ansible-core 2.18.5rc1__py3-none-any.whl → 2.19.0b1__py3-none-any.whl

ansible/_internal/_yaml/_constructor.py

@@ -0,0 +1,240 @@
+from __future__ import annotations
+
+import abc
+import copy
+import typing as t
+
+from yaml import Node
+from yaml.constructor import SafeConstructor
+from yaml.resolver import BaseResolver
+
+from ansible import constants as C
+from ansible.module_utils.common.text.converters import to_text
+from ansible.module_utils._internal._datatag import AnsibleTagHelper
+from ansible._internal._datatag._tags import Origin, TrustedAsTemplate
+from ansible.parsing.vault import EncryptedString
+from ansible.utils.display import Display
+
+from ._errors import AnsibleConstructorError
+
+display = Display()
+
+_TRUSTED_AS_TEMPLATE: t.Final[TrustedAsTemplate] = TrustedAsTemplate()
+
+
+class _BaseConstructor(SafeConstructor, metaclass=abc.ABCMeta):
+    """Base class for Ansible YAML constructors."""
+
+    @classmethod
+    @abc.abstractmethod
+    def _register_constructors(cls) -> None:
+        """Method used to register constructors to derived types during class initialization."""
+
+    def __init_subclass__(cls, **kwargs) -> None:
+        """Initialization for derived types."""
+        cls._register_constructors()
+
+
+class AnsibleInstrumentedConstructor(_BaseConstructor):
+    """Ansible constructor which supports Ansible custom behavior such as `Origin` tagging, but no Ansible-specific YAML tags."""
+
+    name: t.Any  # provided by the YAML parser, which retrieves it from the stream
+
+    def __init__(self, origin: Origin, trusted_as_template: bool) -> None:
+        if not origin.line_num:
+            origin = origin.replace(line_num=1)
+
+        self._origin = origin
+        self._trusted_as_template = trusted_as_template
+        self._duplicate_key_mode = C.config.get_config_value('DUPLICATE_YAML_DICT_KEY')
+
+        super().__init__()
+
+    @property
+    def trusted_as_template(self) -> bool:
+        return self._trusted_as_template
+
+    def construct_yaml_map(self, node):
+        data = self._node_position_info(node).tag({})  # always an ordered dictionary on py3.7+
+        yield data
+        value = self.construct_mapping(node)
+        data.update(value)
+
+    def construct_mapping(self, node, deep=False):
+        # Delegate to built-in implementation to construct the mapping.
+        # This is done before checking for duplicates to leverage existing error checking on the input node.
+        mapping = super().construct_mapping(node, deep)
+        keys = set()
+
+        # Now that the node is known to be a valid mapping, handle any duplicate keys.
+        for key_node, _value_node in node.value:
+            if (key := self.construct_object(key_node, deep=deep)) in keys:
+                msg = f'Found duplicate mapping key {key!r}.'
+
+                if self._duplicate_key_mode == 'error':
+                    raise AnsibleConstructorError(problem=msg, problem_mark=key_node.start_mark)
+
+                if self._duplicate_key_mode == 'warn':
+                    display.warning(msg=msg, obj=key, help_text='Using last defined value only.')
+
+            keys.add(key)
+
+        return mapping
+
+    def construct_yaml_int(self, node):
+        value = super().construct_yaml_int(node)
+        return self._node_position_info(node).tag(value)
+
+    def construct_yaml_float(self, node):
+        value = super().construct_yaml_float(node)
+        return self._node_position_info(node).tag(value)
+
+    def construct_yaml_timestamp(self, node):
+        value = super().construct_yaml_timestamp(node)
+        return self._node_position_info(node).tag(value)
+
+    def construct_yaml_omap(self, node):
+        origin = self._node_position_info(node)
+        display.deprecated(
+            msg='Use of the YAML `!!omap` tag is deprecated.',
+            version='2.23',
+            obj=origin,
+            help_text='Use a standard mapping instead, as key order is always preserved.',
+        )
+        items = list(super().construct_yaml_omap(node))[0]
+        items = [origin.tag(item) for item in items]
+        yield origin.tag(items)
+
+    def construct_yaml_pairs(self, node):
+        origin = self._node_position_info(node)
+        display.deprecated(
+            msg='Use of the YAML `!!pairs` tag is deprecated.',
+            version='2.23',
+            obj=origin,
+            help_text='Use a standard mapping instead.',
+        )
+        items = list(super().construct_yaml_pairs(node))[0]
+        items = [origin.tag(item) for item in items]
+        yield origin.tag(items)
+
+    def construct_yaml_str(self, node):
+        # Override the default string handling function
+        # to always return unicode objects
+        # DTFIX-FUTURE: is this to_text conversion still necessary under Py3?
+        value = to_text(self.construct_scalar(node))
+
+        tags = [self._node_position_info(node)]
+
+        if self.trusted_as_template:
+            # NB: since we're not context aware, this will happily add trust to dictionary keys; this is actually necessary for
+            #  certain backward compat scenarios, though might be accomplished in other ways if we wanted to avoid trusting keys in
+            #  the general scenario
+            tags.append(_TRUSTED_AS_TEMPLATE)
+
+        return AnsibleTagHelper.tag(value, tags)
+
+    def construct_yaml_binary(self, node):
+        value = super().construct_yaml_binary(node)
+
+        return AnsibleTagHelper.tag(value, self._node_position_info(node))
+
+    def construct_yaml_set(self, node):
+        data = AnsibleTagHelper.tag(set(), self._node_position_info(node))
+        yield data
+        value = self.construct_mapping(node)
+        data.update(value)
+
+    def construct_yaml_seq(self, node):
+        data = self._node_position_info(node).tag([])
+        yield data
+        data.extend(self.construct_sequence(node))
+
+    def _resolve_and_construct_object(self, node):
+        # use a copied node to avoid mutating existing node and tripping the recursion check in construct_object
+        copied_node = copy.copy(node)
+        # repeat implicit resolution process to determine the proper tag for the value in the unsafe node
+        copied_node.tag = t.cast(BaseResolver, self).resolve(type(node), node.value, (True, False))
+
+        # re-entrant call using the correct tag
+        # non-deferred construction of hierarchical nodes so the result is a fully realized object, and so our stateful unsafe propagation behavior works
+        return self.construct_object(copied_node, deep=True)
+
+    def _node_position_info(self, node) -> Origin:
+        # the line number where the previous token has ended (plus empty lines)
+        # Add one so that the first line is line 1 rather than line 0
+        return self._origin.replace(line_num=node.start_mark.line + self._origin.line_num, col_num=node.start_mark.column + 1)
+
+    @classmethod
+    def _register_constructors(cls) -> None:
+        constructors: dict[str, t.Callable] = {
+            'tag:yaml.org,2002:binary': cls.construct_yaml_binary,
+            'tag:yaml.org,2002:float': cls.construct_yaml_float,
+            'tag:yaml.org,2002:int': cls.construct_yaml_int,
+            'tag:yaml.org,2002:map': cls.construct_yaml_map,
+            'tag:yaml.org,2002:omap': cls.construct_yaml_omap,
+            'tag:yaml.org,2002:pairs': cls.construct_yaml_pairs,
+            'tag:yaml.org,2002:python/dict': cls.construct_yaml_map,
+            'tag:yaml.org,2002:python/unicode': cls.construct_yaml_str,
+            'tag:yaml.org,2002:seq': cls.construct_yaml_seq,
+            'tag:yaml.org,2002:set': cls.construct_yaml_set,
+            'tag:yaml.org,2002:str': cls.construct_yaml_str,
+            'tag:yaml.org,2002:timestamp': cls.construct_yaml_timestamp,
+        }
+
+        for tag, constructor in constructors.items():
+            cls.add_constructor(tag, constructor)
+
+
+class AnsibleConstructor(AnsibleInstrumentedConstructor):
+    """Ansible constructor which supports Ansible custom behavior such as `Origin` tagging, as well as Ansible-specific YAML tags."""
+
+    def __init__(self, origin: Origin, trusted_as_template: bool) -> None:
+        self._unsafe_depth = 0  # volatile state var used during recursive construction of a value tagged unsafe
+
+        super().__init__(origin=origin, trusted_as_template=trusted_as_template)
+
+    @property
+    def trusted_as_template(self) -> bool:
+        return self._trusted_as_template and not self._unsafe_depth
+
+    def construct_yaml_unsafe(self, node):
+        self._unsafe_depth += 1
+
+        try:
+            return self._resolve_and_construct_object(node)
+        finally:
+            self._unsafe_depth -= 1
+
+    def construct_yaml_vault(self, node: Node) -> EncryptedString:
+        ciphertext = self._resolve_and_construct_object(node)
+
+        if not isinstance(ciphertext, str):
+            raise AnsibleConstructorError(problem=f"the {node.tag!r} tag requires a string value", problem_mark=node.start_mark)
+
+        encrypted_string = AnsibleTagHelper.tag_copy(ciphertext, EncryptedString(ciphertext=AnsibleTagHelper.untag(ciphertext)))
+
+        return encrypted_string
+
+    def construct_yaml_vault_encrypted(self, node: Node) -> EncryptedString:
+        origin = self._node_position_info(node)
+        display.deprecated(
+            msg='Use of the YAML `!vault-encrypted` tag is deprecated.',
+            version='2.23',
+            obj=origin,
+            help_text='Use the `!vault` tag instead.',
+        )
+
+        return self.construct_yaml_vault(node)
+
+    @classmethod
+    def _register_constructors(cls) -> None:
+        super()._register_constructors()
+
+        constructors: dict[str, t.Callable] = {
+            '!unsafe': cls.construct_yaml_unsafe,
+            '!vault': cls.construct_yaml_vault,
+            '!vault-encrypted': cls.construct_yaml_vault_encrypted,
+        }
+
+        for tag, constructor in constructors.items():
+            cls.add_constructor(tag, constructor)

ansible/_internal/_yaml/_dumper.py

@@ -0,0 +1,62 @@
+from __future__ import annotations
+
+import abc
+import collections.abc as c
+import typing as t
+
+from yaml.representer import SafeRepresenter
+
+from ansible.module_utils._internal._datatag import AnsibleTaggedObject, Tripwire, AnsibleTagHelper
+from ansible.parsing.vault import VaultHelper
+from ansible.module_utils.common.yaml import HAS_LIBYAML
+
+if HAS_LIBYAML:
+    from yaml.cyaml import CSafeDumper as SafeDumper
+else:
+    from yaml import SafeDumper  # type: ignore[assignment]
+
+
+class _BaseDumper(SafeDumper, metaclass=abc.ABCMeta):
+    """Base class for Ansible YAML dumpers."""
+
+    @classmethod
+    @abc.abstractmethod
+    def _register_representers(cls) -> None:
+        """Method used to register representers to derived types during class initialization."""
+
+    def __init_subclass__(cls, **kwargs) -> None:
+        """Initialization for derived types."""
+        cls._register_representers()
+
+
+class AnsibleDumper(_BaseDumper):
+    """A simple stub class that allows us to add representers for our custom types."""
+
+    # DTFIX-RELEASE: need a better way to handle serialization controls during YAML dumping
+    def __init__(self, *args, dump_vault_tags: bool | None = None, **kwargs):
+        super().__init__(*args, **kwargs)
+
+        self._dump_vault_tags = dump_vault_tags
+
+    @classmethod
+    def _register_representers(cls) -> None:
+        cls.add_multi_representer(AnsibleTaggedObject, cls.represent_ansible_tagged_object)
+        cls.add_multi_representer(Tripwire, cls.represent_tripwire)
+        cls.add_multi_representer(c.Mapping, SafeRepresenter.represent_dict)
+        cls.add_multi_representer(c.Sequence, SafeRepresenter.represent_list)
+
+    def represent_ansible_tagged_object(self, data):
+        if self._dump_vault_tags is not False and (ciphertext := VaultHelper.get_ciphertext(data, with_tags=False)):
+            # deprecated: description='enable the deprecation warning below' core_version='2.23'
+            # if self._dump_vault_tags is None:
+            #     Display().deprecated(
+            #         msg="Implicit YAML dumping of vaulted value ciphertext is deprecated. Set `dump_vault_tags` to explicitly specify the desired behavior",
+            #         version="2.27",
+            #     )
+
+            return self.represent_scalar('!vault', ciphertext, style='|')
+
+        return self.represent_data(AnsibleTagHelper.as_native_type(data))  # automatically decrypts encrypted strings
+
+    def represent_tripwire(self, data: Tripwire) -> t.NoReturn:
+        data.trip()

ansible/_internal/_yaml/_errors.py

@@ -0,0 +1,166 @@
+from __future__ import annotations
+
+import re
+
+import typing as t
+
+from yaml import MarkedYAMLError
+from yaml.constructor import ConstructorError
+
+from ansible._internal._errors import _utils
+from ansible.errors import AnsibleParserError
+from ansible._internal._datatag._tags import Origin
+
+
+class AnsibleConstructorError(ConstructorError):
+    """Ansible-specific ConstructorError used to bypass exception analysis during wrapping in AnsibleYAMLParserError."""
+
+
+class AnsibleYAMLParserError(AnsibleParserError):
+    """YAML-specific parsing failure wrapping an exception raised by the YAML parser."""
+
+    _default_message = 'YAML parsing failed.'
+
+    _include_cause_message = False  # hide the underlying cause message, it's included by `handle_exception` as needed
+
+    _formatted_source_context_value: str | None = None
+
+    @property
+    def _formatted_source_context(self) -> str | None:
+        return self._formatted_source_context_value
+
+    @classmethod
+    def handle_exception(cls, exception: Exception, origin: Origin) -> t.NoReturn:
+        if isinstance(exception, MarkedYAMLError):
+            origin = origin.replace(line_num=exception.problem_mark.line + 1, col_num=exception.problem_mark.column + 1)
+
+        source_context = _utils.SourceContext.from_origin(origin)
+
+        target_line = source_context.target_line or ''  # for these cases, we don't need to distinguish between None and empty string
+
+        message: str | None = None
+        help_text = None
+
+        # FIXME: Do all this by walking the parsed YAML doc stream. Using regexes is a dead-end; YAML's just too flexible to not have a
+        #  raft of false-positives and corner cases. If we directly consume either the YAML parse stream or override the YAML composer, we can
+        #  better catch these things without worrying about duplicating YAML's scalar parsing logic around quoting/escaping. At first, we can
+        #  replace the regex logic below with tiny special-purpose parse consumers to catch specific issues, but ideally, we could do a lot of this
+        #  inline with the actual doc parse, since our rules are a lot more strict than YAML's (eg, no support for non-scalar keys), and a lot of the
+        #  problem cases where that comes into play are around expression quoting and Jinja {{ syntax looking like weird YAML values we don't support.
+        #  Some common examples, where -> is "what YAML actually sees":
+        #  foo: {{ bar }} -> {"foo": {{"bar": None}: None}} - a mapping with a mapping as its key (legal YAML, but not legal Python/Ansible)
+        #
+        #  - copy: src=foo.txt  # kv syntax (kv could be on following line(s), too- implicit multi-line block scalar)
+        #      dest: bar.txt  # orphaned mapping, since the value of `copy` is the scalar "src=foo.txt"
+        #
+        #  - msg == "Error: 'dude' was not found"  # unquoted scalar has a : in it -> {'msg == "Error"': 'dude'} [ was not found" ] is garbage orphan scalar
+
+        # noinspection PyUnboundLocalVariable
+        if not isinstance(exception, MarkedYAMLError):
+            pass  # unexpected exception, don't use special analysis of exception
+
+        elif isinstance(exception, AnsibleConstructorError):
+            pass  # raised internally by ansible code, don't use special analysis of exception
+
+        # Check for tabs.
+        # There may be cases where there is a valid tab in a line that has other errors.
+        # That's OK, users should "fix" their tab usage anyway -- at which point later error handling logic will hopefully find the real issue.
+        elif (tab_idx := target_line.find('\t')) >= 0:
+            source_context = _utils.SourceContext.from_origin(origin.replace(col_num=tab_idx + 1))
+            message = "Tabs are usually invalid in YAML."
+
+        # Check for unquoted templates.
+        elif match := re.search(r'^\s*(?:-\s+)*(?:[\w\s]+:\s+)?(?P<value>\{\{.*}})', target_line):
+            source_context = _utils.SourceContext.from_origin(origin.replace(col_num=match.start('value') + 1))
+            message = 'This may be an issue with missing quotes around a template block.'
+            # FIXME: Use the captured value to show the actual fix required.
+            help_text = """
+For example:
+
+    raw: {{ some_var }}
+
+Should be:
+
+    raw: "{{ some_var }}"
+"""
+
+        # Check for common unquoted colon mistakes.
+        elif (
+            # ignore lines starting with only whitespace and a colon
+            not target_line.lstrip().startswith(':')
+            # find the value after list/dict preamble
+            and (value_match := re.search(r'^\s*(?:-\s+)*(?:[\w\s\[\]{}]+:\s+)?(?P<value>.*)$', target_line))
+            # ignore properly quoted values
+            and (target_fragment := _replace_quoted_value(value_match.group('value')))
+            # look for an unquoted colon in the value
+            and (colon_match := re.search(r':($| )', target_fragment))
+        ):
+            source_context = _utils.SourceContext.from_origin(origin.replace(col_num=value_match.start('value') + colon_match.start() + 1))
+            message = 'Colons in unquoted values must be followed by a non-space character.'
+            # FIXME: Use the captured value to show the actual fix required.
+            help_text = """
+For example:
+
+    raw: echo 'name: ansible'
+
+Should be:
+
+    raw: "echo 'name: ansible'"
+"""
+
+        # Check for common quoting mistakes.
+        elif match := re.search(r'^\s*(?:-\s+)*(?:[\w\s]+:\s+)?(?P<value>[\"\'].*?\s*)$', target_line):
+            suspected_value = match.group('value')
+            first, last = suspected_value[0], suspected_value[-1]
+
+            if first != last:  # "foo" in bar
+                source_context = _utils.SourceContext.from_origin(origin.replace(col_num=match.start('value') + 1))
+                message = 'Values starting with a quote must end with the same quote.'
+                # FIXME: Use the captured value to show the actual fix required, and use that same logic to improve the origin further.
+                help_text = """
+For example:
+
+    raw: "foo" in bar
+
+Should be:
+
+    raw: '"foo" in bar'
+"""
+            elif first == last and target_line.count(first) > 2:  # "foo" and "bar"
+                source_context = _utils.SourceContext.from_origin(origin.replace(col_num=match.start('value') + 1))
+                message = 'Values starting with a quote must end with the same quote, and not contain that quote.'
+                # FIXME: Use the captured value to show the actual fix required, and use that same logic to improve the origin further.
+                help_text = """
+For example:
+
+    raw: "foo" in "bar"
+
+Should be:
+
+    raw: '"foo" in "bar"'
+"""
+
+        if not message:
+            if isinstance(exception, MarkedYAMLError):
+                # marked YAML error, pull out the useful messages while omitting the noise
+                message = ' '.join(filter(None, (exception.context, exception.problem, exception.note)))
+                message = message.strip()
+                message = f'{message[0].upper()}{message[1:]}'
+
+                if not message.endswith('.'):
+                    message += '.'
+            else:
+                # unexpected error, use the exception message (normally hidden by overriding include_cause_message)
+                message = str(exception)
+
+            message = re.sub(r'\s+', ' ', message).strip()
+
+        error = cls(message, obj=source_context.origin)
+        error._formatted_source_context_value = str(source_context)
+        error._help_text = help_text
+
+        raise error from exception
+
+
+def _replace_quoted_value(value: str, replacement='.') -> str:
+    return re.sub(r"""^\s*('[^']*'|"[^"]*")\s*$""", lambda match: replacement * len(match.group(0)), value)

ansible/_internal/_yaml/_loader.py

@@ -0,0 +1,66 @@
+from __future__ import annotations
+
+import io as _io
+
+from yaml.resolver import Resolver
+
+from ansible.module_utils._internal._datatag import AnsibleTagHelper
+from ansible.module_utils.common.yaml import HAS_LIBYAML
+from ansible._internal._datatag import _tags
+
+from ._constructor import AnsibleConstructor, AnsibleInstrumentedConstructor
+
+if HAS_LIBYAML:
+    from yaml.cyaml import CParser
+
+    class _YamlParser(CParser):
+        def __init__(self, stream: str | bytes | _io.IOBase) -> None:
+            if isinstance(stream, (str, bytes)):
+                stream = AnsibleTagHelper.untag(stream)  # PyYAML + libyaml barfs on str/bytes subclasses
+
+            CParser.__init__(self, stream)
+
+            self.name = getattr(stream, 'name', None)  # provide feature parity with the Python implementation (yaml.reader.Reader provides name)
+
+else:
+    from yaml.composer import Composer
+    from yaml.reader import Reader
+    from yaml.scanner import Scanner
+    from yaml.parser import Parser
+
+    class _YamlParser(Reader, Scanner, Parser, Composer):  # type: ignore[no-redef]
+        def __init__(self, stream: str | bytes | _io.IOBase) -> None:
+            Reader.__init__(self, stream)
+            Scanner.__init__(self)
+            Parser.__init__(self)
+            Composer.__init__(self)
+
+
+class AnsibleInstrumentedLoader(_YamlParser, AnsibleInstrumentedConstructor, Resolver):
+    """Ansible YAML loader which supports Ansible custom behavior such as `Origin` tagging, but no Ansible-specific YAML tags."""
+
+    def __init__(self, stream: str | bytes | _io.IOBase) -> None:
+        _YamlParser.__init__(self, stream)
+
+        AnsibleInstrumentedConstructor.__init__(
+            self,
+            origin=_tags.Origin.get_or_create_tag(stream, self.name),
+            trusted_as_template=_tags.TrustedAsTemplate.is_tagged_on(stream),
+        )
+
+        Resolver.__init__(self)
+
+
+class AnsibleLoader(_YamlParser, AnsibleConstructor, Resolver):
+    """Ansible loader which supports Ansible custom behavior such as `Origin` tagging, as well as Ansible-specific YAML tags."""
+
+    def __init__(self, stream: str | bytes | _io.IOBase) -> None:
+        _YamlParser.__init__(self, stream)
+
+        AnsibleConstructor.__init__(
+            self,
+            origin=_tags.Origin.get_or_create_tag(stream, self.name),
+            trusted_as_template=_tags.TrustedAsTemplate.is_tagged_on(stream),
+        )
+
+        Resolver.__init__(self)

ansible/_internal/ansible_collections/ansible/_protomatter/README.md

@@ -0,0 +1,11 @@
+"Protomatter - an unstable substance which every ethical scientist in the galaxy has denounced as dangerously unpredictable."
+
+"But it was the only way to solve certain problems..."
+
+This Ansible Collection is embedded within ansible-core.
+It contains plugins useful for ansible-core's own integration tests.
+They have been made available, completely unsupported,
+in case they prove useful for debugging and troubleshooting purposes.
+
+> CAUTION: This collection is not supported, and may be changed or removed in any version without prior notice.
+Use of these plugins outside ansible-core is highly discouraged.

ansible/_internal/ansible_collections/ansible/_protomatter/plugins/action/debug.py

@@ -0,0 +1,36 @@
+from __future__ import annotations
+
+import typing as t
+
+from ansible.module_utils.common.validation import _check_type_str_no_conversion, _check_type_list_strict
+from ansible.plugins.action import ActionBase
+from ansible._internal._templating._engine import TemplateEngine
+from ansible._internal._templating._marker_behaviors import ReplacingMarkerBehavior
+
+
+class ActionModule(ActionBase):
+    TRANSFERS_FILES = False
+    _requires_connection = False
+
+    @classmethod
+    def finalize_task_arg(cls, name: str, value: t.Any, templar: TemplateEngine, context: t.Any) -> t.Any:
+        if name == 'expression':
+            return value
+
+        return super().finalize_task_arg(name, value, templar, context)
+
+    def run(self, tmp=None, task_vars=None):
+        # accepts a list of literal expressions (no templating), evaluates with no failure on undefined, returns all results
+        _vr, args = self.validate_argument_spec(
+            argument_spec=dict(
+                expression=dict(type=_check_type_list_strict, elements=_check_type_str_no_conversion, required=True),
+            ),
+        )
+
+        with ReplacingMarkerBehavior.warning_context() as replacing_behavior:
+            templar = self._templar._engine.extend(marker_behavior=replacing_behavior)
+
+            return dict(
+                _ansible_verbose_always=True,
+                expression_result=[templar.evaluate_expression(expression) for expression in args['expression']],
+            )

ansible/_internal/ansible_collections/ansible/_protomatter/plugins/filter/apply_trust.py

@@ -0,0 +1,19 @@
+from __future__ import annotations
+
+import typing as t
+
+from ansible._internal._datatag._tags import TrustedAsTemplate
+
+
+def apply_trust(value: object) -> object:
+    """
+    Filter that returns a tagged copy of the input string with TrustedAsTemplate.
+    Containers and other non-string values are returned unmodified.
+    """
+    return TrustedAsTemplate().tag(value) if isinstance(value, str) else value
+
+
+class FilterModule:
+    @staticmethod
+    def filters() -> dict[str, t.Callable]:
+        return dict(apply_trust=apply_trust)

ansible/_internal/ansible_collections/ansible/_protomatter/plugins/filter/dump_object.py

@@ -0,0 +1,18 @@
+from __future__ import annotations
+
+import dataclasses
+import typing as t
+
+
+def dump_object(value: t.Any) -> object:
+    """Internal filter to convert objects not supported by JSON to types which are."""
+    if dataclasses.is_dataclass(value):
+        return dataclasses.asdict(value)  # type: ignore[arg-type]
+
+    return value
+
+
+class FilterModule(object):
+    @staticmethod
+    def filters() -> dict[str, t.Callable]:
+        return dict(dump_object=dump_object)

ansible/_internal/ansible_collections/ansible/_protomatter/plugins/filter/finalize.py

@@ -0,0 +1,16 @@
+from __future__ import annotations
+
+import typing as t
+
+from ansible._internal._templating._engine import _finalize_template_result, FinalizeMode
+
+
+def finalize(value: t.Any) -> t.Any:
+    """Perform an explicit top-level template finalize operation on the supplied value."""
+    return _finalize_template_result(value, mode=FinalizeMode.TOP_LEVEL)
+
+
+class FilterModule:
+    @staticmethod
+    def filters() -> dict[str, t.Callable]:
+        return dict(finalize=finalize)

ansible/_internal/ansible_collections/ansible/_protomatter/plugins/filter/origin.py

@@ -0,0 +1,18 @@
+from __future__ import annotations
+
+import typing as t
+
+from ansible._internal._datatag._tags import Origin
+
+
+def origin(value: object) -> str | None:
+    """Return the origin of the value, if any, otherwise `None`."""
+    origin_tag = Origin.get_tag(value)
+
+    return str(origin_tag) if origin_tag else None
+
+
+class FilterModule:
+    @staticmethod
+    def filters() -> dict[str, t.Callable]:
+        return dict(origin=origin)