@firestartr/cli 2.11.0-snapshot-ghpages-01 → 2.11.0-snapshot-patch-claims

package/build/index.js

@@ -128395,7 +128395,7 @@ function trasformLeg(leg) {
 
 
 function getFeatureRenderedPathForEntity(entity, featureName, basePath = '/tmp') {
-    const entityFolderName = `${entity.metadata.name}`.toLowerCase();
+    const entityFolderName = `${entity.metadata?.name ?? entity.name}`.toLowerCase();
     return external_path_default().join(basePath, entityFolderName, featureName);
 }
 function getFeatureRenderedConfigForComponent(entity, featureName, basePath = '/tmp/features') {
@@ -161689,6 +161689,19 @@ PolicyInitializer.applicableKinds = ['TFWorkspaceClaim'];
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/initializers/metadata.ts
 
+const BACKSTAGE_ANNOTATION_PREFIX = 'firestartr.backstage.dev/';
+function isCatalogEntity(cr) {
+    return cr.apiVersion === 'backstage.io/v1alpha1';
+}
+function filterBackstageAnnotations(annotations) {
+    const filtered = {};
+    for (const [key, value] of Object.entries(annotations)) {
+        if (!key.startsWith(BACKSTAGE_ANNOTATION_PREFIX)) {
+            filtered[key] = value;
+        }
+    }
+    return filtered;
+}
 class MetadataInitializer extends InitializerPatches {
     constructor() {
         super(...arguments);
@@ -161707,8 +161720,11 @@ class MetadataInitializer extends InitializerPatches {
                     if ('annotations' in claim && typeof claim.annotations === 'object') {
                         cr.metadata = cr.metadata || {};
                         const crAnnotations = cr.metadata.annotations ?? {};
+                        const claimAnnotations = isCatalogEntity(cr)
+                            ? claim.annotations
+                            : filterBackstageAnnotations(claim.annotations);
                         cr.metadata.annotations = {
-                            ...claim.annotations,
+                            ...claimAnnotations,
                             ...crAnnotations,
                         };
                     }
@@ -163661,6 +163677,7 @@ const organizationSettingsProperties = {
                 buildType: { type: 'string', enum: ['workflow', 'legacy'] },
                 source: {
                     type: 'object',
+                    required: ['branch', 'path'],
                     properties: {
                         branch: { type: 'string' },
                         path: { type: 'string', enum: ['/', '/docs'] },
@@ -164346,740 +164363,6 @@ const base_secrets_schema = 'firestartr.dev://common/SecretsClaim';
     SecretsClaimSchema: base_secrets_schema,
 });
 
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/lazy_loader.ts
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-// We need to ensure the grep command is a gnu version
-let IS_GNU_GREP = false;
-let GREP_ON_CHECK = false;
-// this loop is for avoid race conditions
-// once a check is running no more checks
-async function waitForCheck() {
-    const f_wait = () => new Promise((timeOut) => setTimeout(timeOut, 10));
-    do {
-        await f_wait();
-    } while (GREP_ON_CHECK);
-}
-function checkGrep() {
-    return new Promise((ok, ko) => {
-        // idempotency: already checked
-        if (IS_GNU_GREP)
-            return ok();
-        // a check is already running no new checks
-        if (GREP_ON_CHECK)
-            return waitForCheck();
-        logger.info('Checking the grep command');
-        GREP_ON_CHECK = true;
-        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['--version']);
-        handler.on('close', (code) => {
-            GREP_ON_CHECK = false;
-            if (code === 0) {
-                logger.debug('Grep is a gnu grep');
-                IS_GNU_GREP = true;
-                ok();
-            }
-            else {
-                ko('Lazy evaluation needs a gnu-grep command');
-            }
-        });
-    });
-}
-async function loadClaim(claimRef, org, defaults = loadClaimDefaults(), patchClaim = loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, existingRefs = {}, postValidations = new Map()) {
-    await checkGrep();
-    let result = existingRefs;
-    logger.info(`Load reference ${claimRef}`);
-    initVirtualClaims(org);
-    logger.info(`Load reference (parts) ${claimRef.split(/-/)[0]} ${claimRef.replace(/^[^-]+-/, '')}`);
-    // cargas datos con grep
-    try {
-        const claimData = await lazyGetClaim(claimRef.split(/-/)[0], claimRef.replace(/^[^-]+-/, ''), org, cwd);
-        const claim = patchClaim(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(claimData), defaults);
-        let variants = [];
-        if (claim.kind === 'TFWorkspaceClaim' &&
-            claim.providers?.terraform?.variants) {
-            variants = claim.providers.terraform.variants;
-            delete claim.providers.terraform.variants;
-        }
-        logger.silly(`Patched claim is:
-		 ---
-			${catalog_common/* default.io.toYaml */.Z.io.toYaml(claim)}`);
-        try {
-            validateClaim(claim, base[`${claim.kind}Schema`]);
-            await optionalValidation(claim);
-        }
-        catch (error) {
-            let errorMsg = '';
-            if (Array.isArray(error)) {
-                for (const data of error) {
-                    errorMsg = `${errorMsg}
-  - ${data.instancePath}: ${data.message}`;
-                }
-            }
-            else {
-                errorMsg = error instanceof Error ? error.message : String(error);
-            }
-            throw new Error(`Error when validating claim ${claimRef}: ${errorMsg}`);
-        }
-        result[claimRef] = {};
-        result[claimRef]['claim'] = claim;
-        result[claimRef]['claimPath'] = VisitedClaims[claimRef];
-        if (VisitedClaims[claimRef] === 'virtual') {
-            result = await setVirtualClaimAdditionalData(result, claim, claimRef);
-        }
-        else {
-            result = await setNonVirtualClaimAdditionalData(result, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
-        }
-        const claimKind = claim.kind;
-        const references = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(claim));
-        for (const ref of references) {
-            if (!result[ref]) {
-                const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
-                result = lodash_default().merge(result, resolvedReferences);
-            }
-        }
-        if (variants.length > 0) {
-            const parentClaimPath = VisitedClaims[claimRef];
-            for (const variant of variants) {
-                if (!variant.name || !variant.overrides) {
-                    throw new Error(`Variant in claim ${claimRef} is missing required field 'name' or 'overrides'`);
-                }
-                const prohibitedOverrideFields = ['source', 'module', 'name'];
-                for (const field of prohibitedOverrideFields) {
-                    if (field in variant.overrides) {
-                        throw new Error(`Variant '${variant.name}' in claim ${claimRef} cannot override '${field}'`);
-                    }
-                }
-                const composedName = claim.providers.terraform.name + '-' + variant.name;
-                const variantClaim = lodash_default().cloneDeep(claim);
-                variantClaim._parentClaimName = claim.name;
-                variantClaim.name = composedName;
-                variantClaim.providers.terraform = lodash_default().merge({}, claim.providers.terraform, variant.overrides);
-                variantClaim.providers.terraform.name = composedName;
-                if (!variantClaim.annotations) {
-                    variantClaim.annotations = {};
-                }
-                variantClaim.annotations['firestartr.dev/variant-of'] =
-                    claim.providers.terraform.name;
-                const variantRef = `TFWorkspaceClaim-${composedName}`;
-                if (result[variantRef]) {
-                    throw new Error(`Variant name '${variant.name}' (composed: '${composedName}') from claim '${claimRef}' conflicts with existing claim '${variantRef}'`);
-                }
-                logger.info(`Creating synthetic variant claim ${variantRef}`);
-                result[variantRef] = {};
-                result[variantRef]['claim'] = variantClaim;
-                result[variantRef]['claimPath'] = parentClaimPath;
-                result = await setNonVirtualClaimAdditionalData(result, variantClaim, variantRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
-                const variantReferences = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(variantClaim));
-                for (const ref of variantReferences) {
-                    if (!result[ref]) {
-                        const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
-                        result = lodash_default().merge(result, resolvedReferences);
-                    }
-                }
-            }
-        }
-    }
-    catch (err) {
-        throw `Lazy Loading: ${err}`;
-    }
-    return [result, postValidations];
-}
-let LoadedClaims = {};
-let VisitedClaims = {};
-let DuplicatedClaims = {};
-function resetLazyLoader() {
-    LoadedClaims = {};
-    VisitedClaims = {};
-    DuplicatedClaims = {};
-}
-async function lazyGetClaim(kind, name, org, cwd) {
-    const indice = `${kind}-${name}`;
-    logger.info(`Lazy loading ${kind}-${name} with index ${indice}`);
-    if (indice in LoadedClaims)
-        return LoadedClaims[indice];
-    if (isVirtualClaim(kind, name)) {
-        await loadVirtualClaim(kind, name, org);
-    }
-    else {
-        await getClaimsByName(name, cwd);
-    }
-    if (indice in LoadedClaims) {
-        return LoadedClaims[indice];
-    }
-    else {
-        throw new Error(`Error: ${kind}-${name} not found`);
-    }
-}
-async function getClaimsByName(name, cwd = '.') {
-    return new Promise((ok, ko) => {
-        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['-r', '-l', '--include=*', '-E', `name: "?${name}"?`, '.'], {
-            cwd: cwd,
-        });
-        logger.info(`Running ${['grep', '-r', '-l', '--include', '-E', 'name: "' + name + '"?', '.'].join(' ')}`);
-        const entradas = [];
-        const chunks = [];
-        handler.stdout.on('data', (data) => {
-            chunks.push(data.toString('utf-8'));
-        });
-        handler.on('close', () => {
-            const dataFinal = chunks.join('');
-            const fileNameList = dataFinal.split(/\n/).filter((line) => line !== '');
-            for (const fileName of fileNameList) {
-                // only yaml files
-                if (!fileName.match(/\.yml$|\.yaml$/)) {
-                    continue;
-                }
-                // only entries not already visited
-                if (Object.values(VisitedClaims).includes(fileName)) {
-                    continue;
-                }
-                entradas.push(external_path_.join(cwd, fileName));
-            }
-            return Promise.all(entradas.map((entrada) => {
-                return loadRawClaim(entrada);
-            }))
-                .then(() => {
-                ok();
-            })
-                .catch((err) => {
-                ko(err);
-            });
-        });
-    });
-}
-async function loadRawClaim(entry) {
-    return new Promise((ok, ko) => {
-        external_fs_.readFile(entry, 'utf-8', (error, data) => {
-            if (error)
-                return ko(`Reading ${entry}: ${error}`);
-            const claim = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
-            if (!('kind' in claim && 'name' in claim)) {
-                logger.warn(`Invalid claim file ${entry}`);
-            }
-            else {
-                const claimKey = `${claim.kind}-${claim.name}`;
-                if (Object.keys(DuplicatedClaims).includes(claimKey) &&
-                    DuplicatedClaims[claimKey] !== entry) {
-                    return ko(`Duplicated claim ${claimKey} found files: ${DuplicatedClaims[claimKey]} and ${entry}`);
-                }
-                LoadedClaims[claimKey] = data;
-                VisitedClaims[claimKey] = entry;
-                DuplicatedClaims[claimKey] = entry;
-                ok();
-            }
-        });
-    });
-}
-async function setVirtualClaimAdditionalData(renderedData, claim, claimRef) {
-    const virtualClaim = getVirtualClaim(claim.kind, claim.name);
-    renderedData[claimRef]['initializers'] = [
-        new UUIDInitializer(claim),
-        new InitializerClaimRef(),
-        new InitializerDefault(virtualClaim.getDefaultConfig()),
-    ];
-    renderedData[claimRef]['globals'] = [];
-    renderedData[claimRef]['overrides'] = [];
-    renderedData[claimRef]['normalizers'] = [new NameNormalizer()];
-    return renderedData;
-}
-async function setNonVirtualClaimAdditionalData(renderedData, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers) {
-    renderedData[claimRef]['initializers'] = await loadInitializers(claim, renderedData[claimRef]['claimPath']);
-    renderedData[claimRef]['globals'] = await loadGlobals(claim);
-    renderedData[claimRef]['overrides'] = loadOverrides(claim);
-    renderedData[claimRef]['normalizers'] = await loadNormalizers(claim, renderedData[claimRef]['claimPath']);
-    return renderedData;
-}
-async function loadVirtualClaim(kind, name, org) {
-    const virtualClaim = getVirtualClaim(kind, name);
-    const expandedClaim = await virtualClaim.expand({ org });
-    logger.info(`Loading virtual claim ${kind} ${name} ${org}`);
-    LoadedClaims[`${kind}-${name}`] = catalog_common/* default.io.toYaml */.Z.io.toYaml(expandedClaim);
-    VisitedClaims[`${kind}-${name}`] = 'virtual';
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/claimsDefaulter.ts
-
-
-
-/*
- * Default blocks are objects that cannot be merged but applied as a whole. Meaning:
- * - If the object is defined at the claim-level it is maintained *AS IT IS* (no merge)
- * - If the block is missing at the claim-level, the default block is applied
- */
-const defaultBlocksPaths = ['/providers/terraform/sync'];
-function applyBlockAwareDefaults(claim, defaultClaim) {
-    // we always work with a clone of the original
-    const claimClone = JSON.parse(JSON.stringify(claim));
-    // if the block is claim-level defined we store it here
-    const defaultBlocks = new Map();
-    // we remove the blocks entirely of the claim
-    // to achieve an add copy
-    for (const defaultBlockPath of defaultBlocksPaths) {
-        if (claimsDefaulter_hasDeepPath(claimClone, defaultBlockPath) !== true)
-            continue;
-        const originalValue = fast_json_patch_default().getValueByPointer(claimClone, defaultBlockPath);
-        if (originalValue) {
-            logger.silly(`${claim.kind}/${claim.name}: has an original ${defaultBlockPath}: preserving`);
-            defaultBlocks.set(defaultBlockPath, originalValue);
-            fast_json_patch_default().applyPatch(claimClone, [{ op: 'remove', path: defaultBlockPath }]);
-        }
-    }
-    // if the patch has the same path of a block
-    // and the block was defined at claim-level
-    // we interchange the value with the original value
-    // otherwise we use the default
-    const jsonPatchOps = fast_json_patch_default().compare(claimClone, defaultClaim)
-        .filter((jp) => jp.op === 'add')
-        .map((jp) => {
-        if (defaultBlocks.has(jp.path)) {
-            return {
-                ...jp,
-                value: defaultBlocks.get(jp.path),
-            };
-        }
-        else {
-            return jp;
-        }
-    });
-    return fast_json_patch_default().applyPatch(claimClone, jsonPatchOps).newDocument;
-}
-function claimsDefaulter_hasDeepPath(data, deepPath) {
-    return lodash_default().has(data, deepPath.replace(/\//g, '.').replace(/^\./, ''));
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/loader.ts
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-const isYamlFile = new RegExp(/\.(yaml|yml)$/);
-/**
- *
- * @returns Virtual Claims
- */
-const virtualClaims = [new FirestartrAllClaim()];
-/*
- * Loads all applicable globals for a given claim and stores them into a list.
- *
- * Input:
- * - claim: our custom claim object, with which we check if the global is applicable
- *
- * Returns:
- * - A GlobalSection array promise, containing all the globals loaded for this claim
- *
- */
-async function loadGlobals(claim) {
-    const result = [];
-    await crawl(getPath('globals'), (entry) => {
-        return isYamlFile.test(entry);
-    }, async (entry, data) => {
-        const globalData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
-        const ext = external_path_.extname(entry);
-        const name = external_path_.basename(entry, ext);
-        if (name in SECTIONS_BY_FILE_NAME) {
-            const section = new SECTIONS_BY_FILE_NAME[name](globalData);
-            if (!(await section.validate(SCHEMAS_BY_SECTION_NAME[name] || {}))) {
-                throw new Error(`Invalid ${name} global file`);
-            }
-            if (globalData.kind === claim.kind) {
-                result.push(section);
-            }
-            else {
-                logger.debug(`Skipping global ${name} because it is not applicable to ${claim.kind}`);
-            }
-        }
-    });
-    logger.info(`Loaded globals ${result}`);
-    return result;
-}
-/*
- * If the input claim is a GithubRepositoryClaim, it loads all it's applicable
- * overrides and stores them into a list. Otherwise, it returns an empty list.
- *
- * Input:
- * - claim: our custom claim object, which should be a GithubRepositoryClaim
- *
- * Returns:
- * - An Overrider array, with a GithubRepositoryOverrider if the claim
- *   was a GithubRepositoryClaim, or empty if it was not.
- *
- */
-function loadOverrides(claim) {
-    const overrides = [];
-    if (claim.kind === 'ComponentClaim' && claim.providers.github.overrides) {
-        overrides.push(new GithubRepositoryOverrider());
-    }
-    return overrides;
-}
-/**
- * Load all normalizers and stores them into a list.
- * @param claim
- * @returns
- */
-async function loadNormalizers(_claim, path) {
-    const result = [];
-    for (const normalizer of NORMALIZERS) {
-        result.push(new normalizer({ path: path }));
-    }
-    return result;
-}
-/*
- * Loads all applicable initializers for a given claim and stores them into a list.
- *
- * Input:
- * - claim: our custom claim object, with which we check if the initializer is applicable
- *
- * Returns:
- * - An Initializer array promise, containing all the initializers loaded for this claim
- *
- */
-let loadedInitializers = false;
-async function loadInitializers(claim, claimPath, initializersPath = getPath('initializers')) {
-    const result = [];
-    await crawl(initializersPath, (entry) => {
-        return isYamlFile.test(entry);
-    }, async (entry, data) => {
-        const initializerData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
-        const ext = external_path_.extname(entry);
-        const name = external_path_.basename(entry, ext);
-        if (name in INITIALIZERS_BY_FILE_NAME) {
-            const initializerBfN = new INITIALIZERS_BY_FILE_NAME[name](initializerData);
-            if (!(await initializerBfN.validate(SCHEMAS_BY_INITIALIZER_NAME[name] || {}))) {
-                throw new Error(`Invalid ${name} initializer file`);
-            }
-            if (initializerData.kind === claim.kind) {
-                result.push(initializerBfN);
-            }
-            else {
-                logger.debug(`Skipping initializer ${name} because it is not applicable to ${claim.kind}`);
-            }
-        }
-    });
-    for (const initializer of INITIALIZERS) {
-        if (initializer.applicableKinds.includes(claim.kind)) {
-            result.push(new initializer({ path: claimPath }));
-        }
-    }
-    logger.info(`Loaded initializers ${JSON.stringify(result)}`);
-    loadedInitializers = result;
-    return loadedInitializers;
-}
-function loadClaimDefaults() {
-    try {
-        return catalog_common/* default.io.fromYaml */.Z.io.fromYaml(external_fs_.readFileSync(`${getPath('claimsDefaults')}/claims_defaults.yaml`, 'utf-8'));
-    }
-    catch (error) {
-        const errMsg = `Could not read claims defaults file in path ${getPath('claimsDefaults')}/claims_defaults.yaml: ${error}`;
-        logger.error(errMsg);
-        throw new Error(errMsg);
-    }
-}
-/*
- * Using fast-json-patch, compares a claim to its kind's defaults, then patches it.
- *
- * Input:
- * - claim: our custom claim object, which we want to patch
- * - defaultsClaims: an object, containing the defaults for each claim kind,
- *   with the same structure that we use for the actual claims
- *
- * Returns:
- * - The patched claim
- *
- */
-function loader_patchClaim(claim, defaultsClaims) {
-    if (defaultsClaims[claim.kind]) {
-        claim = applyBlockAwareDefaults(claim, defaultsClaims[claim.kind]);
-    }
-    return claim;
-}
-async function loadCRsWithFullSet(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
-    const result = {};
-    const fullResult = {};
-    await crawlWithExclusions(crsPath, (entry) => {
-        return isYamlFile.test(entry);
-    }, async (entry, data) => {
-        const yamlData = stripKnownRelations(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data));
-        const metadata = yamlData?.metadata;
-        if (!(yamlData &&
-            typeof yamlData === 'object' &&
-            'kind' in yamlData &&
-            metadata &&
-            typeof metadata === 'object' &&
-            'name' in metadata)) {
-            logger.warn(`Invalid CR file ${entry}`);
-        }
-        else {
-            const crKey = `${yamlData.kind}-${metadata.name}`;
-            if (fullResult[crKey]) {
-                logger.error(`Duplicate CR ${crKey}`);
-            }
-            // Keep the complete CR set for validations that need repository-wide context.
-            fullResult[crKey] = yamlData;
-            // Keep the filtered CR set for previous-CR lookup during claim rendering.
-            if (allowedClaimReferences.length === 0 ||
-                allowedClaimReferences.includes(yamlData.metadata?.annotations?.[catalog_common/* default.generic.getFirestartrAnnotation */.Z.generic.getFirestartrAnnotation('claim-ref')])) {
-                result[crKey] = yamlData;
-            }
-        }
-    }, excludedPaths.concat(getAdditionalPaths()));
-    return { crs: result, fullCrs: fullResult };
-}
-async function loadCRs(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
-    const { crs } = await loadCRsWithFullSet(crsPath, excludedPaths, allowedClaimReferences);
-    return crs;
-}
-/*
- * Description: Get the renamed using claimRef annotation
- * Input: claims: any, crs: any
- * Output: renames: IRenameResult[]
- */
-async function loadRenames(claims, crs) {
-    /*
-     * If checkRenames is false, we don't need to check for renames
-     */
-    const renamesEnabled = getRenamesEnabled();
-    if (!renamesEnabled)
-        return [];
-    const result = [];
-    /**
-     * For each CR, look for a claim that does not match the name with CR's firestartr.dev/claim-ref annotation
-     */
-    for (const cr of Object.values(crs)) {
-        const anyCr = cr;
-        if (!anyCr?.metadata?.annotations)
-            continue;
-        // if the annotation is a claimRef
-        const annotationName = common.generic.getFirestartrAnnotation('claim-ref');
-        const annotations = anyCr?.metadata?.annotations || {};
-        if (annotationName in annotations) {
-            const claimRef = anyCr.metadata.annotations[annotationName];
-            // split the annotation into kind and name
-            const [kind, name] = claimRef.split('/');
-            // if the claim exists, check if the name is different for the given provider
-            const referencedClaim = claims[`${kind}-${name}`].claim;
-            const oldName = anyCr.metadata.name;
-            const newName = referencedClaim.providers[getConfiguredProvider()].name;
-            if (oldName !== newName) {
-                result.push({
-                    kind: referencedClaim.kind,
-                    claimPath: claims[`${kind}-${name}`].claimPath,
-                    claimName: referencedClaim.name,
-                    oldName,
-                    newName,
-                });
-            }
-        }
-    }
-    return result;
-}
-async function loadClaimsList(claimRefList, claimsPath = getPath('claims')) {
-    const data = {
-        renderClaims: {},
-        crs: {},
-        fullCrs: {},
-    };
-    const defaults = loadClaimDefaults();
-    for await (const claimRef of claimRefList) {
-        const [renderedClaimData] = await loadClaim(claimRef, getOrg(), defaults, loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, claimsPath);
-        data.renderClaims = lodash_default().merge(data.renderClaims, renderedClaimData);
-    }
-    const crClaimReferences = [];
-    for (const ref of Object.keys(data.renderClaims)) {
-        // Replaces only the first instance of '-'
-        crClaimReferences.push(ref.replace('-', '/'));
-    }
-    const loadedCrs = await loadCRsWithFullSet(getPath('crs'), [getPath('globals'), getPath('initializers')], crClaimReferences);
-    data['crs'] = loadedCrs.crs;
-    data['fullCrs'] = loadedCrs.fullCrs;
-    return data;
-}
-function getOrg() {
-    const groupOrg = catalog_common/* default.environment.getFromEnvironmentWithDefault */.Z.environment.getFromEnvironmentWithDefault(catalog_common/* default.types.envVars.org */.Z.types.envVars.org, '');
-    return groupOrg;
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/references.ts
-function validateTfStateKeyUniqueness(crs) {
-    const tfStateKeys = {};
-    for (const crKey of Object.keys(crs)) {
-        const cr = crs[crKey];
-        if (!isTerraformWorkspace(cr))
-            continue;
-        const tfKey = cr.spec.firestartr.tfStateKey;
-        if (tfStateKeys[tfKey]) {
-            throw new Error(`❗❗ ❌ RENDER ERROR ❌ ❗❗
-
-The tfStateKey ${tfKey} is not unique,
-
-It is being used by the following CRs:
-
-- ${tfStateKeys[tfKey].kind} ${tfStateKeys[tfKey].metadata.name}
-
-- ${cr.kind} ${cr.metadata.name}
-
-Check the following Claims to ensure that the tfStateKey is unique:
-
-- ${tfStateKeys[tfKey].metadata.annotations['firestartr.dev/claim-ref']}
-
-- ${cr.metadata.annotations['firestartr.dev/claim-ref']}
-`);
-        }
-        tfStateKeys[cr.spec.firestartr.tfStateKey] = cr;
-    }
-}
-function isCatalogEntity(cr) {
-    return [
-        'Component',
-        'Domain',
-        'System',
-        'User',
-        'Group',
-        'Resource',
-    ].includes(cr.kind);
-}
-function isTerraformWorkspace(cr) {
-    return cr.kind === 'FirestartrTerraformWorkspace';
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/crSize.ts
-
-const K8S_OBJECT_SIZE_LIMIT = 1572864; // 1.5 MiB in bytes, etcd recommended limit: https://etcd.io/docs/latest/dev-guide/limit/
-function validateCrSizes(crs) {
-    for (const key of Object.keys(crs)) {
-        const cr = crs[key];
-        const serialized = catalog_common/* default.io.toYaml */.Z.io.toYaml(cr);
-        const size = Buffer.byteLength(serialized, 'utf8');
-        if (size > K8S_OBJECT_SIZE_LIMIT) {
-            throw new Error(`CR "${cr.kind}-${cr.metadata.name}" exceeds the Kubernetes object size limit by ${size - K8S_OBJECT_SIZE_LIMIT} bytes. Maximum allowed is ${K8S_OBJECT_SIZE_LIMIT} bytes (1.5MiB).`);
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/permissions.ts
-
-function validatePermissionsUniqueness(crs) {
-    for (const crkey in crs) {
-        const cr = crs[crkey];
-        if (cr.kind === 'FirestartrGithubRepository') {
-            const permissions = cr.spec.permissions;
-            logger.debug(`Validating Permissions Uniqueness of ${crkey}`);
-            if (permissions) {
-                const rolesByIdentifier = new Map();
-                for (const perm of permissions) {
-                    const identifier = perm.collaborator
-                        ? perm.collaborator
-                        : `ref:${perm.ref.kind}:${perm.ref.name}`;
-                    const role = perm.role;
-                    const prevRole = rolesByIdentifier.get(identifier);
-                    if (prevRole === undefined) {
-                        rolesByIdentifier.set(identifier, role);
-                    }
-                    else if (prevRole !== role) {
-                        throw new Error(`Conflicting permission role in FirestartrGithubRepository ${crkey}: ${identifier} has roles "${prevRole}" and "${role}".\nFull CR: ${JSON.stringify(cr, null, 2)}`);
-                    }
-                }
-            }
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/refsSorter/refsSorter.ts
-
-/**
- * @param renderClaims renderClaims to sort
- * @param kinds kinds to get from renderClaims
- * @returns renderClaims with only the kinds specified
- */
-function sortRenderClaimsByKind(renderClaims, kinds) {
-    let result = {};
-    for (const kind of kinds) {
-        for (const key in renderClaims) {
-            if (renderClaims[key].claim.kind === kind) {
-                result[key] = renderClaims[key];
-            }
-        }
-        result = sortSelfKindRefs(result, kind);
-    }
-    return result;
-}
-function sortSelfKindRefs(renderClaims, kind) {
-    if (!hasSelfRefs(kind)) {
-        return renderClaims;
-    }
-    const newRenderClaims = {};
-    const data = extractRefs(renderClaims, kind);
-    const ordered = [];
-    const visiting = [];
-    const visited = [];
-    for (const key of Object.keys(data)) {
-        if (!visited.find((obj) => obj.name === key)) {
-            sortRefs(data, data[key], ordered, visiting, visited);
-        }
-    }
-    for (const cr of ordered) {
-        newRenderClaims[cr.name] = renderClaims[cr.name];
-    }
-    return newRenderClaims;
-}
-function sortRefs(data, claim, ordered = [], visiting = [], visited = []) {
-    if (visiting.find((obj) => obj.name === claim.name)) {
-        throw new Error(`Circular dependency detected for '${claim.name}'`);
-    }
-    if (!visited.find((obj) => obj.name === claim.name)) {
-        visiting.push(claim);
-        if (claim.refs) {
-            for (const ref of claim.refs) {
-                const referencedObject = data[ref];
-                if (!referencedObject) {
-                    throw new Error(`Reference '${ref}' does not exist for '${claim.name}'`);
-                }
-                sortRefs(data, referencedObject, ordered, visiting, visited);
-            }
-        }
-        visited.push(visiting.pop());
-        ordered.push(claim);
-    }
-}
-function hasSelfRefs(kind) {
-    return ['TFWorkspaceClaim', 'GroupClaim'].includes(kind);
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-sorter.ts
-
-function sortKinds(orderedKinds, claims) {
-    const result = [];
-    for (const kind of orderedKinds) {
-        const kindRenderClaims = sortRenderClaimsByKind(claims, [kind]);
-        result.push(kindRenderClaims);
-    }
-    return result;
-}
-
 ;// CONCATENATED MODULE: ../features_renderer/src/common.ts
 
 function isDirectory(path) {
@@ -165120,14 +164403,9 @@ var ajv_default = /*#__PURE__*/__nccwpck_require__.n(dist_ajv);
                     },
                 },
                 patches: {
-                    type: 'object',
-                    patternProperties: {
-                        '^.+$': {
-                            type: 'array',
-                            items: {
-                                $ref: '#/definitions/Patch',
-                            },
-                        },
+                    type: 'array',
+                    items: {
+                        $ref: '#/definitions/Patch',
                     },
                 },
                 filesTemplates: {
@@ -165230,7 +164508,7 @@ var ajv_default = /*#__PURE__*/__nccwpck_require__.n(dist_ajv);
                     type: 'string',
                 },
                 value: {
-                    type: 'string',
+                    type: ['string', 'object', 'array', 'number', 'boolean', 'null'],
                 },
             },
             required: ['name', 'op', 'path'],
@@ -165272,6 +164550,12 @@ function __validateFeatureConfig(featurePath) {
     }
 }
 function __validateFeatureConfigData(configData) {
+    // Detect old provider-keyed patches shape for migration hint (PLAN #2648)
+    if (configData.patches &&
+        !Array.isArray(configData.patches) &&
+        typeof configData.patches === 'object') {
+        throw `Feature: config.yaml invalid patches: expected flat array of patches (claim-relative pointers like /annotations/backstage.io~1techdocs-ref), but got provider-keyed object ${JSON.stringify(Object.keys(configData.patches))}. Migrate: patches: { catalog: [...] } → patches: [{ op, path: /annotations/backstage.io~1techdocs-ref, value }]. See #2648. $ref paths also migrate: [spec, org] → [providers, github, org], [metadata, annotations, firestartr.dev/external-name] → [providers, github, name]`;
+    }
     const ajv = new (ajv_default())({
         allowUnionTypes: true,
     });
@@ -165293,14 +164577,12 @@ function stripAnchoringConstraints(schemaDef) {
     return clone;
 }
 function __validateJsonPatches(configData) {
-    const keys = Object.keys(configData.patches);
-    for (const key of keys) {
-        if (configData.patches[key]) {
-            if (fast_json_patch_default().validate(configData.patches[key])) {
-                const errors = JSON.stringify(fast_json_patch_default().validate(configData.patches[key]).message);
-                throw `Feature: config.yaml -> patches: invalid patches ${errors}`;
-            }
-        }
+    const patches = configData.patches;
+    if (!Array.isArray(patches))
+        return;
+    const err = fast_json_patch_default().validate(patches);
+    if (err) {
+        throw `Feature: config.yaml -> patches: invalid patches ${JSON.stringify(err.message ?? err)}`;
     }
 }
 
@@ -166138,10 +165420,12 @@ const renderTestsSchema = {
             items: {
                 type: 'object',
                 additionalProperties: false,
-                required: ['name', 'cr'],
+                required: ['name'],
+                anyOf: [{ required: ['cr'] }, { required: ['claim'] }],
                 properties: {
                     name: { type: 'string', minLength: 1 },
                     cr: { type: 'string', minLength: 1 },
+                    claim: { type: 'string', minLength: 1 },
                     args: { type: 'object' },
                 },
             },
@@ -166196,6 +165480,9 @@ function resolveCrPath(featurePath, crRelPath) {
     }
     return resolved;
 }
+function resolveClaimPath(featurePath, claimRelPath) {
+    return resolveCrPath(featurePath, claimRelPath);
+}
 function listYamlFiles(dir) {
     if (!fs.existsSync(dir))
         return [];
@@ -166313,6 +165600,7 @@ async function createRenderContext(prefix = 'feature-render-') {
     buildExpectedOutput,
     loadAndValidateRenderTests,
     resolveCrPath,
+    resolveClaimPath,
 });
 
 ;// CONCATENATED MODULE: ../features_renderer/src/featureArgsValidation.ts
@@ -166436,19 +165724,97 @@ function render(featurePath, featureRenderPath, entity, firestartrConfig = {}, f
     external_fs_default().writeFileSync(configFile, JSON.stringify(output));
     return output;
 }
-function buildContext(entity, args, firestartrConfig, featureArgs) {
+function getPatches(featurePath, entity, firestartrConfig = {}, featureArgs = {}) {
+    const configData = validate(featurePath);
+    validateFeatureArgs(featurePath, featureArgs);
+    const context = buildContext(entity, configData.args, firestartrConfig, featureArgs);
+    const rendered = JSON.parse(renderContent(JSON.stringify(configData), context));
+    return rendered.patches ?? [];
+}
+function buildContext(stitchedClaim, args, firestartrConfig, featureArgs) {
     const context = {};
+    const resolveRef = (doc, ref) => {
+        const v = lodash_default().get(doc, ref);
+        if (v !== undefined)
+            return v;
+        // Fallback for transition: try CR-shaped alternatives when stitchedClaim is CR-shaped
+        // and vice versa. Covers the ADR 0006 table plus legacy feature_a provisioner paths.
+        const altTable = {
+            'providers,github,org': [
+                ['spec', 'org'],
+                ['spec', 'provisioner', 'org'],
+                ['spec', 'firestartr', 'technology', 'stack'],
+            ],
+            'providers,github,branchStrategy,defaultBranch': [
+                ['spec', 'repo', 'defaultBranch'],
+                ['spec', 'provisioner', 'repo', 'defaultBranch'],
+            ],
+            'providers,github,name': [
+                ['metadata', 'annotations', 'firestartr.dev/external-name'],
+                ['metadata', 'name'],
+            ],
+            name: [['metadata', 'name']],
+            'annotations,firestartr.dev/dest-annotation': [
+                ['metadata', 'annotations', 'firestartr.dev/dest-annotation'],
+            ],
+        };
+        const key = ref.join(',');
+        const alts = altTable[key];
+        if (alts) {
+            for (const alt of alts) {
+                const av = lodash_default().get(doc, alt);
+                if (av !== undefined)
+                    return av;
+            }
+        }
+        // Reverse fallback: if ref is CR-shaped, try claim-shaped
+        const reverseTable = {
+            'spec,org': ['providers', 'github', 'org'],
+            'spec,provisioner,technology,stack': ['providers', 'github', 'org'],
+            'spec,firestartr,technology,stack': ['providers', 'github', 'org'],
+            'metadata,name': ['name'],
+            'metadata,annotations,firestartr.dev/dest-annotation': [
+                'annotations',
+                'firestartr.dev/dest-annotation',
+            ],
+            'spec,provisioner,org': ['providers', 'github', 'org'],
+            'spec,provisioner,repo,defaultBranch': [
+                'providers',
+                'github',
+                'branchStrategy',
+                'defaultBranch',
+            ],
+            'spec,repo,defaultBranch': [
+                'providers',
+                'github',
+                'branchStrategy',
+                'defaultBranch',
+            ],
+            'metadata,annotations,firestartr.dev/external-name': [
+                'providers',
+                'github',
+                'name',
+            ],
+        };
+        const rev = reverseTable[ref.join(',')];
+        if (rev) {
+            const rv = lodash_default().get(doc, rev);
+            if (rv !== undefined)
+                return rv;
+        }
+        return v;
+    };
     Object.entries(args).forEach(([key, arg]) => {
         if ('$default' in arg) {
             if (Array.isArray(arg['$default'])) {
-                context[key] = lodash_default().get(entity, arg['$default']);
+                context[key] = resolveRef(stitchedClaim, arg['$default']);
             }
             else {
                 context[key] = arg['$default'];
             }
         }
         if ('$ref' in arg) {
-            const refValue = lodash_default().get(entity, arg['$ref']);
+            const refValue = resolveRef(stitchedClaim, arg['$ref']);
             context[key] = refValue;
         }
         else if ('$lit' in arg) {
@@ -166578,6 +165944,7 @@ function updateFileContent(featureRenderPath, filePath, content) {
 
 
 
+
 /* harmony default export */ const features_renderer = ({
     validate: validate,
     render: render,
@@ -166587,6 +165954,7 @@ function updateFileContent(featureRenderPath, filePath, content) {
     renderContent: renderContent,
     expandFiles: expandFiles,
     validateFeatureArgs: validateFeatureArgs,
+    getPatches: getPatches,
 });
 
 ;// CONCATENATED MODULE: ../features_preparer/src/logger.ts
@@ -166611,6 +165979,13 @@ function renderFeature(featureName, version, owner, repo, featureOwner, renderPa
 function renderFeatureFromPath(extractPath, renderedPath, featureOwner, featureArgs = {}) {
     return features_renderer.render(extractPath, renderedPath, featureOwner, {}, featureArgs);
 }
+function getFeaturePatches(featureName, version, owner, repo, featureOwner, featureArgs = {}) {
+    const extractPath = external_path_default().join(catalog_common/* default.features.tarballs.getFeaturesExtractPath */.Z.features.tarballs.getFeaturesExtractPath(featureName, version, owner, repo), 'packages', featureName);
+    return getPatches(extractPath, featureOwner, {}, featureArgs);
+}
+function getFeaturePatchesFromPath(extractPath, featureOwner, featureArgs = {}) {
+    return getPatches(extractPath, featureOwner, {}, featureArgs);
+}
 
 // EXTERNAL MODULE: ../../node_modules/adm-zip/adm-zip.js
 var adm_zip = __nccwpck_require__(7993);
@@ -166671,6 +166046,26 @@ featureArgs = {}, repo = 'features', owner = 'prefapp') {
     };
     return renderFeature(featureName, reference, owner, repo, featureOwner, '/tmp', featureArgs);
 }
+async function installer_getFeaturePatches(featureName, version, featureOwner, featureArgs = {}, repo = 'features', owner = 'prefapp') {
+    const reference = `${featureName}-v${version}`;
+    return processFeaturePatches(featureName, reference, featureOwner, featureArgs, repo, owner);
+}
+async function getFeaturePatchesFromRef(featureName, featureRef, featureOwner, featureArgs = {}, repo = 'features', owner = 'prefapp') {
+    const reference = `${featureRef}`;
+    return processFeaturePatches(featureName, reference, featureOwner, featureArgs, repo, owner);
+}
+async function processFeaturePatches(featureName, reference, featureOwner, featureArgs = {}, repo = 'features', owner = 'prefapp') {
+    await downloadFeatureZip(repo, featureName, reference, owner);
+    featureArgs['traceability'] = {
+        version: reference,
+        owner,
+        repo,
+        name: featureName,
+        ref: reference,
+        url: `https://github.com/${owner}/${repo}/tree/${reference}/packages/${featureName}`,
+    };
+    return getFeaturePatches(featureName, reference, owner, repo, featureOwner, featureArgs);
+}
 async function prepareFeature(featureName, version, repo = 'features', owner = 'prefapp') {
     await downloadFeatureZip(repo, featureName, version, owner);
 }
@@ -166725,6 +166120,9 @@ async function downloadFeatureZip(repo, featureName, reference, owner = 'prefapp
 /* harmony default export */ const src = ({
     renderFeature: renderFeature,
     renderFeatureFromPath: renderFeatureFromPath,
+    getFeaturePatches: installer_getFeaturePatches,
+    getFeaturePatchesFromRef: getFeaturePatchesFromRef,
+    getFeaturePatchesFromPath: getFeaturePatchesFromPath,
     getFeatureConfigFromRef: getFeatureConfigFromRef,
     getFeatureConfig: getFeatureConfig,
     prepareFeature: prepareFeature,
@@ -166741,6 +166139,1074 @@ async function downloadFeatureZip(repo, featureName, reference, owner = 'prefapp
     getFeatureConfigFromRef: src.getFeatureConfigFromRef,
 });
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/stitching/protectedPaths.ts
+// Platform-curated protected claim paths — features may not write to these.
+// Stored as JSON Pointers (RFC 6901). Supports wildcard `*` for a single segment.
+// Example: /providers/STAR/org matches /providers/github/org where STAR is *.
+const PROTECTED_CLAIM_PATHS = [
+    '/kind',
+    '/name',
+    '/providers/*/org',
+    '/providers/github/org',
+    '/providers/github/name',
+    '/metadata/name',
+    '/metadata/namespace',
+];
+function isProtectedPath(patchPath) {
+    const normalizedPatch = normalizePointer(patchPath);
+    for (const protectedPath of PROTECTED_CLAIM_PATHS) {
+        if (matchesProtected(protectedPath, normalizedPatch)) {
+            return true;
+        }
+    }
+    return false;
+}
+function normalizePointer(pointer) {
+    if (!pointer.startsWith('/')) {
+        return '/' + pointer;
+    }
+    return pointer;
+}
+function matchesProtected(protectedPointer, patchPointer) {
+    const protectedSegments = protectedPointer
+        .split('/')
+        .slice(1)
+        .map(unescapePointer);
+    const patchSegments = patchPointer.split('/').slice(1).map(unescapePointer);
+    // Treat ancestor/descendant as protected: a patch to a parent (e.g. /metadata)
+    // would replace the protected child (/metadata/name), and a patch to a child
+    // (e.g. /metadata/name/extra) is also under the protected tree. Match when
+    // the shorter prefix equals the longer prefix (with wildcard support).
+    const minLen = Math.min(protectedSegments.length, patchSegments.length);
+    for (let i = 0; i < minLen; i++) {
+        if (protectedSegments[i] === '*')
+            continue;
+        if (protectedSegments[i] !== patchSegments[i])
+            return false;
+    }
+    return true;
+}
+function unescapePointer(segment) {
+    return segment.replace(/~1/g, '/').replace(/~0/g, '~');
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/stitching/errors.ts
+class StitchingError extends Error {
+    constructor(violations) {
+        const lines = violations.map((v) => `  - ${v.message}`).join('\n');
+        super(`Claim stitching failed with ${violations.length} violation(s):\n${lines}`);
+        this.name = 'StitchingError';
+        this.violations = violations;
+    }
+}
+function formatStitchingError(error) {
+    return error.message;
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/stitching/stitching.ts
+
+
+
+
+let MOCK_FEATURES_FN;
+function MOCK_STITCHING_FEATURES(mock) {
+    MOCK_FEATURES_FN = mock;
+}
+function pointerExists(doc, pointer) {
+    const segments = pointer
+        .split('/')
+        .slice(1)
+        .map((s) => s.replace(/~1/g, '/').replace(/~0/g, '~'));
+    let cur = doc;
+    for (const seg of segments) {
+        if (cur === null || cur === undefined || typeof cur !== 'object')
+            return false;
+        if (!Object.prototype.hasOwnProperty.call(cur, seg))
+            return false;
+        cur = cur[seg];
+    }
+    return true;
+}
+function isAppendPointer(pointer) {
+    return pointer.endsWith('/-');
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+// Deduplication identity for a feature patch. Ordinary writes collide on the
+// normalized pointer. Array appends (`add ... /-`) collide on the pointer plus
+// the appended element's `name` when present, so several features can each add
+// a distinct label to /providers/github/labels/- while the same label name from
+// two features still hard-fails.
+function writeIdentity(patch) {
+    const path = normalizePointer(patch.path);
+    if (patch.op === 'add' &&
+        isAppendPointer(path) &&
+        isRecord(patch.value) &&
+        typeof patch.value.name === 'string') {
+        return `${path}#${patch.value.name}`;
+    }
+    return path;
+}
+// fast-json-patch does not create intermediate containers for `add`, and
+// appending to an array requires the array to already exist. Ensure every
+// ancestor segment exists before applying an `add`: missing containers are
+// created as objects, except the immediate parent of a `/-` append, which is
+// created as an array. Existing (user/default-declared) values are never
+// overwritten.
+function ensureAddParents(doc, patch) {
+    const segments = patch.path.split('/').slice(1);
+    let prefix = '';
+    for (let i = 0; i < segments.length - 1; i++) {
+        prefix += '/' + segments[i];
+        if (pointerExists(doc, prefix))
+            continue;
+        const isArrayParent = isAppendPointer(patch.path) && i === segments.length - 2;
+        const value = isArrayParent ? [] : {};
+        try {
+            doc = fast_json_patch.applyPatch(doc, [{ op: 'add', path: prefix, value }], false, false).newDocument;
+        }
+        catch {
+            // Concurrent structural conflict — let the actual patch surface the error.
+        }
+    }
+    return doc;
+}
+async function stitchClaim(claimAfterDefaults, preCollectedEnvelopes) {
+    const envelopes = preCollectedEnvelopes ?? (await collectFeaturePatches(claimAfterDefaults));
+    if (envelopes.length === 0) {
+        return claimAfterDefaults;
+    }
+    const violations = [];
+    const seenPaths = new Map();
+    // Collect all patches for deduplication before any gate — normalize once so all gates and apply use same pointer
+    const normalizedEnvelopes = envelopes.map((env) => ({
+        feature: env.feature,
+        patches: env.patches.map((p) => ({
+            ...p,
+            path: normalizePointer(p.path),
+            _raw: p.path,
+        })),
+    }));
+    for (const envelope of normalizedEnvelopes) {
+        for (const patch of envelope.patches) {
+            const path = patch.path;
+            const raw = patch._raw ?? path;
+            // Gate 1: protected path
+            if (isProtectedPath(path)) {
+                violations.push({
+                    feature: envelope.feature,
+                    op: patch.op,
+                    path,
+                    reason: 'protected-path',
+                    message: `Feature '${envelope.feature}' patch ${patch.op} ${raw} (normalized ${path}) targets protected claim path`,
+                });
+                // continue to collect other violations for same patch (but avoid duplicate counting)
+            }
+            // Gate 3: deduplication — track before overwrite so we report both.
+            // Array appends (`/-`) dedup by element name (see writeIdentity); all
+            // other writes dedup by normalized pointer.
+            const identity = writeIdentity(patch);
+            if (seenPaths.has(identity)) {
+                violations.push({
+                    feature: envelope.feature,
+                    op: patch.op,
+                    path,
+                    reason: 'duplicate-path',
+                    conflictingFeature: seenPaths.get(identity),
+                    message: `Feature '${envelope.feature}' and '${seenPaths.get(identity)}' both write to ${path} (deduplication)`,
+                });
+            }
+            else {
+                seenPaths.set(identity, envelope.feature);
+            }
+            // Gate 2: overwrite protection (II-a strict: raw ∪ defaults counts as declared)
+            if (['replace', 'remove', 'add'].includes(patch.op)) {
+                const exists = pointerExists(claimAfterDefaults, path);
+                if (exists) {
+                    // For strict II-a, any op to existing path is overwrite
+                    // We already reported protected if applicable; still report overwrite unless it was protected
+                    // to keep collect-all but avoid double-counting same patch as two reasons? Keep both for visibility.
+                    if (!isProtectedPath(path)) {
+                        violations.push({
+                            feature: envelope.feature,
+                            op: patch.op,
+                            path,
+                            reason: 'overwrite-protected',
+                            message: `Feature '${envelope.feature}' patch ${patch.op} ${raw} (normalized ${path}) would overwrite user/default-declared value`,
+                        });
+                    }
+                }
+                else {
+                    // Path absent — check intermediate parent existence? For now exact path only.
+                    // If patch is `replace` to absent path, fast-json-patch will fail; we let that be an overwrite concern too.
+                    if (['replace', 'remove'].includes(patch.op)) {
+                        violations.push({
+                            feature: envelope.feature,
+                            op: patch.op,
+                            path,
+                            reason: 'overwrite-protected',
+                            message: `Feature '${envelope.feature}' patch ${patch.op} ${raw} (normalized ${path}) targets absent path (replace/remove requires existing value)`,
+                        });
+                    }
+                }
+            }
+        }
+    }
+    if (violations.length > 0) {
+        throw new StitchingError(violations);
+    }
+    // No violations — apply patches sequentially (deduplication already ensures no conflicts)
+    let stitched = JSON.parse(JSON.stringify(claimAfterDefaults));
+    for (const envelope of normalizedEnvelopes) {
+        if (envelope.patches.length === 0)
+            continue;
+        for (const patch of envelope.patches) {
+            if (patch.op === 'add') {
+                stitched = ensureAddParents(stitched, patch);
+            }
+        }
+        const result = fast_json_patch.applyPatch(stitched, envelope.patches, false, false);
+        stitched = result.newDocument;
+    }
+    return stitched;
+}
+async function collectFeaturePatches(claim) {
+    if (MOCK_FEATURES_FN) {
+        return MOCK_FEATURES_FN(claim);
+    }
+    const typedClaim = claim;
+    const features = typedClaim.providers?.github?.features ?? [];
+    if (features.length === 0)
+        return [];
+    // In unit tests without GitHub credentials, avoid real download — tests that care
+    // about stitching should set MOCK_STITCHING_FEATURES explicitly.
+    if (process.env.JEST_WORKER_ID && !process.env.GITHUB_TOKEN) {
+        return [];
+    }
+    const envelopes = [];
+    for (const feature of features) {
+        const featureName = feature.name;
+        const versionOrRef = feature.ref ?? feature.version ?? '';
+        const repo = feature.repo
+            ? (feature.repo.split('/')[1] ?? 'features')
+            : 'features';
+        const owner = feature.repo
+            ? (feature.repo.split('/')[0] ?? 'prefapp')
+            : 'prefapp';
+        const args = feature.args ?? {};
+        try {
+            let patchesOrRendered;
+            const preparerAny = features_preparer;
+            if (feature.ref) {
+                if (typeof preparerAny.getFeaturePatchesFromRef === 'function') {
+                    patchesOrRendered = await preparerAny.getFeaturePatchesFromRef(featureName, versionOrRef, claim, args, repo, owner);
+                }
+                else {
+                    patchesOrRendered = await preparerAny.getFeatureConfigFromRef(featureName, versionOrRef, claim, args, repo, owner);
+                }
+            }
+            else {
+                if (typeof preparerAny.getFeaturePatches === 'function') {
+                    patchesOrRendered = await preparerAny.getFeaturePatches(featureName, versionOrRef, claim, args, repo, owner);
+                }
+                else {
+                    patchesOrRendered = await preparerAny.getFeatureConfig(featureName, versionOrRef, claim, args, repo, owner);
+                }
+            }
+            const patches = Array.isArray(patchesOrRendered)
+                ? patchesOrRendered
+                : extractClaimPatches(patchesOrRendered);
+            envelopes.push({ feature: featureName, patches });
+        }
+        catch (err) {
+            throw new Error(`Failed to collect patches for feature '${featureName}': ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return envelopes;
+}
+function extractClaimPatches(rendered) {
+    const patches = rendered.patches;
+    if (!patches)
+        return [];
+    if (Array.isArray(patches))
+        return patches;
+    throw new Error(`Feature patches must be a flat array (claim-relative pointers like /annotations/...), got ${typeof patches}: ${JSON.stringify(patches).slice(0, 200)}. See #2648`);
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/lazy_loader.ts
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+// We need to ensure the grep command is a gnu version
+let IS_GNU_GREP = false;
+let GREP_ON_CHECK = false;
+// this loop is for avoid race conditions
+// once a check is running no more checks
+async function waitForCheck() {
+    const f_wait = () => new Promise((timeOut) => setTimeout(timeOut, 10));
+    do {
+        await f_wait();
+    } while (GREP_ON_CHECK);
+}
+function checkGrep() {
+    return new Promise((ok, ko) => {
+        // idempotency: already checked
+        if (IS_GNU_GREP)
+            return ok();
+        // a check is already running no new checks
+        if (GREP_ON_CHECK)
+            return waitForCheck();
+        logger.info('Checking the grep command');
+        GREP_ON_CHECK = true;
+        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['--version']);
+        handler.on('close', (code) => {
+            GREP_ON_CHECK = false;
+            if (code === 0) {
+                logger.debug('Grep is a gnu grep');
+                IS_GNU_GREP = true;
+                ok();
+            }
+            else {
+                ko('Lazy evaluation needs a gnu-grep command');
+            }
+        });
+    });
+}
+async function loadClaim(claimRef, org, defaults = loadClaimDefaults(), patchClaim = loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, existingRefs = {}, postValidations = new Map()) {
+    await checkGrep();
+    let result = existingRefs;
+    logger.info(`Load reference ${claimRef}`);
+    initVirtualClaims(org);
+    logger.info(`Load reference (parts) ${claimRef.split(/-/)[0]} ${claimRef.replace(/^[^-]+-/, '')}`);
+    // cargas datos con grep
+    try {
+        const claimData = await lazyGetClaim(claimRef.split(/-/)[0], claimRef.replace(/^[^-]+-/, ''), org, cwd);
+        let claim = patchClaim(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(claimData), defaults);
+        // Claim stitching: feature claim-patches with three gates before AJV
+        try {
+            claim = await stitchClaim(claim);
+        }
+        catch (e) {
+            throw new Error(`Error when stitching claim ${claimRef}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        let variants = [];
+        if (claim.kind === 'TFWorkspaceClaim' &&
+            claim.providers?.terraform?.variants) {
+            variants = claim.providers.terraform.variants;
+            delete claim.providers.terraform.variants;
+        }
+        logger.silly(`Patched claim is:
+		 ---
+			${catalog_common/* default.io.toYaml */.Z.io.toYaml(claim)}`);
+        try {
+            validateClaim(claim, base[`${claim.kind}Schema`]);
+            await optionalValidation(claim);
+        }
+        catch (error) {
+            let errorMsg = '';
+            if (Array.isArray(error)) {
+                for (const data of error) {
+                    errorMsg = `${errorMsg}
+  - ${data.instancePath}: ${data.message}`;
+                }
+            }
+            else {
+                errorMsg = error instanceof Error ? error.message : String(error);
+            }
+            throw new Error(`Error when validating claim ${claimRef}: ${errorMsg}`);
+        }
+        result[claimRef] = {};
+        result[claimRef]['claim'] = claim;
+        result[claimRef]['claimPath'] = VisitedClaims[claimRef];
+        if (VisitedClaims[claimRef] === 'virtual') {
+            result = await setVirtualClaimAdditionalData(result, claim, claimRef);
+        }
+        else {
+            result = await setNonVirtualClaimAdditionalData(result, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
+        }
+        const claimKind = claim.kind;
+        const references = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(claim));
+        for (const ref of references) {
+            if (!result[ref]) {
+                const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
+                result = lodash_default().merge(result, resolvedReferences);
+            }
+        }
+        if (variants.length > 0) {
+            const parentClaimPath = VisitedClaims[claimRef];
+            for (const variant of variants) {
+                if (!variant.name || !variant.overrides) {
+                    throw new Error(`Variant in claim ${claimRef} is missing required field 'name' or 'overrides'`);
+                }
+                const prohibitedOverrideFields = ['source', 'module', 'name'];
+                for (const field of prohibitedOverrideFields) {
+                    if (field in variant.overrides) {
+                        throw new Error(`Variant '${variant.name}' in claim ${claimRef} cannot override '${field}'`);
+                    }
+                }
+                const composedName = claim.providers.terraform.name + '-' + variant.name;
+                const variantClaim = lodash_default().cloneDeep(claim);
+                variantClaim._parentClaimName = claim.name;
+                variantClaim.name = composedName;
+                variantClaim.providers.terraform = lodash_default().merge({}, claim.providers.terraform, variant.overrides);
+                variantClaim.providers.terraform.name = composedName;
+                if (!variantClaim.annotations) {
+                    variantClaim.annotations = {};
+                }
+                variantClaim.annotations['firestartr.dev/variant-of'] =
+                    claim.providers.terraform.name;
+                const variantRef = `TFWorkspaceClaim-${composedName}`;
+                if (result[variantRef]) {
+                    throw new Error(`Variant name '${variant.name}' (composed: '${composedName}') from claim '${claimRef}' conflicts with existing claim '${variantRef}'`);
+                }
+                logger.info(`Creating synthetic variant claim ${variantRef}`);
+                result[variantRef] = {};
+                result[variantRef]['claim'] = variantClaim;
+                result[variantRef]['claimPath'] = parentClaimPath;
+                result = await setNonVirtualClaimAdditionalData(result, variantClaim, variantRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
+                const variantReferences = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(variantClaim));
+                for (const ref of variantReferences) {
+                    if (!result[ref]) {
+                        const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
+                        result = lodash_default().merge(result, resolvedReferences);
+                    }
+                }
+            }
+        }
+    }
+    catch (err) {
+        throw `Lazy Loading: ${err}`;
+    }
+    return [result, postValidations];
+}
+let LoadedClaims = {};
+let VisitedClaims = {};
+let DuplicatedClaims = {};
+function resetLazyLoader() {
+    LoadedClaims = {};
+    VisitedClaims = {};
+    DuplicatedClaims = {};
+}
+async function lazyGetClaim(kind, name, org, cwd) {
+    const indice = `${kind}-${name}`;
+    logger.info(`Lazy loading ${kind}-${name} with index ${indice}`);
+    if (indice in LoadedClaims)
+        return LoadedClaims[indice];
+    if (isVirtualClaim(kind, name)) {
+        await loadVirtualClaim(kind, name, org);
+    }
+    else {
+        await getClaimsByName(name, cwd);
+    }
+    if (indice in LoadedClaims) {
+        return LoadedClaims[indice];
+    }
+    else {
+        throw new Error(`Error: ${kind}-${name} not found`);
+    }
+}
+async function getClaimsByName(name, cwd = '.') {
+    return new Promise((ok, ko) => {
+        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['-r', '-l', '--include=*', '-E', `name: "?${name}"?`, '.'], {
+            cwd: cwd,
+        });
+        logger.info(`Running ${['grep', '-r', '-l', '--include', '-E', 'name: "' + name + '"?', '.'].join(' ')}`);
+        const entradas = [];
+        const chunks = [];
+        handler.stdout.on('data', (data) => {
+            chunks.push(data.toString('utf-8'));
+        });
+        handler.on('close', () => {
+            const dataFinal = chunks.join('');
+            const fileNameList = dataFinal.split(/\n/).filter((line) => line !== '');
+            for (const fileName of fileNameList) {
+                // only yaml files
+                if (!fileName.match(/\.yml$|\.yaml$/)) {
+                    continue;
+                }
+                // only entries not already visited
+                if (Object.values(VisitedClaims).includes(fileName)) {
+                    continue;
+                }
+                entradas.push(external_path_.join(cwd, fileName));
+            }
+            return Promise.all(entradas.map((entrada) => {
+                return loadRawClaim(entrada);
+            }))
+                .then(() => {
+                ok();
+            })
+                .catch((err) => {
+                ko(err);
+            });
+        });
+    });
+}
+async function loadRawClaim(entry) {
+    return new Promise((ok, ko) => {
+        external_fs_.readFile(entry, 'utf-8', (error, data) => {
+            if (error)
+                return ko(`Reading ${entry}: ${error}`);
+            const claim = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
+            if (!('kind' in claim && 'name' in claim)) {
+                logger.warn(`Invalid claim file ${entry}`);
+            }
+            else {
+                const claimKey = `${claim.kind}-${claim.name}`;
+                if (Object.keys(DuplicatedClaims).includes(claimKey) &&
+                    DuplicatedClaims[claimKey] !== entry) {
+                    return ko(`Duplicated claim ${claimKey} found files: ${DuplicatedClaims[claimKey]} and ${entry}`);
+                }
+                LoadedClaims[claimKey] = data;
+                VisitedClaims[claimKey] = entry;
+                DuplicatedClaims[claimKey] = entry;
+                ok();
+            }
+        });
+    });
+}
+async function setVirtualClaimAdditionalData(renderedData, claim, claimRef) {
+    const virtualClaim = getVirtualClaim(claim.kind, claim.name);
+    renderedData[claimRef]['initializers'] = [
+        new UUIDInitializer(claim),
+        new InitializerClaimRef(),
+        new InitializerDefault(virtualClaim.getDefaultConfig()),
+    ];
+    renderedData[claimRef]['globals'] = [];
+    renderedData[claimRef]['overrides'] = [];
+    renderedData[claimRef]['normalizers'] = [new NameNormalizer()];
+    return renderedData;
+}
+async function setNonVirtualClaimAdditionalData(renderedData, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers) {
+    renderedData[claimRef]['initializers'] = await loadInitializers(claim, renderedData[claimRef]['claimPath']);
+    renderedData[claimRef]['globals'] = await loadGlobals(claim);
+    renderedData[claimRef]['overrides'] = loadOverrides(claim);
+    renderedData[claimRef]['normalizers'] = await loadNormalizers(claim, renderedData[claimRef]['claimPath']);
+    return renderedData;
+}
+async function loadVirtualClaim(kind, name, org) {
+    const virtualClaim = getVirtualClaim(kind, name);
+    const expandedClaim = await virtualClaim.expand({ org });
+    logger.info(`Loading virtual claim ${kind} ${name} ${org}`);
+    LoadedClaims[`${kind}-${name}`] = catalog_common/* default.io.toYaml */.Z.io.toYaml(expandedClaim);
+    VisitedClaims[`${kind}-${name}`] = 'virtual';
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/claimsDefaulter.ts
+
+
+
+/*
+ * Default blocks are objects that cannot be merged but applied as a whole. Meaning:
+ * - If the object is defined at the claim-level it is maintained *AS IT IS* (no merge)
+ * - If the block is missing at the claim-level, the default block is applied
+ */
+const defaultBlocksPaths = ['/providers/terraform/sync'];
+function applyBlockAwareDefaults(claim, defaultClaim) {
+    // we always work with a clone of the original
+    const claimClone = JSON.parse(JSON.stringify(claim));
+    // if the block is claim-level defined we store it here
+    const defaultBlocks = new Map();
+    // we remove the blocks entirely of the claim
+    // to achieve an add copy
+    for (const defaultBlockPath of defaultBlocksPaths) {
+        if (claimsDefaulter_hasDeepPath(claimClone, defaultBlockPath) !== true)
+            continue;
+        const originalValue = fast_json_patch_default().getValueByPointer(claimClone, defaultBlockPath);
+        if (originalValue) {
+            logger.silly(`${claim.kind}/${claim.name}: has an original ${defaultBlockPath}: preserving`);
+            defaultBlocks.set(defaultBlockPath, originalValue);
+            fast_json_patch_default().applyPatch(claimClone, [{ op: 'remove', path: defaultBlockPath }]);
+        }
+    }
+    // if the patch has the same path of a block
+    // and the block was defined at claim-level
+    // we interchange the value with the original value
+    // otherwise we use the default
+    const jsonPatchOps = fast_json_patch_default().compare(claimClone, defaultClaim)
+        .filter((jp) => jp.op === 'add')
+        .map((jp) => {
+        if (defaultBlocks.has(jp.path)) {
+            return {
+                ...jp,
+                value: defaultBlocks.get(jp.path),
+            };
+        }
+        else {
+            return jp;
+        }
+    });
+    return fast_json_patch_default().applyPatch(claimClone, jsonPatchOps).newDocument;
+}
+function claimsDefaulter_hasDeepPath(data, deepPath) {
+    return lodash_default().has(data, deepPath.replace(/\//g, '.').replace(/^\./, ''));
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/loader.ts
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+const isYamlFile = new RegExp(/\.(yaml|yml)$/);
+/**
+ *
+ * @returns Virtual Claims
+ */
+const virtualClaims = [new FirestartrAllClaim()];
+/*
+ * Loads all applicable globals for a given claim and stores them into a list.
+ *
+ * Input:
+ * - claim: our custom claim object, with which we check if the global is applicable
+ *
+ * Returns:
+ * - A GlobalSection array promise, containing all the globals loaded for this claim
+ *
+ */
+async function loadGlobals(claim) {
+    const result = [];
+    await crawl(getPath('globals'), (entry) => {
+        return isYamlFile.test(entry);
+    }, async (entry, data) => {
+        const globalData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
+        const ext = external_path_.extname(entry);
+        const name = external_path_.basename(entry, ext);
+        if (name in SECTIONS_BY_FILE_NAME) {
+            const section = new SECTIONS_BY_FILE_NAME[name](globalData);
+            if (!(await section.validate(SCHEMAS_BY_SECTION_NAME[name] || {}))) {
+                throw new Error(`Invalid ${name} global file`);
+            }
+            if (globalData.kind === claim.kind) {
+                result.push(section);
+            }
+            else {
+                logger.debug(`Skipping global ${name} because it is not applicable to ${claim.kind}`);
+            }
+        }
+    });
+    logger.info(`Loaded globals ${result}`);
+    return result;
+}
+/*
+ * If the input claim is a GithubRepositoryClaim, it loads all it's applicable
+ * overrides and stores them into a list. Otherwise, it returns an empty list.
+ *
+ * Input:
+ * - claim: our custom claim object, which should be a GithubRepositoryClaim
+ *
+ * Returns:
+ * - An Overrider array, with a GithubRepositoryOverrider if the claim
+ *   was a GithubRepositoryClaim, or empty if it was not.
+ *
+ */
+function loadOverrides(claim) {
+    const overrides = [];
+    if (claim.kind === 'ComponentClaim' && claim.providers.github.overrides) {
+        overrides.push(new GithubRepositoryOverrider());
+    }
+    return overrides;
+}
+/**
+ * Load all normalizers and stores them into a list.
+ * @param claim
+ * @returns
+ */
+async function loadNormalizers(_claim, path) {
+    const result = [];
+    for (const normalizer of NORMALIZERS) {
+        result.push(new normalizer({ path: path }));
+    }
+    return result;
+}
+/*
+ * Loads all applicable initializers for a given claim and stores them into a list.
+ *
+ * Input:
+ * - claim: our custom claim object, with which we check if the initializer is applicable
+ *
+ * Returns:
+ * - An Initializer array promise, containing all the initializers loaded for this claim
+ *
+ */
+let loadedInitializers = false;
+async function loadInitializers(claim, claimPath, initializersPath = getPath('initializers')) {
+    const result = [];
+    await crawl(initializersPath, (entry) => {
+        return isYamlFile.test(entry);
+    }, async (entry, data) => {
+        const initializerData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
+        const ext = external_path_.extname(entry);
+        const name = external_path_.basename(entry, ext);
+        if (name in INITIALIZERS_BY_FILE_NAME) {
+            const initializerBfN = new INITIALIZERS_BY_FILE_NAME[name](initializerData);
+            if (!(await initializerBfN.validate(SCHEMAS_BY_INITIALIZER_NAME[name] || {}))) {
+                throw new Error(`Invalid ${name} initializer file`);
+            }
+            if (initializerData.kind === claim.kind) {
+                result.push(initializerBfN);
+            }
+            else {
+                logger.debug(`Skipping initializer ${name} because it is not applicable to ${claim.kind}`);
+            }
+        }
+    });
+    for (const initializer of INITIALIZERS) {
+        if (initializer.applicableKinds.includes(claim.kind)) {
+            result.push(new initializer({ path: claimPath }));
+        }
+    }
+    logger.info(`Loaded initializers ${JSON.stringify(result)}`);
+    loadedInitializers = result;
+    return loadedInitializers;
+}
+function loadClaimDefaults() {
+    try {
+        return catalog_common/* default.io.fromYaml */.Z.io.fromYaml(external_fs_.readFileSync(`${getPath('claimsDefaults')}/claims_defaults.yaml`, 'utf-8'));
+    }
+    catch (error) {
+        const errMsg = `Could not read claims defaults file in path ${getPath('claimsDefaults')}/claims_defaults.yaml: ${error}`;
+        logger.error(errMsg);
+        throw new Error(errMsg);
+    }
+}
+/*
+ * Using fast-json-patch, compares a claim to its kind's defaults, then patches it.
+ *
+ * Input:
+ * - claim: our custom claim object, which we want to patch
+ * - defaultsClaims: an object, containing the defaults for each claim kind,
+ *   with the same structure that we use for the actual claims
+ *
+ * Returns:
+ * - The patched claim
+ *
+ */
+function loader_patchClaim(claim, defaultsClaims) {
+    if (defaultsClaims[claim.kind]) {
+        claim = applyBlockAwareDefaults(claim, defaultsClaims[claim.kind]);
+    }
+    return claim;
+}
+async function loadCRsWithFullSet(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
+    const result = {};
+    const fullResult = {};
+    await crawlWithExclusions(crsPath, (entry) => {
+        return isYamlFile.test(entry);
+    }, async (entry, data) => {
+        const yamlData = stripKnownRelations(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data));
+        const metadata = yamlData?.metadata;
+        if (!(yamlData &&
+            typeof yamlData === 'object' &&
+            'kind' in yamlData &&
+            metadata &&
+            typeof metadata === 'object' &&
+            'name' in metadata)) {
+            logger.warn(`Invalid CR file ${entry}`);
+        }
+        else {
+            const crKey = `${yamlData.kind}-${metadata.name}`;
+            if (fullResult[crKey]) {
+                logger.error(`Duplicate CR ${crKey}`);
+            }
+            // Keep the complete CR set for validations that need repository-wide context.
+            fullResult[crKey] = yamlData;
+            // Keep the filtered CR set for previous-CR lookup during claim rendering.
+            if (allowedClaimReferences.length === 0 ||
+                allowedClaimReferences.includes(yamlData.metadata?.annotations?.[catalog_common/* default.generic.getFirestartrAnnotation */.Z.generic.getFirestartrAnnotation('claim-ref')])) {
+                result[crKey] = yamlData;
+            }
+        }
+    }, excludedPaths.concat(getAdditionalPaths()));
+    return { crs: result, fullCrs: fullResult };
+}
+async function loadCRs(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
+    const { crs } = await loadCRsWithFullSet(crsPath, excludedPaths, allowedClaimReferences);
+    return crs;
+}
+/*
+ * Description: Get the renamed using claimRef annotation
+ * Input: claims: any, crs: any
+ * Output: renames: IRenameResult[]
+ */
+async function loadRenames(claims, crs) {
+    /*
+     * If checkRenames is false, we don't need to check for renames
+     */
+    const renamesEnabled = getRenamesEnabled();
+    if (!renamesEnabled)
+        return [];
+    const result = [];
+    /**
+     * For each CR, look for a claim that does not match the name with CR's firestartr.dev/claim-ref annotation
+     */
+    for (const cr of Object.values(crs)) {
+        const anyCr = cr;
+        if (!anyCr?.metadata?.annotations)
+            continue;
+        // if the annotation is a claimRef
+        const annotationName = common.generic.getFirestartrAnnotation('claim-ref');
+        const annotations = anyCr?.metadata?.annotations || {};
+        if (annotationName in annotations) {
+            const claimRef = anyCr.metadata.annotations[annotationName];
+            // split the annotation into kind and name
+            const [kind, name] = claimRef.split('/');
+            // if the claim exists, check if the name is different for the given provider
+            const referencedClaim = claims[`${kind}-${name}`].claim;
+            const oldName = anyCr.metadata.name;
+            const newName = referencedClaim.providers[getConfiguredProvider()].name;
+            if (oldName !== newName) {
+                result.push({
+                    kind: referencedClaim.kind,
+                    claimPath: claims[`${kind}-${name}`].claimPath,
+                    claimName: referencedClaim.name,
+                    oldName,
+                    newName,
+                });
+            }
+        }
+    }
+    return result;
+}
+async function loadClaimsList(claimRefList, claimsPath = getPath('claims')) {
+    const data = {
+        renderClaims: {},
+        crs: {},
+        fullCrs: {},
+    };
+    const defaults = loadClaimDefaults();
+    for await (const claimRef of claimRefList) {
+        const [renderedClaimData] = await loadClaim(claimRef, getOrg(), defaults, loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, claimsPath);
+        data.renderClaims = lodash_default().merge(data.renderClaims, renderedClaimData);
+    }
+    const crClaimReferences = [];
+    for (const ref of Object.keys(data.renderClaims)) {
+        // Replaces only the first instance of '-'
+        crClaimReferences.push(ref.replace('-', '/'));
+    }
+    const loadedCrs = await loadCRsWithFullSet(getPath('crs'), [getPath('globals'), getPath('initializers')], crClaimReferences);
+    data['crs'] = loadedCrs.crs;
+    data['fullCrs'] = loadedCrs.fullCrs;
+    return data;
+}
+function getOrg() {
+    const groupOrg = catalog_common/* default.environment.getFromEnvironmentWithDefault */.Z.environment.getFromEnvironmentWithDefault(catalog_common/* default.types.envVars.org */.Z.types.envVars.org, '');
+    return groupOrg;
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/references.ts
+function validateTfStateKeyUniqueness(crs) {
+    const tfStateKeys = {};
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (!isTerraformWorkspace(cr))
+            continue;
+        const tfKey = cr.spec.firestartr.tfStateKey;
+        if (tfStateKeys[tfKey]) {
+            throw new Error(`❗❗ ❌ RENDER ERROR ❌ ❗❗
+
+The tfStateKey ${tfKey} is not unique,
+
+It is being used by the following CRs:
+
+- ${tfStateKeys[tfKey].kind} ${tfStateKeys[tfKey].metadata.name}
+
+- ${cr.kind} ${cr.metadata.name}
+
+Check the following Claims to ensure that the tfStateKey is unique:
+
+- ${tfStateKeys[tfKey].metadata.annotations['firestartr.dev/claim-ref']}
+
+- ${cr.metadata.annotations['firestartr.dev/claim-ref']}
+`);
+        }
+        tfStateKeys[cr.spec.firestartr.tfStateKey] = cr;
+    }
+}
+function references_isCatalogEntity(cr) {
+    return [
+        'Component',
+        'Domain',
+        'System',
+        'User',
+        'Group',
+        'Resource',
+    ].includes(cr.kind);
+}
+function isTerraformWorkspace(cr) {
+    return cr.kind === 'FirestartrTerraformWorkspace';
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/crSize.ts
+
+const K8S_OBJECT_SIZE_LIMIT = 1572864; // 1.5 MiB in bytes, etcd recommended limit: https://etcd.io/docs/latest/dev-guide/limit/
+function validateCrSizes(crs) {
+    for (const key of Object.keys(crs)) {
+        const cr = crs[key];
+        const serialized = catalog_common/* default.io.toYaml */.Z.io.toYaml(cr);
+        const size = Buffer.byteLength(serialized, 'utf8');
+        if (size > K8S_OBJECT_SIZE_LIMIT) {
+            throw new Error(`CR "${cr.kind}-${cr.metadata.name}" exceeds the Kubernetes object size limit by ${size - K8S_OBJECT_SIZE_LIMIT} bytes. Maximum allowed is ${K8S_OBJECT_SIZE_LIMIT} bytes (1.5MiB).`);
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/permissions.ts
+
+function validatePermissionsUniqueness(crs) {
+    for (const crkey in crs) {
+        const cr = crs[crkey];
+        if (cr.kind === 'FirestartrGithubRepository') {
+            const permissions = cr.spec.permissions;
+            logger.debug(`Validating Permissions Uniqueness of ${crkey}`);
+            if (permissions) {
+                const rolesByIdentifier = new Map();
+                for (const perm of permissions) {
+                    const identifier = perm.collaborator
+                        ? perm.collaborator
+                        : `ref:${perm.ref.kind}:${perm.ref.name}`;
+                    const role = perm.role;
+                    const prevRole = rolesByIdentifier.get(identifier);
+                    if (prevRole === undefined) {
+                        rolesByIdentifier.set(identifier, role);
+                    }
+                    else if (prevRole !== role) {
+                        throw new Error(`Conflicting permission role in FirestartrGithubRepository ${crkey}: ${identifier} has roles "${prevRole}" and "${role}".\nFull CR: ${JSON.stringify(cr, null, 2)}`);
+                    }
+                }
+            }
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/backstageAnnotations.ts
+const backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX = 'firestartr.backstage.dev/';
+const CATALOG_KINDS = new Set([
+    'User',
+    'Group',
+    'Component',
+    'System',
+    'Domain',
+    'API',
+    'Resource',
+    'CatalogKubernetesResource',
+    'CatalogTerraformWorkspace',
+    'CatalogArgoDeploy',
+    'CatalogOrgWebhook',
+    'CatalogSecrets',
+]);
+function validateNoBackstageAnnotationsInK8sCrs(crs) {
+    for (const crKey in crs) {
+        const cr = crs[crKey];
+        if (CATALOG_KINDS.has(cr.kind))
+            continue;
+        if (cr.metadata?.annotations) {
+            const backstageKeys = Object.keys(cr.metadata.annotations).filter((k) => k.startsWith(backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX));
+            if (backstageKeys.length > 0) {
+                throw new Error(`K8s CR ${crKey} contains Backstage-only annotations (${backstageKeys.join(', ')}). ` +
+                    `Annotations with prefix ${backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX} must only appear on Backstage catalog entities, not on Kubernetes CRs.`);
+            }
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/refsSorter/refsSorter.ts
+
+/**
+ * @param renderClaims renderClaims to sort
+ * @param kinds kinds to get from renderClaims
+ * @returns renderClaims with only the kinds specified
+ */
+function sortRenderClaimsByKind(renderClaims, kinds) {
+    let result = {};
+    for (const kind of kinds) {
+        for (const key in renderClaims) {
+            if (renderClaims[key].claim.kind === kind) {
+                result[key] = renderClaims[key];
+            }
+        }
+        result = sortSelfKindRefs(result, kind);
+    }
+    return result;
+}
+function sortSelfKindRefs(renderClaims, kind) {
+    if (!hasSelfRefs(kind)) {
+        return renderClaims;
+    }
+    const newRenderClaims = {};
+    const data = extractRefs(renderClaims, kind);
+    const ordered = [];
+    const visiting = [];
+    const visited = [];
+    for (const key of Object.keys(data)) {
+        if (!visited.find((obj) => obj.name === key)) {
+            sortRefs(data, data[key], ordered, visiting, visited);
+        }
+    }
+    for (const cr of ordered) {
+        newRenderClaims[cr.name] = renderClaims[cr.name];
+    }
+    return newRenderClaims;
+}
+function sortRefs(data, claim, ordered = [], visiting = [], visited = []) {
+    if (visiting.find((obj) => obj.name === claim.name)) {
+        throw new Error(`Circular dependency detected for '${claim.name}'`);
+    }
+    if (!visited.find((obj) => obj.name === claim.name)) {
+        visiting.push(claim);
+        if (claim.refs) {
+            for (const ref of claim.refs) {
+                const referencedObject = data[ref];
+                if (!referencedObject) {
+                    throw new Error(`Reference '${ref}' does not exist for '${claim.name}'`);
+                }
+                sortRefs(data, referencedObject, ordered, visiting, visited);
+            }
+        }
+        visited.push(visiting.pop());
+        ordered.push(claim);
+    }
+}
+function hasSelfRefs(kind) {
+    return ['TFWorkspaceClaim', 'GroupClaim'].includes(kind);
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-sorter.ts
+
+function sortKinds(orderedKinds, claims) {
+    const result = [];
+    for (const kind of orderedKinds) {
+        const kindRenderClaims = sortRenderClaimsByKind(claims, [kind]);
+        result.push(kindRenderClaims);
+    }
+    return result;
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/overriders/utils.ts
 
 
@@ -166782,14 +167248,12 @@ async function utils_renderFeature(featureName, featureVersion, featureOutputObj
 
 
 
-
-
 // this is the only way currently to make
 // work the system and inject our code
 // without having to download a feature
-let MOCK_FEATURES_FN;
+let featureOverride_MOCK_FEATURES_FN;
 function MOCK_FEATURES(mock) {
-    MOCK_FEATURES_FN = mock;
+    featureOverride_MOCK_FEATURES_FN = mock;
     if (mock) {
         log.warn('⚠️ Warning features system downloader has been mocked, it should only happen in unit testing');
     }
@@ -166820,8 +167284,8 @@ class FeaturesOverrider extends OverriderPatches {
         let owner = 'prefapp';
         let versionOrRef = this.featureVersion;
         let renderer = 'getFeatureConfig';
-        if (MOCK_FEATURES_FN) {
-            return MOCK_FEATURES_FN();
+        if (featureOverride_MOCK_FEATURES_FN) {
+            return featureOverride_MOCK_FEATURES_FN();
         }
         if (this.featureRepo) {
             [owner, repo] = this.featureRepo.split(/\//);
@@ -166839,8 +167303,8 @@ class FeaturesOverrider extends OverriderPatches {
         const featureName = this.featureName;
         const featureVersion = this.featureVersion || this.featureRef;
         const featureArgs = this.featureArgs;
-        const fSetUpAndRunRenderer = function (cr) {
-            return this.setUpAndRunRenderer(cr);
+        const fSetUpAndRunRenderer = function (target) {
+            return this.setUpAndRunRenderer(target);
         }.bind(this);
         let renderedFeatureConfig = null;
         return [
@@ -166849,7 +167313,7 @@ class FeaturesOverrider extends OverriderPatches {
                     return true;
                 },
                 async apply(cr) {
-                    renderedFeatureConfig = await fSetUpAndRunRenderer(cr);
+                    renderedFeatureConfig = await fSetUpAndRunRenderer(claim);
                     return cr;
                 },
                 identify() {
@@ -166862,28 +167326,6 @@ class FeaturesOverrider extends OverriderPatches {
                     return utils_renderFeature(featureName, featureVersion, renderedFeatureConfig, cr, claim.name);
                 },
             },
-            {
-                isPostPatch: true,
-                validate() {
-                    return true;
-                },
-                async apply(cr) {
-                    if (!renderedFeatureConfig) {
-                        logger.warn(`Feature ${featureName}: renderedFeatureConfig is null, skipping post-patch`);
-                        return cr;
-                    }
-                    const provider = helperCTX(this).provider;
-                    const jsonPatches = renderedFeatureConfig.patches?.[provider] || [];
-                    fast_json_patch_default().applyPatch(cr, jsonPatches);
-                    return cr;
-                },
-                identify() {
-                    return `feature-json-patch/${featureName}`;
-                },
-                applicable() {
-                    return { applicableProviders: ['catalog', 'github'] };
-                },
-            },
         ];
     }
 }
@@ -166949,7 +167391,7 @@ function getPreviousCRfromClaim(claim, previousCRs, expectedKind) {
     const isVariantClaim = !!claim._parentClaimName;
     for (const previousCRKey of previousCRsKeys) {
         const previousCR = previousCRs[previousCRKey];
-        if (isCatalogEntity(previousCR))
+        if (references_isCatalogEntity(previousCR))
             continue;
         if (isExcludedFromPreviousCR(previousCR.kind))
             continue;
@@ -171264,15 +171706,30 @@ class CatalogSystemChart extends BaseCatalogChart {
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/catalog/userChart.ts
 
 
+const ORG_ROLE_ANNOTATION = 'firestartr.backstage.dev/org-role';
 class CatalogUserChart extends BaseCatalogChart {
     template() {
         const claim = this.get('claim');
+        const explicitOrgRole = claim.annotations?.[ORG_ROLE_ANNOTATION];
+        const inferredOrgRole = claim.providers &&
+            typeof claim.providers === 'object' &&
+            'github' in claim.providers &&
+            claim.providers.github?.role === 'admin'
+            ? 'owner'
+            : undefined;
+        const orgRole = explicitOrgRole ?? inferredOrgRole;
+        const annotations = {
+            ...(claim.annotations || {}),
+        };
+        if (orgRole) {
+            annotations[ORG_ROLE_ANNOTATION] = orgRole;
+        }
         return {
             apiVersion: 'backstage.io/v1alpha1',
             kind: 'User',
             metadata: {
                 name: claim.name,
-                annotations: claim.annotations || {},
+                annotations,
             },
             spec: {
                 profile: claim.profile,
@@ -172428,6 +172885,7 @@ function validateActionsVariablesUniqueness(crs) {
 
 
 
+
 /*
  * Function called when rendering but not importing
  *
@@ -172455,6 +172913,7 @@ async function renderer_render(catalogScope, firestartrScope, claimList) {
         validateActionsVariablesUniqueness(result);
         validateCrSizes(result);
         validatePermissionsUniqueness(result);
+        validateNoBackstageAnnotationsInK8sCrs(result);
     }
     catch (e) {
         logger.error(e.message);
@@ -172893,7 +173352,7 @@ async function addLastStateAndLastClaimAnnotations(filePath, lastStatePRLink, la
     setRepositoryUrl: setRepositoryUrl,
     setDefaultBranch: setDefaultBranch,
     runComparer: runComparer,
-    isCatalogEntity: isCatalogEntity,
+    isCatalogEntity: references_isCatalogEntity,
     loadCRs: loadCRs,
     renderTfWorkspace: renderTfWorkspace,
     normalizeModuleContent: normalizeModuleContent,
@@ -173685,6 +174144,10 @@ class RepoGithubDecanter extends GithubDecanter {
     __decantPages() {
         if (this.data.pages) {
             const pagesData = this.data.pages;
+            const supportedBuildTypes = ['workflow', 'legacy'];
+            if (!supportedBuildTypes.includes(pagesData.build_type)) {
+                return;
+            }
             const pagesConfig = {
                 buildType: pagesData.build_type,
                 ...(typeof pagesData.cname === 'string' && pagesData.cname.length > 0
@@ -363190,7 +363653,7 @@ function helperCreateCheckRunName(cmd, item) {
 
 ;// CONCATENATED MODULE: ../operator/src/utils/index.ts
 const secretRegex = /\$\{\{ secrets\.(.*?) \}\}/g;
-function isRecord(value) {
+function utils_isRecord(value) {
     return typeof value === 'object' && value !== null;
 }
 function getFirstNonEmptyString(...values) {
@@ -363228,7 +363691,7 @@ function replaceInlineSecrets(inline, secrets) {
     return result;
 }
 function extractErrorDetails(error) {
-    const exitCode = isRecord(error) && typeof error.exitCode === 'number'
+    const exitCode = utils_isRecord(error) && typeof error.exitCode === 'number'
         ? error.exitCode
         : undefined;
     if (typeof error === 'string') {
@@ -363239,7 +363702,7 @@ function extractErrorDetails(error) {
         const output = getFirstNonEmptyString(errorWithOutput.output, error.message);
         return { output: output ?? String(error), exitCode };
     }
-    if (isRecord(error)) {
+    if (utils_isRecord(error)) {
         const output = getFirstNonEmptyString(error.output, error.message, error.error);
         if (output !== undefined) {
             return { output, exitCode };
@@ -713352,7 +713815,7 @@ const crsStatusSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = JSON.parse('{"i8":"2.11.0-snapshot-ghpages-01"}');
+const package_namespaceObject = JSON.parse('{"i8":"2.11.0-snapshot-patch-claims"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"i8":"2.10.0"};
 // EXTERNAL MODULE: ../../node_modules/semver/index.js