diff --git a/.gitattributes b/.gitattributes
index 3fdfd82c1..a9c4f17c8 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,5 +1,11 @@
-# Set the default behavior, in case people don't have core.autocrlf set.
 * text=auto
 
-# Denote all files that are truly binary and should not be modified.
+*.json text eol=lf
 *.png binary
+
+src/step-templates/*/scriptbody.ps1 -text
+src/step-templates/*/predeploy.ps1 -text
+src/step-templates/*/deploy.ps1 -text
+src/step-templates/*/postdeploy.ps1 -text
+src/step-templates/*/scriptbody.sh -text
+src/step-templates/*/scriptbody.py -text
diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 546784b13..22fa35cec 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -7,21 +7,23 @@ Have a great custom step that other Octopus users will love? Here's how to get i
 2. Clone your fork into a directory on your own machine
 3. _Export_ your template from the Octopus server
 4. Save the exported JSON to a file under `/step-templates`
-5. Check that the `LastModifiedBy` username is one you're happy to use on the site (ideally your plain GitHub username)
-6. Add Id property and set it to a GUID using the following format `abcdef00-ab00-cd00-ef00-000000abcdef`, you can use [this site](https://www.guidgen.com/) to generate one automatically
-7. Optional: Assign your template to an existing category. Have a look at existing templates to find the category that matches your template. If you don't specify it your template will be assigned to 'other' category.
-   - If you add a new category, make sure that you add an icon in `.png` format with a size of 200x200px to the `logos` folder with the same name as your category. Also, the `switch` in the `humanize` function in [`gulpfile.babel.js`](https://github.com/OctopusDeploy/Library/blob/master/gulpfile.babel.js#L92) must have a `case` statement corresponding to it.
-8. If you're updating an existing step template, make sure the `Version` property is incremented (e.g. by 1). If the `Version` doesn't change then the [Community Library Integration](http://docs.octopusdeploy.com/display/OD/Step+Templates#StepTemplates-TheCommunityLibrary) in Octopus won't see your changes.
-9. Commit and push your changes to your fork
-10. View your fork in GitHub to create a _pull request_
+5. Run `node tools/migrate-source-first.js --template <template-name> [--template <another-template-name> ...]` to migrate the selected templates into the source-first layout under `/src/step-templates`
+6. Review the generated changes, including the rebuilt compatibility JSON in `/step-templates`
+7. Check that the `LastModifiedBy` username is one you're happy to use on the site (ideally your plain GitHub username)
+8. Add Id property and set it to a GUID using the following format `abcdef00-ab00-cd00-ef00-000000abcdef`, you can use [this site](https://www.guidgen.com/) to generate one automatically
+9. Optional: Assign your template to an existing category. Have a look at existing templates to find the category that matches your template. If you don't specify it your template will be assigned to 'other' category.
+   - If you add a new category, make sure that you add a `logo.png` file with a size of 200x200px beside the migrated template under `src/step-templates/<template-name>/`. Also, the `switch` in the `humanize` function in [`gulpfile.babel.js`](https://github.com/OctopusDeploy/Library/blob/master/gulpfile.babel.js#L92) must have a `case` statement corresponding to it.
+10. If you're updating an existing step template, make sure the `Version` property is incremented (e.g. by 1). If the `Version` doesn't change then the [Community Library Integration](http://docs.octopusdeploy.com/display/OD/Step+Templates#StepTemplates-TheCommunityLibrary) in Octopus won't see your changes.
+11. Commit and push your changes to your fork
+12. View your fork in GitHub to create a _pull request_
 
 Someone from the Octopus team will review your request and help to make the step consistent with the others in the library. Once it's ready we'll merge it into the main repository and publish it to [the library site](http://library.octopusdeploy.com).
 
-**Note**: If you're editing an existing template we've got a tool you can use to help with packing and unpacking the scripts stored in the step template `*.json` file.
+> [!NOTE]
+> The repository is in a temporary mixed migration state. `step-templates/*.json` remains the compatibility output used by the existing build and publishing workflow, but new template work should migrate the named template into `src/step-templates/**` instead of adding new legacy JSON-first files.
 
-* To unpack the step template scripts into separate files alongside the main step template file, run `powershell .\tools\_unpack.ps1`.
-* You can then edit the `*.ps1` files in the `.\step-templates` folder using your favourite PowerShell editor.
-* To pack the step template script files back into the main step template, run `powershell .\tools\_pack.ps1`. 
+> [!NOTE]
+> The migration script follows a four-step guided flow and supports one or more selected templates per run. Use `--template-prefix <prefix>` when you want to migrate or reset a batch by name prefix. If you need to discard a local migration attempt before committing, run `node tools/migrate-source-first-reset.js --template <template-name> [--template <another-template-name> ...]`.
 
 Here's a **checklist** to consider:
 
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 9f007c1d4..6d453ff83 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -41,7 +41,7 @@ _Before submitting your PR, please delete everything above the line below._
 - [ ] `LastModifiedBy` field must be present, and (_optionally_) updated with the correct author
 - [ ] The best practices documented [here](https://github.com/OctopusDeploy/Library/wiki/Best-Practices) have been applied
 - [ ] If a new `Category` has been created:
-   - [ ] An image with the name `{categoryname}.png` must be present under the `step-templates/logos` folder
+   - [ ] A `logo.png` file must be present beside the migrated template under `src/step-templates/<template>/`
    - [ ] The `switch` in the `humanize` function in [`gulpfile.babel.js`](https://github.com/OctopusDeploy/Library/blob/master/gulpfile.babel.js#L92) must have a `case` statement corresponding to it
 
 Fixes # . _If there is an open issue that this PR fixes add it here, otherwise just remove this line_
diff --git a/.gitignore b/.gitignore
index 96cc31e06..f149d1e8e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,9 +9,594 @@ junitresults.xml
 scriptcs_packages/
 scriptcs_packages.config
 
+/step-templates-orig/
 step-templates/*.ps1
 step-templates/*.sh
 step-templates/*.py
+
+# BEGIN source-first legacy template allowlist
+/step-templates/*.json
+!/step-templates/Azure-Backup-TableStorage-to-Blob.json
+!/step-templates/Azure-Container-Copy-to-another-Container.json
+!/step-templates/Azure-CopySelectiveStorageAccountContainersUsingAZCopy.json
+!/step-templates/Azure-Get-Publishing-Credentials.json
+!/step-templates/F5-API-enable-disable-member.json
+!/step-templates/GCP-gcloud-run-deploy.json
+!/step-templates/Jenkins-Queue-Job.json
+!/step-templates/Load-WIF-Issuer-Thumbprints.json
+!/step-templates/Manual-Intervention-User-Restrictions-Enforcement.json
+!/step-templates/Remove-Hosts-File-Entry.json
+!/step-templates/SQL-Query-Octopus-Database-for-Fragmentation.json
+!/step-templates/TeamCity-Pin-Build.json
+!/step-templates/Wait-until-time.json
+!/step-templates/add-server-to-azure-load-balancer.json
+!/step-templates/amazon-chime-post-message.json
+!/step-templates/amazon-s3-upload.json
+!/step-templates/ansible-run-playbook.json
+!/step-templates/ansible-tower-run-template.json
+!/step-templates/apexsql-devops-toolkit-deploy.json
+!/step-templates/apexsql-devops-toolkit-sync-data.json
+!/step-templates/apexsql-devops-toolkit-sync.json
+!/step-templates/apollo-rover-check-subgraph-schema.json
+!/step-templates/apollo-rover-publish-subgraph-schema.json
+!/step-templates/application-insights-annotate-release-with-rbac.json
+!/step-templates/application-insights-annotate-release.json
+!/step-templates/argo-argocd-app-get.json
+!/step-templates/argo-argocd-app-set-with-package.json
+!/step-templates/argo-argocd-app-set.json
+!/step-templates/argo-argocd-app-sync.json
+!/step-templates/argo-argocd-app-wait.json
+!/step-templates/argo-rollouts-get-rollout.json
+!/step-templates/argo-rollouts-pause.json
+!/step-templates/argo-rollouts-promote.json
+!/step-templates/argo-rollouts-set-image.json
+!/step-templates/argo-rollouts-status.json
+!/step-templates/argo-rollouts-undo.json
+!/step-templates/argo-workflow-submit.json
+!/step-templates/aspnet-state-database.json
+!/step-templates/aspnetcore-set-environment-variable-iis.json
+!/step-templates/aspnetcore-set-environment-variable.json
+!/step-templates/automate-manual-intervention-response.json
+!/step-templates/aws-add-imagetag-to-all-used-ecr-packages.json
+!/step-templates/aws-add-remove-elbv2.json
+!/step-templates/aws-add-tags-to-ec2-instance.json
+!/step-templates/aws-change-ec2-instance-state.json
+!/step-templates/aws-cloudformation-create.json
+!/step-templates/aws-cloudfront-invalidate-cache.json
+!/step-templates/aws-configure-lambda-alias.json
+!/step-templates/aws-configure-lambda-api-gateway-integration.json
+!/step-templates/aws-configure-lambda.json
+!/step-templates/aws-create-a-route-53-resource-record.json
+!/step-templates/aws-create-a-security-group.json
+!/step-templates/aws-deploy-lambda-iam.json
+!/step-templates/aws-deploy-lambda-image.json
+!/step-templates/aws-deploy-lambda.json
+!/step-templates/aws-deregister-elb-instance.json
+!/step-templates/aws-ec2-get-public-hostname.json
+!/step-templates/aws-elastic-beanstalk-dotnet-webapp-deploy.json
+!/step-templates/aws-execute-powershell.json
+!/step-templates/aws-find-blue-green-asg.json
+!/step-templates/aws-find-blue-green-target-group.json
+!/step-templates/aws-initiate-instance-refresh.json
+!/step-templates/aws-lambda-create.json
+!/step-templates/aws-launch-ec2-instance.json
+!/step-templates/aws-linux-install-tentacle.json
+!/step-templates/aws-rds-restore-s3.json
+!/step-templates/aws-rds-sql-backup-s3.json
+!/step-templates/aws-register-elb-instance.json
+!/step-templates/aws-secrets-manager-retrieve-secrets.json
+!/step-templates/aws-set-blue-green-target-group.json
+!/step-templates/aws-update-launch-template-ami.json
+!/step-templates/aws-windows-install-tentacle.json
+!/step-templates/azure-add-or-update-azure-loadbalancer-health-probe.json
+!/step-templates/azure-add-or-update-azure-loadbalancer-rule.json
+!/step-templates/azure-add-service-fabric-cluster-certificate.json
+!/step-templates/azure-administer-webjob.json
+!/step-templates/azure-app-config-kv-retrieve-values.json
+!/step-templates/azure-blob-storage-set-cors.json
+!/step-templates/azure-blob-storage-upload.json
+!/step-templates/azure-capture-virtualmachine-image.json
+!/step-templates/azure-check-vmss-provision-status.json
+!/step-templates/azure-create-containerapp-environment.json
+!/step-templates/azure-create-new-resourcegroup.json
+!/step-templates/azure-create-new-webapp.json
+!/step-templates/azure-create-resource-group-az-module.json
+!/step-templates/azure-create-staging-deployment-slot.json
+!/step-templates/azure-database-execute-sql-cmd.json
+!/step-templates/azure-database-export.json
+!/step-templates/azure-database-import-create-new-DTU.json
+!/step-templates/azure-database-import-create-new-vcpu.json
+!/step-templates/azure-database-import.json
+!/step-templates/azure-delete-from-webapp.json
+!/step-templates/azure-delete-resource-group-az-module.json
+!/step-templates/azure-delete-resource-group.json
+!/step-templates/azure-deploy-app-service-config-zip.json
+!/step-templates/azure-deploy-containerapp.json
+!/step-templates/azure-devops-build-pipeline.json
+!/step-templates/azure-function-deployment.json
+!/step-templates/azure-function-set-appsettings-from-azconfig.json
+!/step-templates/azure-install-windows-tentacle.json
+!/step-templates/azure-keyvault-retrieve-secrets.json
+!/step-templates/azure-linux-install-octopus-tentacle.json
+!/step-templates/azure-load-appsettings-from-file.json
+!/step-templates/azure-manage-webjob.json
+!/step-templates/azure-powershell-version-update.json
+!/step-templates/azure-remove-resource-group-deployments.json
+!/step-templates/azure-site-extensions-install.json
+!/step-templates/azure-switch-staging-deployment-slot.json
+!/step-templates/azure-sync-instancecount-from-prod-to-staging.json
+!/step-templates/azure-upload-files.json
+!/step-templates/azure-web-app-disable-appoffline.json
+!/step-templates/azure-web-app-enable-appoffline.json
+!/step-templates/azure-web-app-get-deployment-user.json
+!/step-templates/azure-web-app-restart.json
+!/step-templates/azure-web-app-rolling-restart.json
+!/step-templates/azure-web-app-set-app-settings.json
+!/step-templates/azure-web-app-set-traffic.json
+!/step-templates/azure-web-app-slot-swap.json
+!/step-templates/azure-web-app-ssl.json
+!/step-templates/azure-web-app-start.json
+!/step-templates/azure-web-app-stop.json
+!/step-templates/backup-azure-database-to-azure-storage.json
+!/step-templates/bash-check-net-core-framework-version.json
+!/step-templates/bash-http-test-url.json
+!/step-templates/bash-service-check-running.json
+!/step-templates/bitwarden-secrets-manager-retrieve-secrets.json
+!/step-templates/block-progression.json
+!/step-templates/calculate-deployment-mode.json
+!/step-templates/cassandra-create-keyspace.json
+!/step-templates/chef-run-cookbook.json
+!/step-templates/chocolatey-ensure-installed.json
+!/step-templates/chocolatey-install-package.json
+!/step-templates/chocolatey-manage-config.json
+!/step-templates/chocolatey-manage-features.json
+!/step-templates/chocolatey-manage-sources.json
+!/step-templates/chocolatey-pin-package.json
+!/step-templates/clickonce-from-deployed-package.json
+!/step-templates/clickonce-re-sign.json
+!/step-templates/clickonce-sign-file.json
+!/step-templates/clickonce-update-application-file.json
+!/step-templates/clickonce-update-manifest-file.json
+!/step-templates/clone-tenant.json
+!/step-templates/com-component-register-unregister.json
+!/step-templates/configuration-encrypt-app-config-section.json
+!/step-templates/configuration-encrypt-app-or-web-config-section.json
+!/step-templates/configuration-encrypt-web-config-section.json
+!/step-templates/configure-spm-client.json
+!/step-templates/create-azure-website-staging-slot.json
+!/step-templates/create-tenant.json
+!/step-templates/cyberark-conjur-retrieve-a-secret.json
+!/step-templates/cyberark-conjur-retrieve-secrets.json
+!/step-templates/cyberark-secretsmanager-retrieve-secrets-jwt.json
+!/step-templates/datadog-create-event.json
+!/step-templates/datadog-schedule-downtime.json
+!/step-templates/datadog-task-log.json
+!/step-templates/deploy-child-project.json
+!/step-templates/determine-rolling-deploy-window-size.json
+!/step-templates/docker-create-and-push-image.json
+!/step-templates/docker-install-linux.json
+!/step-templates/docker-install-windows.json
+!/step-templates/dsc-windows-service.json
+!/step-templates/dyn-create-an-A-record.json
+!/step-templates/edgecast-cdn-purge.json
+!/step-templates/elmahio-notify-deployment.json
+!/step-templates/elmahio-upload-source-map.json
+!/step-templates/epplus-register-dll-gac.json
+!/step-templates/event-tracing-register-manifest.json
+!/step-templates/event-tracing-unregister-manifest.json
+!/step-templates/f5-enable-disable-member.json
+!/step-templates/f5-enable-disable-multiple-pools.json
+!/step-templates/f5-gtm-enable-or-disable.json
+!/step-templates/f5-ltm-rest-enable-disable-member.json
+!/step-templates/file-download.json
+!/step-templates/file-system-add-hosts-entry.json
+!/step-templates/file-system-backup-directory.json
+!/step-templates/file-system-check-disk-space.json
+!/step-templates/file-system-clean-asp-net-temp-files.json
+!/step-templates/file-system-clean-configuration-transforms.json
+!/step-templates/file-system-clean-directory.json
+!/step-templates/file-system-combine-files.json
+!/step-templates/file-system-copy-file.json
+!/step-templates/file-system-create-file.json
+!/step-templates/file-system-create-folder.json
+!/step-templates/file-system-create-folders.json
+!/step-templates/file-system-create-symlink.json
+!/step-templates/file-system-find-and-replace.json
+!/step-templates/file-system-grant-permissions.json
+!/step-templates/file-system-rclone.json
+!/step-templates/file-system-regular-expression-find-and-replace.json
+!/step-templates/file-system-rename-file.json
+!/step-templates/file-system-restore-directory.json
+!/step-templates/file-system-rsync.json
+!/step-templates/file-system-zip-directory-contents.json
+!/step-templates/firebase-deploy.json
+!/step-templates/flyway-database-migrations.json
+!/step-templates/flyway-state-based-migration.json
+!/step-templates/ftp-uploadfiles-package.json
+!/step-templates/ftp-uploadfiles.json
+!/step-templates/gcp-secret-manager-retrieve-secret-oidc.json
+!/step-templates/gcp-secret-manager-retrieve-secrets.json
+!/step-templates/ghostinspector-runsuite.json
+!/step-templates/git-clone-copy-push-another-repo.json
+!/step-templates/git-clone-copy-push-package.json
+!/step-templates/git-clone-copy-push.json
+!/step-templates/git-create-pull-request.json
+!/step-templates/git-pull-https.json
+!/step-templates/git-push-https.json
+!/step-templates/git-tag-repository.json
+!/step-templates/github-create-repo.json
+!/step-templates/github-create-secret.json
+!/step-templates/github-fork-repo.json
+!/step-templates/github-push-yeoman-to-repo.json
+!/step-templates/github-report-deployment.json
+!/step-templates/github-tag-release.json
+!/step-templates/github-verify-attestation.json
+!/step-templates/gitlab-create-tag.json
+!/step-templates/google-chat-send-message.json
+!/step-templates/grate-database-migration.json
+!/step-templates/hashicorp-vault-approle-get-wrapped-secretid.json
+!/step-templates/hashicorp-vault-approle-login.json
+!/step-templates/hashicorp-vault-approle-unwrap-secretid-login.json
+!/step-templates/hashicorp-vault-approle-unwrap-secretid.json
+!/step-templates/hashicorp-vault-generate-jwt.json
+!/step-templates/hashicorp-vault-jwt-login.json
+!/step-templates/hashicorp-vault-keyvalue-v1-retrieve-secrets.json
+!/step-templates/hashicorp-vault-keyvalue-v2-retrieve-secrets.json
+!/step-templates/hashicorp-vault-ldap-login.json
+!/step-templates/hg-get-changelog.json
+!/step-templates/hipchat-notify-api-v1.json
+!/step-templates/hipchat-notify.json
+!/step-templates/hockeyapp-upload-mobile-app.json
+!/step-templates/http-invoke-url.json
+!/step-templates/http-post-form.json
+!/step-templates/http-test-url.json
+!/step-templates/hydra-update-octopus-tentacle.json
+!/step-templates/iis-add-isapicgirestrictionexception.json
+!/step-templates/iis-app-create.json
+!/step-templates/iis-app-remove.json
+!/step-templates/iis-app-set-connect-as-credential.json
+!/step-templates/iis-app-update-property.json
+!/step-templates/iis-apppool-create.json
+!/step-templates/iis-apppool-delete.json
+!/step-templates/iis-apppool-restart.json
+!/step-templates/iis-apppool-set-managed-pipeline-mode.json
+!/step-templates/iis-apppool-start.json
+!/step-templates/iis-apppool-stop.json
+!/step-templates/iis-apppool-update-property.json
+!/step-templates/iis-apppool-update-recycle-settings.json
+!/step-templates/iis-autostartprovider-add.json
+!/step-templates/iis-backup-iis-configuration.json
+!/step-templates/iis-bind-ssl-certificate-with-sni-enabled.json
+!/step-templates/iis-bindings-backup.json
+!/step-templates/iis-bindings-enable-ssl-ccs.json
+!/step-templates/iis-bindings-restore.json
+!/step-templates/iis-change-app-offline-online.json
+!/step-templates/iis-configure-compression.json
+!/step-templates/iis-list-sites.json
+!/step-templates/iis-redirect-to-https.json
+!/step-templates/iis-reset.json
+!/step-templates/iis-set-authentication.steptemplate.json
+!/step-templates/iis-set-http-redirect.json
+!/step-templates/iis-vdir-create.json
+!/step-templates/iis-website-add-http-s-bindings.json
+!/step-templates/iis-website-add-release-number-to-response-header.json
+!/step-templates/iis-website-add-windows-auth-providers.json
+!/step-templates/iis-website-appfabric-application-start.json
+!/step-templates/iis-website-appfabric-application-stop.json
+!/step-templates/iis-website-create.json
+!/step-templates/iis-website-delete.json
+!/step-templates/iis-website-restart.json
+!/step-templates/iis-website-set-ip-security.json
+!/step-templates/iis-website-set-log-format.json
+!/step-templates/iis-website-start.json
+!/step-templates/iis-website-stop.json
+!/step-templates/iis-website-update-iis-log-path.json
+!/step-templates/iis-website-update-property.json
+!/step-templates/import-cert-from-azure-keyvault.json
+!/step-templates/import-databricks-workbooks.json
+!/step-templates/jasper-clear-cache.json
+!/step-templates/jira-transition-issues.json
+!/step-templates/jira-update-version.json
+!/step-templates/json-merge.json
+!/step-templates/json-validate-format-and-schema.json
+!/step-templates/jwt-generate-json-web-token.json
+!/step-templates/k8s-create-serviceaccount-and-target.json
+!/step-templates/k8s-deploy-kustomize.json
+!/step-templates/k8s-eksctl-create-cluster-bash.json
+!/step-templates/k8s-hpa-external-metrics.json
+!/step-templates/k8s-hpa-object-metrics.json
+!/step-templates/k8s-hpa-pod-metrics.json
+!/step-templates/k8s-hpa-resource-metrics.json
+!/step-templates/k8s-inspect-resource-pwsh.json
+!/step-templates/keeper-secretsmanager-retrieve-secrets.json
+!/step-templates/launchdarkly-toggle-feature-flag.json
+!/step-templates/letsencrypt-azure-dns.json
+!/step-templates/letsencrypt-cloudflare.json
+!/step-templates/letsencrypt-dnsimple.json
+!/step-templates/letsencrypt-google-cloud.json
+!/step-templates/letsencrypt-route-53.json
+!/step-templates/letsencrypt-selfhosted-http.json
+!/step-templates/linux-service-start-stop-restart.json
+!/step-templates/liquibase-apply-changeset.json
+!/step-templates/liquibase-run-command.json
+!/step-templates/mariadb-add-database-user-to-role.json
+!/step-templates/mariadb-create-database.json
+!/step-templates/mariadb-create-user.json
+!/step-templates/medianova-purge.json
+!/step-templates/microsoft-power-automate-post-adaptivecard.json
+!/step-templates/microsoft-teams-post-a-message.json
+!/step-templates/mongodb-add-update-user-roles.json
+!/step-templates/mongodb-atlas-create-snapshot.json
+!/step-templates/mongodb-atlas-pause-resume-cluster.json
+!/step-templates/mongodb-atlas-restore-snapshot.json
+!/step-templates/mongodb-create-database.json
+!/step-templates/mongodb-create-user.json
+!/step-templates/msmq-create-transactional-queue.json
+!/step-templates/mulesoft-cloudhub.json
+!/step-templates/mysql-add-database-user-to-role.json
+!/step-templates/mysql-backup-database.json
+!/step-templates/mysql-create-database.json
+!/step-templates/mysql-create-user.json
+!/step-templates/mysql-execute-command.json
+!/step-templates/netscaler-adc-enable-or-disable-service.json
+!/step-templates/network-add-ssl-certificate-binding.json
+!/step-templates/network-add-url-reservation.json
+!/step-templates/newrelic-complete-deployment.json
+!/step-templates/nssm-windows-service-create.json
+!/step-templates/octopus-add-runbook-to-project-azure.json
+!/step-templates/octopus-add-runbook-to-project.json
+!/step-templates/octopus-ai-prompt.json
+!/step-templates/octopus-apply-octoterra-module-azure.json
+!/step-templates/octopus-apply-octoterra-module-s3.json
+!/step-templates/octopus-artifact-collect.json
+!/step-templates/octopus-authenticate-with-oidc.json
+!/step-templates/octopus-blue-green-check.json
+!/step-templates/octopus-certificate-expiry-check.json
+!/step-templates/octopus-chain-deployment.json
+!/step-templates/octopus-check-for-argo-instance.json
+!/step-templates/octopus-check-roles.json
+!/step-templates/octopus-consolidate-releasenotes.json
+!/step-templates/octopus-create-octoterra-space-azure.json
+!/step-templates/octopus-create-octoterra-space-s3.json
+!/step-templates/octopus-delete-machine-registration.json
+!/step-templates/octopus-find-cac-updates.json
+!/step-templates/octopus-get-octopus-usage.json
+!/step-templates/octopus-import-certificate.json
+!/step-templates/octopus-lookup-space-id.json
+!/step-templates/octopus-merge-cac-updates.json
+!/step-templates/octopus-octolint-a-space.json
+!/step-templates/octopus-redeploy-previous-release.json
+!/step-templates/octopus-reference-architecture-eks.json
+!/step-templates/octopus-reference-architecture-webapp.json
+!/step-templates/octopus-register-aks-k8s-cluster.json
+!/step-templates/octopus-register-listening-target.json
+!/step-templates/octopus-register-listening-worker.json
+!/step-templates/octopus-serialize-project-to-terraform.json
+!/step-templates/octopus-serialize-runbook-to-terraform.json
+!/step-templates/octopus-serialize-space-to-terraform.json
+!/step-templates/octopus-set-Octopus-releaese-notes-from-TFS-query.json
+!/step-templates/octopus-smtp-server-configured.json
+!/step-templates/octopus-support-export.json
+!/step-templates/octopus-validate-deploying-user.json
+!/step-templates/octopus-wait-for-deployment-target-registration.json
+!/step-templates/octopus-worker-healthcheck.json
+!/step-templates/onepassword-retrieve-secrets.json
+!/step-templates/opslevel-create-deploy-event-bash.json
+!/step-templates/opslevel-create-deploy-event-ps.json
+!/step-templates/oracle-add-user-to-role.json
+!/step-templates/oracle-create-user-if-not-exists.json
+!/step-templates/oracle-run-script-through-sqlplus.json
+!/step-templates/pagerduty-close-maintenance-window.json
+!/step-templates/pagerduty-create-incident.json
+!/step-templates/pagerduty-open-maintenance-window.json
+!/step-templates/pause-resume-pingdom-check.json
+!/step-templates/pingdom-create-uptime-check.json
+!/step-templates/pingdom-modify-uptime-check.json
+!/step-templates/postgres-add-database-user-to-role.json
+!/step-templates/postgres-create-database.json
+!/step-templates/postgres-create-user.json
+!/step-templates/postgres-execute-sql.json
+!/step-templates/proxmox-deploy-lxc.json
+!/step-templates/proxmox-destroy-lxc.json
+!/step-templates/proxmox-start-lxc.json
+!/step-templates/proxmox-stop-lxc.json
+!/step-templates/pushalot-send-notification.json
+!/step-templates/pushover-send-notification.json
+!/step-templates/rabbitmq-notify-deploy.json
+!/step-templates/rackspace-update-load-balancer.json
+!/step-templates/ravendb-create-database.json
+!/step-templates/ravendb-create-filesystem.json
+!/step-templates/ravendb-delete-database.json
+!/step-templates/ravendb-delete-filesystem.json
+!/step-templates/ravendb-smuggler-move-data-between-database.json
+!/step-templates/ravendb-smuggler-move-data-between-filesystems.json
+!/step-templates/ravendb-update-properties-within-a-document.json
+!/step-templates/raygun-api-register-deployment.json
+!/step-templates/re-prioritize-octopus-deploy-tasks.json
+!/step-templates/readyroll-deploy-database-package.json
+!/step-templates/redgate-create-database-release-worker-friendly.json
+!/step-templates/redgate-create-database-release.json
+!/step-templates/redgate-deploy-database-release-worker-friendly.json
+!/step-templates/redgate-deploy-from-database-release.json
+!/step-templates/redgate-deploy-from-database.json
+!/step-templates/redgate-deploy-from-package-worker-friendly.json
+!/step-templates/redgate-deploy-from-package.json
+!/step-templates/redgate-oracle-create-release.json
+!/step-templates/redgate-sql-clone-create-clone.json
+!/step-templates/redgate-sql-clone-create-image.json
+!/step-templates/redgate-sql-clone-delete-clone.json
+!/step-templates/redgate-sql-clone-delete-image.json
+!/step-templates/redis-install.json
+!/step-templates/redis-uninstall.json
+!/step-templates/register-linux-tentacle.json
+!/step-templates/registry-update-configuration-variables-in-export-file.json
+!/step-templates/releasenoteshub-add-release-association.json
+!/step-templates/releasenoteshub-pull-trigger.json
+!/step-templates/remove-server-from-azure-load-balancer.json
+!/step-templates/retention-policy.json
+!/step-templates/rollbar-notify-deployment.json
+!/step-templates/rotate_azure_load_balancer_pool.json
+!/step-templates/roundhouse-database-migration.json
+!/step-templates/run-entity-framework-migrations.json
+!/step-templates/run-mabl-tests.json
+!/step-templates/run-mstest.json
+!/step-templates/run-octopus-runbook.json
+!/step-templates/run-pulumi-on-linux.json
+!/step-templates/run-pulumi-on-windows.json
+!/step-templates/run-windows-installer.json
+!/step-templates/run-xunit.json
+!/step-templates/save-octopus-output-variable-with-scoping.json
+!/step-templates/save-octopus-output-variable.json
+!/step-templates/sbom-scan.json
+!/step-templates/scheduled-task-create-from-xml.json
+!/step-templates/send-email-using-mailkit.json
+!/step-templates/send-sms-using-messagebird.json
+!/step-templates/sentry-release-tracking-token-auth.json
+!/step-templates/sentry-release-tracking.json
+!/step-templates/seq-log-deployment.json
+!/step-templates/sharepoint-solution-deployment.json
+!/step-templates/sitecore-deploy-scwdp.json
+!/step-templates/sitecore-settings-variable-replacement.json
+!/step-templates/sitecore-unicorn-sync.json
+!/step-templates/slack-detailed-notification-bash.json
+!/step-templates/slack-detailed-notification.json
+!/step-templates/slack-notify-deployment.json
+!/step-templates/slack-send-notification-using-block-kit.json
+!/step-templates/slack-send-simple-notification-bash.json
+!/step-templates/slack-send-simple-notification.json
+!/step-templates/snowchange-deploy-scripts.json
+!/step-templates/solarwinds-manage.json
+!/step-templates/solarwinds-unmanage.json
+!/step-templates/spark-sendnotification.json
+!/step-templates/splunk-forward-file.json
+!/step-templates/splunk-log-event-collector.json
+!/step-templates/sql-add-database-user-to-role.json
+!/step-templates/sql-backup-database.json
+!/step-templates/sql-create-database-enhanced.json
+!/step-templates/sql-create-database-user.json
+!/step-templates/sql-create-database.json
+!/step-templates/sql-create-job-category.json
+!/step-templates/sql-create-sql-user.json
+!/step-templates/sql-delete-database.json
+!/step-templates/sql-delete-sql-user.json
+!/step-templates/sql-deploy-dacpac-sqlpackage.json
+!/step-templates/sql-deploylog-read.json
+!/step-templates/sql-deploylog-update.json
+!/step-templates/sql-execute-script-file.json
+!/step-templates/sql-execute-script-with-authentication.json
+!/step-templates/sql-execute-script.json
+!/step-templates/sql-execute-scripts-ordered.json
+!/step-templates/sql-execute-sql-agent-job.json
+!/step-templates/sql-execute-sql-files.json
+!/step-templates/sql-fix-orphaned-user.json
+!/step-templates/sql-restore-database.json
+!/step-templates/sql-smo-change-usermode.json
+!/step-templates/sql-smo-create-database.json
+!/step-templates/sql-smo-create-login-and-user.json
+!/step-templates/sql-smo-drop-database.json
+!/step-templates/sql-test-connection-string.json
+!/step-templates/sql-update-job.json
+!/step-templates/sqlazure-restore-database-from-azure-storage.json
+!/step-templates/sqlserver-high-availability-group.json
+!/step-templates/sqlserver-project-deployment-model-ispac-deploy.json
+!/step-templates/ssas-deploy-from-package.json
+!/step-templates/ssis-deploy-ispac-from-package.json
+!/step-templates/ssis-deploy-ispac-from-referenced-package.json
+!/step-templates/ssis-deploy-ispac-with-enviroment.json
+!/step-templates/ssis-deploy-sqlagentjob.json
+!/step-templates/ssl-certificate-install.json
+!/step-templates/ssl-disable-sslv2.json
+!/step-templates/ssl-write-certificate-pem-and-key.json
+!/step-templates/ssrs-deploy-from-package-parameter.json
+!/step-templates/ssrs-deploy-from-package.json
+!/step-templates/ssrs-report-backup.json
+!/step-templates/stackify-api-template.json
+!/step-templates/statuscake-maintenance-window.json
+!/step-templates/statuspageio-create-scheduled-maintenance-incident.json
+!/step-templates/statuspageio-update-scheduled-maintenance-incident.json
+!/step-templates/swaggerhub-post-api.json
+!/step-templates/teamcity-download-artifact.json
+!/step-templates/teamcity-pin-build-and-dependencies.json
+!/step-templates/teamcity-run-build.json
+!/step-templates/teamcity-tag-build.json
+!/step-templates/teamcity-trigger-build.json
+!/step-templates/terraform-custom-script.json
+!/step-templates/test-run-nunit.json
+!/step-templates/testery-create-environment.json
+!/step-templates/testery-create-test-run.json
+!/step-templates/testery-delete-environment.json
+!/step-templates/testery-report-deployment.json
+!/step-templates/tomcat-undeploy-application.json
+!/step-templates/topshelf-install.json
+!/step-templates/topshelf-uninstall.json
+!/step-templates/trigger-multitenant-deployment.json
+!/step-templates/twilio-send-sms-powershell.json
+!/step-templates/umbraco-v7-folder-permissions.json
+!/step-templates/unicorn-sync-configuration.json
+!/step-templates/unzip.json
+!/step-templates/update-hosts-file.json
+!/step-templates/upgrade-octopus-server.json
+!/step-templates/upgrade_to_latest_tentacle.json
+!/step-templates/variables-find-unreplaced.json
+!/step-templates/variables-substitute-in-files.json
+!/step-templates/variables-substitute-in-json-file.json
+!/step-templates/venafi-tpp-create-provision-certificate.json
+!/step-templates/venafi-tpp-export-certificate.json
+!/step-templates/venafi-tpp-find-certificate-details.json
+!/step-templates/venafi-tpp-generate-oauth-token.json
+!/step-templates/venafi-tpp-import-certificate-into-octopus.json
+!/step-templates/venafi-tpp-retrieve-certificate-details.json
+!/step-templates/venafi-tpp-revoke-oauth-token.json
+!/step-templates/victorops-create-alert.json
+!/step-templates/wait-for-iis-connections-to-drop-to-zero.json
+!/step-templates/wait.json
+!/step-templates/web-deploy-azure-convention.json
+!/step-templates/web-deploy-publish-website-msdeploy.json
+!/step-templates/windows-add-back-connection-host-name.json
+!/step-templates/windows-add-poll-endpoint-task.json
+!/step-templates/windows-add-users-to-local-groups.json
+!/step-templates/windows-apply-windows-updates.json
+!/step-templates/windows-certificate-grant-read-access.json
+!/step-templates/windows-check-net-core-framework-version.json
+!/step-templates/windows-check-net-framework-version.json
+!/step-templates/windows-create-eventsource.json
+!/step-templates/windows-create-shortcut.json
+!/step-templates/windows-disk-cleanup.json
+!/step-templates/windows-ensure-features-installed.json
+!/step-templates/windows-ensure-hosts-file-entry-exists.json
+!/step-templates/windows-firewall-configure-rule.json
+!/step-templates/windows-get-pending-reboot.json
+!/step-templates/windows-get-processor-load.json
+!/step-templates/windows-get-uptime.json
+!/step-templates/windows-grant-logon-as-service.json
+!/step-templates/windows-install-msi.json
+!/step-templates/windows-local-user.json
+!/step-templates/windows-map-network-drive.json
+!/step-templates/windows-restart-computer.json
+!/step-templates/windows-restart-if-required.json
+!/step-templates/windows-scheduled-task-changepath.json
+!/step-templates/windows-scheduled-task-create.json
+!/step-templates/windows-scheduled-task-disable.json
+!/step-templates/windows-scheduled-task-enable.json
+!/step-templates/windows-service-change-binary-path.json
+!/step-templates/windows-service-check-status.json
+!/step-templates/windows-service-create.json
+!/step-templates/windows-service-remove.json
+!/step-templates/windows-service-restart.json
+!/step-templates/windows-service-set-recovery-on-failure-actions.json
+!/step-templates/windows-service-set-startup-type.json
+!/step-templates/windows-service-start.json
+!/step-templates/windows-service-stop-or-kill.json
+!/step-templates/windows-service-stop.json
+!/step-templates/windows-wait-for-or-force-close-application.json
+!/step-templates/winsw-install.json
+!/step-templates/xamarin-Insights-upload-dysm.json
+!/step-templates/xamarin-testcloud-execute-testrun.json
+!/step-templates/xml-attribute-update.json
+!/step-templates/xml-transform-using-xdt.json
+!/step-templates/yams-upload.json
+!/step-templates/zabbix-node-api-maintenance.json
+# END source-first legacy template allowlist
 diff-output/
 /.vs
 !.vscode
diff --git a/README.md b/README.md
index 427d328aa..ad7d88777 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ A repository of step templates and other community-contributed extensions to Oct
 Organization
 ------------
 
-* *Step templates* are checked into `/step-templates` as raw JSON exports direct from Octopus Deploy
+* *Step templates* are in a temporary mixed migration state: legacy JSON remains under `/step-templates`, while migrated templates are authored under `/src/step-templates`
 * The *library website* is largely under `/app`, with build artifacts at the root of the repository
 * The `/tools` folder contains utilities to help with editing step templates
 
@@ -20,7 +20,12 @@ Reviewing PRs
 
 ### Reviewing script changes
 
-Step template JSON files embed scripts as single-line escaped strings, making diffs hard to read. Use the `_diff.ps1` tool to extract old and new scripts into separate files you can compare in your diff tool:
+Migrated templates keep script content beside `metadata.json` as normal source files such as `scriptbody.ps1`, `scriptbody.sh`, or `scriptbody.py`, so those changes can be reviewed directly in GitHub.
+
+> [!NOTE]
+> This repository is intentionally in a temporary mixed migration state. `step-templates/*.json` remains the compatibility output for the site and build pipeline, but new work should migrate templates into `src/step-templates/<template>/` instead of adding new legacy JSON-first templates.
+
+Use `_diff.ps1` when you need to compare the generated JSON for a template against another branch or commit:
 
 ```powershell
 # Compare ScriptBody against previous commit
@@ -34,7 +39,21 @@ This outputs readable files to `diff-output/`:
 - `template-name.ScriptBody.old.ps1`
 - `template-name.ScriptBody.new.ps1`
 
-Also handles `PreDeploy`, `Deploy`, and `PostDeploy` custom scripts if present.
+> [!NOTE]
+> Octopus Deploy still exports step templates as JSON. To migrate one or more templates incrementally, keep the exported JSON under `step-templates/`, then run `node tools/migrate-source-first.js --template <template-name> [--template <another-template-name> ...]` or `node tools/migrate-source-first.js --template-prefix <prefix>`. The script follows the same four-step flow used in the full migration tooling, but only for the selected templates. Migrated templates keep their `logo.png` beside `metadata.json` and `scriptbody.*`.
+
+```powershell
+node tools/migrate-source-first.js --template ssis-deploy-ispac-from-package-parameter.json
+node tools/migrate-source-first.js --template ssis-deploy-ispac-from-package-parameter
+node tools/migrate-source-first.js --template-prefix ssis-
+```
+
+If you need to discard an in-progress migration before committing, run:
+
+```powershell
+node tools/migrate-source-first-reset.js --template <template-name> [--template <another-template-name> ...]
+node tools/migrate-source-first-reset.js --template-prefix <prefix>
+```
 
 ### Checklist
 
@@ -45,5 +64,5 @@ When reviewing a PR, keep the following things in mind:
 * The `DefaultValue`s of `Parameter`s should be either a string or null.
 * `LastModifiedBy` field must be present, and (_optionally_) updated with the correct author
 * If a new `Category` has been created:
-   * An image with the name `{categoryname}.png` must be present under the `step-templates/logos` folder
+   * A `logo.png` file must be present beside the migrated template under `src/step-templates/<template>/`
    * The `switch` in the `humanize` function in [`gulpfile.babel.js`](https://github.com/OctopusDeploy/Library/blob/master/gulpfile.babel.js#L92) must have a `case` statement corresponding to it
diff --git a/gulpfile.babel.js b/gulpfile.babel.js
index eeec6dbcd..4c5e3826e 100644
--- a/gulpfile.babel.js
+++ b/gulpfile.babel.js
@@ -34,7 +34,7 @@ import http from "http";
 import https from "https";
 import jsonlint from "gulp-jsonlint";
 import path from "path";
-import { spawn } from "child_process";
+import { execFileSync, spawn } from "child_process";
 
 const sass = gulpSass(dartSass);
 const clientDir = "app";
@@ -42,6 +42,40 @@ const serverDir = "server";
 
 const buildDir = "build";
 const publishDir = "dist";
+const sourceStepTemplatesDir = "src/step-templates";
+const sourceFirstTemplateFilter = process.env.SOURCE_FIRST_TEMPLATE_FILTER
+  ? new Set(
+      process.env.SOURCE_FIRST_TEMPLATE_FILTER.split(",")
+        .map((value) => value.trim())
+        .filter(Boolean)
+    )
+  : null;
+const scriptDefinitions = [
+  {
+    sourceBaseName: "scriptbody",
+    sourceExtensions: [".ps1", ".sh", ".py"],
+    propertyName: "Octopus.Action.Script.ScriptBody",
+    legacyBaseName: "ScriptBody",
+  },
+  {
+    sourceBaseName: "predeploy",
+    sourceExtensions: [".ps1"],
+    propertyName: "Octopus.Action.CustomScripts.PreDeploy.ps1",
+    legacyBaseName: "PreDeploy",
+  },
+  {
+    sourceBaseName: "deploy",
+    sourceExtensions: [".ps1"],
+    propertyName: "Octopus.Action.CustomScripts.Deploy.ps1",
+    legacyBaseName: "Deploy",
+  },
+  {
+    sourceBaseName: "postdeploy",
+    sourceExtensions: [".ps1"],
+    propertyName: "Octopus.Action.CustomScripts.PostDeploy.ps1",
+    legacyBaseName: "PostDeploy",
+  },
+];
 
 const $ = gulpLoadPlugins({
   rename: {
@@ -52,6 +86,141 @@ const $ = gulpLoadPlugins({
 const reload = browserSync.reload;
 const argv = yargs.argv;
 
+function isDirectory(targetPath) {
+  return fs.existsSync(targetPath) && fs.statSync(targetPath).isDirectory();
+}
+
+function ensureDirectory(dirPath) {
+  fs.mkdirSync(dirPath, { recursive: true });
+}
+
+function listMigratedTemplates() {
+  if (!isDirectory(sourceStepTemplatesDir)) {
+    return [];
+  }
+
+  return fs
+    .readdirSync(sourceStepTemplatesDir)
+    .filter((entry) => !["logos", "tests"].includes(entry))
+    .filter((entry) => isDirectory(path.join(sourceStepTemplatesDir, entry)))
+    .filter((entry) => fs.existsSync(path.join(sourceStepTemplatesDir, entry, "metadata.json")))
+    .filter((entry) => !sourceFirstTemplateFilter || sourceFirstTemplateFilter.has(entry))
+    .sort();
+}
+
+function getLegacyJsonPath(templateName) {
+  return path.join("step-templates", `${templateName}.json`);
+}
+
+function getSourceTemplateDirectory(templateName) {
+  return path.join(sourceStepTemplatesDir, templateName);
+}
+
+function getLegacySidecarFileName(templateName, sourceFileName, definition) {
+  const extension = path.extname(sourceFileName);
+
+  return `${templateName}.${definition.legacyBaseName}${extension}`;
+}
+
+function runPack(templateName) {
+  execFileSync(process.env.PWSH_PATH || "pwsh", ["-NoProfile", "-File", path.join("tools", "_pack.ps1"), "-SearchPattern", templateName], {
+    cwd: process.cwd(),
+    stdio: "inherit",
+  });
+}
+
+function cleanGeneratedSidecars(templateName) {
+  for (const definition of scriptDefinitions) {
+    for (const extension of definition.sourceExtensions) {
+      const sidecarPath = path.join("step-templates", getLegacySidecarFileName(templateName, `${definition.sourceBaseName}${extension}`, definition));
+      if (fs.existsSync(sidecarPath)) {
+        fs.rmSync(sidecarPath, { force: true });
+      }
+    }
+  }
+}
+
+function materializeLegacyTemplate(templateName) {
+  const sourceDirectory = getSourceTemplateDirectory(templateName);
+  const metadataPath = path.join(sourceDirectory, "metadata.json");
+
+  if (!fs.existsSync(metadataPath)) {
+    return false;
+  }
+
+  ensureDirectory("step-templates");
+  fs.copyFileSync(metadataPath, getLegacyJsonPath(templateName));
+
+  for (const definition of scriptDefinitions) {
+    for (const extension of definition.sourceExtensions) {
+      const sourceFileName = `${definition.sourceBaseName}${extension}`;
+      const sourceFilePath = path.join(sourceDirectory, sourceFileName);
+
+      if (!fs.existsSync(sourceFilePath)) {
+        continue;
+      }
+
+      const legacySidecarPath = path.join("step-templates", getLegacySidecarFileName(templateName, sourceFileName, definition));
+      fs.copyFileSync(sourceFilePath, legacySidecarPath);
+      break;
+    }
+  }
+
+  return true;
+}
+
+function generateMigratedTemplate(templateName) {
+  if (!materializeLegacyTemplate(templateName)) {
+    return false;
+  }
+
+  try {
+    runPack(templateName);
+  } finally {
+    cleanGeneratedSidecars(templateName);
+  }
+
+  return true;
+}
+
+function generateAllMigratedTemplates() {
+  const templateNames = listMigratedTemplates();
+
+  if (templateNames.length === 0) {
+    return false;
+  }
+
+  templateNames.forEach((templateName) => {
+    generateMigratedTemplate(templateName);
+  });
+
+  return true;
+}
+
+function getChangedSourcePathType(changedPath) {
+  const absolutePath = path.resolve(changedPath);
+  const relativePath = path.relative(path.resolve(sourceStepTemplatesDir), absolutePath);
+
+  if (relativePath.startsWith("..")) {
+    return { type: "outside" };
+  }
+
+  const [firstSegment] = relativePath.split(path.sep).filter(Boolean);
+  if (!firstSegment) {
+    return { type: "all" };
+  }
+
+  if (firstSegment === "logos") {
+    return { type: "logos" };
+  }
+
+  if (firstSegment === "tests") {
+    return { type: "tests" };
+  }
+
+  return { type: "template", templateName: firstSegment };
+}
+
 function openBrowser(url) {
   if (process.env.CI) {
     return;
@@ -123,6 +292,11 @@ function lint(files, options = {}) {
 
 gulp.task("lint:client", lint(`${clientDir}/**/*.jsx`));
 gulp.task("lint:server", lint(`./${serverDir}/server.js`));
+gulp.task("prepare:step-templates", (done) => {
+  generateAllMigratedTemplates();
+  done();
+});
+
 gulp.task("lint:step-templates", () => {
   return gulp
     .src("./step-templates/*.json")
@@ -132,25 +306,24 @@ gulp.task("lint:step-templates", () => {
     .pipe(jsonlint.reporter());
 });
 
-gulp.task(
-  "tests",
-  gulp.series("lint:step-templates", () => {
-    return (
-      gulp
-        .src("./spec/*-tests.js")
-        // gulp-jasmine works on filepaths so you can't have any plugins before it
-        .pipe(
-          jasmine({
-            includeStackTrace: false,
-            reporter: [new jasmineReporters.JUnitXmlReporter(), process.env.TEAMCITY_VERSION ? new jasmineReporters.TeamCityReporter() : new jasmineTerminalReporter()],
-          })
-        )
-        .on("error", function () {
-          process.exit(1);
+gulp.task("test:step-templates", () => {
+  return (
+    gulp
+      .src("./spec/*-tests.js")
+      // gulp-jasmine works on filepaths so you can't have any plugins before it
+      .pipe(
+        jasmine({
+          includeStackTrace: false,
+          reporter: [new jasmineReporters.JUnitXmlReporter(), process.env.TEAMCITY_VERSION ? new jasmineReporters.TeamCityReporter() : new jasmineTerminalReporter()],
         })
-    );
-  })
-);
+      )
+      .on("error", function () {
+        process.exit(1);
+      })
+  );
+});
+
+gulp.task("tests", gulp.series("prepare:step-templates", "lint:step-templates", "test:step-templates"));
 
 function humanize(categoryId) {
   switch (categoryId) {
@@ -344,6 +517,7 @@ function provideMissingData() {
     var fileContent = file.contents.toString();
     var template = JSON.parse(fileContent);
     var fileName = path.basename(file.path);
+    var templateName = path.basename(file.path, ".json");
 
     if (!template.HistoryUrl) {
       template.HistoryUrl = "https://github.com/OctopusDeploy/Library/commits/master/step-templates/" + fileName;
@@ -363,7 +537,9 @@ function provideMissingData() {
     template.Category = humanize(categoryId);
 
     if (!template.Logo) {
-      var logo = fs.readFileSync("./step-templates/logos/" + categoryId + ".png");
+      var sourceLogoPath = "./src/step-templates/" + templateName + "/logo.png";
+      var legacyLogoPath = "./step-templates/logos/" + categoryId + ".png";
+      var logo = fs.readFileSync(fs.existsSync(sourceLogoPath) ? sourceLogoPath : legacyLogoPath);
       template.Logo = Buffer.from(logo).toString("base64");
     }
 
@@ -504,6 +680,26 @@ gulp.task(
     gulp.watch(`${clientDir}/**/*.jsx`, gulp.series("scripts", "copy:app", reloadServer));
     gulp.watch(`${clientDir}/content/styles/**/*.scss`, gulp.series("styles:client"));
     gulp.watch("step-templates/*.json", gulp.series("step-templates:data"));
+    gulp.watch(`${sourceStepTemplatesDir}/**/*`).on("all", (eventName, changedPath) => {
+      const change = changedPath ? getChangedSourcePathType(changedPath) : { type: "all" };
+
+      if (change.type === "template") {
+        generateMigratedTemplate(change.templateName);
+      } else if (change.type === "logos" || change.type === "all") {
+        generateAllMigratedTemplates();
+      } else if (change.type === "outside" || change.type === "tests") {
+        return;
+      }
+
+      gulp.series("step-templates:data")((error) => {
+        if (error) {
+          log.error(error);
+          return;
+        }
+
+        reload();
+      });
+    });
 
     gulp.watch(`${buildDir}/**/*.*`).on("change", reload);
   })
diff --git a/spec/logos-validation-tests.js b/spec/logos-validation-tests.js
index ad0ad834a..8e74bbf55 100644
--- a/spec/logos-validation-tests.js
+++ b/spec/logos-validation-tests.js
@@ -2,22 +2,26 @@ var fs = require("fs");
 
 describe("logos", function () {
   it("logos have valid details", function (done) {
-    var filenameCounter = 0;
-    var stepTemplateCount = 0;
-    var dirname = "./step-templates/logos";
+    var filenames = [];
 
-    fs.readdir(dirname, function (err, filenames) {
-      if (err) {
-        console.log("error listing files in dir: " + err);
-        return;
-      }
+    if (fs.existsSync("./step-templates/logos")) {
+      filenames = filenames.concat(fs.readdirSync("./step-templates/logos"));
+    }
 
-      filenames.forEach(function (filename) {
-        var extension = filename.substring(filename.length - 4);
-        expect(extension).toBe(".png");
+    if (fs.existsSync("./src/step-templates")) {
+      fs.readdirSync("./src/step-templates").forEach(function (templateName) {
+        var logoPath = "./src/step-templates/" + templateName + "/logo.png";
+        if (fs.existsSync(logoPath)) {
+          filenames.push("logo.png");
+        }
       });
+    }
 
-      done();
+    filenames.forEach(function (filename) {
+      var extension = filename.substring(filename.length - 4);
+      expect(extension).toBe(".png");
     });
+
+    done();
   });
 });
diff --git a/spec/step-template-validation-tests.js b/spec/step-template-validation-tests.js
index 394a8d76a..e18eb0552 100644
--- a/spec/step-template-validation-tests.js
+++ b/spec/step-template-validation-tests.js
@@ -1,4 +1,5 @@
 var fs = require("fs");
+var path = require("path");
 
 describe("step-templates", function () {
   beforeEach(function () {
@@ -160,4 +161,50 @@ describe("step-templates", function () {
       done();
     });
   });
+
+  it("keep the legacy template allowlist in sync with migrated templates", function () {
+    var gitignore = fs.readFileSync("./.gitignore", "utf8");
+    var startMarker = "# BEGIN source-first legacy template allowlist";
+    var endMarker = "# END source-first legacy template allowlist";
+    var startIndex = gitignore.indexOf(startMarker);
+    var endIndex = gitignore.indexOf(endMarker);
+
+    expect(startIndex).toBeGreaterThanOrEqual(0);
+    expect(endIndex).toBeGreaterThan(startIndex);
+
+    var section = gitignore
+      .substring(startIndex + startMarker.length, endIndex)
+      .split(/\r?\n/)
+      .map(function (line) {
+        return line.trim();
+      })
+      .filter(Boolean);
+
+    expect(section[0]).toBe("/step-templates/*.json");
+
+    var allowlistedLegacyTemplates = section
+      .slice(1)
+      .filter(function (line) {
+        return line.indexOf("!/step-templates/") === 0 && line.endsWith(".json");
+      })
+      .map(function (line) {
+        return path.basename(line, ".json");
+      })
+      .sort();
+
+    var legacyTemplates = fs
+      .readdirSync("./step-templates")
+      .filter(function (file) {
+        return file.endsWith(".json");
+      })
+      .map(function (file) {
+        return path.basename(file, ".json");
+      })
+      .filter(function (templateName) {
+        return !fs.existsSync(path.join("./src/step-templates", templateName, "metadata.json"));
+      })
+      .sort();
+
+    expect(allowlistedLegacyTemplates).toEqual(legacyTemplates);
+  });
 });
diff --git a/step-templates/logos/akamai.png b/src/step-templates/akamai-content-purge/logo.png
similarity index 100%
rename from step-templates/logos/akamai.png
rename to src/step-templates/akamai-content-purge/logo.png
diff --git a/src/step-templates/akamai-content-purge/metadata.json b/src/step-templates/akamai-content-purge/metadata.json
new file mode 100644
index 000000000..34caf2115
--- /dev/null
+++ b/src/step-templates/akamai-content-purge/metadata.json
@@ -0,0 +1,139 @@
+{
+  "Id": "0bfe41dc-50b0-44a7-abe3-e6ba2a6d317a",
+  "Name": "Akamai - Content Purge",
+  "Description": "Allows to purge content using the Content Control Utility (CCU) v2 REST API.",
+  "ActionType": "Octopus.Script",
+  "Version": 1,
+  "Properties": {
+    "Octopus.Action.Script.Syntax": "PowerShell",
+    "Octopus.Action.Script.ScriptSource": "Inline",
+    "Octopus.Action.Script.ScriptBody": "__SOURCE_FILE__:scriptbody.ps1",
+    "Octopus.Action.Script.ScriptFileName": null,
+    "Octopus.Action.Package.NuGetFeedId": null,
+    "Octopus.Action.Package.NuGetPackageId": null
+  },
+  "Parameters": [
+    {
+      "Name": "AkamaiClientToken",
+      "Label": "Client Token",
+      "HelpText": "Authentication token used in client authentication. Available in Luna Portal.",
+      "DefaultValue": null,
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      }
+    },
+    {
+      "Name": "AkamaiClientAccessToken",
+      "Label": "Client Access Token",
+      "HelpText": "Authentication token used in client authentication. Available in Luna Portal.",
+      "DefaultValue": null,
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      }
+    },
+    {
+      "Name": "AkamaiSecret",
+      "Label": "Secret",
+      "HelpText": "Authentication password used in client authentication. Available in Luna Portal.",
+      "DefaultValue": null,
+      "DisplaySettings": {
+        "Octopus.ControlType": "Sensitive"
+      }
+    },
+    {
+      "Name": "AkamaiQueue",
+      "Label": "Queue",
+      "HelpText": "Purge requests queue",
+      "DefaultValue": "default",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Select",
+        "Octopus.SelectOptions": "default\nemergency"
+      }
+    },
+    {
+      "Name": "AkamaiObjects",
+      "Label": "Objects",
+      "HelpText": "A comma separated list of objects to purge, either URLs or CPCODEs",
+      "DefaultValue": null,
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      }
+    },
+    {
+      "Name": "AkamaiType",
+      "Label": "Type",
+      "HelpText": "The type associated with the items in the Objects parameter",
+      "DefaultValue": "arl",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Select",
+        "Octopus.SelectOptions": "arl\ncpcode"
+      }
+    },
+    {
+      "Name": "AkamaiAction",
+      "Label": "Action",
+      "HelpText": "The action to execute on the purge operation",
+      "DefaultValue": "invalidate",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Select",
+        "Octopus.SelectOptions": "invalidate\nremove"
+      }
+    },
+    {
+      "Name": "AkamaiDomain",
+      "Label": "Domain",
+      "HelpText": "The Akamai domain to perform the purge operation on",
+      "DefaultValue": "production",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Select",
+        "Octopus.SelectOptions": "production\nstaging"
+      }
+    },
+    {
+      "Name": "ProxyUser",
+      "Label": "Proxy User",
+      "HelpText": "Optional, a user name for the proxy if required in the network",
+      "DefaultValue": null,
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      }
+    },
+    {
+      "Name": "ProxyPassword",
+      "Label": "Proxy Password",
+      "HelpText": "Optional, the password for the account to use if a Proxy User was specified",
+      "DefaultValue": null,
+      "DisplaySettings": {
+        "Octopus.ControlType": "Sensitive"
+      }
+    },
+    {
+      "Name": "WaitForPurgeToComplete",
+      "Label": "Wait",
+      "HelpText": "Indicates if the step should wait for the purge operation to complete",
+      "DefaultValue": "false",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Select",
+        "Octopus.SelectOptions": "false|No\ntrue|Yes"
+      }
+    },
+    {
+      "Name": "CheckLimit",
+      "Label": "Check Limit",
+      "HelpText": "Maximum number of times to check for the purge operation to complete if set to **Wait**",
+      "DefaultValue": "2",
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText",
+        "Octopus.SelectOptions": "0\n5\n10"
+      }
+    }
+  ],
+  "LastModifiedOn": "2016-07-11T14:00:00.000+00:00",
+  "LastModifiedBy": "roberto-mardeni",
+  "$Meta": {
+    "ExportedAt": "2016-07-11T14:27:34.748+00:00",
+    "OctopusVersion": "3.3.12",
+    "Type": "ActionTemplate"
+  },
+  "Category": "akamai"
+}
diff --git a/src/step-templates/akamai-content-purge/scriptbody.ps1 b/src/step-templates/akamai-content-purge/scriptbody.ps1
new file mode 100644
index 000000000..fe18f98fe
--- /dev/null
+++ b/src/step-templates/akamai-content-purge/scriptbody.ps1
@@ -0,0 +1,226 @@
+$clientToken = $OctopusParameters['AkamaiClientToken']
+$clientAccessToken = $OctopusParameters['AkamaiClientAccessToken']
+$clientSecret = $OctopusParameters['AkamaiSecret']
+$queueName = $OctopusParameters['AkamaiQueue']
+$objects = $OctopusParameters['AkamaiObjects'] -split ","
+$type = $OctopusParameters['AkamaiType']
+$action = $OctopusParameters['AkamaiAction']
+$domain = $OctopusParameters['AkamaiDomain']
+$proxyUser = $OctopusParameters['ProxyUser']
+$proxyPassword = $OctopusParameters['ProxyPassword']
+
+$wait = [bool]::Parse($OctopusParameters['WaitForPurgeToComplete'])
+$maxChecks = [int]::Parse($OctopusParameters['CheckLimit'])
+
+if ($proxyUser) {
+    $securePassword = ConvertTo-SecureString $proxyPassword -AsPlainText -Force
+    $proxyCredential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $proxyUser,$securePassword
+
+    (New-Object System.Net.WebClient).Proxy.Credentials=$proxyCredential
+}
+
+# Copied from https://github.com/akamai-open/AkamaiOPEN-powershell/blob/master/Invoke-AkamaiOPEN.ps1
+function Invoke-AkamaiOpenRequest {
+    param(
+        [Parameter(Mandatory=$true)][string]$Method, 
+        [Parameter(Mandatory=$true)][string]$ClientToken, 
+        [Parameter(Mandatory=$true)][string]$ClientAccessToken, 
+        [Parameter(Mandatory=$true)][string]$ClientSecret, 
+        [Parameter(Mandatory=$true)][string]$ReqURL, 
+        [Parameter(Mandatory=$false)][string]$Body)
+
+    #Function to generate HMAC SHA256 Base64
+    Function Crypto ($secret, $message)
+    {
+	    [byte[]] $keyByte = [System.Text.Encoding]::ASCII.GetBytes($secret)
+	    [byte[]] $messageBytes = [System.Text.Encoding]::ASCII.GetBytes($message)
+	    $hmac = new-object System.Security.Cryptography.HMACSHA256((,$keyByte))
+	    [byte[]] $hashmessage = $hmac.ComputeHash($messageBytes)
+	    $Crypt = [System.Convert]::ToBase64String($hashmessage)
+
+	    return $Crypt
+    }
+
+    #ReqURL Verification
+    If (($ReqURL -as [System.URI]).AbsoluteURI -eq $null -or $ReqURL -notmatch "akamai.com")
+    {
+	    throw "Error: Ivalid Request URI"
+    }
+
+    #Sanitize Method param
+    $Method = $Method.ToUpper()
+
+    #Split $ReqURL for inclusion in SignatureData
+    $ReqArray = $ReqURL -split "(.*\/{2})(.*?)(\/)(.*)"
+
+    #Timestamp for request signing
+    $TimeStamp = [DateTime]::UtcNow.ToString("yyyyMMddTHH:mm:sszz00")
+
+    #GUID for request signing
+    $Nonce = [GUID]::NewGuid()
+
+    #Build data string for signature generation
+    $SignatureData = $Method + "`thttps`t"
+    $SignatureData += $ReqArray[2] + "`t" + $ReqArray[3] + $ReqArray[4]
+
+    if (($Body -ne $null) -and ($Method -ceq "POST"))
+    {
+	    $Body_SHA256 = [System.Security.Cryptography.SHA256]::Create()
+	    $Post_Hash = [System.Convert]::ToBase64String($Body_SHA256.ComputeHash([System.Text.Encoding]::ASCII.GetBytes($Body.ToString())))
+
+	    $SignatureData += "`t`t" + $Post_Hash + "`t"
+    }
+    else
+    {
+	    $SignatureData += "`t`t`t"
+    }
+
+    $SignatureData += "EG1-HMAC-SHA256 "
+    $SignatureData += "client_token=" + $ClientToken + ";"
+    $SignatureData += "access_token=" + $ClientAccessToken + ";"
+    $SignatureData += "timestamp=" + $TimeStamp  + ";"
+    $SignatureData += "nonce=" + $Nonce + ";"
+
+    #Generate SigningKey
+    $SigningKey = Crypto -secret $ClientSecret -message $TimeStamp
+
+    #Generate Auth Signature
+    $Signature = Crypto -secret $SigningKey -message $SignatureData
+
+    #Create AuthHeader
+    $AuthorizationHeader = "EG1-HMAC-SHA256 "
+    $AuthorizationHeader += "client_token=" + $ClientToken + ";"
+    $AuthorizationHeader += "access_token=" + $ClientAccessToken + ";"
+    $AuthorizationHeader += "timestamp=" + $TimeStamp + ";"
+    $AuthorizationHeader += "nonce=" + $Nonce + ";"
+    $AuthorizationHeader += "signature=" + $Signature
+
+    #Create IDictionary to hold request headers
+    $Headers = @{}
+
+    #Add Auth header
+    $Headers.Add('Authorization',$AuthorizationHeader)
+
+    #Add additional headers if POSTing or PUTing
+    If (($Method -ceq "POST") -or ($Method -ceq "PUT"))
+    {
+	    $Body_Size = [System.Text.Encoding]::UTF8.GetByteCount($Body)
+	    $Headers.Add('max-body',$Body_Size.ToString())
+
+        # turn off the "Expect: 100 Continue" header
+        # as it's not supported on the Akamai side.
+        [System.Net.ServicePointManager]::Expect100Continue = $false
+    }
+
+    #Check for valid Methods and required switches
+    If (($Method -ceq "POST") -and ($Body -ne $null))
+    {
+        Invoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers -Body $Body -ContentType 'application/json'
+    }
+    elseif  (($Method -ceq "PUT") -and ($Body -ne $null))
+    {
+	    #Invoke API call with PUT and return
+	    Invoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers -Body $Body -ContentType 'application/json'
+    }
+    elseif (($Method -ceq "GET") -or ($Method -ceq "DELETE"))
+    {
+	    #Invoke API call with GET or DELETE and return
+	    Invoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers
+    }
+    else
+    {
+	    throw "Error: Invalid -Method specified or missing required parameter"
+    }
+}
+
+function Perform-AkamaiRequest {
+    param (
+        [string]$request, 
+        [string]$method="Get", 
+        [int]$expectedStatusCode=200, 
+        $body)
+
+    $baseUrl = "http://private-anon-3934daf8d-akamaiopen2purgeccuv2production.apiary-mock.com"
+    # $baseUrl = "https://api.ccu.akamai.com"
+    $uri = "{0}{1}" -f $baseUrl,$request
+
+    if ($uri -match "mock"){
+        $requestHeaders = @{'Cache-Control'='no-cache,proxy-revalidate'}
+        $response = Invoke-RestMethod -Uri $uri -Method $method -DisableKeepAlive -Headers $requestHeaders -Body $body
+    } else {
+        $json = ConvertTo-Json $body -Compress
+        $response = Invoke-AkamaiOpenRequest -Method $method -ClientToken $clientToken -ClientAccessToken $clientAccessToken -ClientSecret $clientSecret -ReqURL $uri -Body $json
+    }
+
+    if ($response.httpStatus -ne $expectedStatusCode){
+        Write-Error "Request not processed correctly: $($response.detail)"
+    } elseif ($response.detail) {
+        Write-Verbose $response.detail
+    }
+
+    Write-Verbose $response
+
+    $response
+}
+
+function Get-QueueSize {
+    param ([string]$queueName)
+
+    $queueSize = Perform-AkamaiRequest "/ccu/v2/queues/$queueName"
+
+    $queueSize 
+}
+
+function Request-Purge {
+    param ($objects,[string]$type="arl",[string]$action="remove",[string]$domain="production")
+
+    $body = @{
+        objects = $objects
+        action = $action
+        type = $type
+        domain = $domain
+    }
+
+    Perform-AkamaiRequest "/ccu/v2/queues/$queueName" "Post" 201 $body
+}
+
+function Get-PurgeStatus {
+    param ([string]$purgeId)
+
+    $status = Perform-AkamaiRequest "/ccu/v2/purges/$purgeId"
+
+    Write-Host "Purge status: $($status.purgeStatus)"
+
+    $status
+}
+
+$queueSize = Get-QueueSize $queueName
+Write-Output "$($queueName) queue size is $($queueSize.queueLength)"
+
+$purge = Request-Purge $objects $type $action $domain
+
+Write-Output "Purge request created"
+Write-Output "PurgeId: $($purge.purgeId)"
+Write-Output "SupportId: $($purge.supportId)" 
+
+if ($wait) {
+    $check = 1
+    $purgeStatus = "Unknown"
+
+    do {
+        if ($check -gt 1) {
+            Write-Output "Waiting $($purge.pingAfterSeconds) seconds before checking purge status again"
+            Start-Sleep -Seconds $purge.pingAfterSeconds
+        }
+        $status = Get-PurgeStatus $purge.purgeId 
+        $purgeStatus = $status.purgeStatus
+        $check = $check + 1
+        if ($check -gt $maxChecks) { 
+            Write-Output "Maximum number of checks reached"
+        }
+    } while ($status.purgeStatus -ne "Done" -and $check -le $maxChecks)
+
+    if ($status.purgeStatus -ne "Done") {
+        Write-Error "Purge status is not Done"
+    }
+}
\ No newline at end of file
diff --git a/src/step-templates/akamai-cpcode-fastpurge/logo.png b/src/step-templates/akamai-cpcode-fastpurge/logo.png
new file mode 100644
index 000000000..f410a3dcc
Binary files /dev/null and b/src/step-templates/akamai-cpcode-fastpurge/logo.png differ
diff --git a/src/step-templates/akamai-cpcode-fastpurge/metadata.json b/src/step-templates/akamai-cpcode-fastpurge/metadata.json
new file mode 100644
index 000000000..e0a1a770d
--- /dev/null
+++ b/src/step-templates/akamai-cpcode-fastpurge/metadata.json
@@ -0,0 +1,106 @@
+{
+  "Id": "ee4a6957-7d98-4dcf-8f94-78f19ab1c6e0",
+  "Name": "Akamai - CPCode Fast Purge",
+  "Description": "Allows to purge CP codes using the Content Control Utility (CCU) v3 REST API.",
+  "ActionType": "Octopus.Script",
+  "Version": 2,
+  "CommunityActionTemplateId": null,
+  "Properties": {
+    "Octopus.Action.Script.Syntax": "PowerShell",
+    "Octopus.Action.Script.ScriptSource": "Inline",
+    "Octopus.Action.Script.ScriptBody": "__SOURCE_FILE__:scriptbody.ps1",
+    "Octopus.Action.RunOnServer": "false",
+    "Octopus.Action.Script.ScriptFileName": null,
+    "Octopus.Action.Package.FeedId": null,
+    "Octopus.Action.Package.PackageId": null
+  },
+  "Parameters": [
+    {
+      "Id": "293e2cc1-e471-4801-8a9c-42633a3c9122",
+      "Name": "AkamaiClientToken",
+      "Label": "Client Token",
+      "HelpText": "Authentication token used in client authentication. Available in Luna Portal.",
+      "DefaultValue": "",
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      },
+      "Links": {}
+    },
+    {
+      "Id": "e0edcbea-bfdd-4781-9a8a-55b08eba6ed5",
+      "Name": "AkamaiClientAccessToken",
+      "Label": "Client Access Token",
+      "HelpText": "Authentication token used in client authentication. Available in Luna Portal.",
+      "DefaultValue": "",
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      },
+      "Links": {}
+    },
+    {
+      "Id": "c1ea0502-f68e-4890-99a2-3c721d16b7f0",
+      "Name": "AkamaiSecret",
+      "Label": "Secret",
+      "HelpText": "Authentication password used in client authentication. Available in Luna Portal.",
+      "DefaultValue": "",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Sensitive"
+      },
+      "Links": {}
+    },
+    {
+      "Id": "f54e1b4a-3960-483b-88c9-5ea7a94698a0",
+      "Name": "AkamaiCPCode",
+      "Label": "CPCode",
+      "HelpText": "The CPCode for which to execute the purge operation",
+      "DefaultValue": "",
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      },
+      "Links": {}
+    },
+    {
+      "Id": "a334eabb-8a36-4c24-b728-52f834f8a893",
+      "Name": "AkamaiHost",
+      "Label": "Host",
+      "HelpText": "Akamai Host (no HTTP/HTTPS). Available in Luna Portal.",
+      "DefaultValue": "",
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      },
+      "Links": {}
+    },
+    {
+      "Id": "8482001d-a6fc-4e72-b9be-8cc584a39b36",
+      "Name": "AkamaiAction",
+      "Label": "Action",
+      "HelpText": "The action to execute on the purge operation",
+      "DefaultValue": "invalidate",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Select",
+        "Octopus.SelectOptions": "invalidate\nremove"
+      },
+      "Links": {}
+    },
+    {
+      "Id": "e1c3dfa0-7118-4e23-9315-c03ea3662125",
+      "Name": "AkamaiDomain",
+      "Label": "Domain",
+      "HelpText": "The Akamai domain to perform the purge operation on",
+      "DefaultValue": "production",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Select",
+        "Octopus.SelectOptions": "production\nstaging"
+      },
+      "Links": {}
+    }
+  ],
+  "LastModifiedOn": "2019-02-11T18:51:20.358Z",
+  "LastModifiedBy": "ajwightm",
+  "$Meta": {
+    "ExportedAt": "2019-02-11T18:51:20.358Z",
+    "OctopusVersion": "3.13.10",
+    "Type": "ActionTemplate"
+  },
+  "Category": "Akamai"
+}
diff --git a/src/step-templates/akamai-cpcode-fastpurge/scriptbody.ps1 b/src/step-templates/akamai-cpcode-fastpurge/scriptbody.ps1
new file mode 100644
index 000000000..f6afdf036
--- /dev/null
+++ b/src/step-templates/akamai-cpcode-fastpurge/scriptbody.ps1
@@ -0,0 +1,168 @@
+$clientToken = $OctopusParameters['AkamaiClientToken']
+$clientAccessToken = $OctopusParameters['AkamaiClientAccessToken']
+$clientSecret = $OctopusParameters['AkamaiSecret']
+$cpcode = $OctopusParameters['AkamaiCPCode']
+$akhost = $OctopusParameters['AkamaiHost']
+$action = $OctopusParameters['AkamaiAction']
+$domain = $OctopusParameters['AkamaiDomain']
+
+# NOTICE : PowerShell EdgeGrid Client has been deprecated and will reach End of Life soon. For more information, please see https://developer.akamai.com/blog/2018/11/13/akamai-powershell-edgegrid-client-end-life-notice
+# Copied from https://github.com/akamai-open/AkamaiOPEN-powershell/blob/master/Invoke-AkamaiOPEN.ps1
+function Invoke-AkamaiOpenRequest {
+	param(
+		[Parameter(Mandatory=$true)]
+		[ValidateSet("GET", "PUT", "POST", "DELETE")]
+		[string]$Method,
+		[Parameter(Mandatory=$true)][string]$ClientToken,
+		[Parameter(Mandatory=$true)][string]$ClientAccessToken,
+		[Parameter(Mandatory=$true)][string]$ClientSecret,
+		[Parameter(Mandatory=$true)][string]$ReqURL,
+		[Parameter(Mandatory=$false)][string]$Body,
+		[Parameter(Mandatory=$false)][string]$MaxBody = 131072
+		)
+
+	#Function to generate HMAC SHA256 Base64
+	Function Crypto ($secret, $message)
+	{
+		[byte[]] $keyByte = [System.Text.Encoding]::ASCII.GetBytes($secret)
+		[byte[]] $messageBytes = [System.Text.Encoding]::ASCII.GetBytes($message)
+		$hmac = new-object System.Security.Cryptography.HMACSHA256((,$keyByte))
+		[byte[]] $hashmessage = $hmac.ComputeHash($messageBytes)
+		$Crypt = [System.Convert]::ToBase64String($hashmessage)
+
+		return $Crypt
+	}
+
+	#ReqURL Verification
+	If (($ReqURL -as [System.URI]).AbsoluteURI -eq $null -or $ReqURL -notmatch "akamaiapis.net")
+	{
+		throw "Error: Ivalid Request URI"
+	}
+
+	#Sanitize Method param
+	$Method = $Method.ToUpper()
+
+	#Split $ReqURL for inclusion in SignatureData
+	$ReqArray = $ReqURL -split "(.*\/{2})(.*?)(\/)(.*)"
+
+	#Timestamp for request signing
+	$TimeStamp = [DateTime]::UtcNow.ToString("yyyyMMddTHH:mm:sszz00")
+
+	#GUID for request signing
+	$Nonce = [GUID]::NewGuid()
+
+	#Build data string for signature generation
+	$SignatureData = $Method + "`thttps`t"
+	$SignatureData += $ReqArray[2] + "`t" + $ReqArray[3] + $ReqArray[4]
+
+	#Add body to signature. Truncate if body is greater than max-body (Akamai default is 131072). PUT Medthod does not require adding to signature.
+	
+	if ($Body -and $Method -eq "POST")
+	{
+	  $Body_SHA256 = [System.Security.Cryptography.SHA256]::Create()
+	  if($Body.Length -gt $MaxBody){
+		$Post_Hash = [System.Convert]::ToBase64String($Body_SHA256.ComputeHash([System.Text.Encoding]::ASCII.GetBytes($Body.Substring(0,$MaxBody))))
+	  }
+	  else{
+		$Post_Hash = [System.Convert]::ToBase64String($Body_SHA256.ComputeHash([System.Text.Encoding]::ASCII.GetBytes($Body)))
+	  }
+
+	  $SignatureData += "`t`t" + $Post_Hash + "`t"
+	}
+	else
+	{
+	  $SignatureData += "`t`t`t"
+	}
+
+	$SignatureData += "EG1-HMAC-SHA256 "
+	$SignatureData += "client_token=" + $ClientToken + ";"
+	$SignatureData += "access_token=" + $ClientAccessToken + ";"
+	$SignatureData += "timestamp=" + $TimeStamp  + ";"
+	$SignatureData += "nonce=" + $Nonce + ";"
+
+	#Generate SigningKey
+	$SigningKey = Crypto -secret $ClientSecret -message $TimeStamp
+
+	#Generate Auth Signature
+	$Signature = Crypto -secret $SigningKey -message $SignatureData
+
+	#Create AuthHeader
+	$AuthorizationHeader = "EG1-HMAC-SHA256 "
+	$AuthorizationHeader += "client_token=" + $ClientToken + ";"
+	$AuthorizationHeader += "access_token=" + $ClientAccessToken + ";"
+	$AuthorizationHeader += "timestamp=" + $TimeStamp + ";"
+	$AuthorizationHeader += "nonce=" + $Nonce + ";"
+	$AuthorizationHeader += "signature=" + $Signature
+
+	#Create IDictionary to hold request headers
+	$Headers = @{}
+
+	#Add Auth header
+	$Headers.Add('Authorization',$AuthorizationHeader)
+
+	#Add additional headers if POSTing or PUTing
+	If ($Body)
+	{
+	  # turn off the "Expect: 100 Continue" header
+	  # as it's not supported on the Akamai side.
+	  [System.Net.ServicePointManager]::Expect100Continue = $false
+	}
+	
+	#Check for valid Methods and required switches
+	[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
+	if ($Method -eq "PUT" -or $Method -eq "POST") {
+		if ($Body) {
+			try{
+				Invoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers -Body $Body -ContentType 'application/json'
+			}
+			catch{
+				Write-Host $_ -fore green
+			}
+		}
+		else {
+		  Invoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers -ContentType 'application/json'
+		}
+	}
+	else {
+		#Invoke API call with GET or DELETE and return
+		Invoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers
+	}
+}
+
+function Perform-AkamaiRequest {
+    param (
+        [string]$request, 
+        [string]$method="Get", 
+        [int]$expectedStatusCode=200, 
+        $body)
+
+    $baseUrl = "https://" + $akhost
+    $uri = "{0}{1}" -f $baseUrl,$request
+
+    $json = ConvertTo-Json $body -Compress
+    $response = Invoke-AkamaiOpenRequest -Method $method -ClientToken $clientToken -ClientAccessToken $clientAccessToken -ClientSecret $clientSecret -ReqURL $uri -Body $json
+	
+    if ($response.httpStatus -ne $expectedStatusCode){
+        Write-Error "Request not processed correctly: $($response.detail)"
+    } elseif ($response.detail) {
+        Write-Verbose $response.detail
+    }
+
+    $response
+}
+
+function Request-Purge {
+    param ([Int]$cpcode,[string]$action="remove",[string]$domain="production")
+
+    $body = @{
+        objects = @($cpcode)
+    }
+
+    Perform-AkamaiRequest "/ccu/v3/$action/cpcode/$domain" "Post" 201 $body
+}
+
+$purge = Request-Purge $cpcode $action $domain
+
+Write-Output "Purge request created"
+Write-Output "PurgeId: $($purge.purgeId)"
+Write-Output "SupportId: $($purge.supportId)" 
\ No newline at end of file
diff --git a/src/step-templates/akamai-fast-content-purge/logo.png b/src/step-templates/akamai-fast-content-purge/logo.png
new file mode 100644
index 000000000..f410a3dcc
Binary files /dev/null and b/src/step-templates/akamai-fast-content-purge/logo.png differ
diff --git a/src/step-templates/akamai-fast-content-purge/metadata.json b/src/step-templates/akamai-fast-content-purge/metadata.json
new file mode 100644
index 000000000..975c8a7b4
--- /dev/null
+++ b/src/step-templates/akamai-fast-content-purge/metadata.json
@@ -0,0 +1,108 @@
+{
+  "Id": "f8e2e47b-62ba-44a0-881c-d1911dc14428",
+  "Name": "Akamai - Content Fast Purge",
+  "Description": "Allows to purge content using the Content Control Utility (CCU) v3 REST API.",
+  "ActionType": "Octopus.Script",
+  "Version": 1,
+  "Properties": {
+    "Octopus.Action.Script.Syntax": "PowerShell",
+    "Octopus.Action.Script.ScriptSource": "Inline",
+    "Octopus.Action.Script.ScriptBody": "__SOURCE_FILE__:scriptbody.ps1",
+    "Octopus.Action.Script.ScriptFileName": null,
+    "Octopus.Action.Package.NuGetFeedId": null,
+    "Octopus.Action.Package.NuGetPackageId": null
+  },
+  "Parameters": [
+    {
+      "Name": "AkamaiClientToken",
+      "Label": "Client Token",
+      "HelpText": "Authentication token used in client authentication. Available in Luna Portal.",
+      "DefaultValue": null,
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      }
+    },
+    {
+      "Name": "AkamaiClientAccessToken",
+      "Label": "Client Access Token",
+      "HelpText": "Authentication token used in client authentication. Available in Luna Portal.",
+      "DefaultValue": null,
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      }
+    },
+    {
+      "Name": "AkamaiSecret",
+      "Label": "Secret",
+      "HelpText": "Authentication password used in client authentication. Available in Luna Portal.",
+      "DefaultValue": null,
+      "DisplaySettings": {
+        "Octopus.ControlType": "Sensitive"
+      }
+    },
+    {
+      "Name": "AkamaiHostname",
+      "Label": "Hostname",
+      "HelpText": "The hostname for which to execute the purge operation",
+      "DefaultValue": null,
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      }
+    },
+    {
+      "Name": "AkamaiObjects",
+      "Label": "Objects",
+      "HelpText": "A comma separated list of objects to purge, only URLs",
+      "DefaultValue": null,
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      }
+    },
+    {
+      "Name": "AkamaiAction",
+      "Label": "Action",
+      "HelpText": "The action to execute on the purge operation",
+      "DefaultValue": "invalidate",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Select",
+        "Octopus.SelectOptions": "invalidate\nremove"
+      }
+    },
+    {
+      "Name": "AkamaiDomain",
+      "Label": "Domain",
+      "HelpText": "The Akamai domain to perform the purge operation on",
+      "DefaultValue": "production",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Select",
+        "Octopus.SelectOptions": "production\nstaging"
+      }
+    },
+    {
+      "Name": "ProxyUser",
+      "Label": "Proxy User",
+      "HelpText": "Optional, a user name for the proxy if required in the network",
+      "DefaultValue": null,
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      }
+    },
+    {
+      "Name": "ProxyPassword",
+      "Label": "Proxy Password",
+      "HelpText": "Optional, the password for the account to use if a Proxy User was specified",
+      "DefaultValue": null,
+      "DisplaySettings": {
+        "Octopus.ControlType": "Sensitive"
+      }
+    }
+  ],
+  "LastModifiedOn": "2016-07-11T14:00:00.000+00:00",
+  "LastModifiedBy": "roberto-mardeni",
+  "$Meta": {
+    "ExportedAt": "2016-07-11T14:30:28.569+00:00",
+    "OctopusVersion": "3.3.12",
+    "Type": "ActionTemplate"
+  },
+  "Category": "akamai"
+}
diff --git a/src/step-templates/akamai-fast-content-purge/scriptbody.ps1 b/src/step-templates/akamai-fast-content-purge/scriptbody.ps1
new file mode 100644
index 000000000..69f123518
--- /dev/null
+++ b/src/step-templates/akamai-fast-content-purge/scriptbody.ps1
@@ -0,0 +1,183 @@
+$clientToken = $OctopusParameters['AkamaiClientToken']
+$clientAccessToken = $OctopusParameters['AkamaiClientAccessToken']
+$clientSecret = $OctopusParameters['AkamaiSecret']
+$hostname = $OctopusParameters['AkamaiHostname']
+$objects = $OctopusParameters['AkamaiObjects'] -split ","
+$action = $OctopusParameters['AkamaiAction']
+$domain = $OctopusParameters['AkamaiDomain']
+$proxyUser = $OctopusParameters['ProxyUser']
+$proxyPassword = $OctopusParameters['ProxyPassword']
+
+if ($proxyUser) {
+    $securePassword = ConvertTo-SecureString $proxyPassword -AsPlainText -Force
+    $proxyCredential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $proxyUser,$securePassword
+
+    (New-Object System.Net.WebClient).Proxy.Credentials=$proxyCredential
+}
+
+# Copied from https://github.com/akamai-open/AkamaiOPEN-powershell/blob/master/Invoke-AkamaiOPEN.ps1
+function Invoke-AkamaiOpenRequest {
+    param(
+        [Parameter(Mandatory=$true)][string]$Method, 
+        [Parameter(Mandatory=$true)][string]$ClientToken, 
+        [Parameter(Mandatory=$true)][string]$ClientAccessToken, 
+        [Parameter(Mandatory=$true)][string]$ClientSecret, 
+        [Parameter(Mandatory=$true)][string]$ReqURL, 
+        [Parameter(Mandatory=$false)][string]$Body)
+
+    #Function to generate HMAC SHA256 Base64
+    Function Crypto ($secret, $message)
+    {
+	    [byte[]] $keyByte = [System.Text.Encoding]::ASCII.GetBytes($secret)
+	    [byte[]] $messageBytes = [System.Text.Encoding]::ASCII.GetBytes($message)
+	    $hmac = new-object System.Security.Cryptography.HMACSHA256((,$keyByte))
+	    [byte[]] $hashmessage = $hmac.ComputeHash($messageBytes)
+	    $Crypt = [System.Convert]::ToBase64String($hashmessage)
+
+	    return $Crypt
+    }
+
+    #ReqURL Verification
+    If (($ReqURL -as [System.URI]).AbsoluteURI -eq $null -or $ReqURL -notmatch "akamai.com")
+    {
+	    throw "Error: Ivalid Request URI"
+    }
+
+    #Sanitize Method param
+    $Method = $Method.ToUpper()
+
+    #Split $ReqURL for inclusion in SignatureData
+    $ReqArray = $ReqURL -split "(.*\/{2})(.*?)(\/)(.*)"
+
+    #Timestamp for request signing
+    $TimeStamp = [DateTime]::UtcNow.ToString("yyyyMMddTHH:mm:sszz00")
+
+    #GUID for request signing
+    $Nonce = [GUID]::NewGuid()
+
+    #Build data string for signature generation
+    $SignatureData = $Method + "`thttps`t"
+    $SignatureData += $ReqArray[2] + "`t" + $ReqArray[3] + $ReqArray[4]
+
+    if (($Body -ne $null) -and ($Method -ceq "POST"))
+    {
+	    $Body_SHA256 = [System.Security.Cryptography.SHA256]::Create()
+	    $Post_Hash = [System.Convert]::ToBase64String($Body_SHA256.ComputeHash([System.Text.Encoding]::ASCII.GetBytes($Body.ToString())))
+
+	    $SignatureData += "`t`t" + $Post_Hash + "`t"
+    }
+    else
+    {
+	    $SignatureData += "`t`t`t"
+    }
+
+    $SignatureData += "EG1-HMAC-SHA256 "
+    $SignatureData += "client_token=" + $ClientToken + ";"
+    $SignatureData += "access_token=" + $ClientAccessToken + ";"
+    $SignatureData += "timestamp=" + $TimeStamp  + ";"
+    $SignatureData += "nonce=" + $Nonce + ";"
+
+    #Generate SigningKey
+    $SigningKey = Crypto -secret $ClientSecret -message $TimeStamp
+
+    #Generate Auth Signature
+    $Signature = Crypto -secret $SigningKey -message $SignatureData
+
+    #Create AuthHeader
+    $AuthorizationHeader = "EG1-HMAC-SHA256 "
+    $AuthorizationHeader += "client_token=" + $ClientToken + ";"
+    $AuthorizationHeader += "access_token=" + $ClientAccessToken + ";"
+    $AuthorizationHeader += "timestamp=" + $TimeStamp + ";"
+    $AuthorizationHeader += "nonce=" + $Nonce + ";"
+    $AuthorizationHeader += "signature=" + $Signature
+
+    #Create IDictionary to hold request headers
+    $Headers = @{}
+
+    #Add Auth header
+    $Headers.Add('Authorization',$AuthorizationHeader)
+
+    #Add additional headers if POSTing or PUTing
+    If (($Method -ceq "POST") -or ($Method -ceq "PUT"))
+    {
+	    $Body_Size = [System.Text.Encoding]::UTF8.GetByteCount($Body)
+	    $Headers.Add('max-body',$Body_Size.ToString())
+
+        # turn off the "Expect: 100 Continue" header
+        # as it's not supported on the Akamai side.
+        [System.Net.ServicePointManager]::Expect100Continue = $false
+    }
+
+    #Check for valid Methods and required switches
+    If (($Method -ceq "POST") -and ($Body -ne $null))
+    {
+        Invoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers -Body $Body -ContentType 'application/json'
+    }
+    elseif  (($Method -ceq "PUT") -and ($Body -ne $null))
+    {
+	    #Invoke API call with PUT and return
+	    Invoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers -Body $Body -ContentType 'application/json'
+    }
+    elseif (($Method -ceq "GET") -or ($Method -ceq "DELETE"))
+    {
+	    #Invoke API call with GET or DELETE and return
+	    Invoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers
+    }
+    else
+    {
+	    throw "Error: Invalid -Method specified or missing required parameter"
+    }
+}
+
+function Perform-AkamaiRequest {
+    param (
+        [string]$request, 
+        [string]$method="Get", 
+        [int]$expectedStatusCode=200, 
+        $body)
+
+    $baseUrl = "http://private-anon-3934daf8d-akamaiopen2purgeccuv3production.apiary-mock.com"
+    # $baseUrl = "https://api.ccu.akamai.com"
+    $uri = "{0}{1}" -f $baseUrl,$request
+
+    if ($uri -match "mock"){
+        $requestHeaders = @{'Cache-Control'='no-cache,proxy-revalidate'}
+        $response = Invoke-RestMethod -Uri $uri -Method $method -DisableKeepAlive -Headers $requestHeaders -Body $body
+    } else {
+        $json = ConvertTo-Json $body -Compress
+        $response = Invoke-AkamaiOpenRequest -Method $method -ClientToken $clientToken -ClientAccessToken $clientAccessToken -ClientSecret $clientSecret -ReqURL $uri -Body $json
+    }
+
+    if ($response.httpStatus -ne $expectedStatusCode){
+        Write-Error "Request not processed correctly: $($response.detail)"
+    } elseif ($response.detail) {
+        Write-Verbose $response.detail
+    }
+
+    Write-Verbose $response
+
+    $response
+}
+
+function Request-Purge {
+    param ($objects,[string]$hostname,[string]$action="remove",[string]$domain="production")
+
+    $body = @{
+        objects = $objects
+    }
+
+    if ($hostname -ne $null -and $hostname -ne "") {
+        $body = @{
+            hostname = $hostname
+            objects = $objects
+        }
+    } 
+
+    Perform-AkamaiRequest "/ccu/v3/$action/$domain" "Post" 201 $body
+}
+
+$purge = Request-Purge $objects $hostname $action $domain
+
+Write-Output "Purge request created"
+Write-Output "PurgeId: $($purge.purgeId)"
+Write-Output "SupportId: $($purge.supportId)" 
\ No newline at end of file
diff --git a/src/step-templates/ssis-deploy-ispac-from-package-parameter/logo.png b/src/step-templates/ssis-deploy-ispac-from-package-parameter/logo.png
new file mode 100644
index 000000000..1c7a263c5
Binary files /dev/null and b/src/step-templates/ssis-deploy-ispac-from-package-parameter/logo.png differ
diff --git a/src/step-templates/ssis-deploy-ispac-from-package-parameter/metadata.json b/src/step-templates/ssis-deploy-ispac-from-package-parameter/metadata.json
new file mode 100644
index 000000000..fa0a46a0c
--- /dev/null
+++ b/src/step-templates/ssis-deploy-ispac-from-package-parameter/metadata.json
@@ -0,0 +1,196 @@
+{
+  "Id": "27567d46-b935-4ee6-8b2d-8c165edada4e",
+  "Name": "Deploy ispac SSIS project from a Package parameter",
+  "Description": "This step template will deploy SSIS ispac projects to SQL Server Integration Services Catalog.  The template uses a referenced package and is Worker compatible.\n\nThis template will install the Nuget package provider if it is not present on the machine it is running on.\n\nNOTE:  The SqlServer PowerShell module this template utilizes removed the assemblies necessary to interface with SSIS as of version 22.0.59.  Version 21.1.18256 has been pinned and will be used if the SqlServer PowerShell module is not installed.",
+  "ActionType": "Octopus.Script",
+  "Version": 7,
+  "Author": "twerthi",
+  "Packages": [
+    {
+      "Id": "5ce9da08-a4ed-4b69-92d1-ab88c705cf08",
+      "Name": "SSIS.Template.ssisPackageId",
+      "PackageId": null,
+      "FeedId": null,
+      "AcquisitionLocation": "Server",
+      "Properties": {
+        "Extract": "True",
+        "SelectionMode": "deferred",
+        "PackageParameterName": "SSIS.Template.ssisPackageId"
+      }
+    }
+  ],
+  "Properties": {
+    "Octopus.Action.Script.Syntax": "PowerShell",
+    "Octopus.Action.Script.ScriptBody": "__SOURCE_FILE__:scriptbody.ps1",
+    "Octopus.Action.Script.ScriptSource": "Inline"
+  },
+  "Parameters": [
+    {
+      "Id": "53aa9e3e-1292-4e75-8095-3666ebd5886b",
+      "Name": "SSIS.Template.ServerName",
+      "Label": "Database server name (\\instance)",
+      "HelpText": "Name of the SQL Server you are deploying to.",
+      "DefaultValue": "",
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      }
+    },
+    {
+      "Id": "c0605196-f184-44f6-9b3d-c043323e017c",
+      "Name": "SSIS.Template.sqlAccountUsername",
+      "Label": "SQL Authentication Username",
+      "HelpText": "(Optional) Username of the SQL Authentication account.  Use this approach when deploying to Azure Databases with SSIS configured.  If SQL Authentication Username and Password are blank, Integrated Authentication is used.",
+      "DefaultValue": "",
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      }
+    },
+    {
+      "Id": "224b913f-657c-4d1c-a3d8-0f286203c1ec",
+      "Name": "SSIS.Template.sqlAccountPassword",
+      "Label": "SQL Authentication Password",
+      "HelpText": "(Optional) Password of the SQL Authentication account.",
+      "DefaultValue": "",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Sensitive"
+      }
+    },
+    {
+      "Id": "0abbb06c-5f98-44d8-b20d-b811b6bf18da",
+      "Name": "SSIS.Template.EnableCLR",
+      "Label": "Enable SQL CLR",
+      "HelpText": "This will reconfigure SQL Server to enable the SQL CLR.  It is highly recommended that this be previously authorized by your Database Administrator.",
+      "DefaultValue": "False",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Checkbox"
+      }
+    },
+    {
+      "Id": "ebe9ab8b-3433-4aeb-bafb-642033a9b0a0",
+      "Name": "SSIS.Template.CatalogName",
+      "Label": "Catalog name",
+      "HelpText": "Name of the catalog to create in Integration Services Catalogs on SQL Server.  When using the GUI, this value gets hardcoded to SSISDB and cannot be changed.  It is recommended that you do not change the default value.",
+      "DefaultValue": "SSISDB",
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      }
+    },
+    {
+      "Id": "d111401b-504f-41f4-96de-b7667fcbf990",
+      "Name": "SSIS.Template.CatalogPwd",
+      "Label": "Catalog password",
+      "HelpText": "Password to the Integration Services Catalog.",
+      "DefaultValue": "",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Sensitive"
+      }
+    },
+    {
+      "Id": "d2fefbf6-c68f-4a66-a5d1-3beb9e51a331",
+      "Name": "SSIS.Template.FolderName",
+      "Label": "Folder name",
+      "HelpText": "Name of the folder to use within the Integration Services Catalog",
+      "DefaultValue": "",
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      }
+    },
+    {
+      "Id": "ec3589c1-360b-44fc-a19c-f2de0f57a323",
+      "Name": "SSIS.Template.UseEnvironment",
+      "Label": "Use environment",
+      "HelpText": "This will make a project reference to the defined environment.",
+      "DefaultValue": "False",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Checkbox"
+      }
+    },
+    {
+      "Id": "718f2836-1c49-4119-a294-9b5488ead33b",
+      "Name": "SSIS.Template.EnvironmentName",
+      "Label": "Environment name",
+      "HelpText": "Name of the environment to reference the project to. If the environment doesn't exist, it will create it.",
+      "DefaultValue": "",
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      }
+    },
+    {
+      "Id": "303dd486-a389-48c2-a653-fe881c3b7d9a",
+      "Name": "SSIS.Template.ReferenceProjectParametersToEnvironmentVairables",
+      "Label": "Reference project parameters to environment variables",
+      "HelpText": "Checking this box will make Project Parameters reference Environment Variables.  If the Environment Variable doesn't exist, it will create it.  This expects that an Octopus variable of the same name exists.",
+      "DefaultValue": "False",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Checkbox"
+      }
+    },
+    {
+      "Id": "06079e96-3c10-4137-9c99-83da2051f8be",
+      "Name": "SSIS.Template.ReferencePackageParametersToEnvironmentVairables",
+      "Label": "Reference package parameters to environment variables",
+      "HelpText": "Checking this box will make Package Parameters reference Environment Variables.  If the Environment Variable doesn't exist, it will create it.  This expects than an Octopus variable of the same name exists.",
+      "DefaultValue": "False",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Checkbox"
+      }
+    },
+    {
+      "Id": "8c219bf1-0715-4c21-a131-f7bfb44690cd",
+      "Name": "SSIS.Template.UseFullyQualifiedVariableNames",
+      "Label": "Use Fully Qualified Variable Names",
+      "HelpText": "When true the package variables names must be represented in `dtsx_name_without_extension.variable_name`",
+      "DefaultValue": "False",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Checkbox"
+      }
+    },
+    {
+      "Id": "6b29c969-3928-4faf-af17-0911d777d5b1",
+      "Name": "SSIS.Template.UseCustomFilter",
+      "Label": "Use Custom Filter for connection manager properties",
+      "HelpText": "Custom filter should contain the regular expression for ignoring properties when setting will occur during the auto-mapping",
+      "DefaultValue": "False",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Checkbox"
+      }
+    },
+    {
+      "Id": "b33575e2-7246-4c04-b4fa-cd58e2b5e516",
+      "Name": "SSIS.Template.CustomFilter",
+      "Label": "Custom Filter for connection manager properties",
+      "HelpText": "Regular expression for filtering out the connection manager properties during the auto-mapping process. This string is used when `UseCustomFilter` is set to true",
+      "DefaultValue": "",
+      "DisplaySettings": {
+        "Octopus.ControlType": "SingleLineText"
+      }
+    },
+    {
+      "Id": "92b546d9-abf3-45e4-a61b-0315c21455df",
+      "Name": "SSIS.Template.SyncEnvironment",
+      "Label": "Clean obsolete variables from environment",
+      "HelpText": "When `true` synchronizes the environment:\n- Removes obsolete variables\n- Removes renamed variables\n- Replaces values of valid variables (also when `false`)",
+      "DefaultValue": "False",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Checkbox"
+      }
+    },
+    {
+      "Id": "6a1fa441-9e14-4c13-b7f3-9c932d9b4e8e",
+      "Name": "SSIS.Template.ssisPackageId",
+      "Label": "Package Id",
+      "HelpText": "Id of the package to deploy, used to support deployment with Workers.",
+      "DefaultValue": "",
+      "DisplaySettings": {
+        "Octopus.ControlType": "Package"
+      }
+    }
+  ],
+  "$Meta": {
+    "ExportedAt": "2026-03-13T09:17:00.0000000",
+    "OctopusVersion": "2025.4.10250",
+    "Type": "ActionTemplate"
+  },
+  "LastModifiedBy": "bcullman",
+  "Category": "sql"
+}
diff --git a/src/step-templates/ssis-deploy-ispac-from-package-parameter/scriptbody.ps1 b/src/step-templates/ssis-deploy-ispac-from-package-parameter/scriptbody.ps1
new file mode 100644
index 000000000..dc41b6698
--- /dev/null
+++ b/src/step-templates/ssis-deploy-ispac-from-package-parameter/scriptbody.ps1
@@ -0,0 +1,707 @@
+function Add-TemporaryPinnedSqlServerModule
+{
+    # Define parameters
+    param(
+        $LocalModulesPath
+    )
+
+    $PowerShellModuleName = "SqlServer"
+    $RequiredVersion = [version]'21.1.18256'
+
+    # Check to see if the package provider has been installed
+    if ($null -eq (Get-PackageProvider -ListAvailable -Name Nuget -ErrorAction SilentlyContinue))
+    {
+        # Display that we need the nuget package provider
+        Write-Host "Nuget package provider not found, installing ..."
+
+        # Install Nuget package provider
+        Install-PackageProvider -Name Nuget -Force
+    }
+
+    # Save the module in the temporary location
+    Save-Module -Name $PowerShellModuleName -Path $LocalModulesPath -Force -RequiredVersion $RequiredVersion -Repository "PSGallery"
+
+    # Display
+    Write-Output "Saved module $PowerShellModuleName v$RequiredVersion to $LocalModulesPath"
+
+    # Import the module
+    Import-Module -Name $PowerShellModuleName
+}
+
+Function Remove-TemporaryPinnedSqlServerModule
+{
+    param(
+        [Parameter(Mandatory = $true)][string]$LocalModulesPath,
+        [Parameter(Mandatory = $true)][version]$PinnedVersion
+    )
+
+    try { Remove-Module SqlServer -Force -ErrorAction SilentlyContinue } catch {}
+
+    $moduleRoot = Join-Path $LocalModulesPath 'SqlServer'
+    $pinnedPath = Join-Path $moduleRoot $PinnedVersion.ToString()
+
+    if (Test-Path $pinnedPath)
+    {
+        Write-Host "Removing temporary pinned SqlServer module folder: $pinnedPath"
+        Remove-Item -Path $pinnedPath -Recurse -Force -ErrorAction SilentlyContinue
+    }
+
+    # Optional: remove parent if empty
+    if (Test-Path $moduleRoot)
+    {
+        $remaining = Get-ChildItem -Path $moduleRoot -Force -ErrorAction SilentlyContinue
+        if (-not $remaining)
+        {
+            Remove-Item -Path $moduleRoot -Force -ErrorAction SilentlyContinue
+        }
+    }
+}
+
+Function Test-IntegrationServicesTypeAvailable
+{
+    # True if the IntegrationServices type resolves in this PowerShell session, else false
+    $typeName = 'Microsoft.SqlServer.Management.IntegrationServices.IntegrationServices'
+    $aqn = "$typeName, Microsoft.SqlServer.Management.IntegrationServices"
+
+    try
+    {
+        if ([Type]::GetType($aqn, $false)) { return $true }
+    }
+    catch {}
+
+    # Try to load assembly (strong name), may fail on some boxes
+    try { [void][Reflection.Assembly]::Load('Microsoft.SqlServer.Management.IntegrationServices') } catch {}
+
+    try
+    {
+        if ([Type]::GetType($aqn, $false)) { return $true }
+    }
+    catch {}
+
+    # Fall back to explicit GAC path load (LoadFrom) if present
+    $gacRoot = Join-Path $env:windir 'Microsoft.NET\assembly\GAC_MSIL\Microsoft.SqlServer.Management.IntegrationServices'
+    if (Test-Path $gacRoot)
+    {
+        $gacDll = Get-ChildItem -Path $gacRoot -Recurse -Filter 'Microsoft.SqlServer.Management.IntegrationServices.dll' -File -ErrorAction SilentlyContinue |
+                  Sort-Object FullName -Descending |
+                  Select-Object -First 1
+
+        if ($null -eq $gacDll)
+        {
+            try
+            {
+                $asm = [Reflection.Assembly]::LoadFrom($gacDll.FullName)
+                if ($asm.GetType('Microsoft.SqlServer.Management.IntegrationServices.IntegrationServices', $false)) { return $true }
+            }
+            catch {}
+        }
+    }
+
+    try
+    {
+        if ([Type]::GetType($aqn, $false)) { return $true }
+    }
+    catch {}
+
+    return $false
+}
+
+Function Load-SqlServerAssemblies
+{
+    # Get the folder where the SqlServer module ended up in
+    $sqlServerModulePath = [System.IO.Path]::GetDirectoryName((Get-Module SqlServer).Path)
+
+    # Loop through the assemblies
+    foreach($assemblyFile in (Get-ChildItem -Path $sqlServerModulePath -Exclude msv*.dll | Where-Object {$_.Extension -eq ".dll"}))
+    {
+        try
+        {
+            # Only load managed .NET assemblies (native DLLs will throw)
+            [void][System.Reflection.AssemblyName]::GetAssemblyName($assemblyFile.FullName)
+
+            # Load the managed assembly
+            [Reflection.Assembly]::LoadFrom($assemblyFile.FullName) | Out-Null
+        }
+        catch [System.BadImageFormatException]
+        {
+            # Native DLL (or wrong format), skip
+        }
+    }
+}
+
+Function Initialize-SsisDeploymentRuntime
+{
+    param(
+        [Parameter(Mandatory = $true)][string]$LocalModulesPath,
+        [Parameter(Mandatory = $true)][version]$PinnedSqlServerVersion
+    )
+
+    # Define PowerShell Modules path
+    $env:PSModulePath = "$LocalModulesPath;$env:PSModulePath"
+
+    $runtime = [pscustomobject]@{
+        UsedPinnedSqlServerModule = $false
+        SsisTypeAvailable         = $false
+    }
+
+    # First preference: use SSIS assemblies already available on the machine/session
+    $runtime.SsisTypeAvailable = Test-IntegrationServicesTypeAvailable
+
+    if ($runtime.SsisTypeAvailable)
+    {
+        Write-Host "SSIS IntegrationServices type is already available."
+
+        # Only need a SqlServer module for cmdlets such as Invoke-Sqlcmd
+        if ($null -ne (Get-Module -ListAvailable -Name "SqlServer"))
+        {
+            Import-Module -Name SqlServer -ErrorAction Stop
+        }
+        else
+        {
+            Write-Output "PowerShell module SqlServer not present, downloading temporary pinned copy for cmdlets ..."
+            [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor [System.Net.SecurityProtocolType]::Tls12
+
+            Add-TemporaryPinnedSqlServerModule -LocalModulesPath $LocalModulesPath
+
+            $manifestPath = Join-Path (Join-Path (Join-Path $LocalModulesPath 'SqlServer') $PinnedSqlServerVersion.ToString()) 'SqlServer.psd1'
+            Write-Host "Importing pinned SqlServer module from: $manifestPath"
+            Import-Module -Name $manifestPath -Force -DisableNameChecking -ErrorAction Stop
+
+            $runtime.UsedPinnedSqlServerModule = $true
+        }
+
+        # SSIS type already resolved, no need to bulk-load module assemblies
+        return $runtime
+    }
+
+    # Second preference: fall back to pinned SqlServer module that still contains SSIS assemblies
+    Write-Output "SSIS IntegrationServices type not available via installed components. Downloading pinned SqlServer module $PinnedSqlServerVersion temporarily ..."
+    [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor [System.Net.SecurityProtocolType]::Tls12
+
+    $manifestPath = Join-Path (Join-Path (Join-Path $LocalModulesPath 'SqlServer') $PinnedSqlServerVersion.ToString()) 'SqlServer.psd1'
+    if (-not (Test-Path $manifestPath))
+    {
+        Add-TemporaryPinnedSqlServerModule -LocalModulesPath $LocalModulesPath
+    }
+
+    Write-Host "Importing pinned SqlServer module from: $manifestPath"
+    Import-Module -Name $manifestPath -Force -DisableNameChecking -ErrorAction Stop
+    Load-SqlServerAssemblies
+
+    $runtime.UsedPinnedSqlServerModule = $true
+    $runtime.SsisTypeAvailable = Test-IntegrationServicesTypeAvailable
+
+    return $runtime
+}
+
+Function Get-Catalog
+{
+    # define parameters
+    Param ($CatalogName)
+    # NOTE: using $integrationServices variable defined in main
+
+    # define working variables
+    $Catalog = $null
+    # check to see if there are any catalogs
+    if($integrationServices.Catalogs.Count -gt 0 -and $integrationServices.Catalogs[$CatalogName])
+    {
+        # get reference to catalog
+        $Catalog = $integrationServices.Catalogs[$CatalogName]
+    }
+    else
+    {
+        if((Get-CLREnabled) -eq 0)
+        {
+            if(-not $EnableCLR)
+            {
+                # throw error
+                throw "SQL CLR is not enabled."
+            }
+            else
+            {
+                # display sql clr isn't enabled
+                Write-Warning "SQL CLR is not enabled on $($sqlConnection.DataSource).  This feature must be enabled for SSIS catalogs."
+
+                # enabling SQLCLR
+                Write-Host "Enabling SQL CLR ..."
+                Enable-SQLCLR
+                Write-Host "SQL CLR enabled"
+            }
+        }
+
+        # Provision a new SSIS Catalog
+        Write-Host "Creating SSIS Catalog ..."
+
+        $Catalog = New-Object "$ISNamespace.Catalog" ($integrationServices, $CatalogName, $OctopusParameters['SSIS.Template.CatalogPwd'])
+        $Catalog.Create()
+    }
+
+    # return the catalog
+    return $Catalog
+}
+
+Function Get-CLREnabled
+{
+    # define parameters
+    # Not using any parameters, but am using $sqlConnection defined in main
+
+    # define working variables
+    $Query = "SELECT * FROM sys.configurations WHERE name = 'clr enabled'"
+
+    # execute script
+    $CLREnabled = Invoke-Sqlcmd -ServerInstance $sqlConnection.DataSource -Database "master" -Query $Query | Select value
+
+    # return value
+    return $CLREnabled.Value
+}
+
+Function Enable-SQLCLR
+{
+    $QueryArray = "sp_configure 'show advanced options', 1", "RECONFIGURE", "sp_configure 'clr enabled', 1", "RECONFIGURE "
+    # execute script
+
+    foreach($Query in $QueryArray)
+    {
+        Invoke-Sqlcmd -ServerInstance $sqlConnection.DataSource -Database "master" -Query $Query
+    }
+
+    # check that it's enabled
+    if((Get-CLREnabled) -ne 1)
+    {
+        # throw error
+        throw "Failed to enable SQL CLR"
+    }
+}
+
+Function Get-Folder
+{
+    # parameters
+    Param($FolderName, $Catalog)
+
+    $Folder = $null
+    # try to get reference to folder
+
+    if(!($Catalog.Folders -eq $null))
+    {
+        $Folder = $Catalog.Folders[$FolderName]
+    }
+
+    # check to see if $Folder has a value
+    if($Folder -eq $null)
+    {
+        # display
+        Write-Host "Folder $FolderName doesn't exist, creating folder..."
+
+        # create the folder
+        $Folder = New-Object "$ISNamespace.CatalogFolder" ($Catalog, $FolderName, $FolderName)
+        $Folder.Create()
+    }
+
+    # return the folder reference
+    return $Folder
+}
+
+Function Get-Environment
+{
+    # define parameters
+    Param($Folder, $EnvironmentName)
+
+    $Environment = $null
+    # get reference to Environment
+    if(!($Folder.Environments -eq $null) -and $Folder.Environments.Count -gt 0)
+    {
+        $Environment = $Folder.Environments[$EnvironmentName]
+    }
+
+    # check to see if it's a null reference
+    if($Environment -eq $null)
+    {
+        # display
+        Write-Host "Environment $EnvironmentName doesn't exist, creating environment..."
+
+        # create environment
+        $Environment = New-Object "$ISNamespace.EnvironmentInfo" ($Folder, $EnvironmentName, $EnvironmentName)
+        $Environment.Create()
+    }
+
+    # return the environment
+    return $Environment
+}
+
+Function Set-EnvironmentReference
+{
+    # define parameters
+    Param($Project, $Environment, $Folder)
+
+    # get reference
+    $Reference = $null
+
+    if(!($Project.References -eq $null))
+    {
+        $Reference = $Project.References[$Environment.Name, $Folder.Name]
+    }
+
+    # check to see if it's a null reference
+    if($Reference -eq $null)
+    {
+        # display
+        Write-Host "Project does not reference environment $($Environment.Name), creating reference..."
+
+        # create reference
+        $Project.References.Add($Environment.Name, $Folder.Name)
+        $Project.Alter()
+    }
+}
+
+Function Set-ProjectParametersToEnvironmentVariablesReference
+{
+    # define parameters
+    Param($Project, $Environment)
+
+    $UpsertedVariables = @()
+
+    if($Project.Parameters -eq $null)
+    {
+        Write-Host "No project parameters exist"
+        return
+    }
+
+    # loop through project parameters
+    foreach($Parameter in $Project.Parameters)
+    {
+        # skip if the parameter is included in custom filters
+        if ($UseCustomFilter)
+        {
+            if ($Parameter.Name -match $CustomFilter)
+            {
+                Write-Host "- $($Parameter.Name) skipped due to CustomFilters."
+                continue
+            }
+        }
+
+        # Add variable to list of variable
+        $UpsertedVariables += $Parameter.Name
+
+        $Variable = $null
+        if(!($Environment.Variables -eq $null))
+        {
+            # get reference to variable
+            $Variable = $Environment.Variables[$Parameter.Name]
+        }
+
+        # check to see if variable exists
+        if($Variable -eq $null)
+        {
+            # add the environment variable
+            Add-EnvironmentVariable -Environment $Environment -Parameter $Parameter -ParameterName $Parameter.Name
+
+            # get reference to the newly created variable
+            $Variable = $Environment.Variables[$Parameter.Name]
+        }
+
+        # set the environment variable value
+        Set-EnvironmentVariableValue -Variable $Variable -Parameter $Parameter -ParameterName $Parameter.Name
+    }
+
+    # alter the environment
+    $Environment.Alter()
+    $Project.Alter()
+
+    return $UpsertedVariables
+}
+
+Function Set-PackageVariablesToEnvironmentVariablesReference
+{
+    # define parameters
+    Param($Project, $Environment)
+
+    $Variables = @()
+    $UpsertedVariables = @()
+
+    # loop through packages in project in order to store a temp collection of variables
+    foreach($Package in $Project.Packages)
+    {
+        # loop through parameters of package
+        foreach($Parameter in $Package.Parameters)
+        {
+            # add to the temporary variable collection
+            $Variables += $Parameter.Name
+        }
+    }
+
+    # loop through packages in project
+    foreach($Package in $Project.Packages)
+    {
+        # loop through parameters of package
+        foreach($Parameter in $Package.Parameters)
+        {
+            if ($UseFullyQualifiedVariableNames)
+            {
+                # Set fully qualified variable name
+                $ParameterName = $Parameter.ObjectName.Replace(".dtsx", "")+"."+$Parameter.Name
+            }
+            else
+            {
+                # check if exists a variable with the same name
+                $VariableNameOccurrences = $($Variables | Where-Object { $_ -eq $Parameter.Name }).count
+                $ParameterName = $Parameter.Name
+
+                if ($VariableNameOccurrences -gt 1)
+                {
+                    $ParameterName = $Parameter.ObjectName.Replace(".dtsx", "")+"."+$Parameter.Name
+                }
+            }
+
+            if ($UseCustomFilter)
+            {
+                if ($ParameterName -match $CustomFilter)
+                {
+                    Write-Host "- $($Parameter.Name) skipped due to CustomFilters."
+                    continue
+                }
+            }
+
+            # get reference to variable
+            $Variable = $Environment.Variables[$ParameterName]
+
+            # Add variable to list of variable
+            $UpsertedVariables += $ParameterName
+
+            # check to see if the parameter exists
+            if(!$Variable)
+            {
+                # add the environment variable
+                Add-EnvironmentVariable -Environment $Environment -Parameter $Parameter -ParameterName $ParameterName
+
+                # get reference to the newly created variable
+                $Variable = $Environment.Variables[$ParameterName]
+            }
+
+            # set the environment variable value
+            Set-EnvironmentVariableValue -Variable $Variable -Parameter $Parameter -ParameterName $ParameterName
+        }
+
+        # alter the package
+        $Package.Alter()
+    }
+
+    # alter the environment
+    $Environment.Alter()
+
+    return $UpsertedVariables
+}
+
+Function Sync-EnvironmentVariables
+{
+    # define parameters
+    Param($Environment, $VariablesToPreserveInEnvironment)
+
+    foreach($VariableToEvaluate in $Environment.Variables)
+    {
+        if ($VariablesToPreserveInEnvironment -notcontains $VariableToEvaluate.Name)
+        {
+            Write-Host "- Removing environment variable: $($VariableToEvaluate.Name)"
+            $VariableToRemove = $Environment.Variables[$VariableToEvaluate.Name]
+            $Environment.Variables.Remove($VariableToRemove) | Out-Null
+        }
+    }
+
+    # alter the environment
+    $Environment.Alter()
+}
+
+Function Add-EnvironmentVariable
+{
+    # define parameters
+    Param($Environment, $Parameter, $ParameterName)
+
+    # display
+    Write-Host "- Adding environment variable $($ParameterName)"
+
+    # check to see if design default value is empty or null
+    if([string]::IsNullOrEmpty($Parameter.DesignDefaultValue))
+    {
+        # give it something
+        $DefaultValue = "" # sensitive variables will not return anything so when trying to use the property of $Parameter.DesignDefaultValue, the Alter method will fail.
+    }
+    else
+    {
+        # take the design
+        $DefaultValue = $Parameter.DesignDefaultValue
+    }
+
+    # add variable with an initial value
+    $Environment.Variables.Add($ParameterName, $Parameter.DataType, $DefaultValue, $Parameter.Sensitive, $Parameter.Description)
+}
+
+Function Set-EnvironmentVariableValue
+{
+     # define parameters
+    Param($Variable, $Parameter, $ParameterName)
+
+    # check to make sure variable value is available
+    if (-not $OctopusParameters){
+        Write-Host "[WARN] - OctopusParameters collection is empty"
+    }
+    else
+    {
+        if($OctopusParameters.ContainsKey($ParameterName))
+        {
+            # display
+            Write-Host "[ OK ] - $($ParameterName) updated."
+
+            # set the variable value
+            $Variable.Value = $OctopusParameters["$($ParameterName)"]
+        }
+        else
+        {
+            # warning
+            Write-Host "[WARN] - $($ParameterName) not in OctopusParameters collection."
+        }
+    }
+
+    # Set reference
+    $Parameter.Set([Microsoft.SqlServer.Management.IntegrationServices.ParameterInfo+ParameterValueType]::Referenced, "$($ParameterName)")
+}
+
+Function Invoke-SsisProjectDeployment
+{
+    $LocalModules = (New-Item "$PSScriptRoot\Modules" -ItemType Directory -Force).FullName
+    $pinnedSqlServerVersion = [version]'21.1.18256'
+    $sqlConnection = $null
+    $runtime = $null
+
+    try
+    {
+        $runtime = Initialize-SsisDeploymentRuntime -LocalModulesPath $LocalModules -PinnedSqlServerVersion $pinnedSqlServerVersion
+
+        # Store the IntegrationServices Assembly namespace to avoid typing it every time
+        $ISNamespace = "Microsoft.SqlServer.Management.IntegrationServices"
+
+        # ensure all boolean variables are true booleans
+        $EnableCLR = [System.Convert]::ToBoolean("$($OctopusParameters['SSIS.Template.EnableCLR'])")
+        $UseEnvironment = [System.Convert]::ToBoolean("$($OctopusParameters['SSIS.Template.UseEnvironment'])")
+        $ReferenceProjectParametersToEnvironmentVairables = [System.Convert]::ToBoolean("$($OctopusParameters['SSIS.Template.ReferenceProjectParametersToEnvironmentVairables'])")
+
+        $ReferencePackageParametersToEnvironmentVairables = [System.Convert]::ToBoolean("$($OctopusParameters['SSIS.Template.ReferencePackageParametersToEnvironmentVairables'])")
+        $UseFullyQualifiedVariableNames = [System.Convert]::ToBoolean("$($OctopusParameters['SSIS.Template.UseFullyQualifiedVariableNames'])")
+        $SyncEnvironment = [System.Convert]::ToBoolean("$($OctopusParameters['SSIS.Template.SyncEnvironment'])")
+        # custom names for filtering out the excluded variables by design
+        $UseCustomFilter = [System.Convert]::ToBoolean("$($OctopusParameters['SSIS.Template.UseCustomFilter'])")
+        $CustomFilter = [System.Convert]::ToString("$($OctopusParameters['SSIS.Template.CustomFilter'])")
+        # list of variables names to keep in target environment
+        $VariablesToPreserveInEnvironment = @()
+        $ssisPackageId = $OctopusParameters['SSIS.Template.ssisPackageId']
+
+        # Get the extracted path
+        $DeployedPath = $OctopusParameters["Octopus.Action.Package[$ssisPackageId].ExtractedPath"]
+
+        # Get all .ispac files from the deployed path
+        $IsPacFiles = Get-ChildItem -Recurse -Path $DeployedPath | Where {$_.Extension.ToLower() -eq ".ispac"}
+
+        # display number of files
+        Write-Host "$($IsPacFiles.Count) .ispac file(s) found."
+
+        Write-Host "Connecting to server ..."
+
+        # Create a connection to the server
+        $sqlConnectionString = "Data Source=$($OctopusParameters['SSIS.Template.ServerName']);Initial Catalog=SSISDB;"
+
+        if (![string]::IsNullOrEmpty($OctopusParameters['SSIS.Template.sqlAccountUsername']) -and ![string]::IsNullOrEmpty($OctopusParameters['SSIS.Template.sqlAccountPassword']))
+        {
+            # Add username and password to connection string
+            $sqlConnectionString += "User ID=$($OctopusParameters['SSIS.Template.sqlAccountUsername']); Password=$($OctopusParameters['SSIS.Template.sqlAccountPassword']);"
+        }
+        else
+        {
+            # Use integrated
+            $sqlConnectionString += "Integrated Security=SSPI;"
+        }
+
+        # Create new connection object with connection string
+        $sqlConnection = New-Object System.Data.SqlClient.SqlConnection $sqlConnectionString
+
+        # create integration services object
+        $integrationServices = New-Object "$ISNamespace.IntegrationServices" $sqlConnection
+
+        # get reference to the catalog
+        Write-Host "Getting reference to catalog $($OctopusParameters['SSIS.Template.CataLogName'])"
+        $Catalog = Get-Catalog -CatalogName $OctopusParameters['SSIS.Template.CataLogName']
+
+        # get folder reference
+        $Folder = Get-Folder -FolderName $OctopusParameters['SSIS.Template.FolderName'] -Catalog $Catalog
+
+        # loop through ispac files
+        foreach($IsPacFile in $IsPacFiles)
+        {
+            # read project file
+            $ProjectFile = [System.IO.File]::ReadAllBytes($IsPacFile.FullName)
+            $ProjectName = $IsPacFile.Name.SubString(0, $IsPacFile.Name.LastIndexOf("."))
+
+            # deploy project
+            Write-Host "Deploying project $($IsPacFile.Name)..."
+            $Folder.DeployProject($ProjectName, $ProjectFile) | Out-Null
+
+            # get reference to deployed project
+            $Project = $Folder.Projects[$ProjectName]
+
+            # check to see if they want to use environments
+            if($UseEnvironment)
+            {
+                # get environment reference
+                $Environment = Get-Environment -Folder $Folder -EnvironmentName $OctopusParameters['SSIS.Template.EnvironmentName']
+
+                # set environment reference
+                Set-EnvironmentReference -Project $Project -Environment $Environment -Folder $Folder
+
+                # check to see if the user wants to convert project parameters to environment variables
+                if($ReferenceProjectParametersToEnvironmentVairables)
+                {
+                    # set environment variables
+                    Write-Host "Referencing Project Parameters to Environment Variables..."
+                    $VariablesToPreserveInEnvironment += Set-ProjectParametersToEnvironmentVariablesReference -Project $Project -Environment $Environment
+                }
+
+                # check to see if the user wants to convert the package parameters to environment variables
+                if($ReferencePackageParametersToEnvironmentVairables)
+                {
+                    # set package variables
+                    Write-Host "Referencing Package Parameters to Environment Variables..."
+                    $VariablesToPreserveInEnvironment += Set-PackageVariablesToEnvironmentVariablesReference -Project $Project -Environment $Environment
+                }
+
+                # Removes all unused variables from the environment
+                if ($SyncEnvironment)
+                {
+                    Write-Host "Sync package environment variables..."
+                    Sync-EnvironmentVariables -Environment $Environment -VariablesToPreserveInEnvironment $VariablesToPreserveInEnvironment
+                }
+            }
+        }
+    }
+
+    finally
+    {
+        # check to make sure sqlconnection isn't null
+        if($sqlConnection)
+        {
+            # check state of sqlconnection
+            if($sqlConnection.State -eq [System.Data.ConnectionState]::Open)
+            {
+                # close the connection
+                $sqlConnection.Close()
+            }
+
+            # cleanup
+            $sqlConnection.Dispose()
+        }
+
+        # cleanup temporary pinned SqlServer module only when it was actually used
+        if ($runtime -and $runtime.UsedPinnedSqlServerModule)
+        {
+            Remove-TemporaryPinnedSqlServerModule -LocalModulesPath $LocalModules -PinnedVersion $pinnedSqlServerVersion
+        }
+    }
+}
+
+Invoke-SsisProjectDeployment
\ No newline at end of file
diff --git a/step-templates/akamai-content-purge.json b/step-templates/akamai-content-purge.json
deleted file mode 100644
index 8b9e645d9..000000000
--- a/step-templates/akamai-content-purge.json
+++ /dev/null
@@ -1,139 +0,0 @@
-{
-  "Id": "0bfe41dc-50b0-44a7-abe3-e6ba2a6d317a",
-  "Name": "Akamai - Content Purge",
-  "Description": "Allows to purge content using the Content Control Utility (CCU) v2 REST API.",
-  "ActionType": "Octopus.Script",
-  "Version": 1,
-  "Properties": {
-    "Octopus.Action.Script.Syntax": "PowerShell",
-    "Octopus.Action.Script.ScriptSource": "Inline",
-    "Octopus.Action.Script.ScriptBody": "$clientToken = $OctopusParameters['AkamaiClientToken']\r\n$clientAccessToken = $OctopusParameters['AkamaiClientAccessToken']\r\n$clientSecret = $OctopusParameters['AkamaiSecret']\r\n$queueName = $OctopusParameters['AkamaiQueue']\r\n$objects = $OctopusParameters['AkamaiObjects'] -split \",\"\r\n$type = $OctopusParameters['AkamaiType']\r\n$action = $OctopusParameters['AkamaiAction']\r\n$domain = $OctopusParameters['AkamaiDomain']\r\n$proxyUser = $OctopusParameters['ProxyUser']\r\n$proxyPassword = $OctopusParameters['ProxyPassword']\r\n\r\n$wait = [bool]::Parse($OctopusParameters['WaitForPurgeToComplete'])\r\n$maxChecks = [int]::Parse($OctopusParameters['CheckLimit'])\r\n\r\nif ($proxyUser) {\r\n    $securePassword = ConvertTo-SecureString $proxyPassword -AsPlainText -Force\r\n    $proxyCredential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $proxyUser,$securePassword\r\n\r\n    (New-Object System.Net.WebClient).Proxy.Credentials=$proxyCredential\r\n}\r\n\r\n# Copied from https://github.com/akamai-open/AkamaiOPEN-powershell/blob/master/Invoke-AkamaiOPEN.ps1\r\nfunction Invoke-AkamaiOpenRequest {\r\n    param(\r\n        [Parameter(Mandatory=$true)][string]$Method, \r\n        [Parameter(Mandatory=$true)][string]$ClientToken, \r\n        [Parameter(Mandatory=$true)][string]$ClientAccessToken, \r\n        [Parameter(Mandatory=$true)][string]$ClientSecret, \r\n        [Parameter(Mandatory=$true)][string]$ReqURL, \r\n        [Parameter(Mandatory=$false)][string]$Body)\r\n\r\n    #Function to generate HMAC SHA256 Base64\r\n    Function Crypto ($secret, $message)\r\n    {\r\n\t    [byte[]] $keyByte = [System.Text.Encoding]::ASCII.GetBytes($secret)\r\n\t    [byte[]] $messageBytes = [System.Text.Encoding]::ASCII.GetBytes($message)\r\n\t    $hmac = new-object System.Security.Cryptography.HMACSHA256((,$keyByte))\r\n\t    [byte[]] $hashmessage = $hmac.ComputeHash($messageBytes)\r\n\t    $Crypt = [System.Convert]::ToBase64String($hashmessage)\r\n\r\n\t    return $Crypt\r\n    }\r\n\r\n    #ReqURL Verification\r\n    If (($ReqURL -as [System.URI]).AbsoluteURI -eq $null -or $ReqURL -notmatch \"akamai.com\")\r\n    {\r\n\t    throw \"Error: Ivalid Request URI\"\r\n    }\r\n\r\n    #Sanitize Method param\r\n    $Method = $Method.ToUpper()\r\n\r\n    #Split $ReqURL for inclusion in SignatureData\r\n    $ReqArray = $ReqURL -split \"(.*\\/{2})(.*?)(\\/)(.*)\"\r\n\r\n    #Timestamp for request signing\r\n    $TimeStamp = [DateTime]::UtcNow.ToString(\"yyyyMMddTHH:mm:sszz00\")\r\n\r\n    #GUID for request signing\r\n    $Nonce = [GUID]::NewGuid()\r\n\r\n    #Build data string for signature generation\r\n    $SignatureData = $Method + \"`thttps`t\"\r\n    $SignatureData += $ReqArray[2] + \"`t\" + $ReqArray[3] + $ReqArray[4]\r\n\r\n    if (($Body -ne $null) -and ($Method -ceq \"POST\"))\r\n    {\r\n\t    $Body_SHA256 = [System.Security.Cryptography.SHA256]::Create()\r\n\t    $Post_Hash = [System.Convert]::ToBase64String($Body_SHA256.ComputeHash([System.Text.Encoding]::ASCII.GetBytes($Body.ToString())))\r\n\r\n\t    $SignatureData += \"`t`t\" + $Post_Hash + \"`t\"\r\n    }\r\n    else\r\n    {\r\n\t    $SignatureData += \"`t`t`t\"\r\n    }\r\n\r\n    $SignatureData += \"EG1-HMAC-SHA256 \"\r\n    $SignatureData += \"client_token=\" + $ClientToken + \";\"\r\n    $SignatureData += \"access_token=\" + $ClientAccessToken + \";\"\r\n    $SignatureData += \"timestamp=\" + $TimeStamp  + \";\"\r\n    $SignatureData += \"nonce=\" + $Nonce + \";\"\r\n\r\n    #Generate SigningKey\r\n    $SigningKey = Crypto -secret $ClientSecret -message $TimeStamp\r\n\r\n    #Generate Auth Signature\r\n    $Signature = Crypto -secret $SigningKey -message $SignatureData\r\n\r\n    #Create AuthHeader\r\n    $AuthorizationHeader = \"EG1-HMAC-SHA256 \"\r\n    $AuthorizationHeader += \"client_token=\" + $ClientToken + \";\"\r\n    $AuthorizationHeader += \"access_token=\" + $ClientAccessToken + \";\"\r\n    $AuthorizationHeader += \"timestamp=\" + $TimeStamp + \";\"\r\n    $AuthorizationHeader += \"nonce=\" + $Nonce + \";\"\r\n    $AuthorizationHeader += \"signature=\" + $Signature\r\n\r\n    #Create IDictionary to hold request headers\r\n    $Headers = @{}\r\n\r\n    #Add Auth header\r\n    $Headers.Add('Authorization',$AuthorizationHeader)\r\n\r\n    #Add additional headers if POSTing or PUTing\r\n    If (($Method -ceq \"POST\") -or ($Method -ceq \"PUT\"))\r\n    {\r\n\t    $Body_Size = [System.Text.Encoding]::UTF8.GetByteCount($Body)\r\n\t    $Headers.Add('max-body',$Body_Size.ToString())\r\n\r\n        # turn off the \"Expect: 100 Continue\" header\r\n        # as it's not supported on the Akamai side.\r\n        [System.Net.ServicePointManager]::Expect100Continue = $false\r\n    }\r\n\r\n    #Check for valid Methods and required switches\r\n    If (($Method -ceq \"POST\") -and ($Body -ne $null))\r\n    {\r\n        Invoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers -Body $Body -ContentType 'application/json'\r\n    }\r\n    elseif  (($Method -ceq \"PUT\") -and ($Body -ne $null))\r\n    {\r\n\t    #Invoke API call with PUT and return\r\n\t    Invoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers -Body $Body -ContentType 'application/json'\r\n    }\r\n    elseif (($Method -ceq \"GET\") -or ($Method -ceq \"DELETE\"))\r\n    {\r\n\t    #Invoke API call with GET or DELETE and return\r\n\t    Invoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers\r\n    }\r\n    else\r\n    {\r\n\t    throw \"Error: Invalid -Method specified or missing required parameter\"\r\n    }\r\n}\r\n\r\nfunction Perform-AkamaiRequest {\r\n    param (\r\n        [string]$request, \r\n        [string]$method=\"Get\", \r\n        [int]$expectedStatusCode=200, \r\n        $body)\r\n\r\n    $baseUrl = \"http://private-anon-3934daf8d-akamaiopen2purgeccuv2production.apiary-mock.com\"\r\n    # $baseUrl = \"https://api.ccu.akamai.com\"\r\n    $uri = \"{0}{1}\" -f $baseUrl,$request\r\n\r\n    if ($uri -match \"mock\"){\r\n        $requestHeaders = @{'Cache-Control'='no-cache,proxy-revalidate'}\r\n        $response = Invoke-RestMethod -Uri $uri -Method $method -DisableKeepAlive -Headers $requestHeaders -Body $body\r\n    } else {\r\n        $json = ConvertTo-Json $body -Compress\r\n        $response = Invoke-AkamaiOpenRequest -Method $method -ClientToken $clientToken -ClientAccessToken $clientAccessToken -ClientSecret $clientSecret -ReqURL $uri -Body $json\r\n    }\r\n\r\n    if ($response.httpStatus -ne $expectedStatusCode){\r\n        Write-Error \"Request not processed correctly: $($response.detail)\"\r\n    } elseif ($response.detail) {\r\n        Write-Verbose $response.detail\r\n    }\r\n\r\n    Write-Verbose $response\r\n\r\n    $response\r\n}\r\n\r\nfunction Get-QueueSize {\r\n    param ([string]$queueName)\r\n\r\n    $queueSize = Perform-AkamaiRequest \"/ccu/v2/queues/$queueName\"\r\n\r\n    $queueSize \r\n}\r\n\r\nfunction Request-Purge {\r\n    param ($objects,[string]$type=\"arl\",[string]$action=\"remove\",[string]$domain=\"production\")\r\n\r\n    $body = @{\r\n        objects = $objects\r\n        action = $action\r\n        type = $type\r\n        domain = $domain\r\n    }\r\n\r\n    Perform-AkamaiRequest \"/ccu/v2/queues/$queueName\" \"Post\" 201 $body\r\n}\r\n\r\nfunction Get-PurgeStatus {\r\n    param ([string]$purgeId)\r\n\r\n    $status = Perform-AkamaiRequest \"/ccu/v2/purges/$purgeId\"\r\n\r\n    Write-Host \"Purge status: $($status.purgeStatus)\"\r\n\r\n    $status\r\n}\r\n\r\n$queueSize = Get-QueueSize $queueName\r\nWrite-Output \"$($queueName) queue size is $($queueSize.queueLength)\"\r\n\r\n$purge = Request-Purge $objects $type $action $domain\r\n\r\nWrite-Output \"Purge request created\"\r\nWrite-Output \"PurgeId: $($purge.purgeId)\"\r\nWrite-Output \"SupportId: $($purge.supportId)\" \r\n\r\nif ($wait) {\r\n    $check = 1\r\n    $purgeStatus = \"Unknown\"\r\n\r\n    do {\r\n        if ($check -gt 1) {\r\n            Write-Output \"Waiting $($purge.pingAfterSeconds) seconds before checking purge status again\"\r\n            Start-Sleep -Seconds $purge.pingAfterSeconds\r\n        }\r\n        $status = Get-PurgeStatus $purge.purgeId \r\n        $purgeStatus = $status.purgeStatus\r\n        $check = $check + 1\r\n        if ($check -gt $maxChecks) { \r\n            Write-Output \"Maximum number of checks reached\"\r\n        }\r\n    } while ($status.purgeStatus -ne \"Done\" -and $check -le $maxChecks)\r\n\r\n    if ($status.purgeStatus -ne \"Done\") {\r\n        Write-Error \"Purge status is not Done\"\r\n    }\r\n}",
-    "Octopus.Action.Script.ScriptFileName": null,
-    "Octopus.Action.Package.NuGetFeedId": null,
-    "Octopus.Action.Package.NuGetPackageId": null
-  },
-  "Parameters": [
-    {
-      "Name": "AkamaiClientToken",
-      "Label": "Client Token",
-      "HelpText": "Authentication token used in client authentication. Available in Luna Portal.",
-      "DefaultValue": null,
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      }
-    },
-    {
-      "Name": "AkamaiClientAccessToken",
-      "Label": "Client Access Token",
-      "HelpText": "Authentication token used in client authentication. Available in Luna Portal.",
-      "DefaultValue": null,
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      }
-    },
-    {
-      "Name": "AkamaiSecret",
-      "Label": "Secret",
-      "HelpText": "Authentication password used in client authentication. Available in Luna Portal.",
-      "DefaultValue": null,
-      "DisplaySettings": {
-        "Octopus.ControlType": "Sensitive"
-      }
-    },
-    {
-      "Name": "AkamaiQueue",
-      "Label": "Queue",
-      "HelpText": "Purge requests queue",
-      "DefaultValue": "default",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Select",
-        "Octopus.SelectOptions": "default\nemergency"
-      }
-    },
-    {
-      "Name": "AkamaiObjects",
-      "Label": "Objects",
-      "HelpText": "A comma separated list of objects to purge, either URLs or CPCODEs",
-      "DefaultValue": null,
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      }
-    },
-    {
-      "Name": "AkamaiType",
-      "Label": "Type",
-      "HelpText": "The type associated with the items in the Objects parameter",
-      "DefaultValue": "arl",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Select",
-        "Octopus.SelectOptions": "arl\ncpcode"
-      }
-    },
-    {
-      "Name": "AkamaiAction",
-      "Label": "Action",
-      "HelpText": "The action to execute on the purge operation",
-      "DefaultValue": "invalidate",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Select",
-        "Octopus.SelectOptions": "invalidate\nremove"
-      }
-    },
-    {
-      "Name": "AkamaiDomain",
-      "Label": "Domain",
-      "HelpText": "The Akamai domain to perform the purge operation on",
-      "DefaultValue": "production",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Select",
-        "Octopus.SelectOptions": "production\nstaging"
-      }
-    },
-    {
-      "Name": "ProxyUser",
-      "Label": "Proxy User",
-      "HelpText": "Optional, a user name for the proxy if required in the network",
-      "DefaultValue": null,
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      }
-    },
-    {
-      "Name": "ProxyPassword",
-      "Label": "Proxy Password",
-      "HelpText": "Optional, the password for the account to use if a Proxy User was specified",
-      "DefaultValue": null,
-      "DisplaySettings": {
-        "Octopus.ControlType": "Sensitive"
-      }
-    },
-    {
-      "Name": "WaitForPurgeToComplete",
-      "Label": "Wait",
-      "HelpText": "Indicates if the step should wait for the purge operation to complete",
-      "DefaultValue": "false",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Select",
-        "Octopus.SelectOptions": "false|No\ntrue|Yes"
-      }
-    },
-    {
-      "Name": "CheckLimit",
-      "Label": "Check Limit",
-      "HelpText": "Maximum number of times to check for the purge operation to complete if set to **Wait**",
-      "DefaultValue": "2",
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText",
-        "Octopus.SelectOptions": "0\n5\n10"
-      }
-    }
-  ],
-  "LastModifiedOn": "2016-07-11T14:00:00.000+00:00",
-  "LastModifiedBy": "roberto-mardeni",
-  "$Meta": {
-    "ExportedAt": "2016-07-11T14:27:34.748+00:00",
-    "OctopusVersion": "3.3.12",
-    "Type": "ActionTemplate"
-  },
-  "Category": "akamai"
-}
\ No newline at end of file
diff --git a/step-templates/akamai-cpcode-fastpurge.json b/step-templates/akamai-cpcode-fastpurge.json
deleted file mode 100644
index 0e5fe2b2e..000000000
--- a/step-templates/akamai-cpcode-fastpurge.json
+++ /dev/null
@@ -1,106 +0,0 @@
-{
-  "Id": "ee4a6957-7d98-4dcf-8f94-78f19ab1c6e0",
-  "Name": "Akamai - CPCode Fast Purge",
-  "Description": "Allows to purge CP codes using the Content Control Utility (CCU) v3 REST API.",
-  "ActionType": "Octopus.Script",
-  "Version": 2,
-  "CommunityActionTemplateId": null,
-  "Properties": {
-    "Octopus.Action.Script.Syntax": "PowerShell",
-    "Octopus.Action.Script.ScriptSource": "Inline",
-    "Octopus.Action.Script.ScriptBody": "$clientToken = $OctopusParameters['AkamaiClientToken']\n$clientAccessToken = $OctopusParameters['AkamaiClientAccessToken']\n$clientSecret = $OctopusParameters['AkamaiSecret']\n$cpcode = $OctopusParameters['AkamaiCPCode']\n$akhost = $OctopusParameters['AkamaiHost']\n$action = $OctopusParameters['AkamaiAction']\n$domain = $OctopusParameters['AkamaiDomain']\n\n# NOTICE : PowerShell EdgeGrid Client has been deprecated and will reach End of Life soon. For more information, please see https://developer.akamai.com/blog/2018/11/13/akamai-powershell-edgegrid-client-end-life-notice\n# Copied from https://github.com/akamai-open/AkamaiOPEN-powershell/blob/master/Invoke-AkamaiOPEN.ps1\nfunction Invoke-AkamaiOpenRequest {\n\tparam(\n\t\t[Parameter(Mandatory=$true)]\n\t\t[ValidateSet(\"GET\", \"PUT\", \"POST\", \"DELETE\")]\n\t\t[string]$Method,\n\t\t[Parameter(Mandatory=$true)][string]$ClientToken,\n\t\t[Parameter(Mandatory=$true)][string]$ClientAccessToken,\n\t\t[Parameter(Mandatory=$true)][string]$ClientSecret,\n\t\t[Parameter(Mandatory=$true)][string]$ReqURL,\n\t\t[Parameter(Mandatory=$false)][string]$Body,\n\t\t[Parameter(Mandatory=$false)][string]$MaxBody = 131072\n\t\t)\n\n\t#Function to generate HMAC SHA256 Base64\n\tFunction Crypto ($secret, $message)\n\t{\n\t\t[byte[]] $keyByte = [System.Text.Encoding]::ASCII.GetBytes($secret)\n\t\t[byte[]] $messageBytes = [System.Text.Encoding]::ASCII.GetBytes($message)\n\t\t$hmac = new-object System.Security.Cryptography.HMACSHA256((,$keyByte))\n\t\t[byte[]] $hashmessage = $hmac.ComputeHash($messageBytes)\n\t\t$Crypt = [System.Convert]::ToBase64String($hashmessage)\n\n\t\treturn $Crypt\n\t}\n\n\t#ReqURL Verification\n\tIf (($ReqURL -as [System.URI]).AbsoluteURI -eq $null -or $ReqURL -notmatch \"akamaiapis.net\")\n\t{\n\t\tthrow \"Error: Ivalid Request URI\"\n\t}\n\n\t#Sanitize Method param\n\t$Method = $Method.ToUpper()\n\n\t#Split $ReqURL for inclusion in SignatureData\n\t$ReqArray = $ReqURL -split \"(.*\\/{2})(.*?)(\\/)(.*)\"\n\n\t#Timestamp for request signing\n\t$TimeStamp = [DateTime]::UtcNow.ToString(\"yyyyMMddTHH:mm:sszz00\")\n\n\t#GUID for request signing\n\t$Nonce = [GUID]::NewGuid()\n\n\t#Build data string for signature generation\n\t$SignatureData = $Method + \"`thttps`t\"\n\t$SignatureData += $ReqArray[2] + \"`t\" + $ReqArray[3] + $ReqArray[4]\n\n\t#Add body to signature. Truncate if body is greater than max-body (Akamai default is 131072). PUT Medthod does not require adding to signature.\n\t\n\tif ($Body -and $Method -eq \"POST\")\n\t{\n\t  $Body_SHA256 = [System.Security.Cryptography.SHA256]::Create()\n\t  if($Body.Length -gt $MaxBody){\n\t\t$Post_Hash = [System.Convert]::ToBase64String($Body_SHA256.ComputeHash([System.Text.Encoding]::ASCII.GetBytes($Body.Substring(0,$MaxBody))))\n\t  }\n\t  else{\n\t\t$Post_Hash = [System.Convert]::ToBase64String($Body_SHA256.ComputeHash([System.Text.Encoding]::ASCII.GetBytes($Body)))\n\t  }\n\n\t  $SignatureData += \"`t`t\" + $Post_Hash + \"`t\"\n\t}\n\telse\n\t{\n\t  $SignatureData += \"`t`t`t\"\n\t}\n\n\t$SignatureData += \"EG1-HMAC-SHA256 \"\n\t$SignatureData += \"client_token=\" + $ClientToken + \";\"\n\t$SignatureData += \"access_token=\" + $ClientAccessToken + \";\"\n\t$SignatureData += \"timestamp=\" + $TimeStamp  + \";\"\n\t$SignatureData += \"nonce=\" + $Nonce + \";\"\n\n\t#Generate SigningKey\n\t$SigningKey = Crypto -secret $ClientSecret -message $TimeStamp\n\n\t#Generate Auth Signature\n\t$Signature = Crypto -secret $SigningKey -message $SignatureData\n\n\t#Create AuthHeader\n\t$AuthorizationHeader = \"EG1-HMAC-SHA256 \"\n\t$AuthorizationHeader += \"client_token=\" + $ClientToken + \";\"\n\t$AuthorizationHeader += \"access_token=\" + $ClientAccessToken + \";\"\n\t$AuthorizationHeader += \"timestamp=\" + $TimeStamp + \";\"\n\t$AuthorizationHeader += \"nonce=\" + $Nonce + \";\"\n\t$AuthorizationHeader += \"signature=\" + $Signature\n\n\t#Create IDictionary to hold request headers\n\t$Headers = @{}\n\n\t#Add Auth header\n\t$Headers.Add('Authorization',$AuthorizationHeader)\n\n\t#Add additional headers if POSTing or PUTing\n\tIf ($Body)\n\t{\n\t  # turn off the \"Expect: 100 Continue\" header\n\t  # as it's not supported on the Akamai side.\n\t  [System.Net.ServicePointManager]::Expect100Continue = $false\n\t}\n\t\n\t#Check for valid Methods and required switches\n\t[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12\n\tif ($Method -eq \"PUT\" -or $Method -eq \"POST\") {\n\t\tif ($Body) {\n\t\t\ttry{\n\t\t\t\tInvoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers -Body $Body -ContentType 'application/json'\n\t\t\t}\n\t\t\tcatch{\n\t\t\t\tWrite-Host $_ -fore green\n\t\t\t}\n\t\t}\n\t\telse {\n\t\t  Invoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers -ContentType 'application/json'\n\t\t}\n\t}\n\telse {\n\t\t#Invoke API call with GET or DELETE and return\n\t\tInvoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers\n\t}\n}\n\nfunction Perform-AkamaiRequest {\n    param (\n        [string]$request, \n        [string]$method=\"Get\", \n        [int]$expectedStatusCode=200, \n        $body)\n\n    $baseUrl = \"https://\" + $akhost\n    $uri = \"{0}{1}\" -f $baseUrl,$request\n\n    $json = ConvertTo-Json $body -Compress\n    $response = Invoke-AkamaiOpenRequest -Method $method -ClientToken $clientToken -ClientAccessToken $clientAccessToken -ClientSecret $clientSecret -ReqURL $uri -Body $json\n\t\n    if ($response.httpStatus -ne $expectedStatusCode){\n        Write-Error \"Request not processed correctly: $($response.detail)\"\n    } elseif ($response.detail) {\n        Write-Verbose $response.detail\n    }\n\n    $response\n}\n\nfunction Request-Purge {\n    param ([Int]$cpcode,[string]$action=\"remove\",[string]$domain=\"production\")\n\n    $body = @{\n        objects = @($cpcode)\n    }\n\n    Perform-AkamaiRequest \"/ccu/v3/$action/cpcode/$domain\" \"Post\" 201 $body\n}\n\n$purge = Request-Purge $cpcode $action $domain\n\nWrite-Output \"Purge request created\"\nWrite-Output \"PurgeId: $($purge.purgeId)\"\nWrite-Output \"SupportId: $($purge.supportId)\" ",
-    "Octopus.Action.RunOnServer": "false",
-    "Octopus.Action.Script.ScriptFileName": null,
-    "Octopus.Action.Package.FeedId": null,
-    "Octopus.Action.Package.PackageId": null
-  },
-  "Parameters": [
-    {
-      "Id": "293e2cc1-e471-4801-8a9c-42633a3c9122",
-      "Name": "AkamaiClientToken",
-      "Label": "Client Token",
-      "HelpText": "Authentication token used in client authentication. Available in Luna Portal.",
-      "DefaultValue": "",
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      },
-      "Links": {}
-    },
-    {
-      "Id": "e0edcbea-bfdd-4781-9a8a-55b08eba6ed5",
-      "Name": "AkamaiClientAccessToken",
-      "Label": "Client Access Token",
-      "HelpText": "Authentication token used in client authentication. Available in Luna Portal.",
-      "DefaultValue": "",
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      },
-      "Links": {}
-    },
-    {
-      "Id": "c1ea0502-f68e-4890-99a2-3c721d16b7f0",
-      "Name": "AkamaiSecret",
-      "Label": "Secret",
-      "HelpText": "Authentication password used in client authentication. Available in Luna Portal.",
-      "DefaultValue": "",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Sensitive"
-      },
-      "Links": {}
-    },
-    {
-      "Id": "f54e1b4a-3960-483b-88c9-5ea7a94698a0",
-      "Name": "AkamaiCPCode",
-      "Label": "CPCode",
-      "HelpText": "The CPCode for which to execute the purge operation",
-      "DefaultValue": "",
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      },
-      "Links": {}
-    },
-    {
-      "Id": "a334eabb-8a36-4c24-b728-52f834f8a893",
-      "Name": "AkamaiHost",
-      "Label": "Host",
-      "HelpText": "Akamai Host (no HTTP/HTTPS). Available in Luna Portal.",
-      "DefaultValue": "",
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      },
-      "Links": {}
-    },
-    {
-      "Id": "8482001d-a6fc-4e72-b9be-8cc584a39b36",
-      "Name": "AkamaiAction",
-      "Label": "Action",
-      "HelpText": "The action to execute on the purge operation",
-      "DefaultValue": "invalidate",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Select",
-        "Octopus.SelectOptions": "invalidate\nremove"
-      },
-      "Links": {}
-    },
-    {
-      "Id": "e1c3dfa0-7118-4e23-9315-c03ea3662125",
-      "Name": "AkamaiDomain",
-      "Label": "Domain",
-      "HelpText": "The Akamai domain to perform the purge operation on",
-      "DefaultValue": "production",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Select",
-        "Octopus.SelectOptions": "production\nstaging"
-      },
-      "Links": {}
-    }
-  ],
-  "LastModifiedOn": "2019-02-11T18:51:20.358Z",
-  "LastModifiedBy": "ajwightm",
-  "$Meta": {
-    "ExportedAt": "2019-02-11T18:51:20.358Z",
-    "OctopusVersion": "3.13.10",
-    "Type": "ActionTemplate"
-  },
-  "Category": "Akamai"
-}
diff --git a/step-templates/akamai-fast-content-purge.json b/step-templates/akamai-fast-content-purge.json
deleted file mode 100644
index 5a8b4e221..000000000
--- a/step-templates/akamai-fast-content-purge.json
+++ /dev/null
@@ -1,108 +0,0 @@
-{
-  "Id": "f8e2e47b-62ba-44a0-881c-d1911dc14428",
-  "Name": "Akamai - Content Fast Purge",
-  "Description": "Allows to purge content using the Content Control Utility (CCU) v3 REST API.",
-  "ActionType": "Octopus.Script",
-  "Version": 1,
-  "Properties": {
-    "Octopus.Action.Script.Syntax": "PowerShell",
-    "Octopus.Action.Script.ScriptSource": "Inline",
-    "Octopus.Action.Script.ScriptBody": "$clientToken = $OctopusParameters['AkamaiClientToken']\r\n$clientAccessToken = $OctopusParameters['AkamaiClientAccessToken']\r\n$clientSecret = $OctopusParameters['AkamaiSecret']\r\n$hostname = $OctopusParameters['AkamaiHostname']\r\n$objects = $OctopusParameters['AkamaiObjects'] -split \",\"\r\n$action = $OctopusParameters['AkamaiAction']\r\n$domain = $OctopusParameters['AkamaiDomain']\r\n$proxyUser = $OctopusParameters['ProxyUser']\r\n$proxyPassword = $OctopusParameters['ProxyPassword']\r\n\r\nif ($proxyUser) {\r\n    $securePassword = ConvertTo-SecureString $proxyPassword -AsPlainText -Force\r\n    $proxyCredential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $proxyUser,$securePassword\r\n\r\n    (New-Object System.Net.WebClient).Proxy.Credentials=$proxyCredential\r\n}\r\n\r\n# Copied from https://github.com/akamai-open/AkamaiOPEN-powershell/blob/master/Invoke-AkamaiOPEN.ps1\r\nfunction Invoke-AkamaiOpenRequest {\r\n    param(\r\n        [Parameter(Mandatory=$true)][string]$Method, \r\n        [Parameter(Mandatory=$true)][string]$ClientToken, \r\n        [Parameter(Mandatory=$true)][string]$ClientAccessToken, \r\n        [Parameter(Mandatory=$true)][string]$ClientSecret, \r\n        [Parameter(Mandatory=$true)][string]$ReqURL, \r\n        [Parameter(Mandatory=$false)][string]$Body)\r\n\r\n    #Function to generate HMAC SHA256 Base64\r\n    Function Crypto ($secret, $message)\r\n    {\r\n\t    [byte[]] $keyByte = [System.Text.Encoding]::ASCII.GetBytes($secret)\r\n\t    [byte[]] $messageBytes = [System.Text.Encoding]::ASCII.GetBytes($message)\r\n\t    $hmac = new-object System.Security.Cryptography.HMACSHA256((,$keyByte))\r\n\t    [byte[]] $hashmessage = $hmac.ComputeHash($messageBytes)\r\n\t    $Crypt = [System.Convert]::ToBase64String($hashmessage)\r\n\r\n\t    return $Crypt\r\n    }\r\n\r\n    #ReqURL Verification\r\n    If (($ReqURL -as [System.URI]).AbsoluteURI -eq $null -or $ReqURL -notmatch \"akamai.com\")\r\n    {\r\n\t    throw \"Error: Ivalid Request URI\"\r\n    }\r\n\r\n    #Sanitize Method param\r\n    $Method = $Method.ToUpper()\r\n\r\n    #Split $ReqURL for inclusion in SignatureData\r\n    $ReqArray = $ReqURL -split \"(.*\\/{2})(.*?)(\\/)(.*)\"\r\n\r\n    #Timestamp for request signing\r\n    $TimeStamp = [DateTime]::UtcNow.ToString(\"yyyyMMddTHH:mm:sszz00\")\r\n\r\n    #GUID for request signing\r\n    $Nonce = [GUID]::NewGuid()\r\n\r\n    #Build data string for signature generation\r\n    $SignatureData = $Method + \"`thttps`t\"\r\n    $SignatureData += $ReqArray[2] + \"`t\" + $ReqArray[3] + $ReqArray[4]\r\n\r\n    if (($Body -ne $null) -and ($Method -ceq \"POST\"))\r\n    {\r\n\t    $Body_SHA256 = [System.Security.Cryptography.SHA256]::Create()\r\n\t    $Post_Hash = [System.Convert]::ToBase64String($Body_SHA256.ComputeHash([System.Text.Encoding]::ASCII.GetBytes($Body.ToString())))\r\n\r\n\t    $SignatureData += \"`t`t\" + $Post_Hash + \"`t\"\r\n    }\r\n    else\r\n    {\r\n\t    $SignatureData += \"`t`t`t\"\r\n    }\r\n\r\n    $SignatureData += \"EG1-HMAC-SHA256 \"\r\n    $SignatureData += \"client_token=\" + $ClientToken + \";\"\r\n    $SignatureData += \"access_token=\" + $ClientAccessToken + \";\"\r\n    $SignatureData += \"timestamp=\" + $TimeStamp  + \";\"\r\n    $SignatureData += \"nonce=\" + $Nonce + \";\"\r\n\r\n    #Generate SigningKey\r\n    $SigningKey = Crypto -secret $ClientSecret -message $TimeStamp\r\n\r\n    #Generate Auth Signature\r\n    $Signature = Crypto -secret $SigningKey -message $SignatureData\r\n\r\n    #Create AuthHeader\r\n    $AuthorizationHeader = \"EG1-HMAC-SHA256 \"\r\n    $AuthorizationHeader += \"client_token=\" + $ClientToken + \";\"\r\n    $AuthorizationHeader += \"access_token=\" + $ClientAccessToken + \";\"\r\n    $AuthorizationHeader += \"timestamp=\" + $TimeStamp + \";\"\r\n    $AuthorizationHeader += \"nonce=\" + $Nonce + \";\"\r\n    $AuthorizationHeader += \"signature=\" + $Signature\r\n\r\n    #Create IDictionary to hold request headers\r\n    $Headers = @{}\r\n\r\n    #Add Auth header\r\n    $Headers.Add('Authorization',$AuthorizationHeader)\r\n\r\n    #Add additional headers if POSTing or PUTing\r\n    If (($Method -ceq \"POST\") -or ($Method -ceq \"PUT\"))\r\n    {\r\n\t    $Body_Size = [System.Text.Encoding]::UTF8.GetByteCount($Body)\r\n\t    $Headers.Add('max-body',$Body_Size.ToString())\r\n\r\n        # turn off the \"Expect: 100 Continue\" header\r\n        # as it's not supported on the Akamai side.\r\n        [System.Net.ServicePointManager]::Expect100Continue = $false\r\n    }\r\n\r\n    #Check for valid Methods and required switches\r\n    If (($Method -ceq \"POST\") -and ($Body -ne $null))\r\n    {\r\n        Invoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers -Body $Body -ContentType 'application/json'\r\n    }\r\n    elseif  (($Method -ceq \"PUT\") -and ($Body -ne $null))\r\n    {\r\n\t    #Invoke API call with PUT and return\r\n\t    Invoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers -Body $Body -ContentType 'application/json'\r\n    }\r\n    elseif (($Method -ceq \"GET\") -or ($Method -ceq \"DELETE\"))\r\n    {\r\n\t    #Invoke API call with GET or DELETE and return\r\n\t    Invoke-RestMethod -Method $Method -Uri $ReqURL -Headers $Headers\r\n    }\r\n    else\r\n    {\r\n\t    throw \"Error: Invalid -Method specified or missing required parameter\"\r\n    }\r\n}\r\n\r\nfunction Perform-AkamaiRequest {\r\n    param (\r\n        [string]$request, \r\n        [string]$method=\"Get\", \r\n        [int]$expectedStatusCode=200, \r\n        $body)\r\n\r\n    $baseUrl = \"http://private-anon-3934daf8d-akamaiopen2purgeccuv3production.apiary-mock.com\"\r\n    # $baseUrl = \"https://api.ccu.akamai.com\"\r\n    $uri = \"{0}{1}\" -f $baseUrl,$request\r\n\r\n    if ($uri -match \"mock\"){\r\n        $requestHeaders = @{'Cache-Control'='no-cache,proxy-revalidate'}\r\n        $response = Invoke-RestMethod -Uri $uri -Method $method -DisableKeepAlive -Headers $requestHeaders -Body $body\r\n    } else {\r\n        $json = ConvertTo-Json $body -Compress\r\n        $response = Invoke-AkamaiOpenRequest -Method $method -ClientToken $clientToken -ClientAccessToken $clientAccessToken -ClientSecret $clientSecret -ReqURL $uri -Body $json\r\n    }\r\n\r\n    if ($response.httpStatus -ne $expectedStatusCode){\r\n        Write-Error \"Request not processed correctly: $($response.detail)\"\r\n    } elseif ($response.detail) {\r\n        Write-Verbose $response.detail\r\n    }\r\n\r\n    Write-Verbose $response\r\n\r\n    $response\r\n}\r\n\r\nfunction Request-Purge {\r\n    param ($objects,[string]$hostname,[string]$action=\"remove\",[string]$domain=\"production\")\r\n\r\n    $body = @{\r\n        objects = $objects\r\n    }\r\n\r\n    if ($hostname -ne $null -and $hostname -ne \"\") {\r\n        $body = @{\r\n            hostname = $hostname\r\n            objects = $objects\r\n        }\r\n    } \r\n\r\n    Perform-AkamaiRequest \"/ccu/v3/$action/$domain\" \"Post\" 201 $body\r\n}\r\n\r\n$purge = Request-Purge $objects $hostname $action $domain\r\n\r\nWrite-Output \"Purge request created\"\r\nWrite-Output \"PurgeId: $($purge.purgeId)\"\r\nWrite-Output \"SupportId: $($purge.supportId)\" ",
-    "Octopus.Action.Script.ScriptFileName": null,
-    "Octopus.Action.Package.NuGetFeedId": null,
-    "Octopus.Action.Package.NuGetPackageId": null
-  },
-  "Parameters": [
-    {
-      "Name": "AkamaiClientToken",
-      "Label": "Client Token",
-      "HelpText": "Authentication token used in client authentication. Available in Luna Portal.",
-      "DefaultValue": null,
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      }
-    },
-    {
-      "Name": "AkamaiClientAccessToken",
-      "Label": "Client Access Token",
-      "HelpText": "Authentication token used in client authentication. Available in Luna Portal.",
-      "DefaultValue": null,
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      }
-    },
-    {
-      "Name": "AkamaiSecret",
-      "Label": "Secret",
-      "HelpText": "Authentication password used in client authentication. Available in Luna Portal.",
-      "DefaultValue": null,
-      "DisplaySettings": {
-        "Octopus.ControlType": "Sensitive"
-      }
-    },
-    {
-      "Name": "AkamaiHostname",
-      "Label": "Hostname",
-      "HelpText": "The hostname for which to execute the purge operation",
-      "DefaultValue": null,
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      }
-    },
-    {
-      "Name": "AkamaiObjects",
-      "Label": "Objects",
-      "HelpText": "A comma separated list of objects to purge, only URLs",
-      "DefaultValue": null,
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      }
-    },
-    {
-      "Name": "AkamaiAction",
-      "Label": "Action",
-      "HelpText": "The action to execute on the purge operation",
-      "DefaultValue": "invalidate",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Select",
-        "Octopus.SelectOptions": "invalidate\nremove"
-      }
-    },
-    {
-      "Name": "AkamaiDomain",
-      "Label": "Domain",
-      "HelpText": "The Akamai domain to perform the purge operation on",
-      "DefaultValue": "production",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Select",
-        "Octopus.SelectOptions": "production\nstaging"
-      }
-    },
-    {
-      "Name": "ProxyUser",
-      "Label": "Proxy User",
-      "HelpText": "Optional, a user name for the proxy if required in the network",
-      "DefaultValue": null,
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      }
-    },
-    {
-      "Name": "ProxyPassword",
-      "Label": "Proxy Password",
-      "HelpText": "Optional, the password for the account to use if a Proxy User was specified",
-      "DefaultValue": null,
-      "DisplaySettings": {
-        "Octopus.ControlType": "Sensitive"
-      }
-    }
-  ],
-  "LastModifiedOn": "2016-07-11T14:00:00.000+00:00",
-  "LastModifiedBy": "roberto-mardeni",
-  "$Meta": {
-    "ExportedAt": "2016-07-11T14:30:28.569+00:00",
-    "OctopusVersion": "3.3.12",
-    "Type": "ActionTemplate"
-  },
-  "Category": "akamai"
-}
\ No newline at end of file
diff --git a/step-templates/ssis-deploy-ispac-from-package-parameter.json b/step-templates/ssis-deploy-ispac-from-package-parameter.json
deleted file mode 100644
index 698a1d1af..000000000
--- a/step-templates/ssis-deploy-ispac-from-package-parameter.json
+++ /dev/null
@@ -1,196 +0,0 @@
-{
-  "Id": "27567d46-b935-4ee6-8b2d-8c165edada4e",
-  "Name": "Deploy ispac SSIS project from a Package parameter",
-  "Description": "This step template will deploy SSIS ispac projects to SQL Server Integration Services Catalog.  The template uses a referenced package and is Worker compatible.\n\nThis template will install the Nuget package provider if it is not present on the machine it is running on.\n\nNOTE:  The SqlServer PowerShell module this template utilizes removed the assemblies necessary to interface with SSIS as of version 22.0.59.  Version 21.1.18256 has been pinned and will be used if the SqlServer PowerShell module is not installed.",
-  "ActionType": "Octopus.Script",
-  "Version": 7,
-  "Author": "twerthi",
-  "Packages": [
-    {
-      "Id": "5ce9da08-a4ed-4b69-92d1-ab88c705cf08",
-      "Name": "SSIS.Template.ssisPackageId",
-      "PackageId": null,
-      "FeedId": null,
-      "AcquisitionLocation": "Server",
-      "Properties": {
-        "Extract": "True",
-        "SelectionMode": "deferred",
-        "PackageParameterName": "SSIS.Template.ssisPackageId"
-      }
-    }
-  ],
-  "Properties": {
-    "Octopus.Action.Script.Syntax": "PowerShell",
-    "Octopus.Action.Script.ScriptBody": "function Add-TemporaryPinnedSqlServerModule\n{\n    # Define parameters\n    param(\n        $LocalModulesPath\n    )\n\n    $PowerShellModuleName = \"SqlServer\"\n    $RequiredVersion = [version]'21.1.18256'\n\n    # Check to see if the package provider has been installed\n    if ($null -eq (Get-PackageProvider -ListAvailable -Name Nuget -ErrorAction SilentlyContinue))\n    {\n        # Display that we need the nuget package provider\n        Write-Host \"Nuget package provider not found, installing ...\"\n\n        # Install Nuget package provider\n        Install-PackageProvider -Name Nuget -Force\n    }\n\n    # Save the module in the temporary location\n    Save-Module -Name $PowerShellModuleName -Path $LocalModulesPath -Force -RequiredVersion $RequiredVersion -Repository \"PSGallery\"\n\n    # Display\n    Write-Output \"Saved module $PowerShellModuleName v$RequiredVersion to $LocalModulesPath\"\n\n    # Import the module\n    Import-Module -Name $PowerShellModuleName\n}\n\nFunction Remove-TemporaryPinnedSqlServerModule\n{\n    param(\n        [Parameter(Mandatory = $true)][string]$LocalModulesPath,\n        [Parameter(Mandatory = $true)][version]$PinnedVersion\n    )\n\n    try { Remove-Module SqlServer -Force -ErrorAction SilentlyContinue } catch {}\n\n    $moduleRoot = Join-Path $LocalModulesPath 'SqlServer'\n    $pinnedPath = Join-Path $moduleRoot $PinnedVersion.ToString()\n\n    if (Test-Path $pinnedPath)\n    {\n        Write-Host \"Removing temporary pinned SqlServer module folder: $pinnedPath\"\n        Remove-Item -Path $pinnedPath -Recurse -Force -ErrorAction SilentlyContinue\n    }\n\n    # Optional: remove parent if empty\n    if (Test-Path $moduleRoot)\n    {\n        $remaining = Get-ChildItem -Path $moduleRoot -Force -ErrorAction SilentlyContinue\n        if (-not $remaining)\n        {\n            Remove-Item -Path $moduleRoot -Force -ErrorAction SilentlyContinue\n        }\n    }\n}\n\nFunction Test-IntegrationServicesTypeAvailable\n{\n    # True if the IntegrationServices type resolves in this PowerShell session, else false\n    $typeName = 'Microsoft.SqlServer.Management.IntegrationServices.IntegrationServices'\n    $aqn = \"$typeName, Microsoft.SqlServer.Management.IntegrationServices\"\n\n    try\n    {\n        if ([Type]::GetType($aqn, $false)) { return $true }\n    }\n    catch {}\n\n    # Try to load assembly (strong name), may fail on some boxes\n    try { [void][Reflection.Assembly]::Load('Microsoft.SqlServer.Management.IntegrationServices') } catch {}\n\n    try\n    {\n        if ([Type]::GetType($aqn, $false)) { return $true }\n    }\n    catch {}\n\n    # Fall back to explicit GAC path load (LoadFrom) if present\n    $gacRoot = Join-Path $env:windir 'Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.SqlServer.Management.IntegrationServices'\n    if (Test-Path $gacRoot)\n    {\n        $gacDll = Get-ChildItem -Path $gacRoot -Recurse -Filter 'Microsoft.SqlServer.Management.IntegrationServices.dll' -File -ErrorAction SilentlyContinue |\n                  Sort-Object FullName -Descending |\n                  Select-Object -First 1\n\n        if ($null -eq $gacDll)\n        {\n            try\n            {\n                $asm = [Reflection.Assembly]::LoadFrom($gacDll.FullName)\n                if ($asm.GetType('Microsoft.SqlServer.Management.IntegrationServices.IntegrationServices', $false)) { return $true }\n            }\n            catch {}\n        }\n    }\n\n    try\n    {\n        if ([Type]::GetType($aqn, $false)) { return $true }\n    }\n    catch {}\n\n    return $false\n}\n\nFunction Load-SqlServerAssemblies\n{\n    # Get the folder where the SqlServer module ended up in\n    $sqlServerModulePath = [System.IO.Path]::GetDirectoryName((Get-Module SqlServer).Path)\n\n    # Loop through the assemblies\n    foreach($assemblyFile in (Get-ChildItem -Path $sqlServerModulePath -Exclude msv*.dll | Where-Object {$_.Extension -eq \".dll\"}))\n    {\n        try\n        {\n            # Only load managed .NET assemblies (native DLLs will throw)\n            [void][System.Reflection.AssemblyName]::GetAssemblyName($assemblyFile.FullName)\n\n            # Load the managed assembly\n            [Reflection.Assembly]::LoadFrom($assemblyFile.FullName) | Out-Null\n        }\n        catch [System.BadImageFormatException]\n        {\n            # Native DLL (or wrong format), skip\n        }\n    }\n}\n\nFunction Initialize-SsisDeploymentRuntime\n{\n    param(\n        [Parameter(Mandatory = $true)][string]$LocalModulesPath,\n        [Parameter(Mandatory = $true)][version]$PinnedSqlServerVersion\n    )\n\n    # Define PowerShell Modules path\n    $env:PSModulePath = \"$LocalModulesPath;$env:PSModulePath\"\n\n    $runtime = [pscustomobject]@{\n        UsedPinnedSqlServerModule = $false\n        SsisTypeAvailable         = $false\n    }\n\n    # First preference: use SSIS assemblies already available on the machine/session\n    $runtime.SsisTypeAvailable = Test-IntegrationServicesTypeAvailable\n\n    if ($runtime.SsisTypeAvailable)\n    {\n        Write-Host \"SSIS IntegrationServices type is already available.\"\n\n        # Only need a SqlServer module for cmdlets such as Invoke-Sqlcmd\n        if ($null -ne (Get-Module -ListAvailable -Name \"SqlServer\"))\n        {\n            Import-Module -Name SqlServer -ErrorAction Stop\n        }\n        else\n        {\n            Write-Output \"PowerShell module SqlServer not present, downloading temporary pinned copy for cmdlets ...\"\n            [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor [System.Net.SecurityProtocolType]::Tls12\n\n            Add-TemporaryPinnedSqlServerModule -LocalModulesPath $LocalModulesPath\n\n            $manifestPath = Join-Path (Join-Path (Join-Path $LocalModulesPath 'SqlServer') $PinnedSqlServerVersion.ToString()) 'SqlServer.psd1'\n            Write-Host \"Importing pinned SqlServer module from: $manifestPath\"\n            Import-Module -Name $manifestPath -Force -DisableNameChecking -ErrorAction Stop\n\n            $runtime.UsedPinnedSqlServerModule = $true\n        }\n\n        # SSIS type already resolved, no need to bulk-load module assemblies\n        return $runtime\n    }\n\n    # Second preference: fall back to pinned SqlServer module that still contains SSIS assemblies\n    Write-Output \"SSIS IntegrationServices type not available via installed components. Downloading pinned SqlServer module $PinnedSqlServerVersion temporarily ...\"\n    [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor [System.Net.SecurityProtocolType]::Tls12\n\n    $manifestPath = Join-Path (Join-Path (Join-Path $LocalModulesPath 'SqlServer') $PinnedSqlServerVersion.ToString()) 'SqlServer.psd1'\n    if (-not (Test-Path $manifestPath))\n    {\n        Add-TemporaryPinnedSqlServerModule -LocalModulesPath $LocalModulesPath\n    }\n\n    Write-Host \"Importing pinned SqlServer module from: $manifestPath\"\n    Import-Module -Name $manifestPath -Force -DisableNameChecking -ErrorAction Stop\n    Load-SqlServerAssemblies\n\n    $runtime.UsedPinnedSqlServerModule = $true\n    $runtime.SsisTypeAvailable = Test-IntegrationServicesTypeAvailable\n\n    return $runtime\n}\n\nFunction Get-Catalog\n{\n    # define parameters\n    Param ($CatalogName)\n    # NOTE: using $integrationServices variable defined in main\n\n    # define working variables\n    $Catalog = $null\n    # check to see if there are any catalogs\n    if($integrationServices.Catalogs.Count -gt 0 -and $integrationServices.Catalogs[$CatalogName])\n    {\n        # get reference to catalog\n        $Catalog = $integrationServices.Catalogs[$CatalogName]\n    }\n    else\n    {\n        if((Get-CLREnabled) -eq 0)\n        {\n            if(-not $EnableCLR)\n            {\n                # throw error\n                throw \"SQL CLR is not enabled.\"\n            }\n            else\n            {\n                # display sql clr isn't enabled\n                Write-Warning \"SQL CLR is not enabled on $($sqlConnection.DataSource).  This feature must be enabled for SSIS catalogs.\"\n\n                # enabling SQLCLR\n                Write-Host \"Enabling SQL CLR ...\"\n                Enable-SQLCLR\n                Write-Host \"SQL CLR enabled\"\n            }\n        }\n\n        # Provision a new SSIS Catalog\n        Write-Host \"Creating SSIS Catalog ...\"\n\n        $Catalog = New-Object \"$ISNamespace.Catalog\" ($integrationServices, $CatalogName, $OctopusParameters['SSIS.Template.CatalogPwd'])\n        $Catalog.Create()\n    }\n\n    # return the catalog\n    return $Catalog\n}\n\nFunction Get-CLREnabled\n{\n    # define parameters\n    # Not using any parameters, but am using $sqlConnection defined in main\n\n    # define working variables\n    $Query = \"SELECT * FROM sys.configurations WHERE name = 'clr enabled'\"\n\n    # execute script\n    $CLREnabled = Invoke-Sqlcmd -ServerInstance $sqlConnection.DataSource -Database \"master\" -Query $Query | Select value\n\n    # return value\n    return $CLREnabled.Value\n}\n\nFunction Enable-SQLCLR\n{\n    $QueryArray = \"sp_configure 'show advanced options', 1\", \"RECONFIGURE\", \"sp_configure 'clr enabled', 1\", \"RECONFIGURE \"\n    # execute script\n\n    foreach($Query in $QueryArray)\n    {\n        Invoke-Sqlcmd -ServerInstance $sqlConnection.DataSource -Database \"master\" -Query $Query\n    }\n\n    # check that it's enabled\n    if((Get-CLREnabled) -ne 1)\n    {\n        # throw error\n        throw \"Failed to enable SQL CLR\"\n    }\n}\n\nFunction Get-Folder\n{\n    # parameters\n    Param($FolderName, $Catalog)\n\n    $Folder = $null\n    # try to get reference to folder\n\n    if(!($Catalog.Folders -eq $null))\n    {\n        $Folder = $Catalog.Folders[$FolderName]\n    }\n\n    # check to see if $Folder has a value\n    if($Folder -eq $null)\n    {\n        # display\n        Write-Host \"Folder $FolderName doesn't exist, creating folder...\"\n\n        # create the folder\n        $Folder = New-Object \"$ISNamespace.CatalogFolder\" ($Catalog, $FolderName, $FolderName)\n        $Folder.Create()\n    }\n\n    # return the folder reference\n    return $Folder\n}\n\nFunction Get-Environment\n{\n    # define parameters\n    Param($Folder, $EnvironmentName)\n\n    $Environment = $null\n    # get reference to Environment\n    if(!($Folder.Environments -eq $null) -and $Folder.Environments.Count -gt 0)\n    {\n        $Environment = $Folder.Environments[$EnvironmentName]\n    }\n\n    # check to see if it's a null reference\n    if($Environment -eq $null)\n    {\n        # display\n        Write-Host \"Environment $EnvironmentName doesn't exist, creating environment...\"\n\n        # create environment\n        $Environment = New-Object \"$ISNamespace.EnvironmentInfo\" ($Folder, $EnvironmentName, $EnvironmentName)\n        $Environment.Create()\n    }\n\n    # return the environment\n    return $Environment\n}\n\nFunction Set-EnvironmentReference\n{\n    # define parameters\n    Param($Project, $Environment, $Folder)\n\n    # get reference\n    $Reference = $null\n\n    if(!($Project.References -eq $null))\n    {\n        $Reference = $Project.References[$Environment.Name, $Folder.Name]\n    }\n\n    # check to see if it's a null reference\n    if($Reference -eq $null)\n    {\n        # display\n        Write-Host \"Project does not reference environment $($Environment.Name), creating reference...\"\n\n        # create reference\n        $Project.References.Add($Environment.Name, $Folder.Name)\n        $Project.Alter()\n    }\n}\n\nFunction Set-ProjectParametersToEnvironmentVariablesReference\n{\n    # define parameters\n    Param($Project, $Environment)\n\n    $UpsertedVariables = @()\n\n    if($Project.Parameters -eq $null)\n    {\n        Write-Host \"No project parameters exist\"\n        return\n    }\n\n    # loop through project parameters\n    foreach($Parameter in $Project.Parameters)\n    {\n        # skip if the parameter is included in custom filters\n        if ($UseCustomFilter)\n        {\n            if ($Parameter.Name -match $CustomFilter)\n            {\n                Write-Host \"- $($Parameter.Name) skipped due to CustomFilters.\"\n                continue\n            }\n        }\n\n        # Add variable to list of variable\n        $UpsertedVariables += $Parameter.Name\n\n        $Variable = $null\n        if(!($Environment.Variables -eq $null))\n        {\n            # get reference to variable\n            $Variable = $Environment.Variables[$Parameter.Name]\n        }\n\n        # check to see if variable exists\n        if($Variable -eq $null)\n        {\n            # add the environment variable\n            Add-EnvironmentVariable -Environment $Environment -Parameter $Parameter -ParameterName $Parameter.Name\n\n            # get reference to the newly created variable\n            $Variable = $Environment.Variables[$Parameter.Name]\n        }\n\n        # set the environment variable value\n        Set-EnvironmentVariableValue -Variable $Variable -Parameter $Parameter -ParameterName $Parameter.Name\n    }\n\n    # alter the environment\n    $Environment.Alter()\n    $Project.Alter()\n\n    return $UpsertedVariables\n}\n\nFunction Set-PackageVariablesToEnvironmentVariablesReference\n{\n    # define parameters\n    Param($Project, $Environment)\n\n    $Variables = @()\n    $UpsertedVariables = @()\n\n    # loop through packages in project in order to store a temp collection of variables\n    foreach($Package in $Project.Packages)\n    {\n        # loop through parameters of package\n        foreach($Parameter in $Package.Parameters)\n        {\n            # add to the temporary variable collection\n            $Variables += $Parameter.Name\n        }\n    }\n\n    # loop through packages in project\n    foreach($Package in $Project.Packages)\n    {\n        # loop through parameters of package\n        foreach($Parameter in $Package.Parameters)\n        {\n            if ($UseFullyQualifiedVariableNames)\n            {\n                # Set fully qualified variable name\n                $ParameterName = $Parameter.ObjectName.Replace(\".dtsx\", \"\")+\".\"+$Parameter.Name\n            }\n            else\n            {\n                # check if exists a variable with the same name\n                $VariableNameOccurrences = $($Variables | Where-Object { $_ -eq $Parameter.Name }).count\n                $ParameterName = $Parameter.Name\n\n                if ($VariableNameOccurrences -gt 1)\n                {\n                    $ParameterName = $Parameter.ObjectName.Replace(\".dtsx\", \"\")+\".\"+$Parameter.Name\n                }\n            }\n\n            if ($UseCustomFilter)\n            {\n                if ($ParameterName -match $CustomFilter)\n                {\n                    Write-Host \"- $($Parameter.Name) skipped due to CustomFilters.\"\n                    continue\n                }\n            }\n\n            # get reference to variable\n            $Variable = $Environment.Variables[$ParameterName]\n\n            # Add variable to list of variable\n            $UpsertedVariables += $ParameterName\n\n            # check to see if the parameter exists\n            if(!$Variable)\n            {\n                # add the environment variable\n                Add-EnvironmentVariable -Environment $Environment -Parameter $Parameter -ParameterName $ParameterName\n\n                # get reference to the newly created variable\n                $Variable = $Environment.Variables[$ParameterName]\n            }\n\n            # set the environment variable value\n            Set-EnvironmentVariableValue -Variable $Variable -Parameter $Parameter -ParameterName $ParameterName\n        }\n\n        # alter the package\n        $Package.Alter()\n    }\n\n    # alter the environment\n    $Environment.Alter()\n\n    return $UpsertedVariables\n}\n\nFunction Sync-EnvironmentVariables\n{\n    # define parameters\n    Param($Environment, $VariablesToPreserveInEnvironment)\n\n    foreach($VariableToEvaluate in $Environment.Variables)\n    {\n        if ($VariablesToPreserveInEnvironment -notcontains $VariableToEvaluate.Name)\n        {\n            Write-Host \"- Removing environment variable: $($VariableToEvaluate.Name)\"\n            $VariableToRemove = $Environment.Variables[$VariableToEvaluate.Name]\n            $Environment.Variables.Remove($VariableToRemove) | Out-Null\n        }\n    }\n\n    # alter the environment\n    $Environment.Alter()\n}\n\nFunction Add-EnvironmentVariable\n{\n    # define parameters\n    Param($Environment, $Parameter, $ParameterName)\n\n    # display\n    Write-Host \"- Adding environment variable $($ParameterName)\"\n\n    # check to see if design default value is empty or null\n    if([string]::IsNullOrEmpty($Parameter.DesignDefaultValue))\n    {\n        # give it something\n        $DefaultValue = \"\" # sensitive variables will not return anything so when trying to use the property of $Parameter.DesignDefaultValue, the Alter method will fail.\n    }\n    else\n    {\n        # take the design\n        $DefaultValue = $Parameter.DesignDefaultValue\n    }\n\n    # add variable with an initial value\n    $Environment.Variables.Add($ParameterName, $Parameter.DataType, $DefaultValue, $Parameter.Sensitive, $Parameter.Description)\n}\n\nFunction Set-EnvironmentVariableValue\n{\n     # define parameters\n    Param($Variable, $Parameter, $ParameterName)\n\n    # check to make sure variable value is available\n    if (-not $OctopusParameters){\n        Write-Host \"[WARN] - OctopusParameters collection is empty\"\n    }\n    else\n    {\n        if($OctopusParameters.ContainsKey($ParameterName))\n        {\n            # display\n            Write-Host \"[ OK ] - $($ParameterName) updated.\"\n\n            # set the variable value\n            $Variable.Value = $OctopusParameters[\"$($ParameterName)\"]\n        }\n        else\n        {\n            # warning\n            Write-Host \"[WARN] - $($ParameterName) not in OctopusParameters collection.\"\n        }\n    }\n\n    # Set reference\n    $Parameter.Set([Microsoft.SqlServer.Management.IntegrationServices.ParameterInfo+ParameterValueType]::Referenced, \"$($ParameterName)\")\n}\n\nFunction Invoke-SsisProjectDeployment\n{\n    $LocalModules = (New-Item \"$PSScriptRoot\\Modules\" -ItemType Directory -Force).FullName\n    $pinnedSqlServerVersion = [version]'21.1.18256'\n    $sqlConnection = $null\n    $runtime = $null\n\n    try\n    {\n        $runtime = Initialize-SsisDeploymentRuntime -LocalModulesPath $LocalModules -PinnedSqlServerVersion $pinnedSqlServerVersion\n\n        # Store the IntegrationServices Assembly namespace to avoid typing it every time\n        $ISNamespace = \"Microsoft.SqlServer.Management.IntegrationServices\"\n\n        # ensure all boolean variables are true booleans\n        $EnableCLR = [System.Convert]::ToBoolean(\"$($OctopusParameters['SSIS.Template.EnableCLR'])\")\n        $UseEnvironment = [System.Convert]::ToBoolean(\"$($OctopusParameters['SSIS.Template.UseEnvironment'])\")\n        $ReferenceProjectParametersToEnvironmentVairables = [System.Convert]::ToBoolean(\"$($OctopusParameters['SSIS.Template.ReferenceProjectParametersToEnvironmentVairables'])\")\n\n        $ReferencePackageParametersToEnvironmentVairables = [System.Convert]::ToBoolean(\"$($OctopusParameters['SSIS.Template.ReferencePackageParametersToEnvironmentVairables'])\")\n        $UseFullyQualifiedVariableNames = [System.Convert]::ToBoolean(\"$($OctopusParameters['SSIS.Template.UseFullyQualifiedVariableNames'])\")\n        $SyncEnvironment = [System.Convert]::ToBoolean(\"$($OctopusParameters['SSIS.Template.SyncEnvironment'])\")\n        # custom names for filtering out the excluded variables by design\n        $UseCustomFilter = [System.Convert]::ToBoolean(\"$($OctopusParameters['SSIS.Template.UseCustomFilter'])\")\n        $CustomFilter = [System.Convert]::ToString(\"$($OctopusParameters['SSIS.Template.CustomFilter'])\")\n        # list of variables names to keep in target environment\n        $VariablesToPreserveInEnvironment = @()\n        $ssisPackageId = $OctopusParameters['SSIS.Template.ssisPackageId']\n\n        # Get the extracted path\n        $DeployedPath = $OctopusParameters[\"Octopus.Action.Package[$ssisPackageId].ExtractedPath\"]\n\n        # Get all .ispac files from the deployed path\n        $IsPacFiles = Get-ChildItem -Recurse -Path $DeployedPath | Where {$_.Extension.ToLower() -eq \".ispac\"}\n\n        # display number of files\n        Write-Host \"$($IsPacFiles.Count) .ispac file(s) found.\"\n\n        Write-Host \"Connecting to server ...\"\n\n        # Create a connection to the server\n        $sqlConnectionString = \"Data Source=$($OctopusParameters['SSIS.Template.ServerName']);Initial Catalog=SSISDB;\"\n\n        if (![string]::IsNullOrEmpty($OctopusParameters['SSIS.Template.sqlAccountUsername']) -and ![string]::IsNullOrEmpty($OctopusParameters['SSIS.Template.sqlAccountPassword']))\n        {\n            # Add username and password to connection string\n            $sqlConnectionString += \"User ID=$($OctopusParameters['SSIS.Template.sqlAccountUsername']); Password=$($OctopusParameters['SSIS.Template.sqlAccountPassword']);\"\n        }\n        else\n        {\n            # Use integrated\n            $sqlConnectionString += \"Integrated Security=SSPI;\"\n        }\n\n        # Create new connection object with connection string\n        $sqlConnection = New-Object System.Data.SqlClient.SqlConnection $sqlConnectionString\n\n        # create integration services object\n        $integrationServices = New-Object \"$ISNamespace.IntegrationServices\" $sqlConnection\n\n        # get reference to the catalog\n        Write-Host \"Getting reference to catalog $($OctopusParameters['SSIS.Template.CataLogName'])\"\n        $Catalog = Get-Catalog -CatalogName $OctopusParameters['SSIS.Template.CataLogName']\n\n        # get folder reference\n        $Folder = Get-Folder -FolderName $OctopusParameters['SSIS.Template.FolderName'] -Catalog $Catalog\n\n        # loop through ispac files\n        foreach($IsPacFile in $IsPacFiles)\n        {\n            # read project file\n            $ProjectFile = [System.IO.File]::ReadAllBytes($IsPacFile.FullName)\n            $ProjectName = $IsPacFile.Name.SubString(0, $IsPacFile.Name.LastIndexOf(\".\"))\n\n            # deploy project\n            Write-Host \"Deploying project $($IsPacFile.Name)...\"\n            $Folder.DeployProject($ProjectName, $ProjectFile) | Out-Null\n\n            # get reference to deployed project\n            $Project = $Folder.Projects[$ProjectName]\n\n            # check to see if they want to use environments\n            if($UseEnvironment)\n            {\n                # get environment reference\n                $Environment = Get-Environment -Folder $Folder -EnvironmentName $OctopusParameters['SSIS.Template.EnvironmentName']\n\n                # set environment reference\n                Set-EnvironmentReference -Project $Project -Environment $Environment -Folder $Folder\n\n                # check to see if the user wants to convert project parameters to environment variables\n                if($ReferenceProjectParametersToEnvironmentVairables)\n                {\n                    # set environment variables\n                    Write-Host \"Referencing Project Parameters to Environment Variables...\"\n                    $VariablesToPreserveInEnvironment += Set-ProjectParametersToEnvironmentVariablesReference -Project $Project -Environment $Environment\n                }\n\n                # check to see if the user wants to convert the package parameters to environment variables\n                if($ReferencePackageParametersToEnvironmentVairables)\n                {\n                    # set package variables\n                    Write-Host \"Referencing Package Parameters to Environment Variables...\"\n                    $VariablesToPreserveInEnvironment += Set-PackageVariablesToEnvironmentVariablesReference -Project $Project -Environment $Environment\n                }\n\n                # Removes all unused variables from the environment\n                if ($SyncEnvironment)\n                {\n                    Write-Host \"Sync package environment variables...\"\n                    Sync-EnvironmentVariables -Environment $Environment -VariablesToPreserveInEnvironment $VariablesToPreserveInEnvironment\n                }\n            }\n        }\n    }\n\n    finally\n    {\n        # check to make sure sqlconnection isn't null\n        if($sqlConnection)\n        {\n            # check state of sqlconnection\n            if($sqlConnection.State -eq [System.Data.ConnectionState]::Open)\n            {\n                # close the connection\n                $sqlConnection.Close()\n            }\n\n            # cleanup\n            $sqlConnection.Dispose()\n        }\n\n        # cleanup temporary pinned SqlServer module only when it was actually used\n        if ($runtime -and $runtime.UsedPinnedSqlServerModule)\n        {\n            Remove-TemporaryPinnedSqlServerModule -LocalModulesPath $LocalModules -PinnedVersion $pinnedSqlServerVersion\n        }\n    }\n}\n\nInvoke-SsisProjectDeployment",
-    "Octopus.Action.Script.ScriptSource": "Inline"
-  },
-  "Parameters": [
-    {
-      "Id": "53aa9e3e-1292-4e75-8095-3666ebd5886b",
-      "Name": "SSIS.Template.ServerName",
-      "Label": "Database server name (\\instance)",
-      "HelpText": "Name of the SQL Server you are deploying to.",
-      "DefaultValue": "",
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      }
-    },
-    {
-      "Id": "c0605196-f184-44f6-9b3d-c043323e017c",
-      "Name": "SSIS.Template.sqlAccountUsername",
-      "Label": "SQL Authentication Username",
-      "HelpText": "(Optional) Username of the SQL Authentication account.  Use this approach when deploying to Azure Databases with SSIS configured.  If SQL Authentication Username and Password are blank, Integrated Authentication is used.",
-      "DefaultValue": "",
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      }
-    },
-    {
-      "Id": "224b913f-657c-4d1c-a3d8-0f286203c1ec",
-      "Name": "SSIS.Template.sqlAccountPassword",
-      "Label": "SQL Authentication Password",
-      "HelpText": "(Optional) Password of the SQL Authentication account.",
-      "DefaultValue": "",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Sensitive"
-      }
-    },
-    {
-      "Id": "0abbb06c-5f98-44d8-b20d-b811b6bf18da",
-      "Name": "SSIS.Template.EnableCLR",
-      "Label": "Enable SQL CLR",
-      "HelpText": "This will reconfigure SQL Server to enable the SQL CLR.  It is highly recommended that this be previously authorized by your Database Administrator.",
-      "DefaultValue": "False",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Checkbox"
-      }
-    },
-    {
-      "Id": "ebe9ab8b-3433-4aeb-bafb-642033a9b0a0",
-      "Name": "SSIS.Template.CatalogName",
-      "Label": "Catalog name",
-      "HelpText": "Name of the catalog to create in Integration Services Catalogs on SQL Server.  When using the GUI, this value gets hardcoded to SSISDB and cannot be changed.  It is recommended that you do not change the default value.",
-      "DefaultValue": "SSISDB",
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      }
-    },
-    {
-      "Id": "d111401b-504f-41f4-96de-b7667fcbf990",
-      "Name": "SSIS.Template.CatalogPwd",
-      "Label": "Catalog password",
-      "HelpText": "Password to the Integration Services Catalog.",
-      "DefaultValue": "",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Sensitive"
-      }
-    },
-    {
-      "Id": "d2fefbf6-c68f-4a66-a5d1-3beb9e51a331",
-      "Name": "SSIS.Template.FolderName",
-      "Label": "Folder name",
-      "HelpText": "Name of the folder to use within the Integration Services Catalog",
-      "DefaultValue": "",
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      }
-    },
-    {
-      "Id": "ec3589c1-360b-44fc-a19c-f2de0f57a323",
-      "Name": "SSIS.Template.UseEnvironment",
-      "Label": "Use environment",
-      "HelpText": "This will make a project reference to the defined environment.",
-      "DefaultValue": "False",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Checkbox"
-      }
-    },
-    {
-      "Id": "718f2836-1c49-4119-a294-9b5488ead33b",
-      "Name": "SSIS.Template.EnvironmentName",
-      "Label": "Environment name",
-      "HelpText": "Name of the environment to reference the project to. If the environment doesn't exist, it will create it.",
-      "DefaultValue": "",
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      }
-    },
-    {
-      "Id": "303dd486-a389-48c2-a653-fe881c3b7d9a",
-      "Name": "SSIS.Template.ReferenceProjectParametersToEnvironmentVairables",
-      "Label": "Reference project parameters to environment variables",
-      "HelpText": "Checking this box will make Project Parameters reference Environment Variables.  If the Environment Variable doesn't exist, it will create it.  This expects that an Octopus variable of the same name exists.",
-      "DefaultValue": "False",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Checkbox"
-      }
-    },
-    {
-      "Id": "06079e96-3c10-4137-9c99-83da2051f8be",
-      "Name": "SSIS.Template.ReferencePackageParametersToEnvironmentVairables",
-      "Label": "Reference package parameters to environment variables",
-      "HelpText": "Checking this box will make Package Parameters reference Environment Variables.  If the Environment Variable doesn't exist, it will create it.  This expects than an Octopus variable of the same name exists.",
-      "DefaultValue": "False",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Checkbox"
-      }
-    },
-    {
-      "Id": "8c219bf1-0715-4c21-a131-f7bfb44690cd",
-      "Name": "SSIS.Template.UseFullyQualifiedVariableNames",
-      "Label": "Use Fully Qualified Variable Names",
-      "HelpText": "When true the package variables names must be represented in `dtsx_name_without_extension.variable_name`",
-      "DefaultValue": "False",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Checkbox"
-      }
-    },
-    {
-      "Id": "6b29c969-3928-4faf-af17-0911d777d5b1",
-      "Name": "SSIS.Template.UseCustomFilter",
-      "Label": "Use Custom Filter for connection manager properties",
-      "HelpText": "Custom filter should contain the regular expression for ignoring properties when setting will occur during the auto-mapping",
-      "DefaultValue": "False",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Checkbox"
-      }
-    },
-    {
-      "Id": "b33575e2-7246-4c04-b4fa-cd58e2b5e516",
-      "Name": "SSIS.Template.CustomFilter",
-      "Label": "Custom Filter for connection manager properties",
-      "HelpText": "Regular expression for filtering out the connection manager properties during the auto-mapping process. This string is used when `UseCustomFilter` is set to true",
-      "DefaultValue": "",
-      "DisplaySettings": {
-        "Octopus.ControlType": "SingleLineText"
-      }
-    },
-    {
-      "Id": "92b546d9-abf3-45e4-a61b-0315c21455df",
-      "Name": "SSIS.Template.SyncEnvironment",
-      "Label": "Clean obsolete variables from environment",
-      "HelpText": "When `true` synchronizes the environment:\n- Removes obsolete variables\n- Removes renamed variables\n- Replaces values of valid variables (also when `false`)",
-      "DefaultValue": "False",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Checkbox"
-      }
-    },
-    {
-      "Id": "6a1fa441-9e14-4c13-b7f3-9c932d9b4e8e",
-      "Name": "SSIS.Template.ssisPackageId",
-      "Label": "Package Id",
-      "HelpText": "Id of the package to deploy, used to support deployment with Workers.",
-      "DefaultValue": "",
-      "DisplaySettings": {
-        "Octopus.ControlType": "Package"
-      }
-    }
-  ],
-  "$Meta": {
-    "ExportedAt": "2026-03-13T09:17:00.0000000",
-    "OctopusVersion": "2025.4.10250",
-    "Type": "ActionTemplate"
-  },
-  "LastModifiedBy": "bcullman",
-  "Category": "sql"
-}
diff --git a/tools/migrate-source-first-reset.js b/tools/migrate-source-first-reset.js
new file mode 100644
index 000000000..03fa57915
--- /dev/null
+++ b/tools/migrate-source-first-reset.js
@@ -0,0 +1,329 @@
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const readline = require("readline/promises");
+const { stdin, stdout } = require("process");
+const { execFileSync } = require("child_process");
+
+const repoRoot = path.resolve(__dirname, "..");
+const legacyRoot = path.join(repoRoot, "step-templates");
+const legacyLogosRoot = path.join(legacyRoot, "logos");
+const sourceRoot = path.join(repoRoot, "src", "step-templates");
+const backupRoot = path.join(repoRoot, "step-templates-orig");
+const gitignorePath = path.join(repoRoot, ".gitignore");
+const legacyAllowlistStart = "# BEGIN source-first legacy template allowlist";
+const legacyAllowlistEnd = "# END source-first legacy template allowlist";
+
+function normalizeTemplateName(value) {
+  return value.trim().replace(/\.json$/i, "");
+}
+
+function parseSelectedTemplateNames(argv) {
+  const selectedTemplateNames = [];
+  const templatePrefixes = [];
+  const positionalTemplateNames = [];
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const value = argv[index].trim();
+    if (!value) {
+      continue;
+    }
+
+    if (value === "--template") {
+      const nextValue = argv[index + 1];
+      if (!nextValue || nextValue.startsWith("--")) {
+        throw new Error("Missing value for --template");
+      }
+
+      selectedTemplateNames.push(normalizeTemplateName(nextValue));
+      index += 1;
+      continue;
+    }
+
+    if (value === "--template-prefix") {
+      const nextValue = argv[index + 1];
+      if (!nextValue || nextValue.startsWith("--")) {
+        throw new Error("Missing value for --template-prefix");
+      }
+
+      templatePrefixes.push(nextValue.trim());
+      index += 1;
+      continue;
+    }
+
+    positionalTemplateNames.push(normalizeTemplateName(value));
+  }
+
+  const allTemplateNames = listMigratedTemplateNames();
+  const prefixMatchedTemplateNames = templatePrefixes.flatMap((prefix) => allTemplateNames.filter((templateName) => templateName.startsWith(prefix)));
+  const resolvedTemplateNames = [...selectedTemplateNames, ...positionalTemplateNames, ...prefixMatchedTemplateNames]
+    .filter(Boolean)
+    .filter((value, index, values) => values.indexOf(value) === index)
+    .sort();
+
+  if (resolvedTemplateNames.length === 0) {
+    throw new Error(
+      "Specify one or more templates with --template <name>, --template-prefix <prefix>, or positional template names. Example: node tools/migrate-source-first-reset.js --template Jenkins-Queue-Job --template-prefix github-"
+    );
+  }
+
+  return resolvedTemplateNames;
+}
+
+function runGit(args) {
+  execFileSync("git", args, {
+    cwd: repoRoot,
+    stdio: "inherit",
+  });
+}
+
+function captureGit(args) {
+  return execFileSync("git", args, {
+    cwd: repoRoot,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "inherit"],
+  }).trim();
+}
+
+function pathExists(targetPath) {
+  return fs.existsSync(targetPath);
+}
+
+function removePath(targetPath) {
+  if (pathExists(targetPath)) {
+    fs.rmSync(targetPath, { recursive: true, force: true });
+  }
+}
+
+function getRelativePath(absolutePath) {
+  return path.relative(repoRoot, absolutePath);
+}
+
+function getLegacyTemplateJsonPath(templateName) {
+  return path.join(legacyRoot, `${templateName}.json`);
+}
+
+function getSourceTemplateDirectory(templateName) {
+  return path.join(sourceRoot, templateName);
+}
+
+function getSourceMetadataPath(templateName) {
+  return path.join(getSourceTemplateDirectory(templateName), "metadata.json");
+}
+
+function getSourceTemplateLogoPath(templateName) {
+  return path.join(getSourceTemplateDirectory(templateName), "logo.png");
+}
+
+function ensureDirectory(directoryPath) {
+  fs.mkdirSync(directoryPath, { recursive: true });
+}
+
+function isTrackedAtHead(targetPath) {
+  return captureGit(["ls-tree", "--name-only", "HEAD", targetPath]).length > 0;
+}
+
+function listTemplateJsonFiles(rootPath) {
+  if (!pathExists(rootPath)) {
+    return [];
+  }
+
+  return fs
+    .readdirSync(rootPath)
+    .filter((entry) => entry.endsWith(".json"))
+    .sort();
+}
+
+function listLegacyTemplateNames() {
+  return listTemplateJsonFiles(legacyRoot).map((fileName) => fileName.replace(/\.json$/i, ""));
+}
+
+function listMigratedTemplateNames() {
+  if (!pathExists(sourceRoot)) {
+    return [];
+  }
+
+  return fs
+    .readdirSync(sourceRoot)
+    .filter((entry) => !["logos", "tests"].includes(entry))
+    .filter((entry) => pathExists(path.join(sourceRoot, entry, "metadata.json")))
+    .sort();
+}
+
+function readJson(jsonPath) {
+  return JSON.parse(fs.readFileSync(jsonPath, "utf8"));
+}
+
+function getTemplateCategoryId(template) {
+  return ((template.Category || "other") + "").toLowerCase();
+}
+
+function getTemplateCategoryIdForMigratedTemplate(templateName) {
+  const metadataPath = getSourceMetadataPath(templateName);
+  return pathExists(metadataPath) ? getTemplateCategoryId(readJson(metadataPath)) : null;
+}
+
+function getTemplateCategoryIdForLegacyTemplate(templateName) {
+  const legacyJsonPath = getLegacyTemplateJsonPath(templateName);
+  return pathExists(legacyJsonPath) ? getTemplateCategoryId(readJson(legacyJsonPath)) : null;
+}
+
+function listMigratedTemplatesUsingCategory(categoryId) {
+  return listMigratedTemplateNames().filter((templateName) => getTemplateCategoryIdForMigratedTemplate(templateName) === categoryId);
+}
+
+function listLegacyTemplatesUsingCategory(categoryId) {
+  return listLegacyTemplateNames().filter((templateName) => !pathExists(getSourceMetadataPath(templateName)) && getTemplateCategoryIdForLegacyTemplate(templateName) === categoryId);
+}
+
+function getLogoPath(rootPath, categoryId) {
+  return path.join(rootPath, `${categoryId}.png`);
+}
+
+function reconcileCategoryLogo(categoryId) {
+  const legacyLogoPath = getLogoPath(legacyLogosRoot, categoryId);
+  const migratedUsers = listMigratedTemplatesUsingCategory(categoryId);
+  const legacyUsers = listLegacyTemplatesUsingCategory(categoryId);
+  const totalUsers = Array.from(new Set([...migratedUsers, ...legacyUsers]));
+  const legacyExists = pathExists(legacyLogoPath);
+  const sourceLogoPaths = migratedUsers.map(getSourceTemplateLogoPath);
+  const firstExistingSourceLogoPath = sourceLogoPaths.find((logoPath) => pathExists(logoPath));
+  const seedLogoPath = legacyExists ? legacyLogoPath : firstExistingSourceLogoPath;
+
+  if (totalUsers.length === 0 || !seedLogoPath) {
+    return;
+  }
+
+  if (totalUsers.length === 1 && migratedUsers.length === 1 && legacyUsers.length === 0 && legacyExists) {
+    const targetLogoPath = getSourceTemplateLogoPath(migratedUsers[0]);
+    ensureDirectory(getSourceTemplateDirectory(migratedUsers[0]));
+    runGit(["mv", getRelativePath(legacyLogoPath), getRelativePath(targetLogoPath)]);
+    return;
+  }
+
+  for (const templateName of migratedUsers) {
+    const templateLogoPath = getSourceTemplateLogoPath(templateName);
+    if (pathExists(templateLogoPath)) {
+      continue;
+    }
+
+    ensureDirectory(getSourceTemplateDirectory(templateName));
+    fs.copyFileSync(seedLogoPath, templateLogoPath);
+  }
+
+  if (legacyUsers.length === 0 && legacyExists) {
+    if (!(totalUsers.length === 1 && migratedUsers.length === 1)) {
+      fs.rmSync(legacyLogoPath, { force: true });
+    }
+    return;
+  }
+
+  if (legacyUsers.length > 0 && !legacyExists) {
+    ensureDirectory(legacyLogosRoot);
+    fs.copyFileSync(seedLogoPath, legacyLogoPath);
+  }
+}
+
+function syncLegacyTemplateAllowlist() {
+  const allLegacyTemplateNames = listLegacyTemplateNames().filter((templateName) => !pathExists(getSourceMetadataPath(templateName)));
+  const sectionLines = [legacyAllowlistStart, "/step-templates/*.json", ...allLegacyTemplateNames.map((templateName) => `!/step-templates/${templateName}.json`), legacyAllowlistEnd];
+  const currentContent = fs.readFileSync(gitignorePath, "utf8");
+  const startIndex = currentContent.indexOf(legacyAllowlistStart);
+  const endIndex = currentContent.indexOf(legacyAllowlistEnd);
+  const sectionText = `${sectionLines.join("\n")}\n`;
+  let updatedContent;
+
+  if (startIndex >= 0 && endIndex >= startIndex) {
+    const sectionEnd = endIndex + legacyAllowlistEnd.length;
+    updatedContent = `${currentContent.slice(0, startIndex)}${sectionText}${currentContent.slice(sectionEnd).replace(/^\n*/, "")}`;
+  } else {
+    updatedContent = `${currentContent.replace(/\s*$/, "\n\n")}${sectionText}`;
+  }
+
+  fs.writeFileSync(gitignorePath, updatedContent);
+}
+
+async function confirmReset(rl, selectedTemplateNames) {
+  const answer = (await rl.question(`Reset these templates back to branch HEAD? (${selectedTemplateNames.join(", ")}) [y/N] `)).trim().toLowerCase();
+  return answer === "y" || answer === "yes";
+}
+
+function restoreTemplateState(templateName) {
+  const legacyJsonPath = getLegacyTemplateJsonPath(templateName);
+  const sourceTemplateDirectory = getSourceTemplateDirectory(templateName);
+  const sourceMetadataPath = getSourceMetadataPath(templateName);
+
+  if (isTrackedAtHead(getRelativePath(legacyJsonPath))) {
+    runGit(["restore", "--source=HEAD", "--staged", "--worktree", getRelativePath(legacyJsonPath)]);
+  }
+
+  if (isTrackedAtHead(getRelativePath(sourceTemplateDirectory))) {
+    runGit(["restore", "--source=HEAD", "--staged", "--worktree", getRelativePath(sourceTemplateDirectory)]);
+  } else {
+    runGit(["rm", "-r", "-f", "--cached", "--ignore-unmatch", getRelativePath(sourceTemplateDirectory)]);
+    removePath(sourceTemplateDirectory);
+  }
+
+  if (!pathExists(sourceMetadataPath)) {
+    removePath(sourceTemplateDirectory);
+  }
+}
+
+async function main() {
+  const selectedTemplateNames = parseSelectedTemplateNames(process.argv.slice(2));
+  const rl = readline.createInterface({ input: stdin, output: stdout });
+
+  try {
+    console.log("Source-first migration reset");
+    console.log(`Repo root: ${repoRoot}`);
+    console.log(`Templates: ${selectedTemplateNames.join(", ")}`);
+    console.log("This will:");
+    console.log("- restore the selected templates to current branch HEAD");
+    console.log("- refresh the legacy-template allowlist in .gitignore");
+    console.log("- reconcile any logo state affected by the selected templates");
+    console.log("- remove step-templates-orig/");
+
+    const confirmed = await confirmReset(rl, selectedTemplateNames);
+    if (!confirmed) {
+      console.log("Aborted.");
+      return;
+    }
+
+    const affectedCategoryIds = new Set();
+    for (const templateName of selectedTemplateNames) {
+      const metadataPath = getSourceMetadataPath(templateName);
+      const legacyJsonPath = getLegacyTemplateJsonPath(templateName);
+
+      if (pathExists(metadataPath)) {
+        affectedCategoryIds.add(getTemplateCategoryId(readJson(metadataPath)));
+      } else if (pathExists(legacyJsonPath)) {
+        affectedCategoryIds.add(getTemplateCategoryId(readJson(legacyJsonPath)));
+      }
+    }
+
+    for (const templateName of selectedTemplateNames) {
+      restoreTemplateState(templateName);
+    }
+
+    for (const categoryId of affectedCategoryIds) {
+      reconcileCategoryLogo(categoryId);
+    }
+
+    syncLegacyTemplateAllowlist();
+    removePath(backupRoot);
+
+    console.log("Reset complete.");
+    console.log("- restored selected templates to branch HEAD");
+    console.log("- refreshed .gitignore allowlist");
+    console.log("- reconciled affected logos");
+    console.log("- removed step-templates-orig/");
+  } finally {
+    rl.close();
+  }
+}
+
+main().catch((error) => {
+  console.error(error.message || error);
+  process.exit(1);
+});
diff --git a/tools/migrate-source-first.js b/tools/migrate-source-first.js
new file mode 100644
index 000000000..79cf0303a
--- /dev/null
+++ b/tools/migrate-source-first.js
@@ -0,0 +1,751 @@
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const readline = require("readline/promises");
+const { stdin, stdout } = require("process");
+const { execFileSync } = require("child_process");
+
+const repoRoot = path.resolve(__dirname, "..");
+const legacyRoot = path.join(repoRoot, "step-templates");
+const legacyLogosRoot = path.join(legacyRoot, "logos");
+const backupRoot = path.join(repoRoot, "step-templates-orig");
+const sourceRoot = path.join(repoRoot, "src", "step-templates");
+const placeholderPrefix = "__SOURCE_FILE__:";
+const gitignorePath = path.join(repoRoot, ".gitignore");
+const legacyAllowlistStart = "# BEGIN source-first legacy template allowlist";
+const legacyAllowlistEnd = "# END source-first legacy template allowlist";
+const ansiReset = "\u001b[0m";
+const ansiBold = "\u001b[1m";
+const ansiDim = "\u001b[2m";
+const ansiGreen = "\u001b[32m";
+const ansiRed = "\u001b[31m";
+const ansiYellow = "\u001b[33m";
+const ansiBlue = "\u001b[34m";
+const ansiCyan = "\u001b[36m";
+
+const scriptDefinitions = [
+  {
+    sourceBaseName: "scriptbody",
+    legacyBaseName: "ScriptBody",
+    propertyName: "Octopus.Action.Script.ScriptBody",
+    getExtension(template) {
+      const syntax = (((template || {}).Properties || {})["Octopus.Action.Script.Syntax"] || "PowerShell").toLowerCase();
+      if (syntax === "bash") {
+        return ".sh";
+      }
+
+      if (syntax === "python") {
+        return ".py";
+      }
+
+      return ".ps1";
+    },
+    shouldExtract(template) {
+      const properties = (template || {}).Properties || {};
+      const scriptSource = properties["Octopus.Action.Script.ScriptSource"] || "Inline";
+      return scriptSource === "Inline" && typeof properties[this.propertyName] === "string" && properties[this.propertyName].length > 0;
+    },
+  },
+  {
+    sourceBaseName: "predeploy",
+    legacyBaseName: "PreDeploy",
+    propertyName: "Octopus.Action.CustomScripts.PreDeploy.ps1",
+    getExtension() {
+      return ".ps1";
+    },
+    shouldExtract(template) {
+      const value = (((template || {}).Properties || {})[this.propertyName] || "");
+      return typeof value === "string" && value.length > 0;
+    },
+  },
+  {
+    sourceBaseName: "deploy",
+    legacyBaseName: "Deploy",
+    propertyName: "Octopus.Action.CustomScripts.Deploy.ps1",
+    getExtension() {
+      return ".ps1";
+    },
+    shouldExtract(template) {
+      const value = (((template || {}).Properties || {})[this.propertyName] || "");
+      return typeof value === "string" && value.length > 0;
+    },
+  },
+  {
+    sourceBaseName: "postdeploy",
+    legacyBaseName: "PostDeploy",
+    propertyName: "Octopus.Action.CustomScripts.PostDeploy.ps1",
+    getExtension() {
+      return ".ps1";
+    },
+    shouldExtract(template) {
+      const value = (((template || {}).Properties || {})[this.propertyName] || "");
+      return typeof value === "string" && value.length > 0;
+    },
+  },
+];
+
+const excludedValidationFields = new Set(["ExportedAt", "LastModifiedOn", "LastModifiedAt", "LastModfiedAt"]);
+
+function normalizeTemplateName(value) {
+  return value.trim().replace(/\.json$/i, "");
+}
+
+function parseSelectedTemplateNames(argv) {
+  const selectedTemplateNames = [];
+  const templatePrefixes = [];
+  const positionalTemplateNames = [];
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const value = argv[index].trim();
+    if (!value) {
+      continue;
+    }
+
+    if (value === "--template") {
+      const nextValue = argv[index + 1];
+      if (!nextValue || nextValue.startsWith("--")) {
+        throw new Error("Missing value for --template");
+      }
+
+      selectedTemplateNames.push(normalizeTemplateName(nextValue));
+      index += 1;
+      continue;
+    }
+
+    if (value === "--template-prefix") {
+      const nextValue = argv[index + 1];
+      if (!nextValue || nextValue.startsWith("--")) {
+        throw new Error("Missing value for --template-prefix");
+      }
+
+      templatePrefixes.push(nextValue.trim());
+      index += 1;
+      continue;
+    }
+
+    positionalTemplateNames.push(normalizeTemplateName(value));
+  }
+
+  const allTemplateNames = listLegacyTemplateNames();
+  const prefixMatchedTemplateNames = templatePrefixes.flatMap((prefix) => allTemplateNames.filter((templateName) => templateName.startsWith(prefix)));
+  const resolvedTemplateNames = [...selectedTemplateNames, ...positionalTemplateNames, ...prefixMatchedTemplateNames]
+    .filter(Boolean)
+    .filter((value, index, values) => values.indexOf(value) === index)
+    .sort();
+
+  if (resolvedTemplateNames.length === 0) {
+    throw new Error(
+      "Specify one or more templates with --template <name>, --template-prefix <prefix>, or positional template names. Example: node tools/migrate-source-first.js --template Jenkins-Queue-Job --template-prefix github-"
+    );
+  }
+
+  return resolvedTemplateNames;
+}
+
+function listTemplateJsonFiles(rootPath) {
+  if (!fs.existsSync(rootPath)) {
+    return [];
+  }
+
+  return fs
+    .readdirSync(rootPath)
+    .filter((entry) => entry.endsWith(".json"))
+    .sort();
+}
+
+function listLegacyTemplateNames() {
+  return listTemplateJsonFiles(legacyRoot).map(getTemplateNameFromFileName);
+}
+
+function listMigratedTemplateNames() {
+  if (!fs.existsSync(sourceRoot)) {
+    return [];
+  }
+
+  return fs
+    .readdirSync(sourceRoot)
+    .filter((entry) => !["logos", "tests"].includes(entry))
+    .filter((entry) => fs.existsSync(path.join(sourceRoot, entry, "metadata.json")))
+    .sort();
+}
+
+function runGit(args) {
+  execFileSync("git", args, {
+    cwd: repoRoot,
+    stdio: "inherit",
+  });
+}
+
+function colorize(color, text) {
+  return `${color}${text}${ansiReset}`;
+}
+
+function log(message, type = "info") {
+  if (type === "blank") {
+    console.log("");
+    return;
+  }
+
+  if (type === "banner") {
+    console.log(colorize(ansiBold + ansiBlue, message));
+    return;
+  }
+
+  if (type === "error") {
+    console.log(colorize(ansiBold + ansiRed, message));
+    return;
+  }
+
+  if (type === "step") {
+    console.log("");
+    console.log(colorize(ansiBold + ansiBlue, message));
+    return;
+  }
+
+  if (type === "note") {
+    console.log(colorize(ansiYellow, `NOTE ${message}`));
+    return;
+  }
+
+  if (type === "success") {
+    console.log(`${colorize(ansiGreen, "DONE")} ${message}`);
+    return;
+  }
+
+  if (type === "action") {
+    console.log(`${colorize(ansiCyan, "ACTION")} ${message}`);
+    return;
+  }
+
+  if (type === "pass") {
+    console.log(`${ansiGreen}PASS${ansiReset} ${message}`);
+    return;
+  }
+
+  if (type === "fail") {
+    console.log(`${ansiRed}FAIL${ansiReset} ${message}`);
+    return;
+  }
+
+  console.log(message);
+}
+
+function normalizeForComparison(value) {
+  if (Array.isArray(value)) {
+    return value.map(normalizeForComparison);
+  }
+
+  if (value && typeof value === "object") {
+    const result = {};
+    for (const [key, childValue] of Object.entries(value)) {
+      if (excludedValidationFields.has(key)) {
+        continue;
+      }
+
+      result[key] = normalizeForComparison(childValue);
+    }
+
+    return result;
+  }
+
+  return value;
+}
+
+function diffObjects(left, right, currentPath = "$") {
+  if (typeof left !== typeof right) {
+    return [`${currentPath}: type mismatch (${typeof left} !== ${typeof right})`];
+  }
+
+  if (Array.isArray(left) && Array.isArray(right)) {
+    if (left.length !== right.length) {
+      return [`${currentPath}: array length mismatch (${left.length} !== ${right.length})`];
+    }
+
+    for (let index = 0; index < left.length; index += 1) {
+      const nested = diffObjects(left[index], right[index], `${currentPath}[${index}]`);
+      if (nested.length > 0) {
+        return nested;
+      }
+    }
+
+    return [];
+  }
+
+  if (left && typeof left === "object" && right && typeof right === "object") {
+    const leftKeys = Object.keys(left).sort();
+    const rightKeys = Object.keys(right).sort();
+
+    if (leftKeys.join("|") !== rightKeys.join("|")) {
+      return [`${currentPath}: key mismatch (${leftKeys.join(", ")} !== ${rightKeys.join(", ")})`];
+    }
+
+    for (const key of leftKeys) {
+      const nested = diffObjects(left[key], right[key], `${currentPath}.${key}`);
+      if (nested.length > 0) {
+        return nested;
+      }
+    }
+
+    return [];
+  }
+
+  if (left !== right) {
+    return [`${currentPath}: value mismatch (${JSON.stringify(left)} !== ${JSON.stringify(right)})`];
+  }
+
+  return [];
+}
+
+async function confirmStep(rl, prompt) {
+  const answer = (await rl.question(`${prompt} [y/N] `)).trim().toLowerCase();
+  if (answer !== "y" && answer !== "yes") {
+    log("Aborted.");
+    return false;
+  }
+
+  return true;
+}
+
+function getTemplateNameFromFileName(fileName) {
+  return fileName.replace(/\.json$/i, "");
+}
+
+function getLegacyTemplateJsonPath(templateName) {
+  return path.join(legacyRoot, `${templateName}.json`);
+}
+
+function getBackupTemplateJsonPath(templateName) {
+  return path.join(backupRoot, `${templateName}.json`);
+}
+
+function getSourceTemplateDirectory(templateName) {
+  return path.join(sourceRoot, templateName);
+}
+
+function getSourceMetadataPath(templateName) {
+  return path.join(getSourceTemplateDirectory(templateName), "metadata.json");
+}
+
+function getSourceTemplateLogoPath(templateName) {
+  return path.join(getSourceTemplateDirectory(templateName), "logo.png");
+}
+
+function getRelativePath(absolutePath) {
+  return path.relative(repoRoot, absolutePath);
+}
+
+function ensureDirectory(directoryPath) {
+  fs.mkdirSync(directoryPath, { recursive: true });
+}
+
+function readJson(jsonPath) {
+  return JSON.parse(fs.readFileSync(jsonPath, "utf8"));
+}
+
+function getTemplateCategoryId(template) {
+  return ((template.Category || "other") + "").toLowerCase();
+}
+
+function getTemplateCategoryIdForMigratedTemplate(templateName) {
+  const metadataPath = getSourceMetadataPath(templateName);
+  if (!fs.existsSync(metadataPath)) {
+    return null;
+  }
+
+  return getTemplateCategoryId(readJson(metadataPath));
+}
+
+function getTemplateCategoryIdForLegacyTemplate(templateName) {
+  const legacyJsonPath = getLegacyTemplateJsonPath(templateName);
+  if (!fs.existsSync(legacyJsonPath)) {
+    return null;
+  }
+
+  return getTemplateCategoryId(readJson(legacyJsonPath));
+}
+
+function listMigratedTemplatesUsingCategory(categoryId) {
+  return listMigratedTemplateNames().filter((templateName) => getTemplateCategoryIdForMigratedTemplate(templateName) === categoryId);
+}
+
+function listLegacyTemplatesUsingCategory(categoryId) {
+  return listLegacyTemplateNames().filter((templateName) => !fs.existsSync(getSourceMetadataPath(templateName)) && getTemplateCategoryIdForLegacyTemplate(templateName) === categoryId);
+}
+
+function getLogoPath(rootPath, categoryId) {
+  return path.join(rootPath, `${categoryId}.png`);
+}
+
+function reconcileCategoryLogo(categoryId) {
+  const legacyLogoPath = getLogoPath(legacyLogosRoot, categoryId);
+  const migratedUsers = listMigratedTemplatesUsingCategory(categoryId);
+  const legacyUsers = listLegacyTemplatesUsingCategory(categoryId);
+  const totalUsers = Array.from(new Set([...migratedUsers, ...legacyUsers]));
+  const legacyExists = fs.existsSync(legacyLogoPath);
+  const sourceLogoPaths = migratedUsers.map(getSourceTemplateLogoPath);
+  const firstExistingSourceLogoPath = sourceLogoPaths.find((logoPath) => fs.existsSync(logoPath));
+  const seedLogoPath = legacyExists ? legacyLogoPath : firstExistingSourceLogoPath;
+
+  if (totalUsers.length === 0 || !seedLogoPath) {
+    return;
+  }
+
+  if (totalUsers.length === 1 && migratedUsers.length === 1 && legacyUsers.length === 0 && legacyExists) {
+    const targetLogoPath = getSourceTemplateLogoPath(migratedUsers[0]);
+    ensureDirectory(getSourceTemplateDirectory(migratedUsers[0]));
+    log(`MOVE ${getRelativePath(legacyLogoPath)} -> ${getRelativePath(targetLogoPath)} ${colorize(ansiDim, "(preserve history)")}`, "action");
+    runGit(["mv", getRelativePath(legacyLogoPath), getRelativePath(targetLogoPath)]);
+    return;
+  }
+
+  for (const templateName of migratedUsers) {
+    const templateLogoPath = getSourceTemplateLogoPath(templateName);
+    if (fs.existsSync(templateLogoPath)) {
+      continue;
+    }
+
+    ensureDirectory(getSourceTemplateDirectory(templateName));
+    fs.copyFileSync(seedLogoPath, templateLogoPath);
+    log(`COPY ${getRelativePath(seedLogoPath)} -> ${getRelativePath(templateLogoPath)} ${colorize(ansiDim, "(template logo)")}`, "action");
+  }
+
+  if (legacyUsers.length === 0 && legacyExists) {
+    if (!(totalUsers.length === 1 && migratedUsers.length === 1)) {
+      fs.rmSync(legacyLogoPath, { force: true });
+      log(`REMOVE ${getRelativePath(legacyLogoPath)} ${colorize(ansiDim, "(last legacy user migrated)")}`, "action");
+    }
+    return;
+  }
+
+  if (legacyUsers.length > 0 && !legacyExists) {
+    ensureDirectory(legacyLogosRoot);
+    fs.copyFileSync(seedLogoPath, legacyLogoPath);
+    log(`COPY ${getRelativePath(seedLogoPath)} -> ${getRelativePath(legacyLogoPath)} ${colorize(ansiDim, "(restore legacy logo)")}`, "action");
+  }
+}
+
+function syncLegacyTemplateAllowlist() {
+  const allLegacyTemplateNames = listLegacyTemplateNames().filter((templateName) => !fs.existsSync(getSourceMetadataPath(templateName)));
+  const sectionLines = [legacyAllowlistStart, "/step-templates/*.json", ...allLegacyTemplateNames.map((templateName) => `!/step-templates/${templateName}.json`), legacyAllowlistEnd];
+  const currentContent = fs.readFileSync(gitignorePath, "utf8");
+  const startIndex = currentContent.indexOf(legacyAllowlistStart);
+  const endIndex = currentContent.indexOf(legacyAllowlistEnd);
+  const sectionText = `${sectionLines.join("\n")}\n`;
+  let updatedContent;
+
+  if (startIndex >= 0 && endIndex >= startIndex) {
+    const sectionEnd = endIndex + legacyAllowlistEnd.length;
+    updatedContent = `${currentContent.slice(0, startIndex)}${sectionText}${currentContent.slice(sectionEnd).replace(/^\n*/, "")}`;
+  } else {
+    updatedContent = `${currentContent.replace(/\s*$/, "\n\n")}${sectionText}`;
+  }
+
+  fs.writeFileSync(gitignorePath, updatedContent);
+  log(`Updated .gitignore legacy template allowlist (${allLegacyTemplateNames.length} remaining legacy templates)`, "success");
+}
+
+function ensureSelectedTemplatesCanMigrate(selectedTemplateNames) {
+  for (const templateName of selectedTemplateNames) {
+    const legacyJsonPath = getLegacyTemplateJsonPath(templateName);
+    if (!fs.existsSync(legacyJsonPath)) {
+      throw new Error(`Legacy template JSON is missing: ${getRelativePath(legacyJsonPath)}`);
+    }
+
+    if (fs.existsSync(getSourceMetadataPath(templateName))) {
+      throw new Error(`Template is already migrated: ${templateName}`);
+    }
+  }
+}
+
+async function step1_DupeStepTemplateJsonFilesForValidationBaseline(rl, selectedTemplateNames) {
+  log("Step 1: Prepare validation baseline", "step");
+  log("This creates a frozen pre-migration copy of the selected step-template JSON files.");
+  log("The copied files are written to step-templates-orig/ at the repo root.");
+  log("The copy is unpacked so we can later compare rebuilt source-first output to the original selected template state.");
+  log(`Selected templates: ${selectedTemplateNames.join(", ")}`);
+
+  if (fs.existsSync(backupRoot)) {
+    log("step-templates-orig/ already exists and will be replaced.", "note");
+  }
+
+  if (!(await confirmStep(rl, "Prepare the validation baseline?"))) {
+    return false;
+  }
+
+  syncLegacyTemplateAllowlist();
+
+  fs.rmSync(backupRoot, { recursive: true, force: true });
+  fs.mkdirSync(backupRoot, { recursive: true });
+
+  for (const templateName of selectedTemplateNames) {
+    const legacyJsonPath = getLegacyTemplateJsonPath(templateName);
+    const backupJsonPath = getBackupTemplateJsonPath(templateName);
+    const template = readJson(legacyJsonPath);
+    const unpackedSidecars = [];
+
+    fs.copyFileSync(legacyJsonPath, backupJsonPath);
+
+    for (const definition of scriptDefinitions) {
+      if (!definition.shouldExtract(template)) {
+        continue;
+      }
+
+      const extension = definition.getExtension(template);
+      const sidecarPath = path.join(backupRoot, `${templateName}.${definition.legacyBaseName}${extension}`);
+      const value = template.Properties[definition.propertyName];
+      fs.writeFileSync(sidecarPath, value, "utf8");
+      unpackedSidecars.push(path.basename(sidecarPath));
+    }
+
+    if (unpackedSidecars.length > 0) {
+      log(`UNPACK ${templateName}.json -> ${unpackedSidecars.join(", ")}`, "action");
+    } else {
+      log(`UNPACK ${templateName}.json -> ${colorize(ansiDim, "no sidecars")}`, "action");
+    }
+  }
+
+  log("Created step-templates-orig/ for selected templates", "success");
+  log("Unpacked reference sidecars for selected templates", "success");
+  return true;
+}
+
+async function step2_GitMoveStepTemplateJsonFilesToSrcAsMetadataJsonFiles(rl, selectedTemplateNames) {
+  log("Step 2: Move JSON templates into the source tree with history", "step");
+  log("Each selected step-template JSON file is moved with git history into src/step-templates/<template>/metadata.json.");
+  log("metadata.json is the file that retains the existing JSON history after the split.");
+  log("Logo files are migrated incrementally based on whether legacy templates still depend on them.");
+
+  if (!(await confirmStep(rl, "Move the selected templates into the new source tree?"))) {
+    return false;
+  }
+
+  ensureDirectory(sourceRoot);
+
+  const affectedCategoryIds = new Set();
+
+  for (const templateName of selectedTemplateNames) {
+    const legacyJsonPath = getLegacyTemplateJsonPath(templateName);
+    const categoryId = getTemplateCategoryId(readJson(legacyJsonPath));
+    const targetDirectory = getSourceTemplateDirectory(templateName);
+    const targetMetadataPath = getSourceMetadataPath(templateName);
+
+    if (fs.existsSync(targetDirectory)) {
+      throw new Error(`Target directory already exists: ${getRelativePath(targetDirectory)}`);
+    }
+
+    fs.mkdirSync(targetDirectory, { recursive: true });
+    log(`MOVE ${getRelativePath(legacyJsonPath)} -> ${getRelativePath(targetMetadataPath)} ${colorize(ansiDim, "(preserve history)")}`, "action");
+    runGit(["mv", getRelativePath(legacyJsonPath), getRelativePath(targetMetadataPath)]);
+    affectedCategoryIds.add(categoryId);
+  }
+
+  for (const categoryId of affectedCategoryIds) {
+    reconcileCategoryLogo(categoryId);
+  }
+
+  syncLegacyTemplateAllowlist();
+  log("Moved selected template JSON files into src/step-templates/.../metadata.json", "success");
+  return true;
+}
+
+async function step3_SplitSrcMetadataJsonFilesIntoConstituentFiles(rl, selectedTemplateNames) {
+  log("Step 3: Split source templates into constituent files", "step");
+  log("Inline script content is extracted from metadata.json into dedicated source files beside each selected template.");
+  log("Octopus.Action.Script.ScriptBody becomes scriptbody.ps1, scriptbody.sh, or scriptbody.py based on script syntax.");
+  log("metadata.json stays as the history-carrying file, and placeholders are written so the existing pack tooling can rebuild the legacy JSON.");
+
+  if (!(await confirmStep(rl, "Split inline script content into source sidecar files?"))) {
+    return false;
+  }
+
+  for (const templateName of selectedTemplateNames) {
+    const metadataPath = getSourceMetadataPath(templateName);
+    const template = readJson(metadataPath);
+    template.Properties = template.Properties || {};
+    const extractedSidecars = [];
+
+    for (const definition of scriptDefinitions) {
+      if (!definition.shouldExtract(template)) {
+        continue;
+      }
+
+      const extension = definition.getExtension(template);
+      const sourceSidecarPath = path.join(getSourceTemplateDirectory(templateName), `${definition.sourceBaseName}${extension}`);
+      const value = template.Properties[definition.propertyName];
+
+      fs.writeFileSync(sourceSidecarPath, value, "utf8");
+      template.Properties[definition.propertyName] = `${placeholderPrefix}${path.basename(sourceSidecarPath)}`;
+      extractedSidecars.push(path.basename(sourceSidecarPath));
+    }
+
+    fs.writeFileSync(metadataPath, `${JSON.stringify(template, null, 2)}\n`);
+
+    if (extractedSidecars.length > 0) {
+      log(`EXTRACT ${templateName}.json -> ${extractedSidecars.join(", ")}`, "action");
+    } else {
+      log(`EXTRACT ${templateName}.json -> ${colorize(ansiDim, "no sidecars")}`, "action");
+    }
+  }
+
+  log("Extracted source sidecars and replaced metadata placeholders for selected templates", "success");
+  return true;
+}
+
+function ensureBuildDependencies(rl) {
+  return (async () => {
+    const gulpExecutable = process.platform === "win32" ? path.join(repoRoot, "node_modules", ".bin", "gulp.cmd") : path.join(repoRoot, "node_modules", ".bin", "gulp");
+
+    if (fs.existsSync(gulpExecutable)) {
+      return gulpExecutable;
+    }
+
+    log("Build dependencies are missing. Step 4 needs the existing gulp-based toolchain to rebuild step-template JSON files.", "note");
+
+    if (!(await confirmStep(rl, "Run npm ci to install the required build dependencies?"))) {
+      return null;
+    }
+
+    log("Running npm ci", "action");
+
+    try {
+      execFileSync("npm", ["ci"], {
+        cwd: repoRoot,
+        stdio: "inherit",
+      });
+    } catch (error) {
+      log("npm ci failed. This repository may require npm install because package-lock.json is not in sync with the current npm client.", "note");
+
+      if (!(await confirmStep(rl, "Run npm install instead?"))) {
+        throw new Error("Dependency installation failed while running npm ci.");
+      }
+
+      log("Running npm install", "action");
+
+      try {
+        execFileSync("npm", ["install"], {
+          cwd: repoRoot,
+          stdio: "inherit",
+        });
+      } catch (installError) {
+        throw new Error("Dependency installation failed while running npm install.");
+      }
+    }
+
+    if (!fs.existsSync(gulpExecutable)) {
+      throw new Error("Dependency installation completed, but the gulp executable is still missing.");
+    }
+
+    return gulpExecutable;
+  })();
+}
+
+async function step4_BuildStepTemplateJsonFilesFromSrcAndValidateAgainstBaseline(rl, selectedTemplateNames) {
+  log("Step 4: Rebuild and validate generated JSON output", "step");
+  log("This rebuilds step-templates/*.json from src/step-templates/ using the existing pack tooling.");
+  log("The rebuilt JSON is then compared to the frozen baseline in step-templates-orig/.");
+  log(`Only the selected templates are validated in this run: ${selectedTemplateNames.join(", ")}`);
+
+  if (!(await confirmStep(rl, "Rebuild the packed JSON and validate it against the baseline?"))) {
+    return false;
+  }
+
+  const gulpExecutable = await ensureBuildDependencies(rl);
+  if (!gulpExecutable) {
+    return false;
+  }
+
+  execFileSync(gulpExecutable, ["step-templates"], {
+    cwd: repoRoot,
+    env: {
+      ...process.env,
+      SOURCE_FIRST_TEMPLATE_FILTER: selectedTemplateNames.join(","),
+    },
+    stdio: "inherit",
+  });
+
+  log("", "blank");
+  log("Regenerated packed step-templates/*.json from src/step-templates", "success");
+
+  const mismatches = [];
+
+  log(
+    `Validation excludes regenerated metadata fields: ${Array.from(excludedValidationFields)
+      .map((fieldName) => `'${fieldName}'`)
+      .join(", ")}`,
+    "note"
+  );
+
+  for (const templateName of selectedTemplateNames) {
+    const originalJsonPath = getBackupTemplateJsonPath(templateName);
+    const generatedJsonPath = getLegacyTemplateJsonPath(templateName);
+
+    if (!fs.existsSync(generatedJsonPath)) {
+      mismatches.push(`${templateName}.json: regenerated file is missing`);
+      continue;
+    }
+
+    const original = normalizeForComparison(readJson(originalJsonPath));
+    const generated = normalizeForComparison(readJson(generatedJsonPath));
+    const diff = diffObjects(original, generated);
+
+    if (diff.length > 0) {
+      mismatches.push(`${templateName}.json: ${diff[0]}`);
+      continue;
+    }
+
+    log(`${templateName}.json`, "pass");
+  }
+
+  if (mismatches.length > 0) {
+    log("", "blank");
+    log("Validation mismatches:", "error");
+    for (const mismatch of mismatches) {
+      log(mismatch, "fail");
+    }
+
+    throw new Error(`Validation failed for ${mismatches.length} template(s).`);
+  }
+
+  syncLegacyTemplateAllowlist();
+  log("Validated regenerated step-templates/*.json against step-templates-orig/ for selected templates", "success");
+  log("Rebuilt and validated selected step-templates/*.json against step-templates-orig/", "success");
+  return true;
+}
+
+async function main() {
+  const selectedTemplateNames = parseSelectedTemplateNames(process.argv.slice(2));
+  const rl = readline.createInterface({ input: stdin, output: stdout });
+
+  try {
+    log("Source-first migration", "banner");
+    log(colorize(ansiDim, `Repo root: ${repoRoot}`));
+    log(colorize(ansiDim, "This script does not commit anything."));
+    log(colorize(ansiDim, `Templates: ${selectedTemplateNames.join(", ")}`));
+
+    ensureSelectedTemplatesCanMigrate(selectedTemplateNames);
+
+    if (!(await step1_DupeStepTemplateJsonFilesForValidationBaseline(rl, selectedTemplateNames))) {
+      return;
+    }
+
+    if (!(await step2_GitMoveStepTemplateJsonFilesToSrcAsMetadataJsonFiles(rl, selectedTemplateNames))) {
+      return;
+    }
+
+    if (!(await step3_SplitSrcMetadataJsonFilesIntoConstituentFiles(rl, selectedTemplateNames))) {
+      return;
+    }
+
+    if (!(await step4_BuildStepTemplateJsonFilesFromSrcAndValidateAgainstBaseline(rl, selectedTemplateNames))) {
+      return;
+    }
+  } finally {
+    rl.close();
+  }
+}
+
+main().catch((error) => {
+  console.error(error.message || error);
+  process.exit(1);
+});