAA;AAC7D,EAAA,IAAI,OAAO,KAAA,EAAO;AAChB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,cAAc,IAAA,CAAK;AAAA,IACvB,KAAA,EAAO,IAAIC,iBAAA,CAAW,2BAA2B;AAAA,GAClD,CAAA;AAED,EAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,IACnB,MAAA,EAAQ,8BAA8B,MAAM;AAAA,GAC7C,CAAA;AACD,EAAA,OAAO,KAAA;AACT;AAKA,eAAsB,aACpB,OAAA,EACyB;AACzB,EAAA,MAAMC,QAAA,GAAS,MAAMC,0BAAA,CAAoB;AAAA,IACvC,UAAA,EAAY;AAAA;AAAA,MAEVC,wBAAA,CAAQ,IAAA,CAAK,EAAE,KAAA,EAAO,QAAQ;AAAA;AAChC,GACD,CAAA;AAED,EAAA,MAAM;AAAA,IACJ,MAAA,EAAQ,YAAA;AAAA,IACR,MAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAA;AAAA,IACA,UAAU,EAAC;AAAA,IACX,SAAA;AAAA,IACA,yBAAA;AAAA,IACA,yBAAA;AAAA,IACA,4BAAA;AAAA,iBACAC,aAAA;AAAA,IACA,mBAAA;AAAA,IACA,eAAA;AAAA,IACA,uBAAuB,EAAC;AAAA,IACxB,MAAA,EAAQ,aAAA;AAAA,IACR,IAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACF,GAAI,OAAA;AAEJ,EAAA,MAAM,uBACJ,OAAA,CAAQ,oBAAA,IACR,OAAA,CAAQ,MAAA,CAAO,kBAAkB,iCAAiC,CAAA;AAEpE,EAAA,MAAM,SAAS,YAAA,CAAa,KAAA,CAAM,EAAE,MAAA,EAAQ,cAAc,CAAA;AAE1D,EAAA,MAAM,gBAAA,GAAmB,MAAMC,2BAAA,CAAoB,MAAA,EAAQ,MAAM,CAAA;AACjE,EAAA,MAAM,YAAA,GAAeC,2BAAA,CAAgB,UAAA,CAAW,MAAM,CAAA;AAEtD,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI,CAAC,QAAQ,UAAA,EAAY;AACvB,IAAA,MAAM,iBAAA,GAAoB,MAAMC,mCAAA,CAAkB,MAAA,CAAO;AAAA,MACvD,QAAA;AAAA,MACA,MAAA,EAAQ;AAAA,KACT,CAAA;AACD,IAAA,UAAA,GAAa,IAAIC,mCAAA;AAAA,MACf,iBAAA;AAAA,MACA,MAAA;AAAA,MACA,MAAA;AAAA,MACA,IAAA;AAAA,MACA,4BAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,IAAI,SAAA,IAAa,kBAAkB,cAAA,EAAgB;AACjD,MAAA,MAAM,UAAU,YAAA,CAAa;AAAA,QAC3B,EAAA,EAAI,mBAAA;AAAA,QACJ,SAAA,EAAW,YAAA;AAAA,UACT,MAAA;AAAA,UACA,wCAAA;AAAA,UACA;AAAA,YACE,OAAA,EAAS;AAAA;AACX,SACF;AAAA,QACA,OAAA,EAAS,EAAE,OAAA,EAAS,EAAA,EAAG;AAAA,QACvB,IAAI,YAAY;AACd,UAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,kBAAkB,cAAA,CAAe;AAAA,YACvD,UAAUC,cAAA,CAAS,UAAA;AAAA,cACjB,YAAA,CAAa,QAAQ,wBAAA,EAA0B;AAAA,gBAC7C,KAAA,EAAO;AAAA,eACR;AAAA,aACH,CAAE,GAAG,SAAS;AAAA,WACf,CAAA;AAED,UAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,YAAA,MAAM,iBAAA,CAAkB,aAAa,IAAI,CAAA;AACzC,YAAA,MAAA,CAAO,IAAA,CAAK,CAAA,+BAAA,EAAkC,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,UAC7D;AAAA,QACF;AAAA,OACD,CAAA;AAAA,IACH;AAAA,EACF,CAAA,MAAO;AACL,IAAA,UAAA,GAAa,OAAA,CAAQ,UAAA;AAAA,EACvB;AAEA,EAAA,MAAM,iBAAiB,IAAIC,oDAAA;AAAA,IACzB,eAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,MAAM,kBAAA,GAAqB;AAAA,IACzB,yBAAA,EAA2BC,iCAAA;AAAA,MACzB;AAAA,KACF;AAAA,IACA,yBAAA,EAA2BC,iCAAA;AAAA,MACzB;AAAA;AACF,GACF;AAEA,EAAA,MAAM,UAAwB,EAAC;AAC/B,EAAA,IAAI,yBAAyB,CAAA,EAAG;AAC9B,IAAA,MAAM,mBAAmB,MAAA,CAAO,kBAAA;AAAA,MAC9B;AAAA,KACF;AAEA,IAAA,MAAM,MAAA,GAAS,MAAMC,qBAAA,CAAW,MAAA,CAAO;AAAA,MACrC,UAAA;AAAA,MACA,cAAA;AAAA,MACA,YAAA;AAAA,MACA,MAAA;AAAA,MACA,OAAA;AAAA,MACA,MAAA;AAAA,MACA,gBAAA;AAAA,MACA,oBAAA;AAAA,mBACAT,aAAA;AAAA,MACA,gBAAA;AAAA,MACA,OAAA;AAAA,MACA,GAAG;AAAA,KACJ,CAAA;AAED,IAAA,OAAA,CAAQ,KAAK,MAAM,CAAA;AAAA,EACrB;AAEA,EAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,IAAA,cAAA,CAAe,SAAS,MAAM,CAAA;AAAA,EAChC;AAEA,EAAA,MAAM,gBAAgB,MAAM,OAAA,CAAQ,QAAQ,CAAA,MAAA,KAAU,MAAA,CAAO,OAAO,CAAA;AAEpE,EAAA,MAAM,kBAAkB,YAAY;AAClC,IAAA,MAAM,OAAA,CAAQ,WAAW,OAAA,CAAQ,GAAA,CAAI,YAAU,MAAA,CAAO,IAAA,EAAM,CAAC,CAAA;AAAA,EAC/D,CAAA;AAEA,EAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,IAAA,OAAA,CAAQ,SAAA,CAAU,eAAe,aAAa,CAAA;AAC9C,IAAA,OAAA,CAAQ,SAAA,CAAU,gBAAgB,eAAe,CAAA;AAAA,EACnD,CAAA,MAAO;AACL,IAAA,aAAA,EAAc;AAAA,EAChB;AAEA,EAAA,MAAM,YAAYU,+BAAA,CAAgB;AAAA,IAChC,cAAA;AAAA,IACA,YAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA;AAAA,IACA,gBAAA;AAAA,iBACAV,aAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA;AAAA,IACA,GAAG;AAAA,GACJ,CAAA;AAED,EAAA,MAAM,gBAA+C,MAAA,CAAO,MAAA;AAAA,IAC1DW;AAAA,GACF;AACA,EAAA,MAAM,cAA2C,MAAA,CAAO,MAAA;AAAA,IACtDC;AAAA,GACF;AACA,EAAA,MAAM,SAAA,GACJ,MAAA,CAAO,MAAA,CAAOC,yBAAmB,CAAA;AAEnC,EAAA,IAAI,eAAA,EAAiB;AACnB,IAAA,aAAA,CAAc,IAAA;AAAA,MACZ,GAAG,eAAA,CAAgB,MAAA,CAAOC,yCAA6B;AAAA,KACzD;AACA,IAAA,WAAA,CAAY,IAAA,CAAK,GAAG,eAAA,CAAgB,MAAA,CAAOC,uCAA2B,CAAC,CAAA;AACvE,IAAA,SAAA,CAAU,IAAA,CAAK,GAAG,eAAA,CAAgB,MAAA,CAAOC,qCAAyB,CAAC,CAAA;AAAA,EACrE;AAEA,EAAA,MAAM,oBAAA,GAAuBC,8CAAA;AAAA,IAC3B,MAAA,CAAO,OAAO,aAAa;AAAA,GAC7B;AACA,EAAA,MAAM,gBAAA,GAAmBA,8CAAA,CAA0B,MAAA,CAAO,MAAA,CAAO,SAAS,CAAC,CAAA;AAE3E,EAAA,MAAM,uBAAA,GACJC,+CAAA,CAA2B,MAAA,CAAO,MAAA,CAAO,SAAS,CAAC,CAAA;AAErD,EAAA,mBAAA,CAAoB,eAAA,CAAgB;AAAA,IAClC,WAAA,EAAaC,+CAAA;AAAA,IACb,WAAA,EAAaC,mCAAA;AAAA,IACb,KAAA,EAAO;AAAA,GACR,CAAA;AAED,EAAA,mBAAA,CAAoB,eAAA,CAAgB;AAAA,IAClC,WAAA,EAAaC,6CAAA;AAAA,IACb,WAAA,EAAaC,iCAAA;AAAA,IACb,KAAA,EAAO;AAAA,GACR,CAAA;AAED,EAAA,mBAAA,CAAoB,eAAA,CAAgB;AAAA,IAClC,WAAA,EAAaC,2CAAA;AAAA,IACb,WAAA,EAAaC,+BAAA;AAAA,IACb,KAAA,EAAO,SAAA;AAAA,IACP,YAAA,EAAc,OAAM,YAAA,KAAgB;AAClC,MAAA,OAAO,OAAA,CAAQ,GAAA;AAAA,QACb,YAAA,CAAa,GAAA,CAAI,OAAM,MAAA,KAAU;AAC/B,UAAA,OAAO,MAAM,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AAAA,QACpC,CAAC;AAAA,OACH;AAAA,IACF;AAAA,GACD,CAAA;AAED,EAAA,mBAAA,CAAoB,cAAA,CAAe;AAAA,IACjCC,0BAAA;AAAA,IACAC;AAAA,GACD,CAAA;AAED,EAAA7B,QAAA,CACG,GAAA;AAAA,IACC,uDAAA;AAAA,IACA,OAAO,KAAK,GAAA,KAAQ;AAClB,MAAA,MAAM,oBAAA,GAAuB,CAAA,EAAG,GAAA,CAAI,MAAA,CAAO,IAAI,CAAA,CAAA,EAAI,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA,CAAA,EAAI,GAAA,CAAI,MAAA,CAAO,IAAI,CAAA,CAAA;AAE1F,MAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,QAC9C,OAAA,EAAS,2BAAA;AAAA,QACT,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM,EAAE,WAAA,EAAa,oBAAA;AAAqB,OAC3C,CAAA;AAED,MAAA,IAAI;AACF,QAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAElD,QAAA,MAAM,QAAA,GAAW,MAAM,iBAAA,CAAkB,GAAA,CAAI,QAAQ,WAAW,CAAA;AAEhE,QAAA,MAAM,UAAA,GAAa,CAAC,QAAA,CAAS,IAAA,CAAK,cAAc,EAAE,EAAE,IAAA,EAAK;AAEzD,QAAA,MAAM,YAAA,GAAe,SAAS,IAAA,CAAK,YAAA;AAEnC,QAAA,MAAM,WAAA,GAAc,CAAA,EAAG,QAAA,CAAS,IAAI,CAAA,CAAA,EAClC,QAAA,CAAS,QAAA,CAAS,SAAA,IAAa,SACjC,CAAA,CAAA,EAAI,QAAA,CAAS,QAAA,CAAS,IAAI,CAAA,CAAA;AAE1B,QAAA,MAAM,cAAc,OAAA,CAAQ,EAAE,MAAM,EAAE,WAAA,IAA4B,CAAA;AAElE,QAAA,GAAA,CAAI,IAAA,CAAK;AAAA,UACP,KAAA,EAAO,QAAA,CAAS,QAAA,CAAS,KAAA,IAAS,SAAS,QAAA,CAAS,IAAA;AAAA,UACpD,GAAI,YAAA,GAAe,EAAE,YAAA,KAAiB,EAAC;AAAA,UACvC,WAAA,EAAa,SAAS,QAAA,CAAS,WAAA;AAAA,UAC/B,YAAA,EAAc,QAAA,CAAS,QAAA,CAAS,YAAY,CAAA;AAAA,UAC5C,KAAA,EAAO,UAAA,CAAW,GAAA,CAAI,CAAA,MAAA,MAAW;AAAA,YAC/B,KAAA,EACG,OAAO,KAAA,IACR,wCAAA;AAAA,YACF,aAAa,MAAA,CAAO,WAAA;AAAA,YACpB;AAAA,WACF,CAAE,CAAA;AAAA,UACF,cAAA,EACE,QAAA,CAAS,IAAA,CAAK,cAAA,IACd,SAAS,IAAA,CAAK;AAAA,SACjB,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,GACF,CACC,GAAA,CAAI,aAAA,EAAe,OAAO,KAAK,GAAA,KAAQ;AACtC,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,MAC9C,OAAA,EAAS,cAAA;AAAA,MACT,OAAA,EAAS;AAAA,KACV,CAAA;AACD,IAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAElD,IAAA,IAAI;AACF,MAAA,MAAM,OAAO,MAAM,cAAA,CAAe,IAAA,CAAK,EAAE,aAAa,CAAA;AACtD,MAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,IAAA,CAAK,QAAQ,CAAA,CACzC,IAAI,CAAA,MAAA,KAAU;AACb,QAAA,OAAO;AAAA,UACL,IAAI,MAAA,CAAO,EAAA;AAAA,UACX,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,UAAU,MAAA,CAAO,QAAA;AAAA,UACjB,QAAQ,MAAA,CAAO;AAAA,SACjB;AAAA,MACF,CAAC,CAAA,CACA,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,EAAA,CAAG,aAAA,CAAc,CAAA,CAAE,EAAE,CAAC,CAAA;AAE1C,MAAA,MAAM,cAAc,OAAA,EAAQ;AAE5B,MAAA,GAAA,CAAI,KAAK,WAAW,CAAA;AAAA,IACtB,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA,CACA,IAAA,CAAK,WAAA,EAAa,OAAO,KAAK,GAAA,KAAQ;AACrC,IAAA,MAAM,WAAA,GAAsB,IAAI,IAAA,CAAK,WAAA;AACrC,IAAA,MAAM,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAK,GAAI8B,4BAAe,WAAA,EAAa;AAAA,MAC5D,WAAA,EAAa;AAAA,KACd,CAAA;AAED,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,MAC9C,OAAA,EAAS,MAAA;AAAA,MACT,aAAA,EAAe,QAAA;AAAA,MACf,OAAA,EAAS,GAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACJ,UAAA,EAAY,QAAA;AAAA,QACZ;AAAA;AACF,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAMC,gCAAA,CAAgB;AAAA,QACpB,WAAA;AAAA,QACA,WAAA,EAAa,CAACH,0BAAoB,CAAA;AAAA,QAClC,iBAAA,EAAmBzB;AAAA,OACpB,CAAA;AAED,MAAA,MAAM,aAAA,GAAgB,KAAK,WAAA,CAAY,WAAA,EAAa,MAAM,CAAA,GACtD,WAAA,CAAY,UAAU,aAAA,GACtB,KAAA,CAAA;AAEJ,MAAA,MAAM,UAAA,GAAa,gBACf,MAAM,OAAA,CAAQ,eAAe,aAAA,EAAe,EAAE,WAAA,EAAa,CAAA,GAC3D,KAAA,CAAA;AAEJ,MAAA,IAAI,QAAA,GAAW,wBAAwB,WAAW,CAAA,CAAA;AAClD,MAAA,IAAI,aAAA,EAAe;AACjB,QAAA,QAAA,IAAY,eAAe,aAAa,CAAA,CAAA;AAAA,MAC1C;AACA,MAAA,MAAA,CAAO,KAAK,QAAQ,CAAA;AAEpB,MAAA,MAAM,MAAA,GAAS,IAAI,IAAA,CAAK,MAAA;AAExB,MAAA,MAAM,WAAW,MAAM,iBAAA;AAAA,QACrB,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAK;AAAA,QACxB;AAAA,OACF;AAEA,MAAA,KAAA,MAAW,UAAA,IAAc,CAAC,QAAA,CAAS,IAAA,CAAK,cAAc,EAAE,CAAA,CAAE,IAAA,EAAK,EAAG;AAChE,QAAA,MAAM6B,OAAAA,GAASlC,mBAAA,CAAS,MAAA,EAAQ,UAAU,CAAA;AAE1C,QAAA,IAAI,CAACkC,QAAO,KAAA,EAAO;AACjB,UAAA,MAAM,cAAc,IAAA,CAAK;AAAA;AAAA,YAEvB,KAAA,EAAQ,cAAA;AAAA,cACNA,OAAAA,CAAO,MAAA;AAAA,cACP;AAAA;AACF,WACD,CAAA;AAED,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,MAAA,EAAQA,OAAAA,CAAO,QAAQ,CAAA;AAC9C,UAAA;AAAA,QACF;AAAA,MACF;AAEA,MAAA,MAAM,YAAA,GAAe,MAAM,eAAA,CAAgB;AAAA,QACzC,QAAA;AAAA,QACA,OAAA,EAAS,GAAA,CAAI,IAAA,CAAK,OAAA,IAAW,EAAC;AAAA,QAC9B,GAAA;AAAA,QACA;AAAA,OACD,CAAA;AACD,MAAA,IAAI,CAAC,YAAA,EAAc;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAUC,yBAAiB,QAAQ,CAAA;AAEzC,MAAA,MAAM,QAAA,GAAqB;AAAA,QACzB,YAAY,QAAA,CAAS,UAAA;AAAA,QACrB,OAAO,QAAA,CAAS,IAAA,CAAK,MAAM,GAAA,CAAI,CAAC,MAAM,KAAA,MAAW;AAAA,UAC/C,GAAG,IAAA;AAAA,UACH,EAAA,EAAI,IAAA,CAAK,EAAA,IAAM,CAAA,KAAA,EAAQ,QAAQ,CAAC,CAAA,CAAA;AAAA,UAChC,IAAA,EAAM,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK;AAAA,SAC1B,CAAE,CAAA;AAAA,QACF,qBAAA,EAAuB,SAAS,IAAA,CAAK,qBAAA;AAAA,QACrC,MAAA,EAAQ,QAAA,CAAS,IAAA,CAAK,MAAA,IAAU,EAAC;AAAA,QACjC,UAAA,EAAY,MAAA;AAAA,QACZ,IAAA,EAAM;AAAA,UACJ,MAAA,EAAQ,UAAA;AAAA,UACR,GAAA,EAAK;AAAA,SACP;AAAA,QACA,YAAA,EAAc;AAAA,UACZ,WAAWC,+BAAA,CAAmB,EAAE,IAAA,EAAM,IAAA,EAAM,WAAW,CAAA;AAAA,UACvD,OAAA;AAAA,UACA,MAAA,EAAQ;AAAA,YACN,UAAU,QAAA,CAAS;AAAA;AACrB;AACF,OACF;AAEA,MAAA,MAAM,OAAA,GAA+B;AAAA,QACnC,GAAG,IAAI,IAAA,CAAK,OAAA;AAAA,QACZ,gBAAiB,WAAA,CAAoB,KAAA;AAAA,QACrC,sBAAA,EAAwB,KAAK,SAAA,CAAU;AAAA,UACrC,GAAG,WAAA;AAAA;AAAA,UAEH,OAAQ,WAAA,CAAoB;AAAA,SAC7B;AAAA,OACH;AAEA,MAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,QAAA,CAAS;AAAA,QACvC,IAAA,EAAM,QAAA;AAAA,QACN,SAAA,EAAW,aAAA;AAAA,QACX;AAAA,OACD,CAAA;AAED,MAAA,MAAM,YAAA,EAAc,QAAQ,EAAE,IAAA,EAAM,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAO,EAAG,CAAA;AAE/D,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,EAAA,EAAI,MAAA,CAAO,QAAQ,CAAA;AAAA,IAC5C,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA,CACA,GAAA,CAAI,WAAA,EAAa,OAAO,KAAK,GAAA,KAAQ;AACpC,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,MAC9C,OAAA,EAAS,MAAA;AAAA,MACT,OAAA,EAAS,GAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACJ,UAAA,EAAY;AAAA;AACd,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAElD,MAAA,IAAI,CAAC,WAAW,IAAA,EAAM;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SACF;AAAA,MACF;AAEA,MAAA,MAAM,SAAA,GAAYC,yBAAA,CAAkB,GAAA,CAAI,KAAA,CAAM,WAAW,WAAW,CAAA;AACpE,MAAA,MAAM,MAAA,GAASA,yBAAA,CAAkB,GAAA,CAAI,KAAA,CAAM,QAAQ,QAAQ,CAAA;AAE3D,MAAA,MAAM,KAAA,GAAQA,0BAAkB,GAAA,CAAI,KAAA,CAAM,OAAO,OAAO,CAAA,EAAG,IAAI,CAAA,IAAA,KAAQ;AACrE,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,mBAAmB,CAAA;AAC5C,QAAA,IAAI,CAAC,KAAA,EAAO;AACV,UAAA,MAAM,IAAIpC,iBAAA;AAAA,YACR,4BAA4B,IAAI,CAAA,wCAAA;AAAA,WAClC;AAAA,QACF;AAEA,QAAA,OAAO;AAAA,UACL,KAAA,EAAO,MAAM,CAAC,CAAA;AAAA,UACd,KAAA,EAAO,MAAM,CAAC;AAAA,SAChB;AAAA,MACF,CAAC,CAAA;AAED,MAAA,MAAM,EAAE,KAAA,EAAO,MAAA,EAAO,GAAI,GAAA,CAAI,KAAA;AAE9B,MAAA,MAAM,qBAAA,GAAwB,MAAMqC,uCAAA,CAAuB;AAAA,QACzD,WAAA;AAAA,QACA,UAAA,EAAYC,wBAAA;AAAA,QACZ,iBAAA,EAAmBlC,aAAA;AAAA,QACnB,mBAAA,EAAqB;AAAA,OACtB,CAAA;AAED,MAAA,MAAM,KAAA,GAAQ,MAAM,UAAA,CAAW,IAAA,CAAK;AAAA,QAClC,OAAA,EAAS;AAAA,UACP,SAAA;AAAA,UACA,MAAA,EAAQ,SAAU,MAAA,GAA0B,KAAA;AAAA,SAC9C;AAAA,QACA,KAAA;AAAA,QACA,UAAA,EAAY;AAAA,UACV,KAAA;AAAA,UACA;AAAA,SACF;AAAA,QACA,iBAAA,EAAmB;AAAA,OACpB,CAAA;AAED,MAAA,MAAM,cAAc,OAAA,EAAQ;AAE5B,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,KAAK,CAAA;AAAA,IAC5B,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA,CACA,GAAA,CAAI,mBAAA,EAAqB,OAAO,KAAK,GAAA,KAAQ;AAC5C,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,GAAA,CAAI,MAAA;AAEvB,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,MAC9C,OAAA,EAAS,MAAA;AAAA,MACT,OAAA,EAAS,GAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACJ,UAAA,EAAY,KAAA;AAAA,QACZ;AAAA;AACF,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAElD,MAAA,MAAM,IAAA,GAAO,MAAM,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AAExC,MAAA,MAAMmC,oCAAA,CAAoB;AAAA,QACxB,WAAA;AAAA,QACA,WAAA,EAAa,CAACD,wBAAkB,CAAA;AAAA,QAChC,iBAAA,EAAmBlC,aAAA;AAAA,QACnB,IAAA;AAAA,QACA;AAAA,OACD,CAAA;AAED,MAAA,IAAI,CAAC,IAAA,EAAM;AACT,QAAA,MAAM,IAAIoC,oBAAA,CAAc,CAAA,aAAA,EAAgB,MAAM,CAAA,eAAA,CAAiB,CAAA;AAAA,MACjE;AAEA,MAAA,MAAM,cAAc,OAAA,EAAQ;AAG5B,MAAA,OAAO,IAAA,CAAK,OAAA;AACZ,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AAAA,IAC3B,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA,CACA,IAAA,CAAK,0BAAA,EAA4B,OAAO,KAAK,GAAA,KAAQ;AACpD,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,GAAA,CAAI,MAAA;AAEvB,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,MAC9C,OAAA,EAAS,MAAA;AAAA,MACT,aAAA,EAAe,QAAA;AAAA,MACf,OAAA,EAAS,GAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACJ,UAAA,EAAY,QAAA;AAAA,QACZ;AAAA;AACF,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,IAAA,GAAO,MAAM,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AAExC,MAAA,MAAMD,oCAAA,CAAoB;AAAA,QACxB,WAAA;AAAA,QACA,WAAA,EAAa,CAACE,0BAAA,EAAsBH,wBAAkB,CAAA;AAAA,QACtD,iBAAA,EAAmBlC,aAAA;AAAA,QACnB,IAAA;AAAA,QACA;AAAA,OACD,CAAA;AAED,MAAA,MAAM,UAAA,CAAW,SAAS,MAAM,CAAA;AAEhC,MAAA,MAAM,cAAc,OAAA,EAAQ;AAE5B,MAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,MAAA,EAAQ,aAAa,CAAA;AAAA,IAC9C,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA,CACA,IAAA,CAAK,yBAAA,EAA2B,OAAO,KAAK,GAAA,KAAQ;AACnD,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,GAAA,CAAI,MAAA;AAEvB,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,MAC9C,OAAA,EAAS,MAAA;AAAA,MACT,aAAA,EAAe,QAAA;AAAA,MACf,OAAA,EAAS,GAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACJ,UAAA,EAAY,OAAA;AAAA,QACZ;AAAA;AACF,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,IAAA,GAAO,MAAM,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AAGxC,MAAA,MAAM4B,gCAAA,CAAgB;AAAA,QACpB,WAAA;AAAA,QACA,WAAA,EAAa,CAACH,0BAAoB,CAAA;AAAA,QAClC,iBAAA,EAAmBzB;AAAA,OACpB,CAAA;AAED,MAAA,MAAMmC,oCAAA,CAAoB;AAAA,QACxB,WAAA;AAAA,QACA,WAAA,EAAa,CAACD,wBAAkB,CAAA;AAAA,QAChC,iBAAA,EAAmBlC,aAAA;AAAA,QACnB,IAAA;AAAA,QACA;AAAA,OACD,CAAA;AAGD,MAAA,IAAI,IAAA,CAAK,IAAA,CAAK,YAAA,EAAc,SAAA,EAAW;AACrC,QAAA,MAAM,iBAAA,GAAoB2B,2BAAA;AAAA,UACxB,IAAA,CAAK,KAAK,YAAA,CAAa,SAAA;AAAA,UACvB,EAAE,aAAa,UAAA;AAAW,SAC5B;AACA,QAAA,MAAM,WAAW,MAAM,iBAAA;AAAA,UACrB,iBAAA;AAAA,UACA;AAAA,SACF;AAEA,QAAA,MAAM,YAAA,GAAe,MAAM,eAAA,CAAgB;AAAA,UACzC,QAAA;AAAA,UACA,OAAA,EAAS,GAAA,CAAI,IAAA,CAAK,OAAA,IAAW,EAAC;AAAA,UAC9B,GAAA;AAAA,UACA;AAAA,SACD,CAAA;AACD,QAAA,IAAI,CAAC,YAAA,EAAc;AACjB,UAAA;AAAA,QACF;AAAA,MACF;AAEA,MAAA,MAAM,cAAc,OAAA,EAAQ;AAE5B,MAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,KAAK,qBAAA,CAAsB;AAAA,QACjD,UAAA,EAAY,WAAA;AAAA,QACZ,cAAA,EAAgB;AAAA,OACjB,CAAA;AAED,MAAA,MAAM,OAAA,GAA+B;AAAA,QACnC,GAAG,IAAI,IAAA,CAAK,OAAA;AAAA,QACZ,cAAA,EAAgB,KAAA;AAAA,QAChB,sBAAA,EAAwB,KAAK,SAAA,CAAU;AAAA,UACrC,GAAG,WAAA;AAAA;AAAA,UAEH,OAAQ,WAAA,CAAoB;AAAA,SAC7B;AAAA,OACH;AAEA,MAAA,MAAM,UAAA,CAAW,KAAA,GAAQ,EAAE,OAAA,EAAS,QAAQ,CAAA;AAC5C,MAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,EAAA,EAAI,QAAQ,CAAA;AAAA,IACrC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA;AACH,EAAC9B,QAAA,CAA0B,GAAA;AAAA,IACzB,+BAAA;AAAA,IACA,OAAO,KAAK,GAAA,KAAQ;AAClB,MAAA,MAAM,EAAE,MAAA,EAAO,GAAI,GAAA,CAAI,MAAA;AAEvB,MAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,QAC9C,OAAA,EAAS,MAAA;AAAA,QACT,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM;AAAA,UACJ,UAAA,EAAY,QAAA;AAAA,UACZ;AAAA;AACF,OACD,CAAA;AAED,MAAA,IAAI;AACF,QAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,QAAA,MAAM,IAAA,GAAO,MAAM,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AAExC,QAAA,MAAMsC,oCAAA,CAAoB;AAAA,UACxB,WAAA;AAAA,UACA,WAAA,EAAa,CAACD,wBAAkB,CAAA;AAAA,UAChC,iBAAA,EAAmBlC,aAAA;AAAA,UACnB,IAAA;AAAA,UACA;AAAA,SACD,CAAA;AAED,QAAA,MAAM,KAAA,GACJ,IAAI,KAAA,CAAM,KAAA,KAAU,SAAY,MAAA,CAAO,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA,GAAI,KAAA,CAAA;AAE5D,QAAA,MAAA,CAAO,KAAA,CAAM,CAAA,+BAAA,EAAkC,MAAM,CAAA,QAAA,CAAU,CAAA;AAG/D,QAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,UACjB,UAAA,EAAY,YAAA;AAAA,UACZ,eAAA,EAAiB,UAAA;AAAA,UACjB,cAAA,EAAgB;AAAA,SACjB,CAAA;AAGD,QAAA,MAAM,YAAA,GAAe,WAAW,MAAA,CAAO,EAAE,QAAQ,KAAA,EAAO,EAAE,SAAA,CAAU;AAAA,UAClE,KAAA,EAAO,OAAM,KAAA,KAAS;AACpB,YAAA,MAAA,CAAO,KAAA;AAAA,cACL,CAAA,wDAAA,EAA2D,MAAM,CAAA,GAAA,EAAM,KAAK,CAAA;AAAA,aAC9E;AACA,YAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAc,CAAA;AACzC,YAAA,GAAA,CAAI,GAAA,EAAI;AAAA,UACV,CAAA;AAAA,UACA,IAAA,EAAM,CAAC,EAAE,MAAA,EAAO,KAAM;AACpB,YAAA,IAAI,iBAAA,GAAoB,KAAA;AACxB,YAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,cAAA,GAAA,CAAI,KAAA;AAAA,gBACF,CAAA,OAAA,EAAU,MAAM,IAAI;AAAA,MAAA,EAAW,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC;;AAAA;AAAA,eACtD;AACA,cAAA,IAAI,KAAA,CAAM,IAAA,KAAS,YAAA,IAAgB,CAAC,MAAM,iBAAA,EAAmB;AAC3D,gBAAA,iBAAA,GAAoB,IAAA;AAAA,cACtB;AAAA,YACF;AAEA,YAAA,GAAA,CAAI,KAAA,IAAQ;AACZ,YAAA,IAAI,iBAAA,EAAmB;AACrB,cAAA,YAAA,CAAa,WAAA,EAAY;AACzB,cAAA,GAAA,CAAI,GAAA,EAAI;AAAA,YACV;AAAA,UACF;AAAA,SACD,CAAA;AAID,QAAA,GAAA,CAAI,EAAA,CAAG,SAAS,YAAY;AAC1B,UAAA,YAAA,CAAa,WAAA,EAAY;AACzB,UAAA,MAAA,CAAO,KAAA,CAAM,CAAA,+BAAA,EAAkC,MAAM,CAAA,QAAA,CAAU,CAAA;AAC/D,UAAA,MAAM,cAAc,OAAA,EAAQ;AAAA,QAC9B,CAAC,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AACZ,QAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF;AAAA,GACF;AACA,EAAAH,QAAA,CACG,GAAA,CAAI,0BAAA,EAA4B,OAAO,GAAA,EAAK,GAAA,KAAQ;AACnD,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,GAAA,CAAI,MAAA;AAEvB,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,MAC9C,OAAA,EAAS,MAAA;AAAA,MACT,OAAA,EAAS,GAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACJ,UAAA,EAAY,QAAA;AAAA,QACZ;AAAA;AACF,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM,IAAA,GAAO,MAAM,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AAExC,MAAA,MAAMsC,oCAAA,CAAoB;AAAA,QACxB,WAAA;AAAA,QACA,WAAA,EAAa,CAACD,wBAAkB,CAAA;AAAA,QAChC,iBAAA,EAAmBlC,aAAA;AAAA,QACnB,IAAA;AAAA,QACA;AAAA,OACD,CAAA;AAED,MAAA,MAAM,KAAA,GACJ,IAAI,KAAA,CAAM,KAAA,KAAU,SAAY,MAAA,CAAO,GAAA,CAAI,KAAA,CAAM,KAAK,CAAA,GAAI,KAAA,CAAA;AAG5D,MAAA,MAAM,OAAA,GAAU,WAAW,MAAM;AAC/B,QAAA,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA;AAAA,MACb,GAAG,GAAM,CAAA;AAGT,MAAA,MAAM,YAAA,GAAe,WAAW,MAAA,CAAO,EAAE,QAAQ,KAAA,EAAO,EAAE,SAAA,CAAU;AAAA,QAClE,KAAA,EAAO,OAAM,KAAA,KAAS;AACpB,UAAA,MAAA,CAAO,KAAA;AAAA,YACL,CAAA,wDAAA,EAA2D,MAAM,CAAA,GAAA,EAAM,KAAK,CAAA;AAAA,WAC9E;AACA,UAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAc,CAAA;AAAA,QAC3C,CAAA;AAAA,QACA,IAAA,EAAM,OAAO,EAAE,MAAA,EAAO,KAAM;AAC1B,UAAA,YAAA,CAAa,OAAO,CAAA;AACpB,UAAA,YAAA,CAAa,WAAA,EAAY;AACzB,UAAA,MAAM,cAAc,OAAA,EAAQ;AAC5B,UAAA,GAAA,CAAI,KAAK,MAAM,CAAA;AAAA,QACjB;AAAA,OACD,CAAA;AAID,MAAA,GAAA,CAAI,EAAA,CAAG,SAAS,MAAM;AACpB,QAAA,YAAA,CAAa,WAAA,EAAY;AACzB,QAAA,YAAA,CAAa,OAAO,CAAA;AAAA,MACtB,CAAC,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA,CACA,IAAA,CAAK,aAAA,EAAe,OAAO,KAAK,GAAA,KAAQ;AACvC,IAAA,MAAM,YAAA,GAAe,MAAM,OAAA,EAAS,WAAA,CAAY;AAAA,MAC9C,OAAA,EAAS,MAAA;AAAA,MACT,OAAA,EAAS,GAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACJ,UAAA,EAAY;AAAA;AACd,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,WAAA,CAAY,GAAG,CAAA;AAClD,MAAA,MAAM4B,gCAAA,CAAgB;AAAA,QACpB,WAAA;AAAA,QACA,WAAA,EAAa,CAACH,0BAAoB,CAAA;AAAA,QAClC,iBAAA,EAAmBzB;AAAA,OACpB,CAAA;AAED,MAAA,MAAM,UAAA,GAAasC,KAAE,MAAA,CAAO;AAAA,QAC1B,QAAA,EAAUA,KAAE,OAAA,EAAQ;AAAA,QACpB,MAAA,EAAQA,IAAA,CAAE,MAAA,CAAOA,IAAA,CAAE,SAAS,CAAA;AAAA,QAC5B,SAASA,IAAA,CAAE,MAAA,CAAOA,KAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,QACvC,mBAAmBA,IAAA,CAAE,KAAA;AAAA,UACnBA,IAAA,CAAE,MAAA,CAAO,EAAE,IAAA,EAAMA,IAAA,CAAE,MAAA,EAAO,EAAG,aAAA,EAAeA,IAAA,CAAE,MAAA,EAAO,EAAG;AAAA;AAC1D,OACD,CAAA;AACD,MAAA,MAAM,IAAA,GAAO,MAAM,UAAA,CAAW,UAAA,CAAW,IAAI,IAAI,CAAA,CAAE,MAAM,CAAA,CAAA,KAAK;AAC5D,QAAA,MAAM,IAAI1C,iBAAA,CAAW,CAAA,mBAAA,EAAsB,CAAC,CAAA,CAAE,CAAA;AAAA,MAChD,CAAC,CAAA;AAED,MAAA,MAAM,WAAW,IAAA,CAAK,QAAA;AACtB,MAAA,IAAI,CAAE,MAAM2C,qDAAA,CAA+B,KAAA,CAAM,QAAQ,CAAA,EAAI;AAC3D,QAAA,MAAM,IAAI3C,kBAAW,kCAAkC,CAAA;AAAA,MACzD;AAEA,MAAA,MAAM,aAAA,GAAgB,KAAK,WAAA,CAAY,WAAA,EAAa,MAAM,CAAA,GACtD,WAAA,CAAY,UAAU,aAAA,GACtB,KAAA,CAAA;AAEJ,MAAA,MAAM,UAAA,GAAa,gBACf,MAAM,OAAA,CAAQ,eAAe,aAAA,EAAe,EAAE,WAAA,EAAa,CAAA,GAC3D,KAAA,CAAA;AAEJ,MAAA,MAAM,WAAA,GAAsB,CAAA,EAAG,QAAA,CAAS,IAAI,CAAA,CAAA,EAC1C,QAAA,CAAS,QAAA,CAAS,SAAA,IAAa,SACjC,CAAA,CAAA,EAAI,QAAA,CAAS,QAAA,CAAS,IAAI,CAAA,CAAA;AAE1B,MAAA,KAAA,MAAW,UAAA,IAAc,CAAC,QAAA,CAAS,IAAA,CAAK,cAAc,EAAE,CAAA,CAAE,IAAA,EAAK,EAAG;AAChE,QAAA,MAAMiC,OAAAA,GAASlC,mBAAA,CAAS,IAAA,CAAK,MAAA,EAAQ,UAAU,CAAA;AAC/C,QAAA,IAAI,CAACkC,QAAO,KAAA,EAAO;AACjB,UAAA,MAAM,cAAc,IAAA,CAAK;AAAA;AAAA,YAEvB,KAAA,EAAQ,cAAA;AAAA,cACNA,OAAAA,CAAO,MAAA;AAAA,cACP;AAAA,aACF;AAAA,YACA,IAAA,EAAM;AAAA,cACJ,WAAA;AAAA,cACA,UAAA,EAAY,SAAS,IAAA,CAAK;AAAA;AAC5B,WACD,CAAA;AAED,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,MAAA,EAAQA,OAAAA,CAAO,QAAQ,CAAA;AAC9C,UAAA;AAAA,QACF;AAAA,MACF;AAEA,MAAA,MAAM,YAAA,GAAe,MAAM,eAAA,CAAgB;AAAA,QACzC,QAAA;AAAA,QACA,OAAA,EAAS,IAAA,CAAK,OAAA,IAAW,EAAC;AAAA,QAC1B,GAAA;AAAA,QACA;AAAA,OACD,CAAA;AACD,MAAA,IAAI,CAAC,YAAA,EAAc;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,QAAQ,QAAA,CAAS,IAAA,CAAK,MAAM,GAAA,CAAI,CAAC,MAAM,KAAA,MAAW;AAAA,QACtD,GAAG,IAAA;AAAA,QACH,EAAA,EAAI,IAAA,CAAK,EAAA,IAAM,CAAA,KAAA,EAAQ,QAAQ,CAAC,CAAA,CAAA;AAAA,QAChC,IAAA,EAAM,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK;AAAA,OAC1B,CAAE,CAAA;AAEF,MAAA,MAAM,WAAWW,sBAAA,EAAK;AACtB,MAAA,MAAM,YAAA,GAAeC,qCAAA;AAAA,QACnB,gBAAA;AAAA,QACA,mBAAmB,QAAQ,CAAA;AAAA,OAC7B;AACA,MAAA,MAAM,YAAA,GAAe;AAAA,QACnB,SAAA,EAAW,0BAAA;AAAA,QACX,MAAA,EAAQ;AAAA,UACN,UAAU,QAAA,CAAS;AAAA,SACrB;AAAA,QACA,OAAA,EAASC,sBAAA;AAAA,UACPD,qCAAA,CAAqB,cAAc,eAAe;AAAA,UAClD,QAAA;AAAS,OACb;AAEA,MAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU;AAAA,QAC7B,IAAA,EAAM;AAAA,UACJ,YAAY,QAAA,CAAS,UAAA;AAAA,UACrB,KAAA;AAAA,UACA,MAAA,EAAQ,QAAA,CAAS,IAAA,CAAK,MAAA,IAAU,EAAC;AAAA,UACjC,YAAY,IAAA,CAAK,MAAA;AAAA,UACjB,IAAA,EAAM;AAAA,YACJ,MAAA,EAAQ,UAAA;AAAA,YACR,GAAA,EAAK;AAAA;AACP,SACF;AAAA,QACA,YAAA;AAAA,QACA,oBAAoB,IAAA,CAAK,iBAAA,IAAqB,EAAC,EAAG,IAAI,CAAA,IAAA,MAAS;AAAA,UAC7D,MAAM,IAAA,CAAK,IAAA;AAAA,UACX,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,eAAe,QAAQ;AAAA,SACnD,CAAE,CAAA;AAAA,QACF,OAAA,EAAS;AAAA,UACP,GAAG,IAAA,CAAK,OAAA;AAAA,UACR,gBAAiB,WAAA,CAAoB;AAAA,SACvC;AAAA,QACA;AAAA,OACD,CAAA;AAED,MAAA,MAAM,cAAc,OAAA,CAAQ;AAAA,QAC1B,IAAA,EAAM;AAAA,UACJ,WAAA;AAAA,UACA,UAAA,EAAY,SAAS,IAAA,CAAK;AAAA;AAC5B,OACD,CAAA;AAED,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,QACnB,GAAG,MAAA;AAAA,QACH,KAAA;AAAA,QACA,iBAAA,EAAmB,MAAA,CAAO,iBAAA,CAAkB,GAAA,CAAI,CAAA,IAAA,MAAS;AAAA,UACvD,MAAM,IAAA,CAAK,IAAA;AAAA,UACX,YAAY,IAAA,CAAK,UAAA;AAAA,UACjB,aAAA,EAAe,IAAA,CAAK,OAAA,CAAQ,QAAA,CAAS,QAAQ;AAAA,SAC/C,CAAE;AAAA,OACH,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,YAAA,EAAc,IAAA,CAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF,CAAC,CAAA,CACA,IAAA,CAAK,sCAAA,EAAwC,OAAO,KAAK,GAAA,KAAQ;AAChE,IAAA,MAAM,EAAE,KAAA,EAAO,OAAA,EAAQ,GAAI,GAAA,CAAI,IAAA;AAC/B,IAAA,MAAM,EAAE,QAAA,EAAU,QAAA,EAAS,GAAI,GAAA,CAAI,MAAA;AAEnC,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI7C,kBAAW,+BAA+B,CAAA;AAEhE,IAAA,IAAI,CAAC,oBAAA,CAAqB,QAAQ,CAAA,EAAG;AACnC,MAAA,MAAM,IAAIA,iBAAA,CAAW,CAAA,sBAAA,EAAyB,QAAQ,CAAA,CAAE,CAAA;AAAA,IAC1D;AAEA,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,oBAAA,CAAqB,QAAQ,CAAA,CAAE;AAAA,MACvD,QAAA;AAAA,MACA,KAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,SAAS,CAAA;AAAA,EAClC,CAAC,CAAA,CACA,GAAA,CAAI,2BAAA,EAA6B,OAAO,MAAM,GAAA,KAAQ;AACrD,IAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK;AAAA,MACnB,OAAA,EAAS;AAAA,QACP,GAAG+C,gCAAA,CAAsBC,yCAAA,CAAqB,EAAE,YAAA,EAAc,CAAC,CAAA;AAAA,QAC/D,GAAGD,iCAAsB,yBAAyB;AAAA,OACpD;AAAA,MACA,OAAA,EAAS;AAAA,QACP,SAAA,EAAWE,yCAA8B,yBAAyB,CAAA;AAAA,QAClE,MAAA,EAAQC,sCAA2B,yBAAyB;AAAA;AAC9D,KACD,CAAA;AAAA,EACH,CAAC,CAAA;AAEH,EAAA,MAAM,MAAM/C,wBAAA,EAAQ;AACpB,EAAA,GAAA,CAAI,GAAA,CAAI,UAAU,MAAM,CAAA;AACxB,EAAA,GAAA,CAAI,GAAA,CAAI,KAAKF,QAAM,CAAA;AAEnB,EAAA,eAAe,iBAAA,CACb,WACA,WAAA,EACA;AACA,IAAA,MAAM,QAAA,GAAW,MAAMkD,oBAAA,CAAa;AAAA,MAClC,OAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,IAAI,CAAC,mBAAA,CAAoB,QAAQ,CAAA,EAAG;AAClC,MAAA,MAAM,IAAInD,iBAAA;AAAA,QACR,CAAA,+CAAA,EACG,SAAoB,UACvB,CAAA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAI,CAACI,aAAA,EAAa;AAChB,MAAA,OAAO,QAAA;AAAA,IACT;AAEA,IAAA,MAAM,CAAC,iBAAA,EAAmB,YAAY,CAAA,GACpC,MAAMA,aAAA,CAAY,oBAAA;AAAA,MAChB;AAAA,QACE,EAAE,YAAYgD,qCAAA,EAAgC;AAAA,QAC9C,EAAE,YAAYC,gCAAA;AAA2B,OAC3C;AAAA,MACA,EAAE,WAAA;AAAY,KAChB;AAGF,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,QAAA,CAAS,IAAA,CAAK,UAAU,CAAA,EAAG;AAC3C,MAAA,QAAA,CAAS,IAAA,CAAK,UAAA,GAAa,QAAA,CAAS,IAAA,CAAK,UAAA,CAAW,MAAA;AAAA,QAAO,CAAA,IAAA,KACzD,oBAAA,CAAqB,iBAAA,EAAmB,IAAI;AAAA,OAC9C;AAAA,IACF,CAAA,MAAA,IACE,QAAA,CAAS,IAAA,CAAK,UAAA,IACd,CAAC,qBAAqB,iBAAA,EAAmB,QAAA,CAAS,IAAA,CAAK,UAAU,CAAA,EACjE;AACA,MAAA,QAAA,CAAS,KAAK,UAAA,GAAa,MAAA;AAAA,IAC7B;AAGA,IAAA,QAAA,CAAS,IAAA,CAAK,KAAA,GAAQ,QAAA,CAAS,IAAA,CAAK,KAAA,CAAM,MAAA;AAAA,MAAO,CAAA,IAAA,KAC/C,oBAAA,CAAqB,YAAA,EAAc,IAAI;AAAA,KACzC;AAEA,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,OAAO,GAAA;AACT;;;;"}

package/dist/service/rules.cjs.js

@@ -79,7 +79,7 @@ const isTaskOwner = createTaskPermissionRule({
   resourceType: alpha.RESOURCE_TYPE_SCAFFOLDER_TASK,
   paramsSchema: v3.z.object({
     createdBy: v3.z.array(v3.z.string()).describe(
-      "List of creater entity refs; only tasks created by these users will be viewable"
+      "List of creator entity refs; only tasks created by these users will be viewable"
     )
   }),
   apply: (resource, { createdBy }) => {

package/dist/service/rules.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.cjs.js","sources":["../../src/service/rules.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { makeCreatePermissionRule } from '@backstage/plugin-permission-node';\n\nimport {\n  RESOURCE_TYPE_SCAFFOLDER_TEMPLATE,\n  RESOURCE_TYPE_SCAFFOLDER_ACTION,\n  RESOURCE_TYPE_SCAFFOLDER_TASK,\n} from '@backstage/plugin-scaffolder-common/alpha';\n\nimport {\n  TemplateEntityStepV1beta3,\n  TemplateParametersV1beta3,\n} from '@backstage/plugin-scaffolder-common';\n\nimport { SerializedTask, TaskFilter } from '@backstage/plugin-scaffolder-node';\n\nimport { z } from 'zod/v3';\nimport { JsonObject, JsonPrimitive } from '@backstage/types';\nimport { get } from 'lodash';\n\nexport const createTemplatePermissionRule = makeCreatePermissionRule<\n  TemplateEntityStepV1beta3 | TemplateParametersV1beta3,\n  {},\n  typeof RESOURCE_TYPE_SCAFFOLDER_TEMPLATE\n>();\n\nexport const hasTag = createTemplatePermissionRule({\n  name: 'HAS_TAG',\n  resourceType: RESOURCE_TYPE_SCAFFOLDER_TEMPLATE,\n  description: `Match parameters or steps with the given tag`,\n  paramsSchema: z.object({\n    tag: z.string().describe('Name of the tag to match on'),\n  }),\n  apply: (resource, { tag }) => {\n    return resource['backstage:permissions']?.tags?.includes(tag) ?? false;\n  },\n  toQuery: () => ({}),\n});\n\nexport const createActionPermissionRule = makeCreatePermissionRule<\n  {\n    action: string;\n    input: JsonObject | undefined;\n  },\n  {},\n  typeof RESOURCE_TYPE_SCAFFOLDER_ACTION\n>();\n\nexport const hasActionId = createActionPermissionRule({\n  name: 'HAS_ACTION_ID',\n  resourceType: RESOURCE_TYPE_SCAFFOLDER_ACTION,\n  description: `Match actions with the given actionId`,\n  paramsSchema: z.object({\n    actionId: z.string().describe('Name of the actionId to match on'),\n  }),\n  apply: (resource, { actionId }) => {\n    return resource.action === actionId;\n  },\n  toQuery: () => ({}),\n});\n\nexport const hasBooleanProperty = buildHasProperty({\n  name: 'HAS_BOOLEAN_PROPERTY',\n  valueSchema: z.boolean(),\n});\nexport const hasNumberProperty = buildHasProperty({\n  name: 'HAS_NUMBER_PROPERTY',\n  valueSchema: z.number(),\n});\nexport const hasStringProperty = buildHasProperty({\n  name: 'HAS_STRING_PROPERTY',\n  valueSchema: z.string(),\n});\n\nfunction buildHasProperty<Schema extends z.ZodType<JsonPrimitive>>({\n  name,\n  valueSchema,\n  validateProperty = true,\n}: {\n  name: string;\n  valueSchema: Schema;\n  validateProperty?: boolean;\n}) {\n  return createActionPermissionRule({\n    name,\n    description: `Allow actions with the specified property`,\n    resourceType: RESOURCE_TYPE_SCAFFOLDER_ACTION,\n    paramsSchema: z.object({\n      key: z\n        .string()\n        .describe(`Property within the action parameters to match on`),\n      value: valueSchema\n        .optional()\n        .describe(`Value of the given property to match on`),\n    }) as unknown as z.ZodType<{ key: string; value?: z.infer<Schema> }>,\n    apply: (resource, { key, value }) => {\n      const foundValue = get(resource.input, key);\n\n      if (validateProperty && !valueSchema.safeParse(foundValue).success) {\n        return false;\n      }\n      if (value !== undefined) {\n        if (valueSchema.safeParse(value).success) {\n          return value === foundValue;\n        }\n        return false;\n      }\n\n      return foundValue !== undefined;\n    },\n    toQuery: () => ({}),\n  });\n}\n\nexport const createTaskPermissionRule = makeCreatePermissionRule<\n  SerializedTask,\n  TaskFilter,\n  typeof RESOURCE_TYPE_SCAFFOLDER_TASK\n>();\n\nexport const isTaskOwner = createTaskPermissionRule({\n  name: 'IS_TASK_OWNER',\n  description: 'Allows tasks created by certain users to be accessible',\n  resourceType: RESOURCE_TYPE_SCAFFOLDER_TASK,\n  paramsSchema: z.object({\n    createdBy: z\n      .array(z.string())\n      .describe(\n        'List of creater entity refs; only tasks created by these users will be viewable',\n      ),\n  }),\n  apply: (resource, { createdBy }) => {\n    if (!resource.createdBy) {\n      return false;\n    }\n    return createdBy.includes(resource.createdBy);\n  },\n  toQuery: ({ createdBy }) => {\n    return {\n      key: 'created_by',\n      values: createdBy,\n    };\n  },\n});\n\nexport const scaffolderTemplateRules = { hasTag };\nexport const scaffolderActionRules = {\n  hasActionId,\n  hasBooleanProperty,\n  hasNumberProperty,\n  hasStringProperty,\n};\nexport const scaffolderTaskRules = { isTaskOwner };\n"],"names":["makeCreatePermissionRule","RESOURCE_TYPE_SCAFFOLDER_TEMPLATE","z","RESOURCE_TYPE_SCAFFOLDER_ACTION","get","RESOURCE_TYPE_SCAFFOLDER_TASK"],"mappings":";;;;;;;AAmCO,MAAM,+BAA+BA,6CAAA;AAMrC,MAAM,SAAS,4BAAA,CAA6B;AAAA,EACjD,IAAA,EAAM,SAAA;AAAA,EACN,YAAA,EAAcC,uCAAA;AAAA,EACd,WAAA,EAAa,CAAA,4CAAA,CAAA;AAAA,EACb,YAAA,EAAcC,KAAE,MAAA,CAAO;AAAA,IACrB,GAAA,EAAKA,IAAA,CAAE,MAAA,EAAO,CAAE,SAAS,6BAA6B;AAAA,GACvD,CAAA;AAAA,EACD,KAAA,EAAO,CAAC,QAAA,EAAU,EAAE,KAAI,KAAM;AAC5B,IAAA,OAAO,SAAS,uBAAuB,CAAA,EAAG,IAAA,EAAM,QAAA,CAAS,GAAG,CAAA,IAAK,KAAA;AAAA,EACnE,CAAA;AAAA,EACA,OAAA,EAAS,OAAO,EAAC;AACnB,CAAC;AAEM,MAAM,6BAA6BF,6CAAA;AASnC,MAAM,cAAc,0BAAA,CAA2B;AAAA,EACpD,IAAA,EAAM,eAAA;AAAA,EACN,YAAA,EAAcG,qCAAA;AAAA,EACd,WAAA,EAAa,CAAA,qCAAA,CAAA;AAAA,EACb,YAAA,EAAcD,KAAE,MAAA,CAAO;AAAA,IACrB,QAAA,EAAUA,IAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kCAAkC;AAAA,GACjE,CAAA;AAAA,EACD,KAAA,EAAO,CAAC,QAAA,EAAU,EAAE,UAAS,KAAM;AACjC,IAAA,OAAO,SAAS,MAAA,KAAW,QAAA;AAAA,EAC7B,CAAA;AAAA,EACA,OAAA,EAAS,OAAO,EAAC;AACnB,CAAC;AAEM,MAAM,qBAAqB,gBAAA,CAAiB;AAAA,EACjD,IAAA,EAAM,sBAAA;AAAA,EACN,WAAA,EAAaA,KAAE,OAAA;AACjB,CAAC;AACM,MAAM,oBAAoB,gBAAA,CAAiB;AAAA,EAChD,IAAA,EAAM,qBAAA;AAAA,EACN,WAAA,EAAaA,KAAE,MAAA;AACjB,CAAC;AACM,MAAM,oBAAoB,gBAAA,CAAiB;AAAA,EAChD,IAAA,EAAM,qBAAA;AAAA,EACN,WAAA,EAAaA,KAAE,MAAA;AACjB,CAAC;AAED,SAAS,gBAAA,CAA0D;AAAA,EACjE,IAAA;AAAA,EACA,WAAA;AAAA,EACA,gBAAA,GAAmB;AACrB,CAAA,EAIG;AACD,EAAA,OAAO,0BAAA,CAA2B;AAAA,IAChC,IAAA;AAAA,IACA,WAAA,EAAa,CAAA,yCAAA,CAAA;AAAA,IACb,YAAA,EAAcC,qCAAA;AAAA,IACd,YAAA,EAAcD,KAAE,MAAA,CAAO;AAAA,MACrB,GAAA,EAAKA,IAAA,CACF,MAAA,EAAO,CACP,SAAS,CAAA,iDAAA,CAAmD,CAAA;AAAA,MAC/D,KAAA,EAAO,WAAA,CACJ,QAAA,EAAS,CACT,SAAS,CAAA,uCAAA,CAAyC;AAAA,KACtD,CAAA;AAAA,IACD,OAAO,CAAC,QAAA,EAAU,EAAE,GAAA,EAAK,OAAM,KAAM;AACnC,MAAA,MAAM,UAAA,GAAaE,UAAA,CAAI,QAAA,CAAS,KAAA,EAAO,GAAG,CAAA;AAE1C,MAAA,IAAI,oBAAoB,CAAC,WAAA,CAAY,SAAA,CAAU,UAAU,EAAE,OAAA,EAAS;AAClE,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,IAAI,WAAA,CAAY,SAAA,CAAU,KAAK,CAAA,CAAE,OAAA,EAAS;AACxC,UAAA,OAAO,KAAA,KAAU,UAAA;AAAA,QACnB;AACA,QAAA,OAAO,KAAA;AAAA,MACT;AAEA,MAAA,OAAO,UAAA,KAAe,MAAA;AAAA,IACxB,CAAA;AAAA,IACA,OAAA,EAAS,OAAO,EAAC;AAAA,GAClB,CAAA;AACH;AAEO,MAAM,2BAA2BJ,6CAAA;AAMjC,MAAM,cAAc,wBAAA,CAAyB;AAAA,EAClD,IAAA,EAAM,eAAA;AAAA,EACN,WAAA,EAAa,wDAAA;AAAA,EACb,YAAA,EAAcK,mCAAA;AAAA,EACd,YAAA,EAAcH,KAAE,MAAA,CAAO;AAAA,IACrB,WAAWA,IAAA,CACR,KAAA,CAAMA,IAAA,CAAE,MAAA,EAAQ,CAAA,CAChB,QAAA;AAAA,MACC;AAAA;AACF,GACH,CAAA;AAAA,EACD,KAAA,EAAO,CAAC,QAAA,EAAU,EAAE,WAAU,KAAM;AAClC,IAAA,IAAI,CAAC,SAAS,SAAA,EAAW;AACvB,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,OAAO,SAAA,CAAU,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA;AAAA,EAC9C,CAAA;AAAA,EACA,OAAA,EAAS,CAAC,EAAE,SAAA,EAAU,KAAM;AAC1B,IAAA,OAAO;AAAA,MACL,GAAA,EAAK,YAAA;AAAA,MACL,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AACF,CAAC;AAEM,MAAM,uBAAA,GAA0B,EAAE,MAAA;AAClC,MAAM,qBAAA,GAAwB;AAAA,EACnC,WAAA;AAAA,EACA,kBAAA;AAAA,EACA,iBAAA;AAAA,EACA;AACF;AACO,MAAM,mBAAA,GAAsB,EAAE,WAAA;;;;;;;;;;;;;;;"}
+{"version":3,"file":"rules.cjs.js","sources":["../../src/service/rules.ts"],"sourcesContent":["/*\n * Copyright 2022 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { makeCreatePermissionRule } from '@backstage/plugin-permission-node';\n\nimport {\n  RESOURCE_TYPE_SCAFFOLDER_TEMPLATE,\n  RESOURCE_TYPE_SCAFFOLDER_ACTION,\n  RESOURCE_TYPE_SCAFFOLDER_TASK,\n} from '@backstage/plugin-scaffolder-common/alpha';\n\nimport {\n  TemplateEntityStepV1beta3,\n  TemplateParametersV1beta3,\n} from '@backstage/plugin-scaffolder-common';\n\nimport { SerializedTask, TaskFilter } from '@backstage/plugin-scaffolder-node';\n\nimport { z } from 'zod/v3';\nimport { JsonObject, JsonPrimitive } from '@backstage/types';\nimport { get } from 'lodash';\n\nexport const createTemplatePermissionRule = makeCreatePermissionRule<\n  TemplateEntityStepV1beta3 | TemplateParametersV1beta3,\n  {},\n  typeof RESOURCE_TYPE_SCAFFOLDER_TEMPLATE\n>();\n\nexport const hasTag = createTemplatePermissionRule({\n  name: 'HAS_TAG',\n  resourceType: RESOURCE_TYPE_SCAFFOLDER_TEMPLATE,\n  description: `Match parameters or steps with the given tag`,\n  paramsSchema: z.object({\n    tag: z.string().describe('Name of the tag to match on'),\n  }),\n  apply: (resource, { tag }) => {\n    return resource['backstage:permissions']?.tags?.includes(tag) ?? false;\n  },\n  toQuery: () => ({}),\n});\n\nexport const createActionPermissionRule = makeCreatePermissionRule<\n  {\n    action: string;\n    input: JsonObject | undefined;\n  },\n  {},\n  typeof RESOURCE_TYPE_SCAFFOLDER_ACTION\n>();\n\nexport const hasActionId = createActionPermissionRule({\n  name: 'HAS_ACTION_ID',\n  resourceType: RESOURCE_TYPE_SCAFFOLDER_ACTION,\n  description: `Match actions with the given actionId`,\n  paramsSchema: z.object({\n    actionId: z.string().describe('Name of the actionId to match on'),\n  }),\n  apply: (resource, { actionId }) => {\n    return resource.action === actionId;\n  },\n  toQuery: () => ({}),\n});\n\nexport const hasBooleanProperty = buildHasProperty({\n  name: 'HAS_BOOLEAN_PROPERTY',\n  valueSchema: z.boolean(),\n});\nexport const hasNumberProperty = buildHasProperty({\n  name: 'HAS_NUMBER_PROPERTY',\n  valueSchema: z.number(),\n});\nexport const hasStringProperty = buildHasProperty({\n  name: 'HAS_STRING_PROPERTY',\n  valueSchema: z.string(),\n});\n\nfunction buildHasProperty<Schema extends z.ZodType<JsonPrimitive>>({\n  name,\n  valueSchema,\n  validateProperty = true,\n}: {\n  name: string;\n  valueSchema: Schema;\n  validateProperty?: boolean;\n}) {\n  return createActionPermissionRule({\n    name,\n    description: `Allow actions with the specified property`,\n    resourceType: RESOURCE_TYPE_SCAFFOLDER_ACTION,\n    paramsSchema: z.object({\n      key: z\n        .string()\n        .describe(`Property within the action parameters to match on`),\n      value: valueSchema\n        .optional()\n        .describe(`Value of the given property to match on`),\n    }) as unknown as z.ZodType<{ key: string; value?: z.infer<Schema> }>,\n    apply: (resource, { key, value }) => {\n      const foundValue = get(resource.input, key);\n\n      if (validateProperty && !valueSchema.safeParse(foundValue).success) {\n        return false;\n      }\n      if (value !== undefined) {\n        if (valueSchema.safeParse(value).success) {\n          return value === foundValue;\n        }\n        return false;\n      }\n\n      return foundValue !== undefined;\n    },\n    toQuery: () => ({}),\n  });\n}\n\nexport const createTaskPermissionRule = makeCreatePermissionRule<\n  SerializedTask,\n  TaskFilter,\n  typeof RESOURCE_TYPE_SCAFFOLDER_TASK\n>();\n\nexport const isTaskOwner = createTaskPermissionRule({\n  name: 'IS_TASK_OWNER',\n  description: 'Allows tasks created by certain users to be accessible',\n  resourceType: RESOURCE_TYPE_SCAFFOLDER_TASK,\n  paramsSchema: z.object({\n    createdBy: z\n      .array(z.string())\n      .describe(\n        'List of creator entity refs; only tasks created by these users will be viewable',\n      ),\n  }),\n  apply: (resource, { createdBy }) => {\n    if (!resource.createdBy) {\n      return false;\n    }\n    return createdBy.includes(resource.createdBy);\n  },\n  toQuery: ({ createdBy }) => {\n    return {\n      key: 'created_by',\n      values: createdBy,\n    };\n  },\n});\n\nexport const scaffolderTemplateRules = { hasTag };\nexport const scaffolderActionRules = {\n  hasActionId,\n  hasBooleanProperty,\n  hasNumberProperty,\n  hasStringProperty,\n};\nexport const scaffolderTaskRules = { isTaskOwner };\n"],"names":["makeCreatePermissionRule","RESOURCE_TYPE_SCAFFOLDER_TEMPLATE","z","RESOURCE_TYPE_SCAFFOLDER_ACTION","get","RESOURCE_TYPE_SCAFFOLDER_TASK"],"mappings":";;;;;;;AAmCO,MAAM,+BAA+BA,6CAAA;AAMrC,MAAM,SAAS,4BAAA,CAA6B;AAAA,EACjD,IAAA,EAAM,SAAA;AAAA,EACN,YAAA,EAAcC,uCAAA;AAAA,EACd,WAAA,EAAa,CAAA,4CAAA,CAAA;AAAA,EACb,YAAA,EAAcC,KAAE,MAAA,CAAO;AAAA,IACrB,GAAA,EAAKA,IAAA,CAAE,MAAA,EAAO,CAAE,SAAS,6BAA6B;AAAA,GACvD,CAAA;AAAA,EACD,KAAA,EAAO,CAAC,QAAA,EAAU,EAAE,KAAI,KAAM;AAC5B,IAAA,OAAO,SAAS,uBAAuB,CAAA,EAAG,IAAA,EAAM,QAAA,CAAS,GAAG,CAAA,IAAK,KAAA;AAAA,EACnE,CAAA;AAAA,EACA,OAAA,EAAS,OAAO,EAAC;AACnB,CAAC;AAEM,MAAM,6BAA6BF,6CAAA;AASnC,MAAM,cAAc,0BAAA,CAA2B;AAAA,EACpD,IAAA,EAAM,eAAA;AAAA,EACN,YAAA,EAAcG,qCAAA;AAAA,EACd,WAAA,EAAa,CAAA,qCAAA,CAAA;AAAA,EACb,YAAA,EAAcD,KAAE,MAAA,CAAO;AAAA,IACrB,QAAA,EAAUA,IAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kCAAkC;AAAA,GACjE,CAAA;AAAA,EACD,KAAA,EAAO,CAAC,QAAA,EAAU,EAAE,UAAS,KAAM;AACjC,IAAA,OAAO,SAAS,MAAA,KAAW,QAAA;AAAA,EAC7B,CAAA;AAAA,EACA,OAAA,EAAS,OAAO,EAAC;AACnB,CAAC;AAEM,MAAM,qBAAqB,gBAAA,CAAiB;AAAA,EACjD,IAAA,EAAM,sBAAA;AAAA,EACN,WAAA,EAAaA,KAAE,OAAA;AACjB,CAAC;AACM,MAAM,oBAAoB,gBAAA,CAAiB;AAAA,EAChD,IAAA,EAAM,qBAAA;AAAA,EACN,WAAA,EAAaA,KAAE,MAAA;AACjB,CAAC;AACM,MAAM,oBAAoB,gBAAA,CAAiB;AAAA,EAChD,IAAA,EAAM,qBAAA;AAAA,EACN,WAAA,EAAaA,KAAE,MAAA;AACjB,CAAC;AAED,SAAS,gBAAA,CAA0D;AAAA,EACjE,IAAA;AAAA,EACA,WAAA;AAAA,EACA,gBAAA,GAAmB;AACrB,CAAA,EAIG;AACD,EAAA,OAAO,0BAAA,CAA2B;AAAA,IAChC,IAAA;AAAA,IACA,WAAA,EAAa,CAAA,yCAAA,CAAA;AAAA,IACb,YAAA,EAAcC,qCAAA;AAAA,IACd,YAAA,EAAcD,KAAE,MAAA,CAAO;AAAA,MACrB,GAAA,EAAKA,IAAA,CACF,MAAA,EAAO,CACP,SAAS,CAAA,iDAAA,CAAmD,CAAA;AAAA,MAC/D,KAAA,EAAO,WAAA,CACJ,QAAA,EAAS,CACT,SAAS,CAAA,uCAAA,CAAyC;AAAA,KACtD,CAAA;AAAA,IACD,OAAO,CAAC,QAAA,EAAU,EAAE,GAAA,EAAK,OAAM,KAAM;AACnC,MAAA,MAAM,UAAA,GAAaE,UAAA,CAAI,QAAA,CAAS,KAAA,EAAO,GAAG,CAAA;AAE1C,MAAA,IAAI,oBAAoB,CAAC,WAAA,CAAY,SAAA,CAAU,UAAU,EAAE,OAAA,EAAS;AAClE,QAAA,OAAO,KAAA;AAAA,MACT;AACA,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,IAAI,WAAA,CAAY,SAAA,CAAU,KAAK,CAAA,CAAE,OAAA,EAAS;AACxC,UAAA,OAAO,KAAA,KAAU,UAAA;AAAA,QACnB;AACA,QAAA,OAAO,KAAA;AAAA,MACT;AAEA,MAAA,OAAO,UAAA,KAAe,MAAA;AAAA,IACxB,CAAA;AAAA,IACA,OAAA,EAAS,OAAO,EAAC;AAAA,GAClB,CAAA;AACH;AAEO,MAAM,2BAA2BJ,6CAAA;AAMjC,MAAM,cAAc,wBAAA,CAAyB;AAAA,EAClD,IAAA,EAAM,eAAA;AAAA,EACN,WAAA,EAAa,wDAAA;AAAA,EACb,YAAA,EAAcK,mCAAA;AAAA,EACd,YAAA,EAAcH,KAAE,MAAA,CAAO;AAAA,IACrB,WAAWA,IAAA,CACR,KAAA,CAAMA,IAAA,CAAE,MAAA,EAAQ,CAAA,CAChB,QAAA;AAAA,MACC;AAAA;AACF,GACH,CAAA;AAAA,EACD,KAAA,EAAO,CAAC,QAAA,EAAU,EAAE,WAAU,KAAM;AAClC,IAAA,IAAI,CAAC,SAAS,SAAA,EAAW;AACvB,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,OAAO,SAAA,CAAU,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA;AAAA,EAC9C,CAAA;AAAA,EACA,OAAA,EAAS,CAAC,EAAE,SAAA,EAAU,KAAM;AAC1B,IAAA,OAAO;AAAA,MACL,GAAA,EAAK,YAAA;AAAA,MACL,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AACF,CAAC;AAEM,MAAM,uBAAA,GAA0B,EAAE,MAAA;AAClC,MAAM,qBAAA,GAAwB;AAAA,EACnC,WAAA;AAAA,EACA,kBAAA;AAAA,EACA,iBAAA;AAAA,EACA;AACF;AACO,MAAM,mBAAA,GAAsB,EAAE,WAAA;;;;;;;;;;;;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-scaffolder-backend",
-  "version": "3.5.0-next.1",
+  "version": "4.0.0-next.2",
   "description": "The Backstage backend plugin that helps you create new things",
   "backstage": {
     "role": "backend-plugin",
@@ -78,17 +78,17 @@
   },
   "dependencies": {
     "@backstage/backend-openapi-utils": "0.6.9-next.0",
-    "@backstage/backend-plugin-api": "1.9.1-next.0",
+    "@backstage/backend-plugin-api": "1.9.1-next.1",
     "@backstage/catalog-model": "1.8.1-next.1",
     "@backstage/config": "1.3.8-next.0",
     "@backstage/errors": "1.3.1-next.0",
-    "@backstage/integration": "2.0.2-next.0",
+    "@backstage/integration": "2.0.2-next.1",
     "@backstage/plugin-catalog-node": "2.2.1-next.1",
     "@backstage/plugin-events-node": "0.4.22-next.0",
     "@backstage/plugin-permission-common": "0.9.9-next.1",
     "@backstage/plugin-permission-node": "0.10.13-next.0",
-    "@backstage/plugin-scaffolder-common": "2.1.1-next.0",
-    "@backstage/plugin-scaffolder-node": "0.13.3-next.1",
+    "@backstage/plugin-scaffolder-common": "2.2.0-next.1",
+    "@backstage/plugin-scaffolder-node": "0.13.3-next.2",
     "@backstage/types": "1.2.2",
     "@types/luxon": "^3.0.0",
     "express": "^4.22.0",
@@ -113,8 +113,8 @@
     "zod-to-json-schema": "^3.25.1"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "0.17.1-next.1",
-    "@backstage/backend-test-utils": "1.11.3-next.1",
+    "@backstage/backend-defaults": "0.17.1-next.2",
+    "@backstage/backend-test-utils": "1.11.3-next.2",
     "@backstage/cli": "0.36.2-next.1",
     "@backstage/plugin-scaffolder-node-test-utils": "0.3.11-next.0",
     "@backstage/repo-tools": "0.17.2-next.0",