@firestartr/cli 2.11.0-snapshot-main-1 → 2.11.0-snapshot-patches-patch-claims-2

package/build/index.js

@@ -128395,7 +128395,7 @@ function trasformLeg(leg) {
 
 
 function getFeatureRenderedPathForEntity(entity, featureName, basePath = '/tmp') {
-    const entityFolderName = `${entity.metadata.name}`.toLowerCase();
+    const entityFolderName = `${entity.metadata?.name ?? entity.name}`.toLowerCase();
     return external_path_default().join(basePath, entityFolderName, featureName);
 }
 function getFeatureRenderedConfigForComponent(entity, featureName, basePath = '/tmp/features') {
@@ -164488,771 +164488,6 @@ const base_secrets_schema = 'firestartr.dev://common/SecretsClaim';
     SecretsClaimSchema: base_secrets_schema,
 });
 
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/lazy_loader.ts
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-// We need to ensure the grep command is a gnu version
-let IS_GNU_GREP = false;
-let GREP_ON_CHECK = false;
-// this loop is for avoid race conditions
-// once a check is running no more checks
-async function waitForCheck() {
-    const f_wait = () => new Promise((timeOut) => setTimeout(timeOut, 10));
-    do {
-        await f_wait();
-    } while (GREP_ON_CHECK);
-}
-function checkGrep() {
-    return new Promise((ok, ko) => {
-        // idempotency: already checked
-        if (IS_GNU_GREP)
-            return ok();
-        // a check is already running no new checks
-        if (GREP_ON_CHECK)
-            return waitForCheck();
-        logger.info('Checking the grep command');
-        GREP_ON_CHECK = true;
-        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['--version']);
-        handler.on('close', (code) => {
-            GREP_ON_CHECK = false;
-            if (code === 0) {
-                logger.debug('Grep is a gnu grep');
-                IS_GNU_GREP = true;
-                ok();
-            }
-            else {
-                ko('Lazy evaluation needs a gnu-grep command');
-            }
-        });
-    });
-}
-async function loadClaim(claimRef, org, defaults = loadClaimDefaults(), patchClaim = loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, existingRefs = {}, postValidations = new Map()) {
-    await checkGrep();
-    let result = existingRefs;
-    logger.info(`Load reference ${claimRef}`);
-    initVirtualClaims(org);
-    logger.info(`Load reference (parts) ${claimRef.split(/-/)[0]} ${claimRef.replace(/^[^-]+-/, '')}`);
-    // cargas datos con grep
-    try {
-        const claimData = await lazyGetClaim(claimRef.split(/-/)[0], claimRef.replace(/^[^-]+-/, ''), org, cwd);
-        const claim = patchClaim(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(claimData), defaults);
-        let variants = [];
-        if (claim.kind === 'TFWorkspaceClaim' &&
-            claim.providers?.terraform?.variants) {
-            variants = claim.providers.terraform.variants;
-            delete claim.providers.terraform.variants;
-        }
-        logger.silly(`Patched claim is:
-		 ---
-			${catalog_common/* default.io.toYaml */.Z.io.toYaml(claim)}`);
-        try {
-            validateClaim(claim, base[`${claim.kind}Schema`]);
-            await optionalValidation(claim);
-        }
-        catch (error) {
-            let errorMsg = '';
-            if (Array.isArray(error)) {
-                for (const data of error) {
-                    errorMsg = `${errorMsg}
-  - ${data.instancePath}: ${data.message}`;
-                }
-            }
-            else {
-                errorMsg = error instanceof Error ? error.message : String(error);
-            }
-            throw new Error(`Error when validating claim ${claimRef}: ${errorMsg}`);
-        }
-        result[claimRef] = {};
-        result[claimRef]['claim'] = claim;
-        result[claimRef]['claimPath'] = VisitedClaims[claimRef];
-        if (VisitedClaims[claimRef] === 'virtual') {
-            result = await setVirtualClaimAdditionalData(result, claim, claimRef);
-        }
-        else {
-            result = await setNonVirtualClaimAdditionalData(result, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
-        }
-        const claimKind = claim.kind;
-        const references = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(claim));
-        for (const ref of references) {
-            if (!result[ref]) {
-                const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
-                result = lodash_default().merge(result, resolvedReferences);
-            }
-        }
-        if (variants.length > 0) {
-            const parentClaimPath = VisitedClaims[claimRef];
-            for (const variant of variants) {
-                if (!variant.name || !variant.overrides) {
-                    throw new Error(`Variant in claim ${claimRef} is missing required field 'name' or 'overrides'`);
-                }
-                const prohibitedOverrideFields = ['source', 'module', 'name'];
-                for (const field of prohibitedOverrideFields) {
-                    if (field in variant.overrides) {
-                        throw new Error(`Variant '${variant.name}' in claim ${claimRef} cannot override '${field}'`);
-                    }
-                }
-                const composedName = claim.providers.terraform.name + '-' + variant.name;
-                const variantClaim = lodash_default().cloneDeep(claim);
-                variantClaim._parentClaimName = claim.name;
-                variantClaim.name = composedName;
-                variantClaim.providers.terraform = lodash_default().merge({}, claim.providers.terraform, variant.overrides);
-                variantClaim.providers.terraform.name = composedName;
-                if (!variantClaim.annotations) {
-                    variantClaim.annotations = {};
-                }
-                variantClaim.annotations['firestartr.dev/variant-of'] =
-                    claim.providers.terraform.name;
-                const variantRef = `TFWorkspaceClaim-${composedName}`;
-                if (result[variantRef]) {
-                    throw new Error(`Variant name '${variant.name}' (composed: '${composedName}') from claim '${claimRef}' conflicts with existing claim '${variantRef}'`);
-                }
-                logger.info(`Creating synthetic variant claim ${variantRef}`);
-                result[variantRef] = {};
-                result[variantRef]['claim'] = variantClaim;
-                result[variantRef]['claimPath'] = parentClaimPath;
-                result = await setNonVirtualClaimAdditionalData(result, variantClaim, variantRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
-                const variantReferences = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(variantClaim));
-                for (const ref of variantReferences) {
-                    if (!result[ref]) {
-                        const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
-                        result = lodash_default().merge(result, resolvedReferences);
-                    }
-                }
-            }
-        }
-    }
-    catch (err) {
-        throw `Lazy Loading: ${err}`;
-    }
-    return [result, postValidations];
-}
-let LoadedClaims = {};
-let VisitedClaims = {};
-let DuplicatedClaims = {};
-function resetLazyLoader() {
-    LoadedClaims = {};
-    VisitedClaims = {};
-    DuplicatedClaims = {};
-}
-async function lazyGetClaim(kind, name, org, cwd) {
-    const indice = `${kind}-${name}`;
-    logger.info(`Lazy loading ${kind}-${name} with index ${indice}`);
-    if (indice in LoadedClaims)
-        return LoadedClaims[indice];
-    if (isVirtualClaim(kind, name)) {
-        await loadVirtualClaim(kind, name, org);
-    }
-    else {
-        await getClaimsByName(name, cwd);
-    }
-    if (indice in LoadedClaims) {
-        return LoadedClaims[indice];
-    }
-    else {
-        throw new Error(`Error: ${kind}-${name} not found`);
-    }
-}
-async function getClaimsByName(name, cwd = '.') {
-    return new Promise((ok, ko) => {
-        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['-r', '-l', '--include=*', '-E', `name: "?${name}"?`, '.'], {
-            cwd: cwd,
-        });
-        logger.info(`Running ${['grep', '-r', '-l', '--include', '-E', 'name: "' + name + '"?', '.'].join(' ')}`);
-        const entradas = [];
-        const chunks = [];
-        handler.stdout.on('data', (data) => {
-            chunks.push(data.toString('utf-8'));
-        });
-        handler.on('close', () => {
-            const dataFinal = chunks.join('');
-            const fileNameList = dataFinal.split(/\n/).filter((line) => line !== '');
-            for (const fileName of fileNameList) {
-                // only yaml files
-                if (!fileName.match(/\.yml$|\.yaml$/)) {
-                    continue;
-                }
-                // only entries not already visited
-                if (Object.values(VisitedClaims).includes(fileName)) {
-                    continue;
-                }
-                entradas.push(external_path_.join(cwd, fileName));
-            }
-            return Promise.all(entradas.map((entrada) => {
-                return loadRawClaim(entrada);
-            }))
-                .then(() => {
-                ok();
-            })
-                .catch((err) => {
-                ko(err);
-            });
-        });
-    });
-}
-async function loadRawClaim(entry) {
-    return new Promise((ok, ko) => {
-        external_fs_.readFile(entry, 'utf-8', (error, data) => {
-            if (error)
-                return ko(`Reading ${entry}: ${error}`);
-            const claim = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
-            if (!('kind' in claim && 'name' in claim)) {
-                logger.warn(`Invalid claim file ${entry}`);
-            }
-            else {
-                const claimKey = `${claim.kind}-${claim.name}`;
-                if (Object.keys(DuplicatedClaims).includes(claimKey) &&
-                    DuplicatedClaims[claimKey] !== entry) {
-                    return ko(`Duplicated claim ${claimKey} found files: ${DuplicatedClaims[claimKey]} and ${entry}`);
-                }
-                LoadedClaims[claimKey] = data;
-                VisitedClaims[claimKey] = entry;
-                DuplicatedClaims[claimKey] = entry;
-                ok();
-            }
-        });
-    });
-}
-async function setVirtualClaimAdditionalData(renderedData, claim, claimRef) {
-    const virtualClaim = getVirtualClaim(claim.kind, claim.name);
-    renderedData[claimRef]['initializers'] = [
-        new UUIDInitializer(claim),
-        new InitializerClaimRef(),
-        new InitializerDefault(virtualClaim.getDefaultConfig()),
-    ];
-    renderedData[claimRef]['globals'] = [];
-    renderedData[claimRef]['overrides'] = [];
-    renderedData[claimRef]['normalizers'] = [new NameNormalizer()];
-    return renderedData;
-}
-async function setNonVirtualClaimAdditionalData(renderedData, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers) {
-    renderedData[claimRef]['initializers'] = await loadInitializers(claim, renderedData[claimRef]['claimPath']);
-    renderedData[claimRef]['globals'] = await loadGlobals(claim);
-    renderedData[claimRef]['overrides'] = loadOverrides(claim);
-    renderedData[claimRef]['normalizers'] = await loadNormalizers(claim, renderedData[claimRef]['claimPath']);
-    return renderedData;
-}
-async function loadVirtualClaim(kind, name, org) {
-    const virtualClaim = getVirtualClaim(kind, name);
-    const expandedClaim = await virtualClaim.expand({ org });
-    logger.info(`Loading virtual claim ${kind} ${name} ${org}`);
-    LoadedClaims[`${kind}-${name}`] = catalog_common/* default.io.toYaml */.Z.io.toYaml(expandedClaim);
-    VisitedClaims[`${kind}-${name}`] = 'virtual';
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/claimsDefaulter.ts
-
-
-
-/*
- * Default blocks are objects that cannot be merged but applied as a whole. Meaning:
- * - If the object is defined at the claim-level it is maintained *AS IT IS* (no merge)
- * - If the block is missing at the claim-level, the default block is applied
- */
-const defaultBlocksPaths = ['/providers/terraform/sync'];
-function applyBlockAwareDefaults(claim, defaultClaim) {
-    // we always work with a clone of the original
-    const claimClone = JSON.parse(JSON.stringify(claim));
-    // if the block is claim-level defined we store it here
-    const defaultBlocks = new Map();
-    // we remove the blocks entirely of the claim
-    // to achieve an add copy
-    for (const defaultBlockPath of defaultBlocksPaths) {
-        if (claimsDefaulter_hasDeepPath(claimClone, defaultBlockPath) !== true)
-            continue;
-        const originalValue = fast_json_patch_default().getValueByPointer(claimClone, defaultBlockPath);
-        if (originalValue) {
-            logger.silly(`${claim.kind}/${claim.name}: has an original ${defaultBlockPath}: preserving`);
-            defaultBlocks.set(defaultBlockPath, originalValue);
-            fast_json_patch_default().applyPatch(claimClone, [{ op: 'remove', path: defaultBlockPath }]);
-        }
-    }
-    // if the patch has the same path of a block
-    // and the block was defined at claim-level
-    // we interchange the value with the original value
-    // otherwise we use the default
-    const jsonPatchOps = fast_json_patch_default().compare(claimClone, defaultClaim)
-        .filter((jp) => jp.op === 'add')
-        .map((jp) => {
-        if (defaultBlocks.has(jp.path)) {
-            return {
-                ...jp,
-                value: defaultBlocks.get(jp.path),
-            };
-        }
-        else {
-            return jp;
-        }
-    });
-    return fast_json_patch_default().applyPatch(claimClone, jsonPatchOps).newDocument;
-}
-function claimsDefaulter_hasDeepPath(data, deepPath) {
-    return lodash_default().has(data, deepPath.replace(/\//g, '.').replace(/^\./, ''));
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/loader.ts
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-const isYamlFile = new RegExp(/\.(yaml|yml)$/);
-/**
- *
- * @returns Virtual Claims
- */
-const virtualClaims = [new FirestartrAllClaim()];
-/*
- * Loads all applicable globals for a given claim and stores them into a list.
- *
- * Input:
- * - claim: our custom claim object, with which we check if the global is applicable
- *
- * Returns:
- * - A GlobalSection array promise, containing all the globals loaded for this claim
- *
- */
-async function loadGlobals(claim) {
-    const result = [];
-    await crawl(getPath('globals'), (entry) => {
-        return isYamlFile.test(entry);
-    }, async (entry, data) => {
-        const globalData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
-        const ext = external_path_.extname(entry);
-        const name = external_path_.basename(entry, ext);
-        if (name in SECTIONS_BY_FILE_NAME) {
-            const section = new SECTIONS_BY_FILE_NAME[name](globalData);
-            if (!(await section.validate(SCHEMAS_BY_SECTION_NAME[name] || {}))) {
-                throw new Error(`Invalid ${name} global file`);
-            }
-            if (globalData.kind === claim.kind) {
-                result.push(section);
-            }
-            else {
-                logger.debug(`Skipping global ${name} because it is not applicable to ${claim.kind}`);
-            }
-        }
-    });
-    logger.info(`Loaded globals ${result}`);
-    return result;
-}
-/*
- * If the input claim is a GithubRepositoryClaim, it loads all it's applicable
- * overrides and stores them into a list. Otherwise, it returns an empty list.
- *
- * Input:
- * - claim: our custom claim object, which should be a GithubRepositoryClaim
- *
- * Returns:
- * - An Overrider array, with a GithubRepositoryOverrider if the claim
- *   was a GithubRepositoryClaim, or empty if it was not.
- *
- */
-function loadOverrides(claim) {
-    const overrides = [];
-    if (claim.kind === 'ComponentClaim' && claim.providers.github.overrides) {
-        overrides.push(new GithubRepositoryOverrider());
-    }
-    return overrides;
-}
-/**
- * Load all normalizers and stores them into a list.
- * @param claim
- * @returns
- */
-async function loadNormalizers(_claim, path) {
-    const result = [];
-    for (const normalizer of NORMALIZERS) {
-        result.push(new normalizer({ path: path }));
-    }
-    return result;
-}
-/*
- * Loads all applicable initializers for a given claim and stores them into a list.
- *
- * Input:
- * - claim: our custom claim object, with which we check if the initializer is applicable
- *
- * Returns:
- * - An Initializer array promise, containing all the initializers loaded for this claim
- *
- */
-let loadedInitializers = false;
-async function loadInitializers(claim, claimPath, initializersPath = getPath('initializers')) {
-    const result = [];
-    await crawl(initializersPath, (entry) => {
-        return isYamlFile.test(entry);
-    }, async (entry, data) => {
-        const initializerData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
-        const ext = external_path_.extname(entry);
-        const name = external_path_.basename(entry, ext);
-        if (name in INITIALIZERS_BY_FILE_NAME) {
-            const initializerBfN = new INITIALIZERS_BY_FILE_NAME[name](initializerData);
-            if (!(await initializerBfN.validate(SCHEMAS_BY_INITIALIZER_NAME[name] || {}))) {
-                throw new Error(`Invalid ${name} initializer file`);
-            }
-            if (initializerData.kind === claim.kind) {
-                result.push(initializerBfN);
-            }
-            else {
-                logger.debug(`Skipping initializer ${name} because it is not applicable to ${claim.kind}`);
-            }
-        }
-    });
-    for (const initializer of INITIALIZERS) {
-        if (initializer.applicableKinds.includes(claim.kind)) {
-            result.push(new initializer({ path: claimPath }));
-        }
-    }
-    logger.info(`Loaded initializers ${JSON.stringify(result)}`);
-    loadedInitializers = result;
-    return loadedInitializers;
-}
-function loadClaimDefaults() {
-    try {
-        return catalog_common/* default.io.fromYaml */.Z.io.fromYaml(external_fs_.readFileSync(`${getPath('claimsDefaults')}/claims_defaults.yaml`, 'utf-8'));
-    }
-    catch (error) {
-        const errMsg = `Could not read claims defaults file in path ${getPath('claimsDefaults')}/claims_defaults.yaml: ${error}`;
-        logger.error(errMsg);
-        throw new Error(errMsg);
-    }
-}
-/*
- * Using fast-json-patch, compares a claim to its kind's defaults, then patches it.
- *
- * Input:
- * - claim: our custom claim object, which we want to patch
- * - defaultsClaims: an object, containing the defaults for each claim kind,
- *   with the same structure that we use for the actual claims
- *
- * Returns:
- * - The patched claim
- *
- */
-function loader_patchClaim(claim, defaultsClaims) {
-    if (defaultsClaims[claim.kind]) {
-        claim = applyBlockAwareDefaults(claim, defaultsClaims[claim.kind]);
-    }
-    return claim;
-}
-async function loadCRsWithFullSet(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
-    const result = {};
-    const fullResult = {};
-    await crawlWithExclusions(crsPath, (entry) => {
-        return isYamlFile.test(entry);
-    }, async (entry, data) => {
-        const yamlData = stripKnownRelations(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data));
-        const metadata = yamlData?.metadata;
-        if (!(yamlData &&
-            typeof yamlData === 'object' &&
-            'kind' in yamlData &&
-            metadata &&
-            typeof metadata === 'object' &&
-            'name' in metadata)) {
-            logger.warn(`Invalid CR file ${entry}`);
-        }
-        else {
-            const crKey = `${yamlData.kind}-${metadata.name}`;
-            if (fullResult[crKey]) {
-                logger.error(`Duplicate CR ${crKey}`);
-            }
-            // Keep the complete CR set for validations that need repository-wide context.
-            fullResult[crKey] = yamlData;
-            // Keep the filtered CR set for previous-CR lookup during claim rendering.
-            if (allowedClaimReferences.length === 0 ||
-                allowedClaimReferences.includes(yamlData.metadata?.annotations?.[catalog_common/* default.generic.getFirestartrAnnotation */.Z.generic.getFirestartrAnnotation('claim-ref')])) {
-                result[crKey] = yamlData;
-            }
-        }
-    }, excludedPaths.concat(getAdditionalPaths()));
-    return { crs: result, fullCrs: fullResult };
-}
-async function loadCRs(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
-    const { crs } = await loadCRsWithFullSet(crsPath, excludedPaths, allowedClaimReferences);
-    return crs;
-}
-/*
- * Description: Get the renamed using claimRef annotation
- * Input: claims: any, crs: any
- * Output: renames: IRenameResult[]
- */
-async function loadRenames(claims, crs) {
-    /*
-     * If checkRenames is false, we don't need to check for renames
-     */
-    const renamesEnabled = getRenamesEnabled();
-    if (!renamesEnabled)
-        return [];
-    const result = [];
-    /**
-     * For each CR, look for a claim that does not match the name with CR's firestartr.dev/claim-ref annotation
-     */
-    for (const cr of Object.values(crs)) {
-        const anyCr = cr;
-        if (!anyCr?.metadata?.annotations)
-            continue;
-        // if the annotation is a claimRef
-        const annotationName = common.generic.getFirestartrAnnotation('claim-ref');
-        const annotations = anyCr?.metadata?.annotations || {};
-        if (annotationName in annotations) {
-            const claimRef = anyCr.metadata.annotations[annotationName];
-            // split the annotation into kind and name
-            const [kind, name] = claimRef.split('/');
-            // if the claim exists, check if the name is different for the given provider
-            const referencedClaim = claims[`${kind}-${name}`].claim;
-            const oldName = anyCr.metadata.name;
-            const newName = referencedClaim.providers[getConfiguredProvider()].name;
-            if (oldName !== newName) {
-                result.push({
-                    kind: referencedClaim.kind,
-                    claimPath: claims[`${kind}-${name}`].claimPath,
-                    claimName: referencedClaim.name,
-                    oldName,
-                    newName,
-                });
-            }
-        }
-    }
-    return result;
-}
-async function loadClaimsList(claimRefList, claimsPath = getPath('claims')) {
-    const data = {
-        renderClaims: {},
-        crs: {},
-        fullCrs: {},
-    };
-    const defaults = loadClaimDefaults();
-    for await (const claimRef of claimRefList) {
-        const [renderedClaimData] = await loadClaim(claimRef, getOrg(), defaults, loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, claimsPath);
-        data.renderClaims = lodash_default().merge(data.renderClaims, renderedClaimData);
-    }
-    const crClaimReferences = [];
-    for (const ref of Object.keys(data.renderClaims)) {
-        // Replaces only the first instance of '-'
-        crClaimReferences.push(ref.replace('-', '/'));
-    }
-    const loadedCrs = await loadCRsWithFullSet(getPath('crs'), [getPath('globals'), getPath('initializers')], crClaimReferences);
-    data['crs'] = loadedCrs.crs;
-    data['fullCrs'] = loadedCrs.fullCrs;
-    return data;
-}
-function getOrg() {
-    const groupOrg = catalog_common/* default.environment.getFromEnvironmentWithDefault */.Z.environment.getFromEnvironmentWithDefault(catalog_common/* default.types.envVars.org */.Z.types.envVars.org, '');
-    return groupOrg;
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/references.ts
-function validateTfStateKeyUniqueness(crs) {
-    const tfStateKeys = {};
-    for (const crKey of Object.keys(crs)) {
-        const cr = crs[crKey];
-        if (!isTerraformWorkspace(cr))
-            continue;
-        const tfKey = cr.spec.firestartr.tfStateKey;
-        if (tfStateKeys[tfKey]) {
-            throw new Error(`❗❗ ❌ RENDER ERROR ❌ ❗❗
-
-The tfStateKey ${tfKey} is not unique,
-
-It is being used by the following CRs:
-
-- ${tfStateKeys[tfKey].kind} ${tfStateKeys[tfKey].metadata.name}
-
-- ${cr.kind} ${cr.metadata.name}
-
-Check the following Claims to ensure that the tfStateKey is unique:
-
-- ${tfStateKeys[tfKey].metadata.annotations['firestartr.dev/claim-ref']}
-
-- ${cr.metadata.annotations['firestartr.dev/claim-ref']}
-`);
-        }
-        tfStateKeys[cr.spec.firestartr.tfStateKey] = cr;
-    }
-}
-function references_isCatalogEntity(cr) {
-    return [
-        'Component',
-        'Domain',
-        'System',
-        'User',
-        'Group',
-        'Resource',
-    ].includes(cr.kind);
-}
-function isTerraformWorkspace(cr) {
-    return cr.kind === 'FirestartrTerraformWorkspace';
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/crSize.ts
-
-const K8S_OBJECT_SIZE_LIMIT = 1572864; // 1.5 MiB in bytes, etcd recommended limit: https://etcd.io/docs/latest/dev-guide/limit/
-function validateCrSizes(crs) {
-    for (const key of Object.keys(crs)) {
-        const cr = crs[key];
-        const serialized = catalog_common/* default.io.toYaml */.Z.io.toYaml(cr);
-        const size = Buffer.byteLength(serialized, 'utf8');
-        if (size > K8S_OBJECT_SIZE_LIMIT) {
-            throw new Error(`CR "${cr.kind}-${cr.metadata.name}" exceeds the Kubernetes object size limit by ${size - K8S_OBJECT_SIZE_LIMIT} bytes. Maximum allowed is ${K8S_OBJECT_SIZE_LIMIT} bytes (1.5MiB).`);
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/permissions.ts
-
-function validatePermissionsUniqueness(crs) {
-    for (const crkey in crs) {
-        const cr = crs[crkey];
-        if (cr.kind === 'FirestartrGithubRepository') {
-            const permissions = cr.spec.permissions;
-            logger.debug(`Validating Permissions Uniqueness of ${crkey}`);
-            if (permissions) {
-                const rolesByIdentifier = new Map();
-                for (const perm of permissions) {
-                    const identifier = perm.collaborator
-                        ? perm.collaborator
-                        : `ref:${perm.ref.kind}:${perm.ref.name}`;
-                    const role = perm.role;
-                    const prevRole = rolesByIdentifier.get(identifier);
-                    if (prevRole === undefined) {
-                        rolesByIdentifier.set(identifier, role);
-                    }
-                    else if (prevRole !== role) {
-                        throw new Error(`Conflicting permission role in FirestartrGithubRepository ${crkey}: ${identifier} has roles "${prevRole}" and "${role}".\nFull CR: ${JSON.stringify(cr, null, 2)}`);
-                    }
-                }
-            }
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/backstageAnnotations.ts
-const backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX = 'firestartr.backstage.dev/';
-const CATALOG_KINDS = new Set([
-    'User',
-    'Group',
-    'Component',
-    'System',
-    'Domain',
-    'API',
-    'Resource',
-    'CatalogKubernetesResource',
-    'CatalogTerraformWorkspace',
-    'CatalogArgoDeploy',
-    'CatalogOrgWebhook',
-    'CatalogSecrets',
-]);
-function validateNoBackstageAnnotationsInK8sCrs(crs) {
-    for (const crKey in crs) {
-        const cr = crs[crKey];
-        if (CATALOG_KINDS.has(cr.kind))
-            continue;
-        if (cr.metadata?.annotations) {
-            const backstageKeys = Object.keys(cr.metadata.annotations).filter((k) => k.startsWith(backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX));
-            if (backstageKeys.length > 0) {
-                throw new Error(`K8s CR ${crKey} contains Backstage-only annotations (${backstageKeys.join(', ')}). ` +
-                    `Annotations with prefix ${backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX} must only appear on Backstage catalog entities, not on Kubernetes CRs.`);
-            }
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/refsSorter/refsSorter.ts
-
-/**
- * @param renderClaims renderClaims to sort
- * @param kinds kinds to get from renderClaims
- * @returns renderClaims with only the kinds specified
- */
-function sortRenderClaimsByKind(renderClaims, kinds) {
-    let result = {};
-    for (const kind of kinds) {
-        for (const key in renderClaims) {
-            if (renderClaims[key].claim.kind === kind) {
-                result[key] = renderClaims[key];
-            }
-        }
-        result = sortSelfKindRefs(result, kind);
-    }
-    return result;
-}
-function sortSelfKindRefs(renderClaims, kind) {
-    if (!hasSelfRefs(kind)) {
-        return renderClaims;
-    }
-    const newRenderClaims = {};
-    const data = extractRefs(renderClaims, kind);
-    const ordered = [];
-    const visiting = [];
-    const visited = [];
-    for (const key of Object.keys(data)) {
-        if (!visited.find((obj) => obj.name === key)) {
-            sortRefs(data, data[key], ordered, visiting, visited);
-        }
-    }
-    for (const cr of ordered) {
-        newRenderClaims[cr.name] = renderClaims[cr.name];
-    }
-    return newRenderClaims;
-}
-function sortRefs(data, claim, ordered = [], visiting = [], visited = []) {
-    if (visiting.find((obj) => obj.name === claim.name)) {
-        throw new Error(`Circular dependency detected for '${claim.name}'`);
-    }
-    if (!visited.find((obj) => obj.name === claim.name)) {
-        visiting.push(claim);
-        if (claim.refs) {
-            for (const ref of claim.refs) {
-                const referencedObject = data[ref];
-                if (!referencedObject) {
-                    throw new Error(`Reference '${ref}' does not exist for '${claim.name}'`);
-                }
-                sortRefs(data, referencedObject, ordered, visiting, visited);
-            }
-        }
-        visited.push(visiting.pop());
-        ordered.push(claim);
-    }
-}
-function hasSelfRefs(kind) {
-    return ['TFWorkspaceClaim', 'GroupClaim'].includes(kind);
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-sorter.ts
-
-function sortKinds(orderedKinds, claims) {
-    const result = [];
-    for (const kind of orderedKinds) {
-        const kindRenderClaims = sortRenderClaimsByKind(claims, [kind]);
-        result.push(kindRenderClaims);
-    }
-    return result;
-}
-
 ;// CONCATENATED MODULE: ../features_renderer/src/common.ts
 
 function isDirectory(path) {
@@ -165263,7 +164498,7 @@ function isFile(path) {
 }
 function common_slurpFile(path) {
     if (!isFile(path)) {
-        throw `File not found ${path}`;
+        throw new Error(`File not found ${path}`);
     }
     return external_fs_.readFileSync(path, { encoding: 'utf-8' });
 }
@@ -165293,13 +164528,23 @@ var ajv_default = /*#__PURE__*/__nccwpck_require__.n(dist_ajv);
                     },
                 },
                 patches: {
+                    // Flat array of claim-level JSON Patch operations, applied to the
+                    // claim during claim stitching via claim-relative pointers (e.g.
+                    // /annotations/backstage.io~1techdocs-ref). This is the canonical
+                    // source for claim-level feature behaviour.
+                    type: 'array',
+                    items: { $ref: '#/definitions/Patch' },
+                },
+                claimPatches: {
+                    // Provider-keyed object consumed when a feature claim is created
+                    // elsewhere (attached at the top level of the created claim). This is
+                    // distinct from `patches`, which claim stitching consumes directly.
                     type: 'object',
+                    additionalProperties: false,
                     patternProperties: {
                         '^.+$': {
                             type: 'array',
-                            items: {
-                                $ref: '#/definitions/Patch',
-                            },
+                            items: { $ref: '#/definitions/Patch' },
                         },
                     },
                 },
@@ -165403,7 +164648,7 @@ var ajv_default = /*#__PURE__*/__nccwpck_require__.n(dist_ajv);
                     type: 'string',
                 },
                 value: {
-                    type: 'string',
+                    type: ['string', 'object', 'array', 'number', 'boolean', 'null'],
                 },
             },
             required: ['name', 'op', 'path'],
@@ -165428,10 +164673,10 @@ function validate(featurePath) {
 }
 function __validateDirStructure(featurePath) {
     if (!isDirectory(featurePath)) {
-        throw `Feature: ${featurePath} not a directory`;
+        throw new Error(`Feature: ${featurePath} not a directory`);
     }
     if (!isFile(external_path_.join(featurePath, 'config.yaml'))) {
-        throw `Feature: ${featurePath}/config.yaml not found or not a file`;
+        throw new Error(`Feature: ${featurePath}/config.yaml not found or not a file`);
     }
 }
 function __validateFeatureConfig(featurePath) {
@@ -165441,10 +164686,16 @@ function __validateFeatureConfig(featurePath) {
         return configData;
     }
     catch (error) {
-        throw `Feature: loading config.yaml: ${error}`;
+        throw new Error(`Feature: loading config.yaml: ${error}`);
     }
 }
 function __validateFeatureConfigData(configData) {
+    // Detect old provider-keyed patches shape for migration hint (PLAN #2648)
+    if (configData.patches &&
+        !Array.isArray(configData.patches) &&
+        typeof configData.patches === 'object') {
+        throw new Error(`Feature: config.yaml invalid patches: expected flat array of patches (claim-relative pointers like /annotations/backstage.io~1techdocs-ref), but got provider-keyed object ${JSON.stringify(Object.keys(configData.patches))}. Migrate: patches: { catalog: [...] } → patches: [{ op, path: /annotations/backstage.io~1techdocs-ref, value }]. See #2648. $ref paths also migrate: [spec, org] → [providers, github, org], [metadata, annotations, firestartr.dev/external-name] → [providers, github, name]`);
+    }
     const ajv = new (ajv_default())({
         allowUnionTypes: true,
     });
@@ -165455,7 +164706,7 @@ function __validateFeatureConfigData(configData) {
     const validate = ajv.compile(activeSchema);
     const valid = validate(configData);
     if (!valid) {
-        throw `Feature: config.yaml invalid ${JSON.stringify(validate.errors)}`;
+        throw new Error(`Feature: config.yaml invalid ${JSON.stringify(validate.errors)}`);
     }
 }
 function stripAnchoringConstraints(schemaDef) {
@@ -165466,14 +164717,12 @@ function stripAnchoringConstraints(schemaDef) {
     return clone;
 }
 function __validateJsonPatches(configData) {
-    const keys = Object.keys(configData.patches);
-    for (const key of keys) {
-        if (configData.patches[key]) {
-            if (fast_json_patch_default().validate(configData.patches[key])) {
-                const errors = JSON.stringify(fast_json_patch_default().validate(configData.patches[key]).message);
-                throw `Feature: config.yaml -> patches: invalid patches ${errors}`;
-            }
-        }
+    const patches = configData.patches;
+    if (!Array.isArray(patches))
+        return;
+    const err = fast_json_patch_default().validate(patches);
+    if (err) {
+        throw new Error(`Feature: config.yaml -> patches: invalid patches ${JSON.stringify(err.message ?? err)}`);
     }
 }
 
@@ -166311,10 +165560,12 @@ const renderTestsSchema = {
             items: {
                 type: 'object',
                 additionalProperties: false,
-                required: ['name', 'cr'],
+                required: ['name'],
+                anyOf: [{ required: ['cr'] }, { required: ['claim'] }],
                 properties: {
                     name: { type: 'string', minLength: 1 },
                     cr: { type: 'string', minLength: 1 },
+                    claim: { type: 'string', minLength: 1 },
                     args: { type: 'object' },
                 },
             },
@@ -166359,16 +165610,22 @@ function loadAndValidateRenderTests(featurePath) {
     ensureUniqueTestNames(doc);
     return doc;
 }
-function resolveCrPath(featurePath, crRelPath) {
-    if (external_node_path_namespaceObject.isAbsolute(crRelPath)) {
-        throw new Error(`CR path must be relative to the feature root, got absolute: ${crRelPath}`);
+function resolvePathRelativeToFeature(featurePath, relPath, kind) {
+    if (external_node_path_namespaceObject.isAbsolute(relPath)) {
+        throw new Error(`${kind} path must be relative to the feature root, got absolute: ${relPath}`);
     }
-    const resolved = external_node_path_namespaceObject.resolve(featurePath, crRelPath);
+    const resolved = external_node_path_namespaceObject.resolve(featurePath, relPath);
     if (!external_node_fs_namespaceObject.existsSync(resolved)) {
-        throw new Error(`CR file not found (resolved from "${crRelPath}"): ${resolved}`);
+        throw new Error(`${kind} file not found (resolved from "${relPath}"): ${resolved}`);
     }
     return resolved;
 }
+function resolveCrPath(featurePath, crRelPath) {
+    return resolvePathRelativeToFeature(featurePath, crRelPath, 'CR');
+}
+function resolveClaimPath(featurePath, claimRelPath) {
+    return resolvePathRelativeToFeature(featurePath, claimRelPath, 'claim');
+}
 function listYamlFiles(dir) {
     if (!fs.existsSync(dir))
         return [];
@@ -166433,6 +165690,7 @@ function buildExpectedOutput(config, renderDir) {
     return {
         files,
         patches: config.patches || [],
+        claimPatches: config.claimPatches || {},
     };
 }
 /* ---------- Context-style API for a render temp dir ---------- */
@@ -166486,6 +165744,7 @@ async function createRenderContext(prefix = 'feature-render-') {
     buildExpectedOutput,
     loadAndValidateRenderTests,
     resolveCrPath,
+    resolveClaimPath,
 });
 
 ;// CONCATENATED MODULE: ../features_renderer/src/featureArgsValidation.ts
@@ -166578,7 +165837,19 @@ function render(featurePath, featureRenderPath, entity, firestartrConfig = {}, f
             resolveInside(featureRenderPath, dest, 'file dest', 'render target directory');
         }
     }
-    const output = { files: [] };
+    const output = { files: [], claimPatches: {} };
+    // `patches` is the flat array of claim-level JSON Patch operations. Claim
+    // stitching (`extractClaimPatches`/`collectFeaturePatches` in cdk8s_renderer)
+    // consumes `output.patches` as the canonical claim-level source.
+    output.patches = context.config.patches;
+    // `claimPatches` is provider-keyed and is a separate attach path used when
+    // a feature claim is created elsewhere (via `renderFeature`). It is not the
+    // claim-stitching source; that is `patches` above. Expose it in the render
+    // output only when present. We do not copy `patches` into `claimPatches`.
+    if (context.config.claimPatches &&
+        typeof context.config.claimPatches === 'object') {
+        output.claimPatches = context.config.claimPatches;
+    }
     context.config.files.forEach((file) => {
         const { src, dest } = file;
         // For now let's keep upgradable flag for backward compatibility
@@ -166599,7 +165870,6 @@ function render(featurePath, featureRenderPath, entity, firestartrConfig = {}, f
             userManaged: userManaged,
             targetBranch,
         });
-        output.patches = context.config.patches;
         // Not used anymore
         // output.unpatches = context.config.unpatches
     });
@@ -166609,19 +165879,97 @@ function render(featurePath, featureRenderPath, entity, firestartrConfig = {}, f
     external_fs_default().writeFileSync(configFile, JSON.stringify(output));
     return output;
 }
-function buildContext(entity, args, firestartrConfig, featureArgs) {
+function getPatches(featurePath, entity, firestartrConfig = {}, featureArgs = {}) {
+    const configData = validate(featurePath);
+    validateFeatureArgs(featurePath, featureArgs);
+    const context = buildContext(entity, configData.args, firestartrConfig, featureArgs);
+    const rendered = JSON.parse(renderContent(JSON.stringify(configData), context));
+    return rendered.patches ?? [];
+}
+function buildContext(stitchedClaim, args, firestartrConfig, featureArgs) {
     const context = {};
+    const resolveRef = (doc, ref) => {
+        const v = lodash_default().get(doc, ref);
+        if (v !== undefined)
+            return v;
+        // Fallback for transition: try CR-shaped alternatives when stitchedClaim is CR-shaped
+        // and vice versa. Covers the ADR 0006 table plus legacy feature_a provisioner paths.
+        const altTable = {
+            'providers,github,org': [
+                ['spec', 'org'],
+                ['spec', 'provisioner', 'org'],
+                ['spec', 'firestartr', 'technology', 'stack'],
+            ],
+            'providers,github,branchStrategy,defaultBranch': [
+                ['spec', 'repo', 'defaultBranch'],
+                ['spec', 'provisioner', 'repo', 'defaultBranch'],
+            ],
+            'providers,github,name': [
+                ['metadata', 'annotations', 'firestartr.dev/external-name'],
+                ['metadata', 'name'],
+            ],
+            name: [['metadata', 'name']],
+            'annotations,firestartr.dev/dest-annotation': [
+                ['metadata', 'annotations', 'firestartr.dev/dest-annotation'],
+            ],
+        };
+        const key = ref.join(',');
+        const alts = altTable[key];
+        if (alts) {
+            for (const alt of alts) {
+                const av = lodash_default().get(doc, alt);
+                if (av !== undefined)
+                    return av;
+            }
+        }
+        // Reverse fallback: if ref is CR-shaped, try claim-shaped
+        const reverseTable = {
+            'spec,org': ['providers', 'github', 'org'],
+            'spec,provisioner,technology,stack': ['providers', 'github', 'org'],
+            'spec,firestartr,technology,stack': ['providers', 'github', 'org'],
+            'metadata,name': ['name'],
+            'metadata,annotations,firestartr.dev/dest-annotation': [
+                'annotations',
+                'firestartr.dev/dest-annotation',
+            ],
+            'spec,provisioner,org': ['providers', 'github', 'org'],
+            'spec,provisioner,repo,defaultBranch': [
+                'providers',
+                'github',
+                'branchStrategy',
+                'defaultBranch',
+            ],
+            'spec,repo,defaultBranch': [
+                'providers',
+                'github',
+                'branchStrategy',
+                'defaultBranch',
+            ],
+            'metadata,annotations,firestartr.dev/external-name': [
+                'providers',
+                'github',
+                'name',
+            ],
+        };
+        const rev = reverseTable[ref.join(',')];
+        if (rev) {
+            const rv = lodash_default().get(doc, rev);
+            if (rv !== undefined)
+                return rv;
+        }
+        return v;
+    };
     Object.entries(args).forEach(([key, arg]) => {
         if ('$default' in arg) {
             if (Array.isArray(arg['$default'])) {
-                context[key] = lodash_default().get(entity, arg['$default']);
+                context[key] = resolveRef(stitchedClaim, arg['$default']);
             }
             else {
                 context[key] = arg['$default'];
             }
         }
         if ('$ref' in arg) {
-            const refValue = lodash_default().get(entity, arg['$ref']);
+            const refValue = resolveRef(stitchedClaim, arg['$ref']);
             context[key] = refValue;
         }
         else if ('$lit' in arg) {
@@ -166751,6 +166099,7 @@ function updateFileContent(featureRenderPath, filePath, content) {
 
 
 
+
 /* harmony default export */ const features_renderer = ({
     validate: validate,
     render: render,
@@ -166760,6 +166109,7 @@ function updateFileContent(featureRenderPath, filePath, content) {
     renderContent: renderContent,
     expandFiles: expandFiles,
     validateFeatureArgs: validateFeatureArgs,
+    getPatches: getPatches,
 });
 
 ;// CONCATENATED MODULE: ../features_preparer/src/logger.ts
@@ -166784,6 +166134,13 @@ function renderFeature(featureName, version, owner, repo, featureOwner, renderPa
 function renderFeatureFromPath(extractPath, renderedPath, featureOwner, featureArgs = {}) {
     return features_renderer.render(extractPath, renderedPath, featureOwner, {}, featureArgs);
 }
+function getFeaturePatches(featureName, version, owner, repo, featureOwner, featureArgs = {}) {
+    const extractPath = external_path_default().join(catalog_common/* default.features.tarballs.getFeaturesExtractPath */.Z.features.tarballs.getFeaturesExtractPath(featureName, version, owner, repo), 'packages', featureName);
+    return getPatches(extractPath, featureOwner, {}, featureArgs);
+}
+function getFeaturePatchesFromPath(extractPath, featureOwner, featureArgs = {}) {
+    return getPatches(extractPath, featureOwner, {}, featureArgs);
+}
 
 // EXTERNAL MODULE: ../../node_modules/adm-zip/adm-zip.js
 var adm_zip = __nccwpck_require__(7993);
@@ -166844,6 +166201,26 @@ featureArgs = {}, repo = 'features', owner = 'prefapp') {
     };
     return renderFeature(featureName, reference, owner, repo, featureOwner, '/tmp', featureArgs);
 }
+async function installer_getFeaturePatches(featureName, version, featureOwner, featureArgs = {}, repo = 'features', owner = 'prefapp') {
+    const reference = `${featureName}-v${version}`;
+    return processFeaturePatches(featureName, reference, featureOwner, featureArgs, repo, owner);
+}
+async function getFeaturePatchesFromRef(featureName, featureRef, featureOwner, featureArgs = {}, repo = 'features', owner = 'prefapp') {
+    const reference = `${featureRef}`;
+    return processFeaturePatches(featureName, reference, featureOwner, featureArgs, repo, owner);
+}
+async function processFeaturePatches(featureName, reference, featureOwner, featureArgs = {}, repo = 'features', owner = 'prefapp') {
+    await downloadFeatureZip(repo, featureName, reference, owner);
+    featureArgs['traceability'] = {
+        version: reference,
+        owner,
+        repo,
+        name: featureName,
+        ref: reference,
+        url: `https://github.com/${owner}/${repo}/tree/${reference}/packages/${featureName}`,
+    };
+    return getFeaturePatches(featureName, reference, owner, repo, featureOwner, featureArgs);
+}
 async function prepareFeature(featureName, version, repo = 'features', owner = 'prefapp') {
     await downloadFeatureZip(repo, featureName, version, owner);
 }
@@ -166898,6 +166275,9 @@ async function downloadFeatureZip(repo, featureName, reference, owner = 'prefapp
 /* harmony default export */ const src = ({
     renderFeature: renderFeature,
     renderFeatureFromPath: renderFeatureFromPath,
+    getFeaturePatches: installer_getFeaturePatches,
+    getFeaturePatchesFromRef: getFeaturePatchesFromRef,
+    getFeaturePatchesFromPath: getFeaturePatchesFromPath,
     getFeatureConfigFromRef: getFeatureConfigFromRef,
     getFeatureConfig: getFeatureConfig,
     prepareFeature: prepareFeature,
@@ -166914,6 +166294,1139 @@ async function downloadFeatureZip(repo, featureName, reference, owner = 'prefapp
     getFeatureConfigFromRef: src.getFeatureConfigFromRef,
 });
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/stitching/protectedPaths.ts
+// Platform-curated protected claim paths — features may not write to these.
+// Stored as JSON Pointers (RFC 6901). Supports wildcard `*` for a single segment.
+// Example: /providers/STAR/org matches /providers/github/org where STAR is *.
+const PROTECTED_CLAIM_PATHS = [
+    '/kind',
+    '/name',
+    '/providers/*/org',
+    '/providers/github/org',
+    '/providers/github/name',
+    '/metadata/name',
+    '/metadata/namespace',
+];
+function isProtectedPath(patchPath) {
+    const normalizedPatch = normalizePointer(patchPath);
+    for (const protectedPath of PROTECTED_CLAIM_PATHS) {
+        if (matchesProtected(protectedPath, normalizedPatch)) {
+            return true;
+        }
+    }
+    return false;
+}
+function normalizePointer(pointer) {
+    if (!pointer.startsWith('/')) {
+        return '/' + pointer;
+    }
+    return pointer;
+}
+function matchesProtected(protectedPointer, patchPointer) {
+    const protectedSegments = protectedPointer
+        .split('/')
+        .slice(1)
+        .map(unescapePointer);
+    const patchSegments = patchPointer.split('/').slice(1).map(unescapePointer);
+    // Treat ancestor/descendant as protected: a patch to a parent (e.g. /metadata)
+    // would replace the protected child (/metadata/name), and a patch to a child
+    // (e.g. /metadata/name/extra) is also under the protected tree. Match when
+    // the shorter prefix equals the longer prefix (with wildcard support).
+    const minLen = Math.min(protectedSegments.length, patchSegments.length);
+    for (let i = 0; i < minLen; i++) {
+        if (protectedSegments[i] === '*')
+            continue;
+        if (protectedSegments[i] !== patchSegments[i])
+            return false;
+    }
+    return true;
+}
+function unescapePointer(segment) {
+    return segment.replace(/~1/g, '/').replace(/~0/g, '~');
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/stitching/errors.ts
+class StitchingError extends Error {
+    constructor(violations) {
+        const lines = violations.map((v) => `  - ${v.message}`).join('\n');
+        super(`Claim stitching failed with ${violations.length} violation(s):\n${lines}`);
+        this.name = 'StitchingError';
+        this.violations = violations;
+    }
+}
+function formatStitchingError(error) {
+    return error.message;
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/stitching/stitching.ts
+
+
+
+
+let MOCK_FEATURES_FN;
+function MOCK_STITCHING_FEATURES(mock) {
+    MOCK_FEATURES_FN = mock;
+}
+function pointerExists(doc, pointer) {
+    const segments = pointer
+        .split('/')
+        .slice(1)
+        .map((s) => s.replace(/~1/g, '/').replace(/~0/g, '~'));
+    let cur = doc;
+    for (const seg of segments) {
+        if (cur === null || cur === undefined || typeof cur !== 'object')
+            return false;
+        if (!Object.prototype.hasOwnProperty.call(cur, seg))
+            return false;
+        cur = cur[seg];
+    }
+    return true;
+}
+function isAppendPointer(pointer) {
+    return pointer.endsWith('/-');
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+// Deduplication identity for a feature patch. Ordinary writes collide on the
+// normalized pointer. Array appends (`add ... /-`) collide on the pointer plus
+// the appended element's `name` when present, for example so several features can each add
+// a distinct label to /providers/github/labels/- while the same label name from
+// two features is silently deduplicated (or errors if values differ).
+function writeIdentity(patch) {
+    const path = normalizePointer(patch.path);
+    if (patch.op === 'add' &&
+        isAppendPointer(path) &&
+        isRecord(patch.value) &&
+        typeof patch.value.name === 'string') {
+        return `${path}#${patch.value.name}`;
+    }
+    return path;
+}
+// Check whether an array at `appendPath`'s parent already contains an element
+// whose `name` matches `value.name`.  Used for the "claim wins" gate: when a
+// feature tries to append an array element that already exists in the claim,
+// the patch is silently dropped.
+function arrayElementExists(doc, appendPath, value) {
+    if (!isRecord(value) || typeof value.name !== 'string')
+        return false;
+    const parentPath = appendPath.slice(0, -2); // strip trailing /-
+    const segments = parentPath
+        .split('/')
+        .slice(1)
+        .map((s) => s.replace(/~1/g, '/').replace(/~0/g, '~'));
+    let cur = doc;
+    for (const seg of segments) {
+        if (cur === null || cur === undefined || typeof cur !== 'object')
+            return false;
+        if (!Object.prototype.hasOwnProperty.call(cur, seg))
+            return false;
+        cur = cur[seg];
+    }
+    if (!Array.isArray(cur))
+        return false;
+    return cur.some((el) => isRecord(el) && el.name === value.name);
+}
+// fast-json-patch does not create intermediate containers for `add`, and
+// appending to an array requires the array to already exist. Ensure every
+// ancestor segment exists before applying an `add`: missing containers are
+// created as objects, except the immediate parent of a `/-` append, which is
+// created as an array. Existing (user/default-declared) values are never
+// overwritten.
+function ensureAddParents(doc, patch) {
+    const segments = patch.path.split('/').slice(1);
+    let prefix = '';
+    for (let i = 0; i < segments.length - 1; i++) {
+        prefix += '/' + segments[i];
+        if (pointerExists(doc, prefix))
+            continue;
+        const isArrayParent = isAppendPointer(patch.path) && i === segments.length - 2;
+        const value = isArrayParent ? [] : {};
+        try {
+            doc = fast_json_patch.applyPatch(doc, [{ op: 'add', path: prefix, value }], false, false).newDocument;
+        }
+        catch {
+            // Concurrent structural conflict — let the actual patch surface the error.
+        }
+    }
+    return doc;
+}
+async function stitchClaim(claimAfterDefaults, preCollectedEnvelopes) {
+    const envelopes = preCollectedEnvelopes ?? (await collectFeaturePatches(claimAfterDefaults));
+    if (envelopes.length === 0) {
+        return claimAfterDefaults;
+    }
+    // Normalize all patches once so every gate and the apply phase use the same pointers.
+    const normalizedEnvelopes = envelopes.map((env) => ({
+        feature: env.feature,
+        patches: env.patches.map((p) => ({
+            ...p,
+            path: normalizePointer(p.path),
+            _raw: p.path,
+        })),
+    }));
+    // ── Phase 1: silently drop patches that should not be applied ──────────
+    //  • Array append whose element already exists in the claim → claim wins
+    //  • Duplicate identity with identical value across features → silent dedup
+    const dropped = new Set(); // "envelopeIdx:patchIdx"
+    const seenIdentities = new Map();
+    for (let ei = 0; ei < normalizedEnvelopes.length; ei++) {
+        const envelope = normalizedEnvelopes[ei];
+        for (let pi = 0; pi < envelope.patches.length; pi++) {
+            const patch = envelope.patches[pi];
+            const key = `${ei}:${pi}`;
+            // Array claim-wins: element already in claim → drop
+            if (patch.op === 'add' && isAppendPointer(patch.path)) {
+                if (arrayElementExists(claimAfterDefaults, patch.path, patch.value)) {
+                    dropped.add(key);
+                    continue;
+                }
+            }
+            // Silent dedup: same identity + same value → drop
+            const identity = writeIdentity(patch);
+            const existing = seenIdentities.get(identity);
+            if (existing) {
+                if (JSON.stringify(existing.value) === JSON.stringify(patch.value)) {
+                    dropped.add(key);
+                    continue;
+                }
+                // Different value — kept here, caught as a violation in Phase 2.
+            }
+            else {
+                seenIdentities.set(identity, {
+                    feature: envelope.feature,
+                    value: patch.value,
+                });
+            }
+        }
+    }
+    // ── Phase 2: collect violations on non-dropped patches ─────────────────
+    const violations = [];
+    const seenForViolations = new Map(); // identity → feature
+    for (let ei = 0; ei < normalizedEnvelopes.length; ei++) {
+        const envelope = normalizedEnvelopes[ei];
+        for (let pi = 0; pi < envelope.patches.length; pi++) {
+            if (dropped.has(`${ei}:${pi}`))
+                continue;
+            const patch = envelope.patches[pi];
+            const path = patch.path;
+            const raw = patch._raw ?? path;
+            // Gate 1: protected path
+            if (isProtectedPath(path)) {
+                violations.push({
+                    feature: envelope.feature,
+                    op: patch.op,
+                    path,
+                    reason: 'protected-path',
+                    message: `Feature '${envelope.feature}' patch ${patch.op} ${raw} (normalized ${path}) targets protected claim path`,
+                });
+            }
+            // Gate 2: conflicting value from another feature
+            const identity = writeIdentity(patch);
+            if (seenForViolations.has(identity)) {
+                violations.push({
+                    feature: envelope.feature,
+                    op: patch.op,
+                    path,
+                    reason: 'duplicate-path',
+                    conflictingFeature: seenForViolations.get(identity),
+                    message: `Feature '${envelope.feature}' and '${seenForViolations.get(identity)}' both write to ${path} (deduplication)`,
+                });
+            }
+            else {
+                seenForViolations.set(identity, envelope.feature);
+            }
+            // Gate 3: overwrite protection — features may only add to absent paths
+            // and must never overwrite a value the user (or claims_defaults.yaml)
+            // declared (#2648).
+            const targetExists = pointerExists(claimAfterDefaults, path);
+            const isArrayAppend = patch.op === 'add' && isAppendPointer(path);
+            if (patch.op === 'add') {
+                // `add` on an existing, non-append path is an overwrite in JSON Patch,
+                // so reject it. Array appends (`... /-`) add a new element; a genuinely
+                // new element targets an absent slot (claim-wins/dedup handled elsewhere)
+                // so those are allowed.
+                if (!isArrayAppend && targetExists) {
+                    violations.push({
+                        feature: envelope.feature,
+                        op: patch.op,
+                        path,
+                        reason: 'overwrite-protected',
+                        message: `Feature '${envelope.feature}' patch ${patch.op} ${raw} (normalized ${path}) targets existing path (features may only add to absent paths, never overwrite user-declared values)`,
+                    });
+                }
+            }
+            else if (['replace', 'remove'].includes(patch.op)) {
+                // replace/remove on an existing path overwrites user intent; on an
+                // absent path fast-json-patch would fail anyway. Either way: reject.
+                violations.push({
+                    feature: envelope.feature,
+                    op: patch.op,
+                    path,
+                    reason: 'overwrite-protected',
+                    message: targetExists
+                        ? `Feature '${envelope.feature}' patch ${patch.op} ${raw} (normalized ${path}) targets existing path (cannot overwrite user-declared value)`
+                        : `Feature '${envelope.feature}' patch ${patch.op} ${raw} (normalized ${path}) targets absent path (replace/remove requires existing value)`,
+                });
+            }
+        }
+    }
+    if (violations.length > 0) {
+        throw new StitchingError(violations);
+    }
+    // ── Phase 3: apply remaining patches ───────────────────────────────────
+    let stitched = JSON.parse(JSON.stringify(claimAfterDefaults));
+    for (let ei = 0; ei < normalizedEnvelopes.length; ei++) {
+        const envelope = normalizedEnvelopes[ei];
+        const patchesToApply = envelope.patches.filter((_, pi) => !dropped.has(`${ei}:${pi}`));
+        if (patchesToApply.length === 0)
+            continue;
+        for (const patch of patchesToApply) {
+            if (patch.op === 'add') {
+                stitched = ensureAddParents(stitched, patch);
+            }
+        }
+        const result = fast_json_patch.applyPatch(stitched, patchesToApply, false, false);
+        stitched = result.newDocument;
+    }
+    return stitched;
+}
+async function collectFeaturePatches(claim) {
+    if (MOCK_FEATURES_FN) {
+        return MOCK_FEATURES_FN(claim);
+    }
+    const typedClaim = claim;
+    const features = typedClaim.providers?.github?.features ?? [];
+    if (features.length === 0)
+        return [];
+    // In unit tests without GitHub credentials, avoid real download — tests that care
+    // about stitching should set MOCK_STITCHING_FEATURES explicitly.
+    if (process.env.JEST_WORKER_ID && !process.env.GITHUB_TOKEN) {
+        return [];
+    }
+    const envelopes = [];
+    for (const feature of features) {
+        const featureName = feature.name;
+        const versionOrRef = feature.ref ?? feature.version ?? '';
+        const repo = feature.repo
+            ? (feature.repo.split('/')[1] ?? 'features')
+            : 'features';
+        const owner = feature.repo
+            ? (feature.repo.split('/')[0] ?? 'prefapp')
+            : 'prefapp';
+        const args = feature.args ?? {};
+        try {
+            let patchesOrRendered;
+            const preparerAny = features_preparer;
+            if (feature.ref) {
+                if (typeof preparerAny.getFeaturePatchesFromRef === 'function') {
+                    patchesOrRendered = await preparerAny.getFeaturePatchesFromRef(featureName, versionOrRef, claim, args, repo, owner);
+                }
+                else {
+                    patchesOrRendered = await preparerAny.getFeatureConfigFromRef(featureName, versionOrRef, claim, args, repo, owner);
+                }
+            }
+            else {
+                if (typeof preparerAny.getFeaturePatches === 'function') {
+                    patchesOrRendered = await preparerAny.getFeaturePatches(featureName, versionOrRef, claim, args, repo, owner);
+                }
+                else {
+                    patchesOrRendered = await preparerAny.getFeatureConfig(featureName, versionOrRef, claim, args, repo, owner);
+                }
+            }
+            const patches = Array.isArray(patchesOrRendered)
+                ? patchesOrRendered
+                : extractClaimPatches(patchesOrRendered);
+            envelopes.push({ feature: featureName, patches });
+        }
+        catch (err) {
+            throw new Error(`Failed to collect patches for feature '${featureName}': ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return envelopes;
+}
+function extractClaimPatches(rendered) {
+    const patches = rendered.patches;
+    if (!patches)
+        return [];
+    if (Array.isArray(patches))
+        return patches;
+    throw new Error(`Feature patches must be a flat array (claim-relative pointers like /annotations/...), got ${typeof patches}: ${JSON.stringify(patches).slice(0, 200)}. See #2648`);
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/lazy_loader.ts
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+// We need to ensure the grep command is a gnu version
+let IS_GNU_GREP = false;
+let GREP_ON_CHECK = false;
+// this loop is for avoid race conditions
+// once a check is running no more checks
+async function waitForCheck() {
+    const f_wait = () => new Promise((timeOut) => setTimeout(timeOut, 10));
+    do {
+        await f_wait();
+    } while (GREP_ON_CHECK);
+}
+function checkGrep() {
+    return new Promise((ok, ko) => {
+        // idempotency: already checked
+        if (IS_GNU_GREP)
+            return ok();
+        // a check is already running no new checks
+        if (GREP_ON_CHECK)
+            return waitForCheck();
+        logger.info('Checking the grep command');
+        GREP_ON_CHECK = true;
+        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['--version']);
+        handler.on('close', (code) => {
+            GREP_ON_CHECK = false;
+            if (code === 0) {
+                logger.debug('Grep is a gnu grep');
+                IS_GNU_GREP = true;
+                ok();
+            }
+            else {
+                ko('Lazy evaluation needs a gnu-grep command');
+            }
+        });
+    });
+}
+async function loadClaim(claimRef, org, defaults = loadClaimDefaults(), patchClaim = loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, existingRefs = {}, postValidations = new Map()) {
+    await checkGrep();
+    let result = existingRefs;
+    logger.info(`Load reference ${claimRef}`);
+    initVirtualClaims(org);
+    logger.info(`Load reference (parts) ${claimRef.split(/-/)[0]} ${claimRef.replace(/^[^-]+-/, '')}`);
+    // cargas datos con grep
+    try {
+        const claimData = await lazyGetClaim(claimRef.split(/-/)[0], claimRef.replace(/^[^-]+-/, ''), org, cwd);
+        let claim = patchClaim(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(claimData), defaults);
+        // Claim stitching: feature claim-patches with three gates before AJV
+        try {
+            claim = await stitchClaim(claim);
+        }
+        catch (e) {
+            throw new Error(`Error when stitching claim ${claimRef}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        let variants = [];
+        if (claim.kind === 'TFWorkspaceClaim' &&
+            claim.providers?.terraform?.variants) {
+            variants = claim.providers.terraform.variants;
+            delete claim.providers.terraform.variants;
+        }
+        logger.silly(`Patched claim is:
+		 ---
+			${catalog_common/* default.io.toYaml */.Z.io.toYaml(claim)}`);
+        try {
+            validateClaim(claim, base[`${claim.kind}Schema`]);
+            await optionalValidation(claim);
+        }
+        catch (error) {
+            let errorMsg = '';
+            if (Array.isArray(error)) {
+                for (const data of error) {
+                    errorMsg = `${errorMsg}
+  - ${data.instancePath}: ${data.message}`;
+                }
+            }
+            else {
+                errorMsg = error instanceof Error ? error.message : String(error);
+            }
+            throw new Error(`Error when validating claim ${claimRef}: ${errorMsg}`);
+        }
+        result[claimRef] = {};
+        result[claimRef]['claim'] = claim;
+        result[claimRef]['claimPath'] = VisitedClaims[claimRef];
+        if (VisitedClaims[claimRef] === 'virtual') {
+            result = await setVirtualClaimAdditionalData(result, claim, claimRef);
+        }
+        else {
+            result = await setNonVirtualClaimAdditionalData(result, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
+        }
+        const claimKind = claim.kind;
+        const references = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(claim));
+        for (const ref of references) {
+            if (!result[ref]) {
+                const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
+                result = lodash_default().merge(result, resolvedReferences);
+            }
+        }
+        if (variants.length > 0) {
+            const parentClaimPath = VisitedClaims[claimRef];
+            for (const variant of variants) {
+                if (!variant.name || !variant.overrides) {
+                    throw new Error(`Variant in claim ${claimRef} is missing required field 'name' or 'overrides'`);
+                }
+                const prohibitedOverrideFields = ['source', 'module', 'name'];
+                for (const field of prohibitedOverrideFields) {
+                    if (field in variant.overrides) {
+                        throw new Error(`Variant '${variant.name}' in claim ${claimRef} cannot override '${field}'`);
+                    }
+                }
+                const composedName = claim.providers.terraform.name + '-' + variant.name;
+                const variantClaim = lodash_default().cloneDeep(claim);
+                variantClaim._parentClaimName = claim.name;
+                variantClaim.name = composedName;
+                variantClaim.providers.terraform = lodash_default().merge({}, claim.providers.terraform, variant.overrides);
+                variantClaim.providers.terraform.name = composedName;
+                if (!variantClaim.annotations) {
+                    variantClaim.annotations = {};
+                }
+                variantClaim.annotations['firestartr.dev/variant-of'] =
+                    claim.providers.terraform.name;
+                const variantRef = `TFWorkspaceClaim-${composedName}`;
+                if (result[variantRef]) {
+                    throw new Error(`Variant name '${variant.name}' (composed: '${composedName}') from claim '${claimRef}' conflicts with existing claim '${variantRef}'`);
+                }
+                logger.info(`Creating synthetic variant claim ${variantRef}`);
+                result[variantRef] = {};
+                result[variantRef]['claim'] = variantClaim;
+                result[variantRef]['claimPath'] = parentClaimPath;
+                result = await setNonVirtualClaimAdditionalData(result, variantClaim, variantRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
+                const variantReferences = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(variantClaim));
+                for (const ref of variantReferences) {
+                    if (!result[ref]) {
+                        const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
+                        result = lodash_default().merge(result, resolvedReferences);
+                    }
+                }
+            }
+        }
+    }
+    catch (err) {
+        throw `Lazy Loading: ${err}`;
+    }
+    return [result, postValidations];
+}
+let LoadedClaims = {};
+let VisitedClaims = {};
+let DuplicatedClaims = {};
+function resetLazyLoader() {
+    LoadedClaims = {};
+    VisitedClaims = {};
+    DuplicatedClaims = {};
+}
+async function lazyGetClaim(kind, name, org, cwd) {
+    const indice = `${kind}-${name}`;
+    logger.info(`Lazy loading ${kind}-${name} with index ${indice}`);
+    if (indice in LoadedClaims)
+        return LoadedClaims[indice];
+    if (isVirtualClaim(kind, name)) {
+        await loadVirtualClaim(kind, name, org);
+    }
+    else {
+        await getClaimsByName(name, cwd);
+    }
+    if (indice in LoadedClaims) {
+        return LoadedClaims[indice];
+    }
+    else {
+        throw new Error(`Error: ${kind}-${name} not found`);
+    }
+}
+async function getClaimsByName(name, cwd = '.') {
+    return new Promise((ok, ko) => {
+        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['-r', '-l', '--include=*', '-E', `name: "?${name}"?`, '.'], {
+            cwd: cwd,
+        });
+        logger.info(`Running ${['grep', '-r', '-l', '--include', '-E', 'name: "' + name + '"?', '.'].join(' ')}`);
+        const entradas = [];
+        const chunks = [];
+        handler.stdout.on('data', (data) => {
+            chunks.push(data.toString('utf-8'));
+        });
+        handler.on('close', () => {
+            const dataFinal = chunks.join('');
+            const fileNameList = dataFinal.split(/\n/).filter((line) => line !== '');
+            for (const fileName of fileNameList) {
+                // only yaml files
+                if (!fileName.match(/\.yml$|\.yaml$/)) {
+                    continue;
+                }
+                // only entries not already visited
+                if (Object.values(VisitedClaims).includes(fileName)) {
+                    continue;
+                }
+                entradas.push(external_path_.join(cwd, fileName));
+            }
+            return Promise.all(entradas.map((entrada) => {
+                return loadRawClaim(entrada);
+            }))
+                .then(() => {
+                ok();
+            })
+                .catch((err) => {
+                ko(err);
+            });
+        });
+    });
+}
+async function loadRawClaim(entry) {
+    return new Promise((ok, ko) => {
+        external_fs_.readFile(entry, 'utf-8', (error, data) => {
+            if (error)
+                return ko(`Reading ${entry}: ${error}`);
+            const claim = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
+            if (!('kind' in claim && 'name' in claim)) {
+                logger.warn(`Invalid claim file ${entry}`);
+            }
+            else {
+                const claimKey = `${claim.kind}-${claim.name}`;
+                if (Object.keys(DuplicatedClaims).includes(claimKey) &&
+                    DuplicatedClaims[claimKey] !== entry) {
+                    return ko(`Duplicated claim ${claimKey} found files: ${DuplicatedClaims[claimKey]} and ${entry}`);
+                }
+                LoadedClaims[claimKey] = data;
+                VisitedClaims[claimKey] = entry;
+                DuplicatedClaims[claimKey] = entry;
+                ok();
+            }
+        });
+    });
+}
+async function setVirtualClaimAdditionalData(renderedData, claim, claimRef) {
+    const virtualClaim = getVirtualClaim(claim.kind, claim.name);
+    renderedData[claimRef]['initializers'] = [
+        new UUIDInitializer(claim),
+        new InitializerClaimRef(),
+        new InitializerDefault(virtualClaim.getDefaultConfig()),
+    ];
+    renderedData[claimRef]['globals'] = [];
+    renderedData[claimRef]['overrides'] = [];
+    renderedData[claimRef]['normalizers'] = [new NameNormalizer()];
+    return renderedData;
+}
+async function setNonVirtualClaimAdditionalData(renderedData, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers) {
+    renderedData[claimRef]['initializers'] = await loadInitializers(claim, renderedData[claimRef]['claimPath']);
+    renderedData[claimRef]['globals'] = await loadGlobals(claim);
+    renderedData[claimRef]['overrides'] = loadOverrides(claim);
+    renderedData[claimRef]['normalizers'] = await loadNormalizers(claim, renderedData[claimRef]['claimPath']);
+    return renderedData;
+}
+async function loadVirtualClaim(kind, name, org) {
+    const virtualClaim = getVirtualClaim(kind, name);
+    const expandedClaim = await virtualClaim.expand({ org });
+    logger.info(`Loading virtual claim ${kind} ${name} ${org}`);
+    LoadedClaims[`${kind}-${name}`] = catalog_common/* default.io.toYaml */.Z.io.toYaml(expandedClaim);
+    VisitedClaims[`${kind}-${name}`] = 'virtual';
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/claimsDefaulter.ts
+
+
+
+/*
+ * Default blocks are objects that cannot be merged but applied as a whole. Meaning:
+ * - If the object is defined at the claim-level it is maintained *AS IT IS* (no merge)
+ * - If the block is missing at the claim-level, the default block is applied
+ */
+const defaultBlocksPaths = ['/providers/terraform/sync'];
+function applyBlockAwareDefaults(claim, defaultClaim) {
+    // we always work with a clone of the original
+    const claimClone = JSON.parse(JSON.stringify(claim));
+    // if the block is claim-level defined we store it here
+    const defaultBlocks = new Map();
+    // we remove the blocks entirely of the claim
+    // to achieve an add copy
+    for (const defaultBlockPath of defaultBlocksPaths) {
+        if (claimsDefaulter_hasDeepPath(claimClone, defaultBlockPath) !== true)
+            continue;
+        const originalValue = fast_json_patch_default().getValueByPointer(claimClone, defaultBlockPath);
+        if (originalValue) {
+            logger.silly(`${claim.kind}/${claim.name}: has an original ${defaultBlockPath}: preserving`);
+            defaultBlocks.set(defaultBlockPath, originalValue);
+            fast_json_patch_default().applyPatch(claimClone, [{ op: 'remove', path: defaultBlockPath }]);
+        }
+    }
+    // if the patch has the same path of a block
+    // and the block was defined at claim-level
+    // we interchange the value with the original value
+    // otherwise we use the default
+    const jsonPatchOps = fast_json_patch_default().compare(claimClone, defaultClaim)
+        .filter((jp) => jp.op === 'add')
+        .map((jp) => {
+        if (defaultBlocks.has(jp.path)) {
+            return {
+                ...jp,
+                value: defaultBlocks.get(jp.path),
+            };
+        }
+        else {
+            return jp;
+        }
+    });
+    return fast_json_patch_default().applyPatch(claimClone, jsonPatchOps).newDocument;
+}
+function claimsDefaulter_hasDeepPath(data, deepPath) {
+    return lodash_default().has(data, deepPath.replace(/\//g, '.').replace(/^\./, ''));
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/loader.ts
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+const isYamlFile = new RegExp(/\.(yaml|yml)$/);
+/**
+ *
+ * @returns Virtual Claims
+ */
+const virtualClaims = [new FirestartrAllClaim()];
+/*
+ * Loads all applicable globals for a given claim and stores them into a list.
+ *
+ * Input:
+ * - claim: our custom claim object, with which we check if the global is applicable
+ *
+ * Returns:
+ * - A GlobalSection array promise, containing all the globals loaded for this claim
+ *
+ */
+async function loadGlobals(claim) {
+    const result = [];
+    await crawl(getPath('globals'), (entry) => {
+        return isYamlFile.test(entry);
+    }, async (entry, data) => {
+        const globalData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
+        const ext = external_path_.extname(entry);
+        const name = external_path_.basename(entry, ext);
+        if (name in SECTIONS_BY_FILE_NAME) {
+            const section = new SECTIONS_BY_FILE_NAME[name](globalData);
+            if (!(await section.validate(SCHEMAS_BY_SECTION_NAME[name] || {}))) {
+                throw new Error(`Invalid ${name} global file`);
+            }
+            if (globalData.kind === claim.kind) {
+                result.push(section);
+            }
+            else {
+                logger.debug(`Skipping global ${name} because it is not applicable to ${claim.kind}`);
+            }
+        }
+    });
+    logger.info(`Loaded globals ${result}`);
+    return result;
+}
+/*
+ * If the input claim is a GithubRepositoryClaim, it loads all it's applicable
+ * overrides and stores them into a list. Otherwise, it returns an empty list.
+ *
+ * Input:
+ * - claim: our custom claim object, which should be a GithubRepositoryClaim
+ *
+ * Returns:
+ * - An Overrider array, with a GithubRepositoryOverrider if the claim
+ *   was a GithubRepositoryClaim, or empty if it was not.
+ *
+ */
+function loadOverrides(claim) {
+    const overrides = [];
+    if (claim.kind === 'ComponentClaim' && claim.providers.github.overrides) {
+        overrides.push(new GithubRepositoryOverrider());
+    }
+    return overrides;
+}
+/**
+ * Load all normalizers and stores them into a list.
+ * @param claim
+ * @returns
+ */
+async function loadNormalizers(_claim, path) {
+    const result = [];
+    for (const normalizer of NORMALIZERS) {
+        result.push(new normalizer({ path: path }));
+    }
+    return result;
+}
+/*
+ * Loads all applicable initializers for a given claim and stores them into a list.
+ *
+ * Input:
+ * - claim: our custom claim object, with which we check if the initializer is applicable
+ *
+ * Returns:
+ * - An Initializer array promise, containing all the initializers loaded for this claim
+ *
+ */
+let loadedInitializers = false;
+async function loadInitializers(claim, claimPath, initializersPath = getPath('initializers')) {
+    const result = [];
+    await crawl(initializersPath, (entry) => {
+        return isYamlFile.test(entry);
+    }, async (entry, data) => {
+        const initializerData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
+        const ext = external_path_.extname(entry);
+        const name = external_path_.basename(entry, ext);
+        if (name in INITIALIZERS_BY_FILE_NAME) {
+            const initializerBfN = new INITIALIZERS_BY_FILE_NAME[name](initializerData);
+            if (!(await initializerBfN.validate(SCHEMAS_BY_INITIALIZER_NAME[name] || {}))) {
+                throw new Error(`Invalid ${name} initializer file`);
+            }
+            if (initializerData.kind === claim.kind) {
+                result.push(initializerBfN);
+            }
+            else {
+                logger.debug(`Skipping initializer ${name} because it is not applicable to ${claim.kind}`);
+            }
+        }
+    });
+    for (const initializer of INITIALIZERS) {
+        if (initializer.applicableKinds.includes(claim.kind)) {
+            result.push(new initializer({ path: claimPath }));
+        }
+    }
+    logger.info(`Loaded initializers ${JSON.stringify(result)}`);
+    loadedInitializers = result;
+    return loadedInitializers;
+}
+function loadClaimDefaults() {
+    try {
+        return catalog_common/* default.io.fromYaml */.Z.io.fromYaml(external_fs_.readFileSync(`${getPath('claimsDefaults')}/claims_defaults.yaml`, 'utf-8'));
+    }
+    catch (error) {
+        const errMsg = `Could not read claims defaults file in path ${getPath('claimsDefaults')}/claims_defaults.yaml: ${error}`;
+        logger.error(errMsg);
+        throw new Error(errMsg);
+    }
+}
+/*
+ * Using fast-json-patch, compares a claim to its kind's defaults, then patches it.
+ *
+ * Input:
+ * - claim: our custom claim object, which we want to patch
+ * - defaultsClaims: an object, containing the defaults for each claim kind,
+ *   with the same structure that we use for the actual claims
+ *
+ * Returns:
+ * - The patched claim
+ *
+ */
+function loader_patchClaim(claim, defaultsClaims) {
+    if (defaultsClaims[claim.kind]) {
+        claim = applyBlockAwareDefaults(claim, defaultsClaims[claim.kind]);
+    }
+    return claim;
+}
+async function loadCRsWithFullSet(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
+    const result = {};
+    const fullResult = {};
+    await crawlWithExclusions(crsPath, (entry) => {
+        return isYamlFile.test(entry);
+    }, async (entry, data) => {
+        const yamlData = stripKnownRelations(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data));
+        const metadata = yamlData?.metadata;
+        if (!(yamlData &&
+            typeof yamlData === 'object' &&
+            'kind' in yamlData &&
+            metadata &&
+            typeof metadata === 'object' &&
+            'name' in metadata)) {
+            logger.warn(`Invalid CR file ${entry}`);
+        }
+        else {
+            const crKey = `${yamlData.kind}-${metadata.name}`;
+            if (fullResult[crKey]) {
+                logger.error(`Duplicate CR ${crKey}`);
+            }
+            // Keep the complete CR set for validations that need repository-wide context.
+            fullResult[crKey] = yamlData;
+            // Keep the filtered CR set for previous-CR lookup during claim rendering.
+            if (allowedClaimReferences.length === 0 ||
+                allowedClaimReferences.includes(yamlData.metadata?.annotations?.[catalog_common/* default.generic.getFirestartrAnnotation */.Z.generic.getFirestartrAnnotation('claim-ref')])) {
+                result[crKey] = yamlData;
+            }
+        }
+    }, excludedPaths.concat(getAdditionalPaths()));
+    return { crs: result, fullCrs: fullResult };
+}
+async function loadCRs(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
+    const { crs } = await loadCRsWithFullSet(crsPath, excludedPaths, allowedClaimReferences);
+    return crs;
+}
+/*
+ * Description: Get the renamed using claimRef annotation
+ * Input: claims: any, crs: any
+ * Output: renames: IRenameResult[]
+ */
+async function loadRenames(claims, crs) {
+    /*
+     * If checkRenames is false, we don't need to check for renames
+     */
+    const renamesEnabled = getRenamesEnabled();
+    if (!renamesEnabled)
+        return [];
+    const result = [];
+    /**
+     * For each CR, look for a claim that does not match the name with CR's firestartr.dev/claim-ref annotation
+     */
+    for (const cr of Object.values(crs)) {
+        const anyCr = cr;
+        if (!anyCr?.metadata?.annotations)
+            continue;
+        // if the annotation is a claimRef
+        const annotationName = common.generic.getFirestartrAnnotation('claim-ref');
+        const annotations = anyCr?.metadata?.annotations || {};
+        if (annotationName in annotations) {
+            const claimRef = anyCr.metadata.annotations[annotationName];
+            // split the annotation into kind and name
+            const [kind, name] = claimRef.split('/');
+            // if the claim exists, check if the name is different for the given provider
+            const referencedClaim = claims[`${kind}-${name}`].claim;
+            const oldName = anyCr.metadata.name;
+            const newName = referencedClaim.providers[getConfiguredProvider()].name;
+            if (oldName !== newName) {
+                result.push({
+                    kind: referencedClaim.kind,
+                    claimPath: claims[`${kind}-${name}`].claimPath,
+                    claimName: referencedClaim.name,
+                    oldName,
+                    newName,
+                });
+            }
+        }
+    }
+    return result;
+}
+async function loadClaimsList(claimRefList, claimsPath = getPath('claims')) {
+    const data = {
+        renderClaims: {},
+        crs: {},
+        fullCrs: {},
+    };
+    const defaults = loadClaimDefaults();
+    for await (const claimRef of claimRefList) {
+        const [renderedClaimData] = await loadClaim(claimRef, getOrg(), defaults, loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, claimsPath);
+        data.renderClaims = lodash_default().merge(data.renderClaims, renderedClaimData);
+    }
+    const crClaimReferences = [];
+    for (const ref of Object.keys(data.renderClaims)) {
+        // Replaces only the first instance of '-'
+        crClaimReferences.push(ref.replace('-', '/'));
+    }
+    const loadedCrs = await loadCRsWithFullSet(getPath('crs'), [getPath('globals'), getPath('initializers')], crClaimReferences);
+    data['crs'] = loadedCrs.crs;
+    data['fullCrs'] = loadedCrs.fullCrs;
+    return data;
+}
+function getOrg() {
+    const groupOrg = catalog_common/* default.environment.getFromEnvironmentWithDefault */.Z.environment.getFromEnvironmentWithDefault(catalog_common/* default.types.envVars.org */.Z.types.envVars.org, '');
+    return groupOrg;
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/references.ts
+function validateTfStateKeyUniqueness(crs) {
+    const tfStateKeys = {};
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (!isTerraformWorkspace(cr))
+            continue;
+        const tfKey = cr.spec.firestartr.tfStateKey;
+        if (tfStateKeys[tfKey]) {
+            throw new Error(`❗❗ ❌ RENDER ERROR ❌ ❗❗
+
+The tfStateKey ${tfKey} is not unique,
+
+It is being used by the following CRs:
+
+- ${tfStateKeys[tfKey].kind} ${tfStateKeys[tfKey].metadata.name}
+
+- ${cr.kind} ${cr.metadata.name}
+
+Check the following Claims to ensure that the tfStateKey is unique:
+
+- ${tfStateKeys[tfKey].metadata.annotations['firestartr.dev/claim-ref']}
+
+- ${cr.metadata.annotations['firestartr.dev/claim-ref']}
+`);
+        }
+        tfStateKeys[cr.spec.firestartr.tfStateKey] = cr;
+    }
+}
+function references_isCatalogEntity(cr) {
+    return [
+        'Component',
+        'Domain',
+        'System',
+        'User',
+        'Group',
+        'Resource',
+    ].includes(cr.kind);
+}
+function isTerraformWorkspace(cr) {
+    return cr.kind === 'FirestartrTerraformWorkspace';
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/crSize.ts
+
+const K8S_OBJECT_SIZE_LIMIT = 1572864; // 1.5 MiB in bytes, etcd recommended limit: https://etcd.io/docs/latest/dev-guide/limit/
+function validateCrSizes(crs) {
+    for (const key of Object.keys(crs)) {
+        const cr = crs[key];
+        const serialized = catalog_common/* default.io.toYaml */.Z.io.toYaml(cr);
+        const size = Buffer.byteLength(serialized, 'utf8');
+        if (size > K8S_OBJECT_SIZE_LIMIT) {
+            throw new Error(`CR "${cr.kind}-${cr.metadata.name}" exceeds the Kubernetes object size limit by ${size - K8S_OBJECT_SIZE_LIMIT} bytes. Maximum allowed is ${K8S_OBJECT_SIZE_LIMIT} bytes (1.5MiB).`);
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/permissions.ts
+
+function validatePermissionsUniqueness(crs) {
+    for (const crkey in crs) {
+        const cr = crs[crkey];
+        if (cr.kind === 'FirestartrGithubRepository') {
+            const permissions = cr.spec.permissions;
+            logger.debug(`Validating Permissions Uniqueness of ${crkey}`);
+            if (permissions) {
+                const rolesByIdentifier = new Map();
+                for (const perm of permissions) {
+                    const identifier = perm.collaborator
+                        ? perm.collaborator
+                        : `ref:${perm.ref.kind}:${perm.ref.name}`;
+                    const role = perm.role;
+                    const prevRole = rolesByIdentifier.get(identifier);
+                    if (prevRole === undefined) {
+                        rolesByIdentifier.set(identifier, role);
+                    }
+                    else if (prevRole !== role) {
+                        throw new Error(`Conflicting permission role in FirestartrGithubRepository ${crkey}: ${identifier} has roles "${prevRole}" and "${role}".\nFull CR: ${JSON.stringify(cr, null, 2)}`);
+                    }
+                }
+            }
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/backstageAnnotations.ts
+const backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX = 'firestartr.backstage.dev/';
+const CATALOG_KINDS = new Set([
+    'User',
+    'Group',
+    'Component',
+    'System',
+    'Domain',
+    'API',
+    'Resource',
+    'CatalogKubernetesResource',
+    'CatalogTerraformWorkspace',
+    'CatalogArgoDeploy',
+    'CatalogOrgWebhook',
+    'CatalogSecrets',
+]);
+function validateNoBackstageAnnotationsInK8sCrs(crs) {
+    for (const crKey in crs) {
+        const cr = crs[crKey];
+        if (CATALOG_KINDS.has(cr.kind))
+            continue;
+        if (cr.metadata?.annotations) {
+            const backstageKeys = Object.keys(cr.metadata.annotations).filter((k) => k.startsWith(backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX));
+            if (backstageKeys.length > 0) {
+                throw new Error(`K8s CR ${crKey} contains Backstage-only annotations (${backstageKeys.join(', ')}). ` +
+                    `Annotations with prefix ${backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX} must only appear on Backstage catalog entities, not on Kubernetes CRs.`);
+            }
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/refsSorter/refsSorter.ts
+
+/**
+ * @param renderClaims renderClaims to sort
+ * @param kinds kinds to get from renderClaims
+ * @returns renderClaims with only the kinds specified
+ */
+function sortRenderClaimsByKind(renderClaims, kinds) {
+    let result = {};
+    for (const kind of kinds) {
+        for (const key in renderClaims) {
+            if (renderClaims[key].claim.kind === kind) {
+                result[key] = renderClaims[key];
+            }
+        }
+        result = sortSelfKindRefs(result, kind);
+    }
+    return result;
+}
+function sortSelfKindRefs(renderClaims, kind) {
+    if (!hasSelfRefs(kind)) {
+        return renderClaims;
+    }
+    const newRenderClaims = {};
+    const data = extractRefs(renderClaims, kind);
+    const ordered = [];
+    const visiting = [];
+    const visited = [];
+    for (const key of Object.keys(data)) {
+        if (!visited.find((obj) => obj.name === key)) {
+            sortRefs(data, data[key], ordered, visiting, visited);
+        }
+    }
+    for (const cr of ordered) {
+        newRenderClaims[cr.name] = renderClaims[cr.name];
+    }
+    return newRenderClaims;
+}
+function sortRefs(data, claim, ordered = [], visiting = [], visited = []) {
+    if (visiting.find((obj) => obj.name === claim.name)) {
+        throw new Error(`Circular dependency detected for '${claim.name}'`);
+    }
+    if (!visited.find((obj) => obj.name === claim.name)) {
+        visiting.push(claim);
+        if (claim.refs) {
+            for (const ref of claim.refs) {
+                const referencedObject = data[ref];
+                if (!referencedObject) {
+                    throw new Error(`Reference '${ref}' does not exist for '${claim.name}'`);
+                }
+                sortRefs(data, referencedObject, ordered, visiting, visited);
+            }
+        }
+        visited.push(visiting.pop());
+        ordered.push(claim);
+    }
+}
+function hasSelfRefs(kind) {
+    return ['TFWorkspaceClaim', 'GroupClaim'].includes(kind);
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-sorter.ts
+
+function sortKinds(orderedKinds, claims) {
+    const result = [];
+    for (const kind of orderedKinds) {
+        const kindRenderClaims = sortRenderClaimsByKind(claims, [kind]);
+        result.push(kindRenderClaims);
+    }
+    return result;
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/overriders/utils.ts
 
 
@@ -166947,6 +167460,16 @@ async function utils_renderFeature(featureName, featureVersion, featureOutputObj
             },
             branch: cr.spec.repo.branch,
         },
+        // Attach provider-keyed claimPatches if present in the feature render
+        // output. This is a separate attach path used when the claim is created
+        // elsewhere (the claim object here will be merged by the caller into the
+        // created claim); it is distinct from `patches`, which claim stitching
+        // consumes directly. Keep this field optional.
+        ...(featureOutputObject.claimPatches
+            ? {
+                claimPatches: featureOutputObject.claimPatches,
+            }
+            : {}),
     };
 }
 
@@ -166955,14 +167478,12 @@ async function utils_renderFeature(featureName, featureVersion, featureOutputObj
 
 
 
-
-
 // this is the only way currently to make
 // work the system and inject our code
 // without having to download a feature
-let MOCK_FEATURES_FN;
+let featureOverride_MOCK_FEATURES_FN;
 function MOCK_FEATURES(mock) {
-    MOCK_FEATURES_FN = mock;
+    featureOverride_MOCK_FEATURES_FN = mock;
     if (mock) {
         log.warn('⚠️ Warning features system downloader has been mocked, it should only happen in unit testing');
     }
@@ -166993,8 +167514,8 @@ class FeaturesOverrider extends OverriderPatches {
         let owner = 'prefapp';
         let versionOrRef = this.featureVersion;
         let renderer = 'getFeatureConfig';
-        if (MOCK_FEATURES_FN) {
-            return MOCK_FEATURES_FN();
+        if (featureOverride_MOCK_FEATURES_FN) {
+            return featureOverride_MOCK_FEATURES_FN();
         }
         if (this.featureRepo) {
             [owner, repo] = this.featureRepo.split(/\//);
@@ -167012,8 +167533,8 @@ class FeaturesOverrider extends OverriderPatches {
         const featureName = this.featureName;
         const featureVersion = this.featureVersion || this.featureRef;
         const featureArgs = this.featureArgs;
-        const fSetUpAndRunRenderer = function (cr) {
-            return this.setUpAndRunRenderer(cr);
+        const fSetUpAndRunRenderer = function (target) {
+            return this.setUpAndRunRenderer(target);
         }.bind(this);
         let renderedFeatureConfig = null;
         return [
@@ -167022,7 +167543,7 @@ class FeaturesOverrider extends OverriderPatches {
                     return true;
                 },
                 async apply(cr) {
-                    renderedFeatureConfig = await fSetUpAndRunRenderer(cr);
+                    renderedFeatureConfig = await fSetUpAndRunRenderer(claim);
                     return cr;
                 },
                 identify() {
@@ -167035,28 +167556,6 @@ class FeaturesOverrider extends OverriderPatches {
                     return utils_renderFeature(featureName, featureVersion, renderedFeatureConfig, cr, claim.name);
                 },
             },
-            {
-                isPostPatch: true,
-                validate() {
-                    return true;
-                },
-                async apply(cr) {
-                    if (!renderedFeatureConfig) {
-                        logger.warn(`Feature ${featureName}: renderedFeatureConfig is null, skipping post-patch`);
-                        return cr;
-                    }
-                    const provider = helperCTX(this).provider;
-                    const jsonPatches = renderedFeatureConfig.patches?.[provider] || [];
-                    fast_json_patch_default().applyPatch(cr, jsonPatches);
-                    return cr;
-                },
-                identify() {
-                    return `feature-json-patch/${featureName}`;
-                },
-                applicable() {
-                    return { applicableProviders: ['catalog', 'github'] };
-                },
-            },
         ];
     }
 }
@@ -363508,7 +364007,7 @@ function helperCreateCheckRunName(cmd, item) {
 
 ;// CONCATENATED MODULE: ../operator/src/utils/index.ts
 const secretRegex = /\$\{\{ secrets\.(.*?) \}\}/g;
-function isRecord(value) {
+function utils_isRecord(value) {
     return typeof value === 'object' && value !== null;
 }
 function getFirstNonEmptyString(...values) {
@@ -363546,7 +364045,7 @@ function replaceInlineSecrets(inline, secrets) {
     return result;
 }
 function extractErrorDetails(error) {
-    const exitCode = isRecord(error) && typeof error.exitCode === 'number'
+    const exitCode = utils_isRecord(error) && typeof error.exitCode === 'number'
         ? error.exitCode
         : undefined;
     if (typeof error === 'string') {
@@ -363557,7 +364056,7 @@ function extractErrorDetails(error) {
         const output = getFirstNonEmptyString(errorWithOutput.output, error.message);
         return { output: output ?? String(error), exitCode };
     }
-    if (isRecord(error)) {
+    if (utils_isRecord(error)) {
         const output = getFirstNonEmptyString(error.output, error.message, error.error);
         if (output !== undefined) {
             return { output, exitCode };
@@ -713893,7 +714392,7 @@ const crsStatusSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = JSON.parse('{"i8":"2.11.0-snapshot-main-1"}');
+const package_namespaceObject = JSON.parse('{"i8":"2.11.0-snapshot-patches-patch-claims-2"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"i8":"2.10.0"};
 // EXTERNAL MODULE: ../../node_modules/semver/index.js