Merge pull request #30061 from backstage/blam/actions-registry

feat: Added `ActionsRegistry`

.changeset/sweet-ducks-wait.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-test-utils': minor
+---
+
+Added mock implementations for `ActionsService` and `ActionsRegistryService`

.changeset/wet-bars-report.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-plugin-api': minor
+---
+
+Added `coreServices.actionsRegistry` and `coreServices.actions` to allow registration of distributed actions from plugins, and the ability to invoke these actions

.changeset/wet-bars-reporting.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+Added some default implementations for the `ActionsService` and `ActionsRegistryService` that allow registration of actions for a particular plugin.

packages/backend-defaults/config.d.ts

@@ -121,6 +121,16 @@ export interface Config {
       };
     };
 
+    /**
+     * Options used by the default actions service.
+     */
+    actions?: {
+      /**
+       * List of plugin sources to load actions from.
+       */
+      pluginSources?: string[];
+    };
+
     /**
      * Options used by the default auth, httpAuth and userInfo services.
      */

packages/backend-defaults/package.json

@@ -20,6 +20,8 @@
   "license": "Apache-2.0",
   "exports": {
     ".": "./src/index.ts",
+    "./actions": "./src/entrypoints/actions/index.ts",
+    "./actionsRegistry": "./src/entrypoints/actionsRegistry/index.ts",
     "./auditor": "./src/entrypoints/auditor/index.ts",
     "./auth": "./src/entrypoints/auth/index.ts",
     "./cache": "./src/entrypoints/cache/index.ts",
@@ -45,6 +47,12 @@
   "types": "src/index.ts",
   "typesVersions": {
     "*": {
+      "actions": [
+        "src/entrypoints/actions/index.ts"
+      ],
+      "actionsRegistry": [
+        "src/entrypoints/actionsRegistry/index.ts"
+      ],
       "auditor": [
         "src/entrypoints/auditor/index.ts"
       ],
@@ -188,7 +196,8 @@
     "winston-transport": "^4.5.0",
     "yauzl": "^3.0.0",
     "yn": "^4.0.0",
-    "zod": "^3.22.4"
+    "zod": "^3.22.4",
+    "zod-to-json-schema": "^3.20.4"
   },
   "devDependencies": {
     "@aws-sdk/util-stream-node": "^3.350.0",

packages/backend-defaults/report-actions.api.md

@@ -0,0 +1,17 @@
+## API Report File for "@backstage/backend-defaults"
+
+> Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).
+
+```ts
+import { ActionsService } from '@backstage/backend-plugin-api';
+import { ServiceFactory } from '@backstage/backend-plugin-api';
+
+// @public (undocumented)
+export const actionsServiceFactory: ServiceFactory<
+  ActionsService,
+  'plugin',
+  'singleton'
+>;
+
+// (No @packageDocumentation comment for this package)
+```

packages/backend-defaults/report-actionsRegistry.api.md

@@ -0,0 +1,17 @@
+## API Report File for "@backstage/backend-defaults"
+
+> Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).
+
+```ts
+import { ActionsRegistryService } from '@backstage/backend-plugin-api';
+import { ServiceFactory } from '@backstage/backend-plugin-api';
+
+// @public (undocumented)
+export const actionsRegistryServiceFactory: ServiceFactory<
+  ActionsRegistryService,
+  'plugin',
+  'singleton'
+>;
+
+// (No @packageDocumentation comment for this package)
+```

packages/backend-defaults/src/CreateBackend.ts

@@ -35,8 +35,12 @@ import { schedulerServiceFactory } from '@backstage/backend-defaults/scheduler';
 import { urlReaderServiceFactory } from '@backstage/backend-defaults/urlReader';
 import { userInfoServiceFactory } from '@backstage/backend-defaults/userInfo';
 import { eventsServiceFactory } from '@backstage/plugin-events-node';
+import { actionsRegistryServiceFactory } from './entrypoints/actionsRegistry';
+import { actionsServiceFactory } from './entrypoints/actions';
 
 export const defaultServiceFactories = [
+  actionsRegistryServiceFactory,
+  actionsServiceFactory,
   auditorServiceFactory,
   authServiceFactory,
   cacheServiceFactory,

packages/backend-defaults/src/entrypoints/actions/DefaultActionsService.ts

@@ -0,0 +1,139 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import {
+  ActionsService,
+  ActionsServiceAction,
+  AuthService,
+  BackstageCredentials,
+  DiscoveryService,
+  LoggerService,
+  RootConfigService,
+} from '@backstage/backend-plugin-api';
+import { ResponseError } from '@backstage/errors';
+import { JsonObject } from '@backstage/types';
+
+export class DefaultActionsService implements ActionsService {
+  private constructor(
+    private readonly discovery: DiscoveryService,
+    private readonly config: RootConfigService,
+    private readonly logger: LoggerService,
+    private readonly auth: AuthService,
+  ) {}
+
+  static create({
+    discovery,
+    config,
+    logger,
+    auth,
+  }: {
+    discovery: DiscoveryService;
+    config: RootConfigService;
+    logger: LoggerService;
+    auth: AuthService;
+  }) {
+    return new DefaultActionsService(discovery, config, logger, auth);
+  }
+
+  async list({ credentials }: { credentials: BackstageCredentials }) {
+    const pluginSources =
+      this.config.getOptionalStringArray('backend.actions.pluginSources') ?? [];
+
+    const remoteActionsList = await Promise.all(
+      pluginSources.map(async source => {
+        try {
+          const response = await this.makeRequest({
+            path: `/.backstage/actions/v1/actions`,
+            pluginId: source,
+            credentials,
+          });
+          if (!response.ok) {
+            throw await ResponseError.fromResponse(response);
+          }
+          const { actions } = (await response.json()) as {
+            actions: ActionsServiceAction;
+          };
+
+          return actions;
+        } catch (error) {
+          this.logger.warn(`Failed to fetch actions from ${source}`, error);
+          return [];
+        }
+      }),
+    );
+
+    return { actions: remoteActionsList.flat() };
+  }
+
+  async invoke(opts: {
+    id: string;
+    input?: JsonObject;
+    credentials: BackstageCredentials;
+  }) {
+    const pluginId = this.pluginIdFromActionId(opts.id);
+    const response = await this.makeRequest({
+      path: `/.backstage/actions/v1/actions/${encodeURIComponent(
+        opts.id,
+      )}/invoke`,
+      pluginId,
+      credentials: opts.credentials,
+      options: {
+        method: 'POST',
+        body: JSON.stringify(opts.input),
+        headers: {
+          'Content-Type': 'application/json',
+        },
+      },
+    });
+
+    if (!response.ok) {
+      throw await ResponseError.fromResponse(response);
+    }
+
+    const { output } = await response.json();
+    return { output };
+  }
+
+  private async makeRequest(opts: {
+    path: string;
+    pluginId: string;
+    options?: RequestInit;
+    credentials: BackstageCredentials;
+  }) {
+    const { path, pluginId, credentials, options } = opts;
+    const baseUrl = await this.discovery.getBaseUrl(pluginId);
+
+    const { token } = await this.auth.getPluginRequestToken({
+      onBehalfOf: credentials,
+      targetPluginId: opts.pluginId,
+    });
+
+    return fetch(`${baseUrl}${path}`, {
+      ...options,
+      headers: {
+        ...options?.headers,
+        Authorization: `Bearer ${token}`,
+      },
+    });
+  }
+
+  private pluginIdFromActionId(id: string): string {
+    const colonIndex = id.indexOf(':');
+    if (colonIndex === -1) {
+      throw new Error(`Invalid action id: ${id}`);
+    }
+    return id.substring(0, colonIndex);
+  }
+}

packages/backend-defaults/src/entrypoints/actions/actionsServiceFactory.test.ts

@@ -0,0 +1,334 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import {
+  mockCredentials,
+  mockServices,
+  registerMswTestHooks,
+  ServiceFactoryTester,
+  startTestBackend,
+} from '@backstage/backend-test-utils';
+import { actionsRegistryServiceFactory } from '../actionsRegistry';
+import { httpRouterServiceFactory } from '../httpRouter';
+import { actionsServiceFactory } from './actionsServiceFactory';
+import { setupServer } from 'msw/node';
+import { rest } from 'msw';
+import {
+  ActionsServiceAction,
+  coreServices,
+  createBackendPlugin,
+} from '@backstage/backend-plugin-api';
+import { json } from 'express';
+import Router from 'express-promise-router';
+import request from 'supertest';
+
+const server = setupServer();
+
+describe('actionsServiceFactory', () => {
+  describe('client', () => {
+    registerMswTestHooks(server);
+    const mockActionsListEndpoint = jest.fn();
+    const mockNotFoundActionsListEndpoint = jest.fn();
+
+    const defaultServices = [
+      mockServices.rootConfig.factory({
+        data: {
+          backend: {
+            actions: {
+              pluginSources: ['my-plugin', 'not-found-plugin'],
+            },
+          },
+        },
+      }),
+      actionsServiceFactory,
+      httpRouterServiceFactory,
+      mockServices.httpAuth.factory({
+        defaultCredentials: mockCredentials.service('user:default/mock'),
+      }),
+      mockServices.discovery.factory(),
+      actionsRegistryServiceFactory,
+    ];
+
+    const mockActionsDefinition: ActionsServiceAction = {
+      description: 'my mock description',
+      id: 'my-plugin:test',
+      name: 'testy',
+      title: 'Test',
+      schema: {
+        input: {},
+        output: {},
+      },
+    };
+
+    beforeEach(() => {
+      server.use(
+        rest.get(
+          'http://localhost:0/api/my-plugin/.backstage/actions/v1/actions',
+          mockActionsListEndpoint.mockImplementation((_req, res, ctx) =>
+            res(
+              ctx.json({
+                actions: [mockActionsDefinition],
+              }),
+            ),
+          ),
+        ),
+        rest.get(
+          'http://localhost:0/api/not-found-plugin/.backstage/actions/v1/actions',
+          mockNotFoundActionsListEndpoint.mockImplementation((_req, res, ctx) =>
+            res(ctx.status(404)),
+          ),
+        ),
+      );
+    });
+
+    describe('list', () => {
+      it('should list all plugins in config to find actions and handle failures gracefully', async () => {
+        const subject = await ServiceFactoryTester.from(actionsServiceFactory, {
+          dependencies: defaultServices,
+        }).getSubject();
+
+        const { actions } = await subject.list({
+          credentials: mockCredentials.service('user:default/mock'),
+        });
+
+        expect(actions).toEqual([mockActionsDefinition]);
+
+        expect(mockActionsListEndpoint).toHaveBeenCalledTimes(1);
+        expect(mockNotFoundActionsListEndpoint).toHaveBeenCalledTimes(1);
+      });
+    });
+
+    describe('invoke', () => {
+      it('should invoke the action and return the output', async () => {
+        server.use(
+          rest.post(
+            'http://localhost:0/api/my-plugin/.backstage/actions/v1/actions/my-plugin:test/invoke',
+            (_req, res, ctx) => res(ctx.json({ output: { ok: true } })),
+          ),
+        );
+        const subject = await ServiceFactoryTester.from(actionsServiceFactory, {
+          dependencies: defaultServices,
+        }).getSubject();
+
+        const { output } = await subject.invoke({
+          id: 'my-plugin:test',
+          credentials: mockCredentials.service('user:default/mock'),
+        });
+
+        expect(output).toEqual({ ok: true });
+      });
+
+      it('should throw a 404 if the action does not exist', async () => {
+        server.use(
+          rest.post(
+            'http://localhost:0/api/my-plugin/.backstage/actions/v1/actions/my-plugin:test/invoke',
+            (_req, res, ctx) => res(ctx.status(404)),
+          ),
+        );
+
+        const subject = await ServiceFactoryTester.from(actionsServiceFactory, {
+          dependencies: defaultServices,
+        }).getSubject();
+
+        await expect(
+          subject.invoke({
+            id: 'my-plugin:test',
+            credentials: mockCredentials.service('user:default/mock'),
+          }),
+        ).rejects.toThrow('404');
+      });
+
+      it('should throw a 400 if the action returns an invalid input', async () => {
+        server.use(
+          rest.post(
+            'http://localhost:0/api/my-plugin/.backstage/actions/v1/actions/my-plugin:test/invoke',
+            (_req, res, ctx) => res(ctx.status(400)),
+          ),
+        );
+
+        const subject = await ServiceFactoryTester.from(actionsServiceFactory, {
+          dependencies: defaultServices,
+        }).getSubject();
+
+        await expect(
+          subject.invoke({
+            id: 'my-plugin:test',
+            credentials: mockCredentials.service('user:default/mock'),
+          }),
+        ).rejects.toThrow('400');
+      });
+    });
+
+    describe('integration', () => {
+      beforeAll(() => {
+        // disable the msw server for this test.
+        server.close();
+      });
+
+      const features = [
+        actionsServiceFactory,
+        httpRouterServiceFactory,
+        mockServices.httpAuth.factory({
+          defaultCredentials: mockCredentials.service('user:default/mock'),
+        }),
+        actionsRegistryServiceFactory,
+        mockServices.rootConfig.factory({
+          data: {
+            backend: {
+              actions: { pluginSources: ['plugin-with-action'] },
+            },
+          },
+        }),
+
+        createBackendPlugin({
+          pluginId: 'plugin-with-action',
+          register({ registerInit }) {
+            registerInit({
+              deps: { actionsRegistry: coreServices.actionsRegistry },
+              async init({ actionsRegistry }) {
+                actionsRegistry.register({
+                  name: 'with-validation',
+                  title: 'Test',
+                  description: 'Test',
+                  schema: {
+                    input: z =>
+                      z.object({
+                        name: z.string(),
+                      }),
+                    output: z =>
+                      z.object({
+                        ok: z.boolean(),
+                        string: z.string(),
+                      }),
+                  },
+                  action: async ({ input }) => {
+                    return {
+                      output: {
+                        ok: true,
+                        string: `hello ${input.name}`,
+                      },
+                    };
+                  },
+                });
+              },
+            });
+          },
+        }),
+        createBackendPlugin({
+          pluginId: 'test-harness',
+          register({ registerInit }) {
+            registerInit({
+              deps: {
+                actionsService: coreServices.actions,
+                router: coreServices.httpRouter,
+                httpAuth: coreServices.httpAuth,
+              },
+              async init({ actionsService, router, httpAuth }) {
+                const innerRouter = Router();
+                innerRouter.use(json());
+                router.use(innerRouter);
+
+                innerRouter.post('/invoke', async (req, res) => {
+                  const { id, input } = req.body;
+                  const response = await actionsService.invoke({
+                    id,
+                    input,
+                    credentials: await httpAuth.credentials(req),
+                  });
+                  res.json(response);
+                });
+
+                innerRouter.get('/actions', async (req, res) => {
+                  const response = await actionsService.list({
+                    credentials: await httpAuth.credentials(req),
+                  });
+
+                  res.json(response);
+                });
+              },
+            });
+          },
+        }),
+      ];
+
+      it('should list the actions and return the output', async () => {
+        const { server: testHarnessServer } = await startTestBackend({
+          features,
+        });
+
+        const { body, status } = await request(testHarnessServer).get(
+          '/api/test-harness/actions',
+        );
+
+        expect(status).toBe(200);
+        expect(body).toEqual({
+          actions: [
+            {
+              description: 'Test',
+              id: 'plugin-with-action:with-validation',
+              name: 'with-validation',
+              schema: {
+                input: {
+                  $schema: 'http://json-schema.org/draft-07/schema#',
+                  additionalProperties: false,
+                  properties: {
+                    name: {
+                      type: 'string',
+                    },
+                  },
+                  required: ['name'],
+                  type: 'object',
+                },
+                output: {
+                  $schema: 'http://json-schema.org/draft-07/schema#',
+                  additionalProperties: false,
+                  properties: {
+                    ok: {
+                      type: 'boolean',
+                    },
+                    string: {
+                      type: 'string',
+                    },
+                  },
+                  required: ['ok', 'string'],
+                  type: 'object',
+                },
+              },
+              title: 'Test',
+            },
+          ],
+        });
+      });
+
+      it('should invoke the action and return the output', async () => {
+        const { server: testHarnessServer } = await startTestBackend({
+          features,
+        });
+
+        const { body, status } = await request(testHarnessServer)
+          .post('/api/test-harness/invoke')
+          .send({
+            id: 'plugin-with-action:with-validation',
+            input: {
+              name: 'world',
+            },
+          });
+
+        expect(body).toEqual({ output: { ok: true, string: 'hello world' } });
+        expect(status).toBe(200);
+      });
+    });
+  });
+});

packages/backend-defaults/src/entrypoints/actions/actionsServiceFactory.ts

@@ -0,0 +1,38 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { createServiceFactory } from '@backstage/backend-plugin-api';
+import { coreServices } from '@backstage/backend-plugin-api';
+import { DefaultActionsService } from './DefaultActionsService';
+
+/**
+ * @public
+ */
+export const actionsServiceFactory = createServiceFactory({
+  service: coreServices.actions,
+  deps: {
+    discovery: coreServices.discovery,
+    config: coreServices.rootConfig,
+    logger: coreServices.logger,
+    auth: coreServices.auth,
+  },
+  factory: ({ discovery, config, logger, auth }) =>
+    DefaultActionsService.create({
+      discovery,
+      config,
+      logger,
+      auth,
+    }),
+});

packages/backend-defaults/src/entrypoints/actions/index.ts

@@ -0,0 +1,16 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export { actionsServiceFactory } from './actionsServiceFactory';

packages/backend-defaults/src/entrypoints/actionsRegistry/DefaultActionsRegistryService.ts

@@ -0,0 +1,156 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {
+  ActionsRegistryActionOptions,
+  ActionsRegistryService,
+  AuthService,
+  HttpAuthService,
+  LoggerService,
+  PluginMetadataService,
+} from '@backstage/backend-plugin-api';
+import PromiseRouter from 'express-promise-router';
+import { Router, json } from 'express';
+import { z, ZodType } from 'zod';
+import zodToJsonSchema from 'zod-to-json-schema';
+import {
+  ForwardedError,
+  InputError,
+  NotAllowedError,
+  NotFoundError,
+} from '@backstage/errors';
+
+export class DefaultActionsRegistryService implements ActionsRegistryService {
+  private actions: Map<string, ActionsRegistryActionOptions<any, any>> =
+    new Map();
+
+  private constructor(
+    private readonly logger: LoggerService,
+    private readonly httpAuth: HttpAuthService,
+    private readonly auth: AuthService,
+    private readonly metadata: PluginMetadataService,
+  ) {}
+
+  static create({
+    httpAuth,
+    logger,
+    auth,
+    metadata,
+  }: {
+    httpAuth: HttpAuthService;
+    logger: LoggerService;
+    auth: AuthService;
+    metadata: PluginMetadataService;
+  }): DefaultActionsRegistryService {
+    return new DefaultActionsRegistryService(logger, httpAuth, auth, metadata);
+  }
+
+  createRouter(): Router {
+    const router = PromiseRouter();
+    router.use(json());
+
+    router.get('/.backstage/actions/v1/actions', (_, res) => {
+      return res.json({
+        actions: Array.from(this.actions.entries()).map(([id, action]) => ({
+          id,
+          ...action,
+          schema: {
+            input: action.schema?.input
+              ? zodToJsonSchema(action.schema.input(z))
+              : zodToJsonSchema(z.any()),
+            output: action.schema?.output
+              ? zodToJsonSchema(action.schema.output(z))
+              : zodToJsonSchema(z.any()),
+          },
+        })),
+      });
+    });
+
+    router.post(
+      '/.backstage/actions/v1/actions/:actionId/invoke',
+      async (req, res) => {
+        const credentials = await this.httpAuth.credentials(req);
+        if (this.auth.isPrincipal(credentials, 'user')) {
+          if (!credentials.principal.actor) {
+            throw new NotAllowedError(
+              `Actions must be invoked by a service, not a user`,
+            );
+          }
+        } else if (this.auth.isPrincipal(credentials, 'none')) {
+          throw new NotAllowedError(
+            `Actions must be invoked by a service, not an anonymous request`,
+          );
+        }
+
+        const action = this.actions.get(req.params.actionId);
+
+        if (!action) {
+          throw new NotFoundError(`Action "${req.params.actionId}" not found`);
+        }
+
+        const input = action.schema?.input
+          ? action.schema.input(z).safeParse(req.body)
+          : ({ success: true, data: undefined } as const);
+
+        if (!input.success) {
+          throw new InputError(
+            `Invalid input to action "${req.params.actionId}"`,
+            input.error,
+          );
+        }
+
+        try {
+          const result = await action.action({
+            input: input.data,
+            credentials,
+            logger: this.logger,
+          });
+
+          const output = action.schema?.output
+            ? action.schema.output(z).safeParse(result?.output)
+            : ({ success: true, data: result?.output } as const);
+
+          if (!output.success) {
+            throw new InputError(
+              `Invalid output from action "${req.params.actionId}"`,
+              output.error,
+            );
+          }
+
+          res.json({ output: output.data });
+        } catch (error) {
+          throw new ForwardedError(
+            `Failed execution of action "${req.params.actionId}"`,
+            error,
+          );
+        }
+      },
+    );
+    return router;
+  }
+
+  register<TInputSchema extends ZodType, TOutputSchema extends ZodType>(
+    options: ActionsRegistryActionOptions<TInputSchema, TOutputSchema>,
+  ): void {
+    const id = `${this.metadata.getId()}:${options.name}`;
+
+    if (this.actions.has(id)) {
+      throw new Error(`Action with id "${id}" is already registered`);
+    }
+
+    this.actions.set(id, options);
+  }
+}

packages/backend-defaults/src/entrypoints/actionsRegistry/actionsRegistryServiceFactory.test.ts

@@ -0,0 +1,434 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import {
+  coreServices,
+  createBackendPlugin,
+} from '@backstage/backend-plugin-api';
+import {
+  mockCredentials,
+  mockServices,
+  startTestBackend,
+} from '@backstage/backend-test-utils';
+import { httpRouterServiceFactory } from '../httpRouter';
+import request from 'supertest';
+import { actionsRegistryServiceFactory } from './actionsRegistryServiceFactory';
+import { InputError } from '@backstage/errors';
+
+describe('actionsRegistryServiceFactory', () => {
+  const defaultServices = [
+    actionsRegistryServiceFactory,
+    httpRouterServiceFactory,
+    mockServices.httpAuth.factory({
+      defaultCredentials: mockCredentials.service('user:default/mock'),
+    }),
+  ];
+
+  describe('typescript tests', () => {
+    it('should properly infer the input types', () => {
+      createBackendPlugin({
+        pluginId: 'my-plugin',
+        register(reg) {
+          reg.registerInit({
+            deps: {
+              actionsRegistry: coreServices.actionsRegistry,
+            },
+            async init({ actionsRegistry }) {
+              actionsRegistry.register({
+                name: 'test',
+                title: 'Test',
+                description: 'Test',
+                schema: {
+                  input: z =>
+                    z.object({
+                      test: z.string(),
+                    }),
+                  output: z =>
+                    z.object({
+                      ok: z.boolean(),
+                    }),
+                },
+                action: async ({ input: { test } }) => {
+                  // @ts-expect-error - test is not a boolean
+                  const _t: boolean = test;
+                  return { output: { ok: true } };
+                },
+              });
+            },
+          });
+        },
+      });
+
+      expect(true).toBe(true);
+    });
+
+    it('should properly infer the output types', () => {
+      createBackendPlugin({
+        pluginId: 'my-plugin',
+        register(reg) {
+          reg.registerInit({
+            deps: {
+              actionsRegistry: coreServices.actionsRegistry,
+            },
+            async init({ actionsRegistry }) {
+              actionsRegistry.register({
+                name: 'test',
+                title: 'Test',
+                description: 'Test',
+                schema: {
+                  input: z =>
+                    z.object({
+                      test: z.string(),
+                    }),
+                  output: z =>
+                    z.object({
+                      ok: z.boolean(),
+                    }),
+                },
+                // @ts-expect-error - ok is not a boolean
+                action: async () => {
+                  return { output: { ok: 'bo' } };
+                },
+              });
+            },
+          });
+        },
+      });
+
+      expect(true).toBe(true);
+    });
+  });
+
+  describe('/.backstage/actions/v1/actions', () => {
+    it('should allow registering of actions', async () => {
+      const pluginSubject = createBackendPlugin({
+        pluginId: 'my-plugin',
+        register(reg) {
+          reg.registerInit({
+            deps: {
+              actionsRegistry: coreServices.actionsRegistry,
+            },
+            async init({ actionsRegistry }) {
+              actionsRegistry.register({
+                name: 'test',
+                title: 'Test',
+                description: 'Test',
+                schema: {
+                  input: z =>
+                    z.object({
+                      name: z.string(),
+                    }),
+                  output: z =>
+                    z.object({
+                      ok: z.boolean(),
+                    }),
+                },
+                action: async () => ({ output: { ok: true } }),
+              });
+            },
+          });
+        },
+      });
+
+      const { server } = await startTestBackend({
+        features: [pluginSubject, ...defaultServices],
+      });
+
+      const { body, status } = await request(server).get(
+        '/api/my-plugin/.backstage/actions/v1/actions',
+      );
+
+      expect(status).toBe(200);
+
+      expect(body).toMatchObject({
+        actions: [
+          {
+            name: 'test',
+            title: 'Test',
+            description: 'Test',
+            schema: {
+              input: {
+                type: 'object',
+                properties: {
+                  name: {
+                    type: 'string',
+                  },
+                },
+              },
+              output: {
+                type: 'object',
+                properties: {
+                  ok: {
+                    type: 'boolean',
+                  },
+                },
+              },
+            },
+          },
+        ],
+      });
+    });
+
+    it('should allow registering of actions with no schema', async () => {
+      const pluginSubject = createBackendPlugin({
+        pluginId: 'my-plugin',
+        register(reg) {
+          reg.registerInit({
+            deps: {
+              actionsRegistry: coreServices.actionsRegistry,
+            },
+            async init({ actionsRegistry }) {
+              actionsRegistry.register({
+                name: 'test',
+                title: 'Test',
+                description: 'Test',
+                schema: {
+                  input: z => z.undefined(),
+                  output: z => z.string(),
+                },
+                action: async () => ({ output: 'ok' }),
+              });
+            },
+          });
+        },
+      });
+
+      const { server } = await startTestBackend({
+        features: [pluginSubject, ...defaultServices],
+      });
+
+      const { body, status } = await request(server).get(
+        '/api/my-plugin/.backstage/actions/v1/actions',
+      );
+
+      expect(status).toBe(200);
+
+      expect(body).toMatchObject({
+        actions: [
+          {
+            name: 'test',
+            title: 'Test',
+            description: 'Test',
+            schema: {
+              input: {},
+              output: {},
+            },
+          },
+        ],
+      });
+    });
+  });
+
+  describe('/.backstage/actions/v1/actions/:actionId/invoke', () => {
+    const mockAction = jest.fn();
+
+    beforeEach(() => {
+      mockAction.mockResolvedValue({ output: { ok: true } });
+    });
+
+    const pluginSubject = createBackendPlugin({
+      pluginId: 'my-plugin',
+      register(reg) {
+        reg.registerInit({
+          deps: {
+            actionsRegistry: coreServices.actionsRegistry,
+          },
+          async init({ actionsRegistry }) {
+            actionsRegistry.register({
+              name: 'test',
+              title: 'Test',
+              description: 'Test',
+              schema: {
+                input: z =>
+                  z.object({
+                    name: z.string(),
+                  }),
+                output: z =>
+                  z.object({
+                    ok: z.boolean(),
+                  }),
+              },
+              action: mockAction,
+            });
+          },
+        });
+      },
+    });
+
+    it('should throw an error if the action is not found', async () => {
+      const { server } = await startTestBackend({
+        features: [pluginSubject, ...defaultServices],
+      });
+
+      const { body, status } = await request(server).post(
+        '/api/my-plugin/.backstage/actions/v1/actions/test/invoke',
+      );
+
+      expect(status).toBe(404);
+      expect(body).toMatchObject({
+        error: {
+          message: 'Action "test" not found',
+        },
+      });
+    });
+
+    it('should throw an error if the action input does not match the schema', async () => {
+      const { server } = await startTestBackend({
+        features: [pluginSubject, ...defaultServices],
+      });
+
+      const { body, status } = await request(server)
+        .post(
+          '/api/my-plugin/.backstage/actions/v1/actions/my-plugin:test/invoke',
+        )
+        .send({
+          name: 123,
+        });
+
+      expect(status).toBe(400);
+      expect(body).toMatchObject({
+        error: {
+          message: expect.stringMatching(
+            'Invalid input to action "my-plugin:test"',
+          ),
+        },
+      });
+    });
+
+    it('should call the action with the input', async () => {
+      const { server } = await startTestBackend({
+        features: [pluginSubject, ...defaultServices],
+      });
+
+      await request(server)
+        .post(
+          '/api/my-plugin/.backstage/actions/v1/actions/my-plugin:test/invoke',
+        )
+        .send({
+          name: 'test',
+        });
+
+      expect(mockAction).toHaveBeenCalledWith({
+        input: {
+          name: 'test',
+        },
+        credentials: {
+          $$type: '@backstage/BackstageCredentials',
+          principal: {
+            type: 'service',
+            subject: 'user:default/mock',
+          },
+        },
+        logger: expect.anything(),
+      });
+    });
+
+    it('should throw an error if the action is invoked by a user', async () => {
+      const testServices = [
+        actionsRegistryServiceFactory,
+        httpRouterServiceFactory,
+        mockServices.httpAuth.factory({
+          defaultCredentials: mockCredentials.user(),
+        }),
+      ];
+
+      const { server } = await startTestBackend({
+        features: [pluginSubject, ...testServices],
+      });
+
+      const { body, status } = await request(server)
+        .post(
+          '/api/my-plugin/.backstage/actions/v1/actions/my-plugin:test/invoke',
+        )
+        .send({
+          name: 'test',
+        });
+
+      expect(status).toBe(403);
+      expect(body).toMatchObject({
+        error: {
+          message: 'Actions must be invoked by a service, not a user',
+        },
+      });
+    });
+
+    it('should validate the output of the action if provided', async () => {
+      const { server } = await startTestBackend({
+        features: [pluginSubject, ...defaultServices],
+      });
+
+      mockAction.mockResolvedValue({ ok: 'blob' });
+
+      const { body, status } = await request(server)
+        .post(
+          '/api/my-plugin/.backstage/actions/v1/actions/my-plugin:test/invoke',
+        )
+        .send({
+          name: 'test',
+        });
+
+      expect(status).toBe(400);
+      expect(body).toMatchObject({
+        error: {
+          message: expect.stringMatching(
+            'Invalid output from action "my-plugin:test"',
+          ),
+        },
+      });
+    });
+
+    it('should return the output of the action', async () => {
+      const { server } = await startTestBackend({
+        features: [pluginSubject, ...defaultServices],
+      });
+
+      const { body, status } = await request(server)
+        .post(
+          '/api/my-plugin/.backstage/actions/v1/actions/my-plugin:test/invoke',
+        )
+        .send({
+          name: 'test',
+        });
+
+      expect(status).toBe(200);
+      expect(body).toMatchObject({ output: { ok: true } });
+    });
+
+    it('should return the error from the action if it throws', async () => {
+      const { server } = await startTestBackend({
+        features: [pluginSubject, ...defaultServices],
+      });
+
+      mockAction.mockRejectedValue(new InputError('test'));
+
+      const { body, status } = await request(server)
+        .post(
+          '/api/my-plugin/.backstage/actions/v1/actions/my-plugin:test/invoke',
+        )
+        .send({
+          name: 'test',
+        });
+
+      expect(status).toBe(400);
+      expect(body).toMatchObject({
+        error: {
+          message: expect.stringContaining(
+            'Failed execution of action "my-plugin:test"',
+          ),
+        },
+      });
+    });
+  });
+});

packages/backend-defaults/src/entrypoints/actionsRegistry/actionsRegistryServiceFactory.ts

@@ -0,0 +1,47 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {
+  coreServices,
+  createServiceFactory,
+} from '@backstage/backend-plugin-api';
+import { DefaultActionsRegistryService } from './DefaultActionsRegistryService';
+
+/**
+ * @public
+ */
+export const actionsRegistryServiceFactory = createServiceFactory({
+  service: coreServices.actionsRegistry,
+  deps: {
+    metadata: coreServices.pluginMetadata,
+    httpRouter: coreServices.httpRouter,
+    httpAuth: coreServices.httpAuth,
+    logger: coreServices.logger,
+    auth: coreServices.auth,
+  },
+  factory: ({ metadata, httpRouter, httpAuth, logger, auth }) => {
+    const actionsRegistryService = DefaultActionsRegistryService.create({
+      httpAuth,
+      logger,
+      auth,
+      metadata,
+    });
+
+    httpRouter.use(actionsRegistryService.createRouter());
+
+    return actionsRegistryService;
+  },
+});

packages/backend-defaults/src/entrypoints/actionsRegistry/index.ts

@@ -0,0 +1,16 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export { actionsRegistryServiceFactory } from './actionsRegistryServiceFactory';

packages/backend-plugin-api/package.json

@@ -61,9 +61,12 @@
     "@backstage/plugin-permission-node": "workspace:^",
     "@backstage/types": "workspace:^",
     "@types/express": "^4.17.6",
+    "@types/json-schema": "^7.0.6",
     "@types/luxon": "^3.0.0",
+    "json-schema": "^0.4.0",
     "knex": "^3.0.0",
-    "luxon": "^3.0.0"
+    "luxon": "^3.0.0",
+    "zod": "^3.22.4"
   },
   "devDependencies": {
     "@backstage/backend-test-utils": "workspace:^",

packages/backend-plugin-api/report.api.md

@@ -12,6 +12,7 @@ import type { Handler } from 'express';
 import { HumanDuration } from '@backstage/types';
 import { isChildPath } from '@backstage/cli-common';
 import { JsonObject } from '@backstage/types';
+import { JSONSchema7 } from 'json-schema';
 import { JsonValue } from '@backstage/types';
 import { Knex } from 'knex';
 import { Permission } from '@backstage/plugin-permission-common';
@@ -25,6 +26,72 @@ import { QueryPermissionResponse } from '@backstage/plugin-permission-common';
 import { Readable } from 'stream';
 import type { Request as Request_2 } from 'express';
 import type { Response as Response_2 } from 'express';
+import { z } from 'zod';
+import { ZodType } from 'zod';
+
+// @public (undocumented)
+export type ActionsRegistryActionContext<TInputSchema extends ZodType> = {
+  input: z.infer<TInputSchema>;
+  logger: LoggerService;
+  credentials: BackstageCredentials;
+};
+
+// @public (undocumented)
+export type ActionsRegistryActionOptions<
+  TInputSchema extends ZodType,
+  TOutputSchema extends ZodType,
+> = {
+  name: string;
+  title: string;
+  description: string;
+  schema: {
+    input: (zod: typeof z) => TInputSchema;
+    output: (zod: typeof z) => TOutputSchema;
+  };
+  action: (context: ActionsRegistryActionContext<TInputSchema>) => Promise<
+    z.infer<TOutputSchema> extends void
+      ? void
+      : {
+          output: z.infer<TOutputSchema>;
+        }
+  >;
+};
+
+// @public (undocumented)
+export interface ActionsRegistryService {
+  // (undocumented)
+  register<TInputSchema extends ZodType, TOutputSchema extends ZodType>(
+    options: ActionsRegistryActionOptions<TInputSchema, TOutputSchema>,
+  ): void;
+}
+
+// @public (undocumented)
+export interface ActionsService {
+  // (undocumented)
+  invoke(opts: {
+    id: string;
+    input?: JsonObject;
+    credentials: BackstageCredentials;
+  }): Promise<{
+    output: JsonValue;
+  }>;
+  // (undocumented)
+  list: (opts: { credentials: BackstageCredentials }) => Promise<{
+    actions: ActionsServiceAction[];
+  }>;
+}
+
+// @public (undocumented)
+export type ActionsServiceAction = {
+  id: string;
+  name: string;
+  title: string;
+  description: string;
+  schema: {
+    input: JSONSchema7;
+    output: JSONSchema7;
+  };
+};
 
 // @public
 export interface AuditorService {
@@ -205,6 +272,12 @@ export type CacheServiceSetOptions = {
 // @public
 export namespace coreServices {
   const auth: ServiceRef<AuthService, 'plugin', 'singleton'>;
+  const actions: ServiceRef<ActionsService, 'plugin', 'singleton'>;
+  const actionsRegistry: ServiceRef<
+    ActionsRegistryService,
+    'plugin',
+    'singleton'
+  >;
   const userInfo: ServiceRef<UserInfoService, 'plugin', 'singleton'>;
   const cache: ServiceRef<CacheService, 'plugin', 'singleton'>;
   const rootConfig: ServiceRef<RootConfigService, 'root', 'singleton'>;

packages/backend-plugin-api/src/services/definitions/ActionsRegistryService.ts

@@ -0,0 +1,59 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { z, ZodType } from 'zod';
+import { LoggerService } from './LoggerService';
+import { BackstageCredentials } from './AuthService';
+
+/**
+ * @public
+ */
+export type ActionsRegistryActionContext<TInputSchema extends ZodType> = {
+  input: z.infer<TInputSchema>;
+  logger: LoggerService;
+  credentials: BackstageCredentials;
+};
+
+/**
+ * @public
+ */
+export type ActionsRegistryActionOptions<
+  TInputSchema extends ZodType,
+  TOutputSchema extends ZodType,
+> = {
+  name: string;
+  title: string;
+  description: string;
+  schema: {
+    input: (zod: typeof z) => TInputSchema;
+    output: (zod: typeof z) => TOutputSchema;
+  };
+  action: (
+    context: ActionsRegistryActionContext<TInputSchema>,
+  ) => Promise<
+    z.infer<TOutputSchema> extends void
+      ? void
+      : { output: z.infer<TOutputSchema> }
+  >;
+};
+
+/**
+ * @public
+ */
+export interface ActionsRegistryService {
+  register<TInputSchema extends ZodType, TOutputSchema extends ZodType>(
+    options: ActionsRegistryActionOptions<TInputSchema, TOutputSchema>,
+  ): void;
+}

packages/backend-plugin-api/src/services/definitions/ActionsService.ts

@@ -0,0 +1,46 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { JsonObject, JsonValue } from '@backstage/types';
+import { JSONSchema7 } from 'json-schema';
+import { BackstageCredentials } from './AuthService';
+
+/**
+ * @public
+ */
+export type ActionsServiceAction = {
+  id: string;
+  name: string;
+  title: string;
+  description: string;
+  schema: {
+    input: JSONSchema7;
+    output: JSONSchema7;
+  };
+};
+
+/**
+ * @public
+ */
+export interface ActionsService {
+  list: (opts: {
+    credentials: BackstageCredentials;
+  }) => Promise<{ actions: ActionsServiceAction[] }>;
+  invoke(opts: {
+    id: string;
+    input?: JsonObject;
+    credentials: BackstageCredentials;
+  }): Promise<{ output: JsonValue }>;
+}

packages/backend-plugin-api/src/services/definitions/coreServices.ts

@@ -35,6 +35,36 @@ export namespace coreServices {
     id: 'core.auth',
   });
 
+  /**
+   * Service for calling distributed actions
+   *
+   * See {@link ActionsService}
+   * and {@link https://backstage.io/docs/backend-system/core-services/actions | the service docs}
+   * for more information.
+   *
+   * @public
+   */
+  export const actions = createServiceRef<
+    import('./ActionsService').ActionsService
+  >({
+    id: 'core.actions',
+  });
+
+  /**
+   * Service for registering and managing distributed actions.
+   *
+   * See {@link ActionsRegistryService}
+   * and {@link https://backstage.io/docs/backend-system/core-services/actions-registry | the service docs}
+   * for more information.
+   *
+   * @public
+   */
+  export const actionsRegistry = createServiceRef<
+    import('./ActionsRegistryService').ActionsRegistryService
+  >({
+    id: 'core.actionsRegistry',
+  });
+
   /**
    * Authenticated user information retrieval.
    *

packages/backend-plugin-api/src/services/definitions/index.ts

@@ -14,6 +14,13 @@
  * limitations under the License.
  */
 
+export type {
+  ActionsRegistryService,
+  ActionsRegistryActionOptions,
+  ActionsRegistryActionContext,
+} from './ActionsRegistryService';
+
+export type { ActionsService, ActionsServiceAction } from './ActionsService';
 export type {
   AuditorService,
   AuditorServiceCreateEventOptions,

packages/backend-test-utils/report.api.md

@@ -3,6 +3,8 @@
 > Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).
 
 ```ts
+import { ActionsRegistryService } from '@backstage/backend-plugin-api';
+import { ActionsService } from '@backstage/backend-plugin-api';
 import { AuditorService } from '@backstage/backend-plugin-api';
 import { AuthService } from '@backstage/backend-plugin-api';
 import { Backend } from '@backstage/backend-app-api';
@@ -161,6 +163,28 @@ export function mockErrorHandler(): ErrorRequestHandler<
 
 // @public
 export namespace mockServices {
+  // (undocumented)
+  export namespace actions {
+    const // (undocumented)
+      factory: () => ServiceFactory<ActionsService, 'plugin', 'singleton'>;
+    const // (undocumented)
+      mock: (
+        partialImpl?: Partial<ActionsService> | undefined,
+      ) => ServiceMock<ActionsService>;
+  }
+  // (undocumented)
+  export namespace actionsRegistry {
+    const // (undocumented)
+      factory: () => ServiceFactory<
+        ActionsRegistryService,
+        'plugin',
+        'singleton'
+      >;
+    const // (undocumented)
+      mock: (
+        partialImpl?: Partial<ActionsRegistryService> | undefined,
+      ) => ServiceMock<ActionsRegistryService>;
+  }
   // (undocumented)
   export namespace auditor {
     const // (undocumented)

packages/backend-test-utils/src/next/services/mockServices.ts

@@ -53,6 +53,8 @@ import { MockRootLoggerService } from './MockRootLoggerService';
 import { MockUserInfoService } from './MockUserInfoService';
 import { mockCredentials } from './mockCredentials';
 import { MockEventsService } from './MockEventsService';
+import { actionsServiceFactory } from '@backstage/backend-defaults/actions';
+import { actionsRegistryServiceFactory } from '@backstage/backend-defaults/actionsRegistry';
 
 /** @internal */
 function createLoggerMock() {
@@ -518,6 +520,20 @@ export namespace mockServices {
       search: jest.fn(),
     }));
   }
+  export namespace actions {
+    export const factory = () => actionsServiceFactory;
+    export const mock = simpleMock(coreServices.actions, () => ({
+      list: jest.fn(),
+      invoke: jest.fn(),
+    }));
+  }
+
+  export namespace actionsRegistry {
+    export const factory = () => actionsRegistryServiceFactory;
+    export const mock = simpleMock(coreServices.actionsRegistry, () => ({
+      register: jest.fn(),
+    }));
+  }
 
   /**
    * Creates a functional mock implementation of the

yarn.lock

@@ -3636,6 +3636,7 @@ __metadata:
     yauzl: "npm:^3.0.0"
     yn: "npm:^4.0.0"
     zod: "npm:^3.22.4"
+    zod-to-json-schema: "npm:^3.20.4"
   peerDependencies:
     "@google-cloud/cloud-sql-connector": ^1.4.0
   peerDependenciesMeta:
@@ -3735,9 +3736,12 @@ __metadata:
     "@backstage/plugin-permission-node": "workspace:^"
     "@backstage/types": "workspace:^"
     "@types/express": "npm:^4.17.6"
+    "@types/json-schema": "npm:^7.0.6"
     "@types/luxon": "npm:^3.0.0"
+    json-schema: "npm:^0.4.0"
     knex: "npm:^3.0.0"
     luxon: "npm:^3.0.0"
+    zod: "npm:^3.22.4"
   languageName: unknown
   linkType: soft