@firestartr/cli 2.11.0-snapshot-org-secrets-00 → 2.11.0-snapshot-patch-claims-4

package/build/index.js

@@ -128395,7 +128395,7 @@ function trasformLeg(leg) {
 
 
 function getFeatureRenderedPathForEntity(entity, featureName, basePath = '/tmp') {
-    const entityFolderName = `${entity.metadata.name}`.toLowerCase();
+    const entityFolderName = `${entity.metadata?.name ?? entity.name}`.toLowerCase();
     return external_path_default().join(basePath, entityFolderName, featureName);
 }
 function getFeatureRenderedConfigForComponent(entity, featureName, basePath = '/tmp/features') {
@@ -128727,7 +128727,7 @@ function getCronNextInterval(cronLine, tz) {
 
 /***/ }),
 
-/***/ 3342:
+/***/ 99029:
 /***/ ((__unused_webpack_module, __webpack_exports__, __nccwpck_require__) => {
 
 // ESM COMPAT FLAG
@@ -134407,66 +134407,6 @@ async function encryptRepoSecret(owner, repo, section, plaintextValue, octokit)
     }
 }
 
-;// CONCATENATED MODULE: ../github/src/orgSecrets.ts
-
-
-
-async function getOrgPublicKey(org, section, octokit) {
-    logger.info(`Retrieving org public key for ${org} (${section})`);
-    try {
-        if (!octokit) {
-            octokit = await getOctokitForOrg(org);
-        }
-        const { data } = await octokit.rest[`${section}`].getOrgPublicKey({
-            org,
-        });
-        return data;
-    }
-    catch (error) {
-        logger.error(`Error retrieving org public key (${section}) for ${org}: ${error}`);
-        throw error;
-    }
-}
-async function encryptOrgSecret(org, section, plaintextValue, preFetchedKey, octokit) {
-    try {
-        const { key_id, key } = preFetchedKey
-            ? preFetchedKey
-            : await getOrgPublicKey(org, section, octokit);
-        await libsodium_wrappers.ready;
-        const publicKey = libsodium_wrappers.from_base64(key, libsodium_wrappers.base64_variants.ORIGINAL);
-        const secretBytes = libsodium_wrappers.from_string(plaintextValue);
-        const encryptedBytes = libsodium_wrappers.crypto_box_seal(secretBytes, publicKey);
-        const encryptedValue = libsodium_wrappers.to_base64(encryptedBytes, libsodium_wrappers.base64_variants.ORIGINAL);
-        return {
-            key_id,
-            encrypted_value: encryptedValue,
-        };
-    }
-    catch (err) {
-        logger.error(`Error encrypting org secret (${section}) for ${org}: ${err}`);
-        throw err;
-    }
-}
-async function getOrgSecret(org, section, name, octokit) {
-    logger.info(`Checking org secret ${name} (${section}) for ${org}`);
-    try {
-        if (!octokit) {
-            octokit = await getOctokitForOrg(org);
-        }
-        const response = await octokit.rest[`${section}`].getOrgSecret({
-            org,
-            secret_name: name,
-        });
-        return response.data;
-    }
-    catch (err) {
-        if (err && err.status === 404) {
-            return null;
-        }
-        throw err;
-    }
-}
-
 ;// CONCATENATED MODULE: ../github/src/profile.ts
 // Profile definitions and store for github package (immutable and ambient profiles)
 const profileStore = new Map();
@@ -134901,7 +134841,6 @@ function withProfile(profileName) {
 
 
 
-
 /* harmony default export */ const github = ({
     org: organization,
     repo: repository,
@@ -134924,9 +134863,6 @@ function withProfile(profileName) {
     encryption: {
         encryptRepoSecret: encryptRepoSecret,
         getRepoPublicKey: getRepoPublicKey,
-        getOrgPublicKey: getOrgPublicKey,
-        encryptOrgSecret: encryptOrgSecret,
-        getOrgSecret: getOrgSecret,
     },
     withProfile: withProfile,
     createProfile: createProfile,
@@ -159704,8 +159640,8 @@ var dist = __nccwpck_require__(44516);
 var dist_default = /*#__PURE__*/__nccwpck_require__.n(dist);
 // EXTERNAL MODULE: ../catalog_common/index.ts + 44 modules
 var catalog_common = __nccwpck_require__(78542);
-// EXTERNAL MODULE: ../github/index.ts + 38 modules
-var github = __nccwpck_require__(3342);
+// EXTERNAL MODULE: ../github/index.ts + 37 modules
+var github = __nccwpck_require__(99029);
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/patches/base.ts
 class BasePatches {
     constructor() { }
@@ -162566,31 +162502,6 @@ function extractAllRefs(claimData) {
                     }
                 }
             }
-            const orgSecrets = parsedClaim.providers?.github?.org_secrets;
-            if (orgSecrets && typeof orgSecrets === 'object') {
-                const secretRefRegex = /^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$/;
-                for (const section of ['actions', 'codespaces', 'dependabot']) {
-                    const secrets = orgSecrets[section];
-                    if (!Array.isArray(secrets))
-                        continue;
-                    for (const secret of secrets) {
-                        if (secret.value) {
-                            const match = secret.value.match(secretRefRegex);
-                            if (match) {
-                                refs.push(`SecretsClaim-${match[1]}`);
-                            }
-                        }
-                        if (Array.isArray(secret.selected_repositories)) {
-                            for (const repoRef of secret.selected_repositories) {
-                                const compMatch = repoRef.match(/^component:(.+)$/);
-                                if (compMatch) {
-                                    refs.push(`ComponentClaim-${compMatch[1]}`);
-                                }
-                            }
-                        }
-                    }
-                }
-            }
             break;
         }
     }
@@ -163749,30 +163660,6 @@ const organizationSettingsProperties = {
             ],
         },
     },
-    org_secrets: {
-        type: 'object',
-        properties: {
-            actions: {
-                type: 'array',
-                items: {
-                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                },
-            },
-            codespaces: {
-                type: 'array',
-                items: {
-                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                },
-            },
-            dependabot: {
-                type: 'array',
-                items: {
-                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                },
-            },
-        },
-        additionalProperties: false,
-    },
 };
 /* harmony default export */ const github_orgsettings_schema = ({
     $schema: SCHEMA,
@@ -163997,75 +163884,6 @@ const organizationSettingsProperties = {
     },
 });
 
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/github/orgSecrets.schema.ts
-
-/* harmony default export */ const orgSecrets_schema = ({
-    $schema: SCHEMA,
-    $id: 'GithubOrgClaimSecrets',
-    definitions: {
-        GithubOrgClaimSecrets: {
-            $id: 'firestartr.dev://github/GithubOrgClaimSecrets',
-            type: 'object',
-            description: 'Organization-level GitHub Actions secrets',
-            properties: {
-                actions: {
-                    type: 'array',
-                    items: {
-                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                    },
-                },
-                codespaces: {
-                    type: 'array',
-                    items: {
-                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                    },
-                },
-                dependabot: {
-                    type: 'array',
-                    items: {
-                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                    },
-                },
-            },
-            additionalProperties: false,
-        },
-        GithubOrgClaimSecretRef: {
-            $id: 'firestartr.dev://github/GithubOrgClaimSecretRef',
-            type: 'string',
-            description: 'the reference of the secret',
-            pattern: '^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$',
-        },
-        GithubOrgClaimSecret: {
-            $id: 'firestartr.dev://github/GithubOrgClaimSecret',
-            type: 'object',
-            description: 'An organization-level secret for GitHub Actions',
-            properties: {
-                name: {
-                    type: 'string',
-                    description: 'the name of the secret',
-                },
-                value: {
-                    $ref: 'firestartr.dev://github/GithubOrgClaimSecretRef',
-                },
-                visibility: {
-                    type: 'string',
-                    enum: ['all', 'selected', 'private'],
-                    description: 'which repositories can access the secret',
-                },
-                selected_repositories: {
-                    type: 'array',
-                    items: {
-                        type: 'string',
-                    },
-                    description: 'list of repository refs when visibility is selected',
-                },
-            },
-            required: ['name', 'value'],
-            additionalProperties: false,
-        },
-    },
-});
-
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/github/index.ts
 
 
@@ -164076,7 +163894,6 @@ const organizationSettingsProperties = {
 
 
 
-
 const GithubSchemas = [
     github_group_schema,
     github_user_schema,
@@ -164087,7 +163904,6 @@ const GithubSchemas = [
     component_secrets_vars_schema,
     component_labels_schema,
     pages_schema,
-    orgSecrets_schema,
 ];
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/tfworkspaces/terraform.schema.ts
@@ -164734,771 +164550,6 @@ const base_secrets_schema = 'firestartr.dev://common/SecretsClaim';
     SecretsClaimSchema: base_secrets_schema,
 });
 
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/lazy_loader.ts
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-// We need to ensure the grep command is a gnu version
-let IS_GNU_GREP = false;
-let GREP_ON_CHECK = false;
-// this loop is for avoid race conditions
-// once a check is running no more checks
-async function waitForCheck() {
-    const f_wait = () => new Promise((timeOut) => setTimeout(timeOut, 10));
-    do {
-        await f_wait();
-    } while (GREP_ON_CHECK);
-}
-function checkGrep() {
-    return new Promise((ok, ko) => {
-        // idempotency: already checked
-        if (IS_GNU_GREP)
-            return ok();
-        // a check is already running no new checks
-        if (GREP_ON_CHECK)
-            return waitForCheck();
-        logger.info('Checking the grep command');
-        GREP_ON_CHECK = true;
-        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['--version']);
-        handler.on('close', (code) => {
-            GREP_ON_CHECK = false;
-            if (code === 0) {
-                logger.debug('Grep is a gnu grep');
-                IS_GNU_GREP = true;
-                ok();
-            }
-            else {
-                ko('Lazy evaluation needs a gnu-grep command');
-            }
-        });
-    });
-}
-async function loadClaim(claimRef, org, defaults = loadClaimDefaults(), patchClaim = loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, existingRefs = {}, postValidations = new Map()) {
-    await checkGrep();
-    let result = existingRefs;
-    logger.info(`Load reference ${claimRef}`);
-    initVirtualClaims(org);
-    logger.info(`Load reference (parts) ${claimRef.split(/-/)[0]} ${claimRef.replace(/^[^-]+-/, '')}`);
-    // cargas datos con grep
-    try {
-        const claimData = await lazyGetClaim(claimRef.split(/-/)[0], claimRef.replace(/^[^-]+-/, ''), org, cwd);
-        const claim = patchClaim(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(claimData), defaults);
-        let variants = [];
-        if (claim.kind === 'TFWorkspaceClaim' &&
-            claim.providers?.terraform?.variants) {
-            variants = claim.providers.terraform.variants;
-            delete claim.providers.terraform.variants;
-        }
-        logger.silly(`Patched claim is:
-		 ---
-			${catalog_common/* default.io.toYaml */.Z.io.toYaml(claim)}`);
-        try {
-            validateClaim(claim, base[`${claim.kind}Schema`]);
-            await optionalValidation(claim);
-        }
-        catch (error) {
-            let errorMsg = '';
-            if (Array.isArray(error)) {
-                for (const data of error) {
-                    errorMsg = `${errorMsg}
-  - ${data.instancePath}: ${data.message}`;
-                }
-            }
-            else {
-                errorMsg = error instanceof Error ? error.message : String(error);
-            }
-            throw new Error(`Error when validating claim ${claimRef}: ${errorMsg}`);
-        }
-        result[claimRef] = {};
-        result[claimRef]['claim'] = claim;
-        result[claimRef]['claimPath'] = VisitedClaims[claimRef];
-        if (VisitedClaims[claimRef] === 'virtual') {
-            result = await setVirtualClaimAdditionalData(result, claim, claimRef);
-        }
-        else {
-            result = await setNonVirtualClaimAdditionalData(result, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
-        }
-        const claimKind = claim.kind;
-        const references = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(claim));
-        for (const ref of references) {
-            if (!result[ref]) {
-                const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
-                result = lodash_default().merge(result, resolvedReferences);
-            }
-        }
-        if (variants.length > 0) {
-            const parentClaimPath = VisitedClaims[claimRef];
-            for (const variant of variants) {
-                if (!variant.name || !variant.overrides) {
-                    throw new Error(`Variant in claim ${claimRef} is missing required field 'name' or 'overrides'`);
-                }
-                const prohibitedOverrideFields = ['source', 'module', 'name'];
-                for (const field of prohibitedOverrideFields) {
-                    if (field in variant.overrides) {
-                        throw new Error(`Variant '${variant.name}' in claim ${claimRef} cannot override '${field}'`);
-                    }
-                }
-                const composedName = claim.providers.terraform.name + '-' + variant.name;
-                const variantClaim = lodash_default().cloneDeep(claim);
-                variantClaim._parentClaimName = claim.name;
-                variantClaim.name = composedName;
-                variantClaim.providers.terraform = lodash_default().merge({}, claim.providers.terraform, variant.overrides);
-                variantClaim.providers.terraform.name = composedName;
-                if (!variantClaim.annotations) {
-                    variantClaim.annotations = {};
-                }
-                variantClaim.annotations['firestartr.dev/variant-of'] =
-                    claim.providers.terraform.name;
-                const variantRef = `TFWorkspaceClaim-${composedName}`;
-                if (result[variantRef]) {
-                    throw new Error(`Variant name '${variant.name}' (composed: '${composedName}') from claim '${claimRef}' conflicts with existing claim '${variantRef}'`);
-                }
-                logger.info(`Creating synthetic variant claim ${variantRef}`);
-                result[variantRef] = {};
-                result[variantRef]['claim'] = variantClaim;
-                result[variantRef]['claimPath'] = parentClaimPath;
-                result = await setNonVirtualClaimAdditionalData(result, variantClaim, variantRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
-                const variantReferences = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(variantClaim));
-                for (const ref of variantReferences) {
-                    if (!result[ref]) {
-                        const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
-                        result = lodash_default().merge(result, resolvedReferences);
-                    }
-                }
-            }
-        }
-    }
-    catch (err) {
-        throw `Lazy Loading: ${err}`;
-    }
-    return [result, postValidations];
-}
-let LoadedClaims = {};
-let VisitedClaims = {};
-let DuplicatedClaims = {};
-function resetLazyLoader() {
-    LoadedClaims = {};
-    VisitedClaims = {};
-    DuplicatedClaims = {};
-}
-async function lazyGetClaim(kind, name, org, cwd) {
-    const indice = `${kind}-${name}`;
-    logger.info(`Lazy loading ${kind}-${name} with index ${indice}`);
-    if (indice in LoadedClaims)
-        return LoadedClaims[indice];
-    if (isVirtualClaim(kind, name)) {
-        await loadVirtualClaim(kind, name, org);
-    }
-    else {
-        await getClaimsByName(name, cwd);
-    }
-    if (indice in LoadedClaims) {
-        return LoadedClaims[indice];
-    }
-    else {
-        throw new Error(`Error: ${kind}-${name} not found`);
-    }
-}
-async function getClaimsByName(name, cwd = '.') {
-    return new Promise((ok, ko) => {
-        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['-r', '-l', '--include=*', '-E', `name: "?${name}"?`, '.'], {
-            cwd: cwd,
-        });
-        logger.info(`Running ${['grep', '-r', '-l', '--include', '-E', 'name: "' + name + '"?', '.'].join(' ')}`);
-        const entradas = [];
-        const chunks = [];
-        handler.stdout.on('data', (data) => {
-            chunks.push(data.toString('utf-8'));
-        });
-        handler.on('close', () => {
-            const dataFinal = chunks.join('');
-            const fileNameList = dataFinal.split(/\n/).filter((line) => line !== '');
-            for (const fileName of fileNameList) {
-                // only yaml files
-                if (!fileName.match(/\.yml$|\.yaml$/)) {
-                    continue;
-                }
-                // only entries not already visited
-                if (Object.values(VisitedClaims).includes(fileName)) {
-                    continue;
-                }
-                entradas.push(external_path_.join(cwd, fileName));
-            }
-            return Promise.all(entradas.map((entrada) => {
-                return loadRawClaim(entrada);
-            }))
-                .then(() => {
-                ok();
-            })
-                .catch((err) => {
-                ko(err);
-            });
-        });
-    });
-}
-async function loadRawClaim(entry) {
-    return new Promise((ok, ko) => {
-        external_fs_.readFile(entry, 'utf-8', (error, data) => {
-            if (error)
-                return ko(`Reading ${entry}: ${error}`);
-            const claim = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
-            if (!('kind' in claim && 'name' in claim)) {
-                logger.warn(`Invalid claim file ${entry}`);
-            }
-            else {
-                const claimKey = `${claim.kind}-${claim.name}`;
-                if (Object.keys(DuplicatedClaims).includes(claimKey) &&
-                    DuplicatedClaims[claimKey] !== entry) {
-                    return ko(`Duplicated claim ${claimKey} found files: ${DuplicatedClaims[claimKey]} and ${entry}`);
-                }
-                LoadedClaims[claimKey] = data;
-                VisitedClaims[claimKey] = entry;
-                DuplicatedClaims[claimKey] = entry;
-                ok();
-            }
-        });
-    });
-}
-async function setVirtualClaimAdditionalData(renderedData, claim, claimRef) {
-    const virtualClaim = getVirtualClaim(claim.kind, claim.name);
-    renderedData[claimRef]['initializers'] = [
-        new UUIDInitializer(claim),
-        new InitializerClaimRef(),
-        new InitializerDefault(virtualClaim.getDefaultConfig()),
-    ];
-    renderedData[claimRef]['globals'] = [];
-    renderedData[claimRef]['overrides'] = [];
-    renderedData[claimRef]['normalizers'] = [new NameNormalizer()];
-    return renderedData;
-}
-async function setNonVirtualClaimAdditionalData(renderedData, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers) {
-    renderedData[claimRef]['initializers'] = await loadInitializers(claim, renderedData[claimRef]['claimPath']);
-    renderedData[claimRef]['globals'] = await loadGlobals(claim);
-    renderedData[claimRef]['overrides'] = loadOverrides(claim);
-    renderedData[claimRef]['normalizers'] = await loadNormalizers(claim, renderedData[claimRef]['claimPath']);
-    return renderedData;
-}
-async function loadVirtualClaim(kind, name, org) {
-    const virtualClaim = getVirtualClaim(kind, name);
-    const expandedClaim = await virtualClaim.expand({ org });
-    logger.info(`Loading virtual claim ${kind} ${name} ${org}`);
-    LoadedClaims[`${kind}-${name}`] = catalog_common/* default.io.toYaml */.Z.io.toYaml(expandedClaim);
-    VisitedClaims[`${kind}-${name}`] = 'virtual';
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/claimsDefaulter.ts
-
-
-
-/*
- * Default blocks are objects that cannot be merged but applied as a whole. Meaning:
- * - If the object is defined at the claim-level it is maintained *AS IT IS* (no merge)
- * - If the block is missing at the claim-level, the default block is applied
- */
-const defaultBlocksPaths = ['/providers/terraform/sync'];
-function applyBlockAwareDefaults(claim, defaultClaim) {
-    // we always work with a clone of the original
-    const claimClone = JSON.parse(JSON.stringify(claim));
-    // if the block is claim-level defined we store it here
-    const defaultBlocks = new Map();
-    // we remove the blocks entirely of the claim
-    // to achieve an add copy
-    for (const defaultBlockPath of defaultBlocksPaths) {
-        if (claimsDefaulter_hasDeepPath(claimClone, defaultBlockPath) !== true)
-            continue;
-        const originalValue = fast_json_patch_default().getValueByPointer(claimClone, defaultBlockPath);
-        if (originalValue) {
-            logger.silly(`${claim.kind}/${claim.name}: has an original ${defaultBlockPath}: preserving`);
-            defaultBlocks.set(defaultBlockPath, originalValue);
-            fast_json_patch_default().applyPatch(claimClone, [{ op: 'remove', path: defaultBlockPath }]);
-        }
-    }
-    // if the patch has the same path of a block
-    // and the block was defined at claim-level
-    // we interchange the value with the original value
-    // otherwise we use the default
-    const jsonPatchOps = fast_json_patch_default().compare(claimClone, defaultClaim)
-        .filter((jp) => jp.op === 'add')
-        .map((jp) => {
-        if (defaultBlocks.has(jp.path)) {
-            return {
-                ...jp,
-                value: defaultBlocks.get(jp.path),
-            };
-        }
-        else {
-            return jp;
-        }
-    });
-    return fast_json_patch_default().applyPatch(claimClone, jsonPatchOps).newDocument;
-}
-function claimsDefaulter_hasDeepPath(data, deepPath) {
-    return lodash_default().has(data, deepPath.replace(/\//g, '.').replace(/^\./, ''));
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/loader.ts
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-const isYamlFile = new RegExp(/\.(yaml|yml)$/);
-/**
- *
- * @returns Virtual Claims
- */
-const virtualClaims = [new FirestartrAllClaim()];
-/*
- * Loads all applicable globals for a given claim and stores them into a list.
- *
- * Input:
- * - claim: our custom claim object, with which we check if the global is applicable
- *
- * Returns:
- * - A GlobalSection array promise, containing all the globals loaded for this claim
- *
- */
-async function loadGlobals(claim) {
-    const result = [];
-    await crawl(getPath('globals'), (entry) => {
-        return isYamlFile.test(entry);
-    }, async (entry, data) => {
-        const globalData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
-        const ext = external_path_.extname(entry);
-        const name = external_path_.basename(entry, ext);
-        if (name in SECTIONS_BY_FILE_NAME) {
-            const section = new SECTIONS_BY_FILE_NAME[name](globalData);
-            if (!(await section.validate(SCHEMAS_BY_SECTION_NAME[name] || {}))) {
-                throw new Error(`Invalid ${name} global file`);
-            }
-            if (globalData.kind === claim.kind) {
-                result.push(section);
-            }
-            else {
-                logger.debug(`Skipping global ${name} because it is not applicable to ${claim.kind}`);
-            }
-        }
-    });
-    logger.info(`Loaded globals ${result}`);
-    return result;
-}
-/*
- * If the input claim is a GithubRepositoryClaim, it loads all it's applicable
- * overrides and stores them into a list. Otherwise, it returns an empty list.
- *
- * Input:
- * - claim: our custom claim object, which should be a GithubRepositoryClaim
- *
- * Returns:
- * - An Overrider array, with a GithubRepositoryOverrider if the claim
- *   was a GithubRepositoryClaim, or empty if it was not.
- *
- */
-function loadOverrides(claim) {
-    const overrides = [];
-    if (claim.kind === 'ComponentClaim' && claim.providers.github.overrides) {
-        overrides.push(new GithubRepositoryOverrider());
-    }
-    return overrides;
-}
-/**
- * Load all normalizers and stores them into a list.
- * @param claim
- * @returns
- */
-async function loadNormalizers(_claim, path) {
-    const result = [];
-    for (const normalizer of NORMALIZERS) {
-        result.push(new normalizer({ path: path }));
-    }
-    return result;
-}
-/*
- * Loads all applicable initializers for a given claim and stores them into a list.
- *
- * Input:
- * - claim: our custom claim object, with which we check if the initializer is applicable
- *
- * Returns:
- * - An Initializer array promise, containing all the initializers loaded for this claim
- *
- */
-let loadedInitializers = false;
-async function loadInitializers(claim, claimPath, initializersPath = getPath('initializers')) {
-    const result = [];
-    await crawl(initializersPath, (entry) => {
-        return isYamlFile.test(entry);
-    }, async (entry, data) => {
-        const initializerData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
-        const ext = external_path_.extname(entry);
-        const name = external_path_.basename(entry, ext);
-        if (name in INITIALIZERS_BY_FILE_NAME) {
-            const initializerBfN = new INITIALIZERS_BY_FILE_NAME[name](initializerData);
-            if (!(await initializerBfN.validate(SCHEMAS_BY_INITIALIZER_NAME[name] || {}))) {
-                throw new Error(`Invalid ${name} initializer file`);
-            }
-            if (initializerData.kind === claim.kind) {
-                result.push(initializerBfN);
-            }
-            else {
-                logger.debug(`Skipping initializer ${name} because it is not applicable to ${claim.kind}`);
-            }
-        }
-    });
-    for (const initializer of INITIALIZERS) {
-        if (initializer.applicableKinds.includes(claim.kind)) {
-            result.push(new initializer({ path: claimPath }));
-        }
-    }
-    logger.info(`Loaded initializers ${JSON.stringify(result)}`);
-    loadedInitializers = result;
-    return loadedInitializers;
-}
-function loadClaimDefaults() {
-    try {
-        return catalog_common/* default.io.fromYaml */.Z.io.fromYaml(external_fs_.readFileSync(`${getPath('claimsDefaults')}/claims_defaults.yaml`, 'utf-8'));
-    }
-    catch (error) {
-        const errMsg = `Could not read claims defaults file in path ${getPath('claimsDefaults')}/claims_defaults.yaml: ${error}`;
-        logger.error(errMsg);
-        throw new Error(errMsg);
-    }
-}
-/*
- * Using fast-json-patch, compares a claim to its kind's defaults, then patches it.
- *
- * Input:
- * - claim: our custom claim object, which we want to patch
- * - defaultsClaims: an object, containing the defaults for each claim kind,
- *   with the same structure that we use for the actual claims
- *
- * Returns:
- * - The patched claim
- *
- */
-function loader_patchClaim(claim, defaultsClaims) {
-    if (defaultsClaims[claim.kind]) {
-        claim = applyBlockAwareDefaults(claim, defaultsClaims[claim.kind]);
-    }
-    return claim;
-}
-async function loadCRsWithFullSet(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
-    const result = {};
-    const fullResult = {};
-    await crawlWithExclusions(crsPath, (entry) => {
-        return isYamlFile.test(entry);
-    }, async (entry, data) => {
-        const yamlData = stripKnownRelations(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data));
-        const metadata = yamlData?.metadata;
-        if (!(yamlData &&
-            typeof yamlData === 'object' &&
-            'kind' in yamlData &&
-            metadata &&
-            typeof metadata === 'object' &&
-            'name' in metadata)) {
-            logger.warn(`Invalid CR file ${entry}`);
-        }
-        else {
-            const crKey = `${yamlData.kind}-${metadata.name}`;
-            if (fullResult[crKey]) {
-                logger.error(`Duplicate CR ${crKey}`);
-            }
-            // Keep the complete CR set for validations that need repository-wide context.
-            fullResult[crKey] = yamlData;
-            // Keep the filtered CR set for previous-CR lookup during claim rendering.
-            if (allowedClaimReferences.length === 0 ||
-                allowedClaimReferences.includes(yamlData.metadata?.annotations?.[catalog_common/* default.generic.getFirestartrAnnotation */.Z.generic.getFirestartrAnnotation('claim-ref')])) {
-                result[crKey] = yamlData;
-            }
-        }
-    }, excludedPaths.concat(getAdditionalPaths()));
-    return { crs: result, fullCrs: fullResult };
-}
-async function loadCRs(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
-    const { crs } = await loadCRsWithFullSet(crsPath, excludedPaths, allowedClaimReferences);
-    return crs;
-}
-/*
- * Description: Get the renamed using claimRef annotation
- * Input: claims: any, crs: any
- * Output: renames: IRenameResult[]
- */
-async function loadRenames(claims, crs) {
-    /*
-     * If checkRenames is false, we don't need to check for renames
-     */
-    const renamesEnabled = getRenamesEnabled();
-    if (!renamesEnabled)
-        return [];
-    const result = [];
-    /**
-     * For each CR, look for a claim that does not match the name with CR's firestartr.dev/claim-ref annotation
-     */
-    for (const cr of Object.values(crs)) {
-        const anyCr = cr;
-        if (!anyCr?.metadata?.annotations)
-            continue;
-        // if the annotation is a claimRef
-        const annotationName = common.generic.getFirestartrAnnotation('claim-ref');
-        const annotations = anyCr?.metadata?.annotations || {};
-        if (annotationName in annotations) {
-            const claimRef = anyCr.metadata.annotations[annotationName];
-            // split the annotation into kind and name
-            const [kind, name] = claimRef.split('/');
-            // if the claim exists, check if the name is different for the given provider
-            const referencedClaim = claims[`${kind}-${name}`].claim;
-            const oldName = anyCr.metadata.name;
-            const newName = referencedClaim.providers[getConfiguredProvider()].name;
-            if (oldName !== newName) {
-                result.push({
-                    kind: referencedClaim.kind,
-                    claimPath: claims[`${kind}-${name}`].claimPath,
-                    claimName: referencedClaim.name,
-                    oldName,
-                    newName,
-                });
-            }
-        }
-    }
-    return result;
-}
-async function loadClaimsList(claimRefList, claimsPath = getPath('claims')) {
-    const data = {
-        renderClaims: {},
-        crs: {},
-        fullCrs: {},
-    };
-    const defaults = loadClaimDefaults();
-    for await (const claimRef of claimRefList) {
-        const [renderedClaimData] = await loadClaim(claimRef, getOrg(), defaults, loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, claimsPath);
-        data.renderClaims = lodash_default().merge(data.renderClaims, renderedClaimData);
-    }
-    const crClaimReferences = [];
-    for (const ref of Object.keys(data.renderClaims)) {
-        // Replaces only the first instance of '-'
-        crClaimReferences.push(ref.replace('-', '/'));
-    }
-    const loadedCrs = await loadCRsWithFullSet(getPath('crs'), [getPath('globals'), getPath('initializers')], crClaimReferences);
-    data['crs'] = loadedCrs.crs;
-    data['fullCrs'] = loadedCrs.fullCrs;
-    return data;
-}
-function getOrg() {
-    const groupOrg = catalog_common/* default.environment.getFromEnvironmentWithDefault */.Z.environment.getFromEnvironmentWithDefault(catalog_common/* default.types.envVars.org */.Z.types.envVars.org, '');
-    return groupOrg;
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/references.ts
-function validateTfStateKeyUniqueness(crs) {
-    const tfStateKeys = {};
-    for (const crKey of Object.keys(crs)) {
-        const cr = crs[crKey];
-        if (!isTerraformWorkspace(cr))
-            continue;
-        const tfKey = cr.spec.firestartr.tfStateKey;
-        if (tfStateKeys[tfKey]) {
-            throw new Error(`❗❗ ❌ RENDER ERROR ❌ ❗❗
-
-The tfStateKey ${tfKey} is not unique,
-
-It is being used by the following CRs:
-
-- ${tfStateKeys[tfKey].kind} ${tfStateKeys[tfKey].metadata.name}
-
-- ${cr.kind} ${cr.metadata.name}
-
-Check the following Claims to ensure that the tfStateKey is unique:
-
-- ${tfStateKeys[tfKey].metadata.annotations['firestartr.dev/claim-ref']}
-
-- ${cr.metadata.annotations['firestartr.dev/claim-ref']}
-`);
-        }
-        tfStateKeys[cr.spec.firestartr.tfStateKey] = cr;
-    }
-}
-function references_isCatalogEntity(cr) {
-    return [
-        'Component',
-        'Domain',
-        'System',
-        'User',
-        'Group',
-        'Resource',
-    ].includes(cr.kind);
-}
-function isTerraformWorkspace(cr) {
-    return cr.kind === 'FirestartrTerraformWorkspace';
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/crSize.ts
-
-const K8S_OBJECT_SIZE_LIMIT = 1572864; // 1.5 MiB in bytes, etcd recommended limit: https://etcd.io/docs/latest/dev-guide/limit/
-function validateCrSizes(crs) {
-    for (const key of Object.keys(crs)) {
-        const cr = crs[key];
-        const serialized = catalog_common/* default.io.toYaml */.Z.io.toYaml(cr);
-        const size = Buffer.byteLength(serialized, 'utf8');
-        if (size > K8S_OBJECT_SIZE_LIMIT) {
-            throw new Error(`CR "${cr.kind}-${cr.metadata.name}" exceeds the Kubernetes object size limit by ${size - K8S_OBJECT_SIZE_LIMIT} bytes. Maximum allowed is ${K8S_OBJECT_SIZE_LIMIT} bytes (1.5MiB).`);
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/permissions.ts
-
-function validatePermissionsUniqueness(crs) {
-    for (const crkey in crs) {
-        const cr = crs[crkey];
-        if (cr.kind === 'FirestartrGithubRepository') {
-            const permissions = cr.spec.permissions;
-            logger.debug(`Validating Permissions Uniqueness of ${crkey}`);
-            if (permissions) {
-                const rolesByIdentifier = new Map();
-                for (const perm of permissions) {
-                    const identifier = perm.collaborator
-                        ? perm.collaborator
-                        : `ref:${perm.ref.kind}:${perm.ref.name}`;
-                    const role = perm.role;
-                    const prevRole = rolesByIdentifier.get(identifier);
-                    if (prevRole === undefined) {
-                        rolesByIdentifier.set(identifier, role);
-                    }
-                    else if (prevRole !== role) {
-                        throw new Error(`Conflicting permission role in FirestartrGithubRepository ${crkey}: ${identifier} has roles "${prevRole}" and "${role}".\nFull CR: ${JSON.stringify(cr, null, 2)}`);
-                    }
-                }
-            }
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/backstageAnnotations.ts
-const backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX = 'firestartr.backstage.dev/';
-const CATALOG_KINDS = new Set([
-    'User',
-    'Group',
-    'Component',
-    'System',
-    'Domain',
-    'API',
-    'Resource',
-    'CatalogKubernetesResource',
-    'CatalogTerraformWorkspace',
-    'CatalogArgoDeploy',
-    'CatalogOrgWebhook',
-    'CatalogSecrets',
-]);
-function validateNoBackstageAnnotationsInK8sCrs(crs) {
-    for (const crKey in crs) {
-        const cr = crs[crKey];
-        if (CATALOG_KINDS.has(cr.kind))
-            continue;
-        if (cr.metadata?.annotations) {
-            const backstageKeys = Object.keys(cr.metadata.annotations).filter((k) => k.startsWith(backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX));
-            if (backstageKeys.length > 0) {
-                throw new Error(`K8s CR ${crKey} contains Backstage-only annotations (${backstageKeys.join(', ')}). ` +
-                    `Annotations with prefix ${backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX} must only appear on Backstage catalog entities, not on Kubernetes CRs.`);
-            }
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/refsSorter/refsSorter.ts
-
-/**
- * @param renderClaims renderClaims to sort
- * @param kinds kinds to get from renderClaims
- * @returns renderClaims with only the kinds specified
- */
-function sortRenderClaimsByKind(renderClaims, kinds) {
-    let result = {};
-    for (const kind of kinds) {
-        for (const key in renderClaims) {
-            if (renderClaims[key].claim.kind === kind) {
-                result[key] = renderClaims[key];
-            }
-        }
-        result = sortSelfKindRefs(result, kind);
-    }
-    return result;
-}
-function sortSelfKindRefs(renderClaims, kind) {
-    if (!hasSelfRefs(kind)) {
-        return renderClaims;
-    }
-    const newRenderClaims = {};
-    const data = extractRefs(renderClaims, kind);
-    const ordered = [];
-    const visiting = [];
-    const visited = [];
-    for (const key of Object.keys(data)) {
-        if (!visited.find((obj) => obj.name === key)) {
-            sortRefs(data, data[key], ordered, visiting, visited);
-        }
-    }
-    for (const cr of ordered) {
-        newRenderClaims[cr.name] = renderClaims[cr.name];
-    }
-    return newRenderClaims;
-}
-function sortRefs(data, claim, ordered = [], visiting = [], visited = []) {
-    if (visiting.find((obj) => obj.name === claim.name)) {
-        throw new Error(`Circular dependency detected for '${claim.name}'`);
-    }
-    if (!visited.find((obj) => obj.name === claim.name)) {
-        visiting.push(claim);
-        if (claim.refs) {
-            for (const ref of claim.refs) {
-                const referencedObject = data[ref];
-                if (!referencedObject) {
-                    throw new Error(`Reference '${ref}' does not exist for '${claim.name}'`);
-                }
-                sortRefs(data, referencedObject, ordered, visiting, visited);
-            }
-        }
-        visited.push(visiting.pop());
-        ordered.push(claim);
-    }
-}
-function hasSelfRefs(kind) {
-    return ['TFWorkspaceClaim', 'GroupClaim'].includes(kind);
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-sorter.ts
-
-function sortKinds(orderedKinds, claims) {
-    const result = [];
-    for (const kind of orderedKinds) {
-        const kindRenderClaims = sortRenderClaimsByKind(claims, [kind]);
-        result.push(kindRenderClaims);
-    }
-    return result;
-}
-
 ;// CONCATENATED MODULE: ../features_renderer/src/common.ts
 
 function isDirectory(path) {
@@ -165538,6 +164589,16 @@ var ajv_default = /*#__PURE__*/__nccwpck_require__.n(dist_ajv);
                         $ref: '#/definitions/File',
                     },
                 },
+                claimPatches: {
+                    type: 'array',
+                    items: {
+                        $ref: '#/definitions/Patch',
+                    },
+                },
+                // Legacy field kept for backward compatibility. Real feature packages
+                // (prefapp/features) ship `patches` in the provider-keyed object
+                // shape. The renderer ignores it for claim-level behaviour; claim-level
+                // patches must come from `claimPatches`.
                 patches: {
                     type: 'object',
                     patternProperties: {
@@ -165569,7 +164630,7 @@ var ajv_default = /*#__PURE__*/__nccwpck_require__.n(dist_ajv);
                     },
                 },
             },
-            required: ['args', 'feature_name', 'files', 'patches'],
+            required: ['args', 'feature_name', 'files'],
             title: 'root',
         },
         Args: {
@@ -165649,10 +164710,10 @@ var ajv_default = /*#__PURE__*/__nccwpck_require__.n(dist_ajv);
                     type: 'string',
                 },
                 value: {
-                    type: 'string',
+                    type: ['string', 'object', 'array', 'number', 'boolean', 'null'],
                 },
             },
-            required: ['name', 'op', 'path'],
+            required: ['op', 'path'],
             title: 'Patch',
         },
     },
@@ -165674,10 +164735,10 @@ function validate(featurePath) {
 }
 function __validateDirStructure(featurePath) {
     if (!isDirectory(featurePath)) {
-        throw `Feature: ${featurePath} not a directory`;
+        throw new Error(`Feature: ${featurePath} not a directory`);
     }
     if (!isFile(external_path_.join(featurePath, 'config.yaml'))) {
-        throw `Feature: ${featurePath}/config.yaml not found or not a file`;
+        throw new Error(`Feature: ${featurePath}/config.yaml not found or not a file`);
     }
 }
 function __validateFeatureConfig(featurePath) {
@@ -165687,10 +164748,16 @@ function __validateFeatureConfig(featurePath) {
         return configData;
     }
     catch (error) {
-        throw `Feature: loading config.yaml: ${error}`;
+        throw new Error(`Feature: loading config.yaml: ${error}`);
     }
 }
 function __validateFeatureConfigData(configData) {
+    // Detect old provider-keyed claimPatches shape for migration hint.
+    if (configData.claimPatches &&
+        !Array.isArray(configData.claimPatches) &&
+        typeof configData.claimPatches === 'object') {
+        throw new Error(`Feature: config.yaml invalid claimPatches: expected flat array of claimPatches (claim-relative pointers like /annotations/backstage.io~1techdocs-ref), but got provider-keyed object ${JSON.stringify(Object.keys(configData.claimPatches))}. Migrate: claimPatches: { catalog: [...] } → claimPatches: [{ op, path: /annotations/backstage.io~1techdocs-ref, value }]. $ref paths also migrate: [spec, org] → [providers, github, org], [metadata, annotations, firestartr.dev/external-name] → [providers, github, name]`);
+    }
     const ajv = new (ajv_default())({
         allowUnionTypes: true,
     });
@@ -165701,7 +164768,7 @@ function __validateFeatureConfigData(configData) {
     const validate = ajv.compile(activeSchema);
     const valid = validate(configData);
     if (!valid) {
-        throw `Feature: config.yaml invalid ${JSON.stringify(validate.errors)}`;
+        throw new Error(`Feature: config.yaml invalid ${JSON.stringify(validate.errors)}`);
     }
 }
 function stripAnchoringConstraints(schemaDef) {
@@ -165712,12 +164779,26 @@ function stripAnchoringConstraints(schemaDef) {
     return clone;
 }
 function __validateJsonPatches(configData) {
-    const keys = Object.keys(configData.patches);
-    for (const key of keys) {
-        if (configData.patches[key]) {
-            if (fast_json_patch_default().validate(configData.patches[key])) {
-                const errors = JSON.stringify(fast_json_patch_default().validate(configData.patches[key]).message);
-                throw `Feature: config.yaml -> patches: invalid patches ${errors}`;
+    const patches = configData.claimPatches;
+    if (!Array.isArray(patches))
+        return;
+    const err = fast_json_patch_default().validate(patches);
+    if (err) {
+        throw new Error(`Feature: config.yaml -> claimPatches: invalid claimPatches ${JSON.stringify(err.message ?? err)}`);
+    }
+    // Legacy provider-keyed `patches` field is accepted for backward
+    // compatibility. Its values are per-provider arrays of the same Patch
+    // shape, so validate each of them too.
+    const legacyPatches = configData.patches;
+    if (legacyPatches && typeof legacyPatches === 'object') {
+        for (const key of Object.keys(legacyPatches)) {
+            const arr = legacyPatches[key];
+            if (!Array.isArray(arr)) {
+                throw new Error(`Feature: config.yaml -> patches.${key}: expected an array of patches, got ${typeof arr}`);
+            }
+            const legacyErr = fast_json_patch_default().validate(arr);
+            if (legacyErr) {
+                throw new Error(`Feature: config.yaml -> patches.${key}: invalid patch ${JSON.stringify(legacyErr.message ?? legacyErr)}`);
             }
         }
     }
@@ -166564,10 +165645,12 @@ const renderTestsSchema = {
             items: {
                 type: 'object',
                 additionalProperties: false,
-                required: ['name', 'cr'],
+                required: ['name'],
+                anyOf: [{ required: ['cr'] }, { required: ['claim'] }],
                 properties: {
                     name: { type: 'string', minLength: 1 },
                     cr: { type: 'string', minLength: 1 },
+                    claim: { type: 'string', minLength: 1 },
                     args: { type: 'object' },
                 },
             },
@@ -166622,6 +165705,9 @@ function resolveCrPath(featurePath, crRelPath) {
     }
     return resolved;
 }
+function resolveClaimPath(featurePath, claimRelPath) {
+    return resolveCrPath(featurePath, claimRelPath);
+}
 function listYamlFiles(dir) {
     if (!fs.existsSync(dir))
         return [];
@@ -166685,7 +165771,7 @@ function buildExpectedOutput(config, renderDir) {
     }));
     return {
         files,
-        patches: config.patches || [],
+        claimPatches: config.claimPatches || [],
         traceability: {},
     };
 }
@@ -166740,6 +165826,7 @@ async function createRenderContext(prefix = 'feature-render-') {
     buildExpectedOutput,
     loadAndValidateRenderTests,
     resolveCrPath,
+    resolveClaimPath,
 });
 
 ;// CONCATENATED MODULE: ../features_renderer/src/featureArgsValidation.ts
@@ -166832,7 +165919,7 @@ function render(featurePath, featureRenderPath, entity, firestartrConfig = {}, f
             resolveInside(featureRenderPath, dest, 'file dest', 'render target directory');
         }
     }
-    const output = { files: [] };
+    const output = { files: [], claimPatches: [] };
     context.config.files.forEach((file) => {
         const { src, dest } = file;
         // For now let's keep upgradable flag for backward compatibility
@@ -166853,30 +165940,125 @@ function render(featurePath, featureRenderPath, entity, firestartrConfig = {}, f
             userManaged: userManaged,
             targetBranch,
         });
-        output.patches = context.config.patches;
-        // Not used anymore
-        // output.unpatches = context.config.unpatches
     });
+    // claimPatches are applied to the claim during claim stitching. Present in
+    // the output even when empty or when the feature renders no files. The
+    // legacy `patches` field is deliberately not copied: it is accepted in
+    // config.yaml for backward compatibility but ignored for claim-level
+    // behaviour.
+    output.claimPatches = context.config.claimPatches || [];
     output.traceability = context.traceability;
+    external_fs_default().mkdirSync(featureRenderPath, { recursive: true });
     external_fs_default().writeFileSync(external_path_default().join(featureRenderPath, 'config.json'), JSON.stringify(context.config));
     // write the output file
     const configFile = external_path_default().join(featureRenderPath, 'output.json');
     external_fs_default().writeFileSync(configFile, JSON.stringify(output));
     return output;
 }
-function buildContext(entity, args, firestartrConfig, featureArgs) {
+function getClaimPatches(featurePath, entity, firestartrConfig = {}, featureArgs = {}) {
+    const configData = validate(featurePath);
+    validateFeatureArgs(featurePath, featureArgs);
+    const context = buildContext(entity, configData.args, firestartrConfig, featureArgs);
+    const rendered = JSON.parse(renderContent(JSON.stringify(configData), context));
+    return rendered.claimPatches ?? [];
+}
+function buildContext(stitchedClaim, args, firestartrConfig, featureArgs) {
     const context = {};
+    const resolveRef = (doc, ref) => {
+        const v = lodash_default().get(doc, ref);
+        if (v !== undefined)
+            return v;
+        // Fallback for transition: try CR-shaped alternatives when stitchedClaim is CR-shaped
+        // and vice versa. Covers the ADR 0006 table plus legacy feature_a provisioner paths.
+        const altTable = {
+            'providers,github,org': [
+                ['spec', 'org'],
+                ['spec', 'provisioner', 'org'],
+            ],
+            'providers,github,branchStrategy,defaultBranch': [
+                ['spec', 'repo', 'defaultBranch'],
+                ['spec', 'provisioner', 'repo', 'defaultBranch'],
+            ],
+            'providers,github,name': [
+                ['metadata', 'annotations', 'firestartr.dev/external-name'],
+                ['metadata', 'name'],
+            ],
+            'providers,github,technology,stack': [
+                ['spec', 'firestartr', 'technology', 'stack'],
+                ['spec', 'provisioner', 'technology', 'stack'],
+            ],
+            name: [['metadata', 'name']],
+            'annotations,firestartr.dev/dest-annotation': [
+                ['metadata', 'annotations', 'firestartr.dev/dest-annotation'],
+            ],
+        };
+        const key = ref.join(',');
+        const alts = altTable[key];
+        if (alts) {
+            for (const alt of alts) {
+                const av = lodash_default().get(doc, alt);
+                if (av !== undefined)
+                    return av;
+            }
+        }
+        // Reverse fallback: if ref is CR-shaped, try claim-shaped
+        const reverseTable = {
+            'spec,org': ['providers', 'github', 'org'],
+            'spec,provisioner,technology,stack': [
+                'providers',
+                'github',
+                'technology',
+                'stack',
+            ],
+            'spec,firestartr,technology,stack': [
+                'providers',
+                'github',
+                'technology',
+                'stack',
+            ],
+            'metadata,name': ['name'],
+            'metadata,annotations,firestartr.dev/dest-annotation': [
+                'annotations',
+                'firestartr.dev/dest-annotation',
+            ],
+            'spec,provisioner,org': ['providers', 'github', 'org'],
+            'spec,provisioner,repo,defaultBranch': [
+                'providers',
+                'github',
+                'branchStrategy',
+                'defaultBranch',
+            ],
+            'spec,repo,defaultBranch': [
+                'providers',
+                'github',
+                'branchStrategy',
+                'defaultBranch',
+            ],
+            'metadata,annotations,firestartr.dev/external-name': [
+                'providers',
+                'github',
+                'name',
+            ],
+        };
+        const rev = reverseTable[ref.join(',')];
+        if (rev) {
+            const rv = lodash_default().get(doc, rev);
+            if (rv !== undefined)
+                return rv;
+        }
+        return v;
+    };
     Object.entries(args).forEach(([key, arg]) => {
         if ('$default' in arg) {
             if (Array.isArray(arg['$default'])) {
-                context[key] = lodash_default().get(entity, arg['$default']);
+                context[key] = resolveRef(stitchedClaim, arg['$default']);
             }
             else {
                 context[key] = arg['$default'];
             }
         }
         if ('$ref' in arg) {
-            const refValue = lodash_default().get(entity, arg['$ref']);
+            const refValue = resolveRef(stitchedClaim, arg['$ref']);
             context[key] = refValue;
         }
         else if ('$lit' in arg) {
@@ -167006,6 +166188,7 @@ function updateFileContent(featureRenderPath, filePath, content) {
 
 
 
+
 /* harmony default export */ const features_renderer = ({
     validate: validate,
     render: render,
@@ -167015,6 +166198,7 @@ function updateFileContent(featureRenderPath, filePath, content) {
     renderContent: renderContent,
     expandFiles: expandFiles,
     validateFeatureArgs: validateFeatureArgs,
+    getClaimPatches: getClaimPatches,
 });
 
 ;// CONCATENATED MODULE: ../features_preparer/src/logger.ts
@@ -167039,6 +166223,13 @@ function renderFeature(featureName, version, owner, repo, featureOwner, renderPa
 function renderFeatureFromPath(extractPath, renderedPath, featureOwner, featureArgs = {}) {
     return features_renderer.render(extractPath, renderedPath, featureOwner, {}, featureArgs);
 }
+function getFeatureClaimPatches(featureName, version, owner, repo, featureOwner, featureArgs = {}) {
+    const extractPath = external_path_default().join(catalog_common/* default.features.tarballs.getFeaturesExtractPath */.Z.features.tarballs.getFeaturesExtractPath(featureName, version, owner, repo), 'packages', featureName);
+    return getClaimPatches(extractPath, featureOwner, {}, featureArgs);
+}
+function getFeatureClaimPatchesFromPath(extractPath, featureOwner, featureArgs = {}) {
+    return getClaimPatches(extractPath, featureOwner, {}, featureArgs);
+}
 
 // EXTERNAL MODULE: ../../node_modules/adm-zip/adm-zip.js
 var adm_zip = __nccwpck_require__(7993);
@@ -167089,6 +166280,7 @@ featureArgs = {}, repo = 'features', owner = 'prefapp') {
 async function processFeature(featureName, reference, featureOwner, // -> cr
 featureArgs = {}, repo = 'features', owner = 'prefapp') {
     await downloadFeatureZip(repo, featureName, reference, owner);
+    featureArgs = { ...(featureArgs ?? {}) };
     const commitInfo = await resolveFeatureCommit(owner, repo, reference);
     featureArgs['traceability'] = {
         version: reference,
@@ -167102,6 +166294,27 @@ featureArgs = {}, repo = 'features', owner = 'prefapp') {
     };
     return renderFeature(featureName, reference, owner, repo, featureOwner, '/tmp', featureArgs);
 }
+async function installer_getFeatureClaimPatches(featureName, version, featureOwner, featureArgs = {}, repo = 'features', owner = 'prefapp') {
+    const reference = `${featureName}-v${version}`;
+    return processFeatureClaimPatches(featureName, reference, featureOwner, featureArgs, repo, owner);
+}
+async function getFeatureClaimPatchesFromRef(featureName, featureRef, featureOwner, featureArgs = {}, repo = 'features', owner = 'prefapp') {
+    const reference = `${featureRef}`;
+    return processFeatureClaimPatches(featureName, reference, featureOwner, featureArgs, repo, owner);
+}
+async function processFeatureClaimPatches(featureName, reference, featureOwner, featureArgs = {}, repo = 'features', owner = 'prefapp') {
+    await downloadFeatureZip(repo, featureName, reference, owner);
+    featureArgs = { ...(featureArgs ?? {}) };
+    featureArgs['traceability'] = {
+        version: reference,
+        owner,
+        repo,
+        name: featureName,
+        ref: reference,
+        url: `https://github.com/${owner}/${repo}/tree/${reference}/packages/${featureName}`,
+    };
+    return getFeatureClaimPatches(featureName, reference, owner, repo, featureOwner, featureArgs);
+}
 async function resolveFeatureCommit(owner, repo, reference) {
     try {
         const octokit = await github["default"].getOctokitForOrg(owner, true);
@@ -167189,6 +166402,9 @@ async function downloadFeatureZip(repo, featureName, reference, owner = 'prefapp
 /* harmony default export */ const src = ({
     renderFeature: renderFeature,
     renderFeatureFromPath: renderFeatureFromPath,
+    getFeatureClaimPatches: installer_getFeatureClaimPatches,
+    getFeatureClaimPatchesFromRef: getFeatureClaimPatchesFromRef,
+    getFeatureClaimPatchesFromPath: getFeatureClaimPatchesFromPath,
     getFeatureConfigFromRef: getFeatureConfigFromRef,
     getFeatureConfig: getFeatureConfig,
     prepareFeature: prepareFeature,
@@ -167203,8 +166419,1266 @@ async function downloadFeatureZip(repo, featureName, reference, owner = 'prefapp
     renderFeatureFromPath: src.renderFeatureFromPath,
     getFeatureConfig: src.getFeatureConfig,
     getFeatureConfigFromRef: src.getFeatureConfigFromRef,
+    getFeatureClaimPatches: src.getFeatureClaimPatches,
+    getFeatureClaimPatchesFromRef: src.getFeatureClaimPatchesFromRef,
+    getFeatureClaimPatchesFromPath: src.getFeatureClaimPatchesFromPath,
 });
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/stitching/protectedPaths.ts
+// Platform-curated protected claim paths — features may not write to these.
+// Stored as JSON Pointers (RFC 6901). Supports wildcard `*` for a single segment.
+// Example: /providers/STAR/org matches /providers/github/org where STAR is *.
+const PROTECTED_CLAIM_PATHS = [
+    '/kind',
+    '/name',
+    '/providers/*/org',
+    '/providers/github/org',
+    '/providers/github/name',
+    '/providers/*/features',
+    '/metadata/name',
+    '/metadata/namespace',
+];
+function isProtectedPath(patchPath) {
+    const normalizedPatch = normalizePointer(patchPath);
+    for (const protectedPath of PROTECTED_CLAIM_PATHS) {
+        if (matchesProtected(protectedPath, normalizedPatch)) {
+            return true;
+        }
+    }
+    return false;
+}
+function normalizePointer(pointer) {
+    // '' is RFC 6901's whole-document (root) pointer. Replacing the root touches
+    // every protected field, so it must keep its identity for classification
+    // instead of being rewritten to '/' (the "" empty-string member).
+    if (pointer === '')
+        return pointer;
+    if (!pointer.startsWith('/')) {
+        return '/' + pointer;
+    }
+    return pointer;
+}
+function matchesProtected(protectedPointer, patchPointer) {
+    const protectedSegments = protectedPointer
+        .split('/')
+        .slice(1)
+        .map(unescapePointer);
+    const patchSegments = patchPointer.split('/').slice(1).map(unescapePointer);
+    // Treat ancestor/descendant as protected: a patch to a parent (e.g. /metadata)
+    // would replace the protected child (/metadata/name), and a patch to a child
+    // (e.g. /metadata/name/extra) is also under the protected tree. Match when
+    // the shorter prefix equals the longer prefix (with wildcard support).
+    const minLen = Math.min(protectedSegments.length, patchSegments.length);
+    for (let i = 0; i < minLen; i++) {
+        if (protectedSegments[i] === '*')
+            continue;
+        if (protectedSegments[i] !== patchSegments[i])
+            return false;
+    }
+    return true;
+}
+function unescapePointer(segment) {
+    return segment.replace(/~1/g, '/').replace(/~0/g, '~');
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/stitching/errors.ts
+class StitchingError extends Error {
+    constructor(violations) {
+        const lines = violations.map((v) => `  - ${v.message}`).join('\n');
+        super(`Claim stitching failed with ${violations.length} violation(s):\n${lines}`);
+        this.name = 'StitchingError';
+        this.violations = violations;
+    }
+}
+function formatStitchingError(error) {
+    return error.message;
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/stitching/validateFeatureDescriptors.ts
+
+
+let validateFeatureDescriptors_validate;
+let validateFeatureDescriptors_ajv;
+function getValidate() {
+    if (!validateFeatureDescriptors_validate) {
+        validateFeatureDescriptors_ajv = new (_2020_default())();
+        validateFeatureDescriptors_ajv.addSchema(feature_schema.definitions.GithubComponentFeatureClaim);
+        validateFeatureDescriptors_validate = validateFeatureDescriptors_ajv.compile({
+            type: 'array',
+            items: { $ref: 'firestartr.dev://github/GithubComponentFeatureClaim' },
+        });
+    }
+    return validateFeatureDescriptors_validate;
+}
+// Validates the `providers.github.features` descriptor array against the same
+// GithubComponentFeatureClaim schema used by claim-kind AJV validation. This
+// runs BEFORE any feature preparer (auth/network) is invoked, so malformed or
+// unauthorized `repo`/`ref`/`version` values are rejected without triggering
+// GitHub downloads. Full AJV validation of the stitched claim is still applied
+// after stitching.
+function validateFeatureDescriptors(claim) {
+    const typedClaim = claim;
+    const features = typedClaim.providers?.github?.features;
+    if (!Array.isArray(features))
+        return;
+    const v = getValidate();
+    if (v(features))
+        return;
+    const details = (v.errors ?? [])
+        .map((e) => {
+        const formatted = `${e.instancePath || '/'} ${e.message}`;
+        return `  - ${formatted}`;
+    })
+        .join('\n');
+    throw new Error(`Invalid feature descriptor(s):\n${details}\nFix the claim before stitching or rendering.`);
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/stitching/stitching.ts
+
+
+
+
+
+let MOCK_FEATURES_FN;
+function MOCK_STITCHING_FEATURES(mock) {
+    MOCK_FEATURES_FN = mock;
+}
+// Non-enumerable stamp marking a claim as already stitched. Lets stitching be
+// once-only at each entry point (e.g. renderFromImports) without re-running
+// feature downloads or re-applying gates on the same claim object.
+const STITCHED_CLAIM = Symbol('firestartr.stitchedClaim');
+function stitching_unescapePointer(segment) {
+    return segment.replace(/~1/g, '/').replace(/~0/g, '~');
+}
+function pointerExists(doc, pointer) {
+    const segments = pointer.split('/').slice(1).map(stitching_unescapePointer);
+    let cur = doc;
+    for (const seg of segments) {
+        if (cur === null || cur === undefined || typeof cur !== 'object')
+            return false;
+        if (!Object.prototype.hasOwnProperty.call(cur, seg))
+            return false;
+        cur = cur[seg];
+    }
+    return true;
+}
+function isAppendPointer(pointer) {
+    return pointer.endsWith('/-');
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+// Deduplication identity for a feature patch (Phase 1 silent dedup). Two
+// patches are only considered identical intent when the operation, the
+// normalized pointer, and — for array appends (`add ... /-`) — the appended
+// element's `name` all match, e.g. two features adding the same label. The
+// operation is part of the identity so an `add` and a `replace` on the same
+// pointer are never deduplicated against each other.
+function dedupIdentity(patch) {
+    const path = normalizePointer(patch.path);
+    if (patch.op === 'add' &&
+        isAppendPointer(path) &&
+        isRecord(patch.value) &&
+        typeof patch.value.name === 'string') {
+        return `${patch.op} ${path}#${patch.value.name}`;
+    }
+    return `${patch.op} ${path}`;
+}
+// Write region for a feature patch — the claim locations the patch occupies.
+// For a regular op it is the unescaped pointer segments; for an array append
+// (`add ... /-`) carrying a `name` it is the array parent plus the element
+// `name`, so two appends of distinct names stay sibling writes while an append
+// and a whole-array write overlap.
+function writeRegion(patch) {
+    const path = normalizePointer(patch.path);
+    const segments = path.split('/').slice(1).map(stitching_unescapePointer);
+    if (patch.op === 'add' &&
+        isAppendPointer(path) &&
+        isRecord(patch.value) &&
+        typeof patch.value.name === 'string') {
+        return [...segments.slice(0, -1), patch.value.name];
+    }
+    return segments;
+}
+// Ancestor/descendant (or identical) regions conflict: under JSON Patch
+// semantics a parent write replaces its whole subtree, so the composed result
+// would depend on feature order. Distinct-name appends yield sibling regions
+// and stay composable.
+function regionsOverlap(a, b) {
+    const minLen = Math.min(a.length, b.length);
+    for (let i = 0; i < minLen; i++) {
+        if (a[i] !== b[i])
+            return false;
+    }
+    return true;
+}
+function isStitchedClaim(claim) {
+    return (isRecord(claim) &&
+        claim[STITCHED_CLAIM] === true);
+}
+function markStitched(claim) {
+    if (isRecord(claim)) {
+        Object.defineProperty(claim, STITCHED_CLAIM, {
+            value: true,
+            enumerable: false,
+            writable: false,
+            configurable: true,
+        });
+    }
+    return claim;
+}
+// Check whether an array at `appendPath`'s parent already contains an element
+// whose `name` matches `value.name`.  Used for the "claim wins" gate: when a
+// feature tries to append an array element that already exists in the claim,
+// the patch is silently dropped.
+function arrayElementExists(doc, appendPath, value) {
+    if (!isRecord(value) || typeof value.name !== 'string')
+        return false;
+    const parentPath = appendPath.slice(0, -2); // strip trailing /-
+    const segments = parentPath.split('/').slice(1).map(stitching_unescapePointer);
+    let cur = doc;
+    for (const seg of segments) {
+        if (cur === null || cur === undefined || typeof cur !== 'object')
+            return false;
+        if (!Object.prototype.hasOwnProperty.call(cur, seg))
+            return false;
+        cur = cur[seg];
+    }
+    if (!Array.isArray(cur))
+        return false;
+    return cur.some((el) => isRecord(el) && el.name === value.name);
+}
+// fast-json-patch does not create intermediate containers for `add`, and
+// appending to an array requires the array to already exist. Ensure every
+// ancestor segment exists before applying an `add`: missing containers are
+// created as objects, except the immediate parent of a `/-` append, which is
+// created as an array. Existing (user/default-declared) values are never
+// overwritten.
+function ensureAddParents(doc, patch) {
+    const segments = patch.path.split('/').slice(1);
+    let prefix = '';
+    for (let i = 0; i < segments.length - 1; i++) {
+        prefix += '/' + segments[i];
+        if (pointerExists(doc, prefix))
+            continue;
+        const isArrayParent = isAppendPointer(patch.path) && i === segments.length - 2;
+        const value = isArrayParent ? [] : {};
+        try {
+            doc = fast_json_patch.applyPatch(doc, [{ op: 'add', path: prefix, value }], false, false).newDocument;
+        }
+        catch {
+            // Concurrent structural conflict — let the actual patch surface the error.
+        }
+    }
+    return doc;
+}
+async function stitchClaim(claimAfterDefaults, preCollectedEnvelopes, originalClaim) {
+    if (isStitchedClaim(claimAfterDefaults)) {
+        return claimAfterDefaults;
+    }
+    const envelopes = preCollectedEnvelopes ?? (await collectFeaturePatches(claimAfterDefaults));
+    if (envelopes.length === 0) {
+        return markStitched(claimAfterDefaults);
+    }
+    // Normalize all patches once so every gate and the apply phase use the same pointers.
+    const normalizedEnvelopes = envelopes.map((env) => ({
+        feature: env.feature,
+        patches: env.patches.map((p) => ({
+            ...p,
+            path: normalizePointer(p.path),
+            _raw: p.path,
+        })),
+    }));
+    // ── Phase 1: silently drop patches that should not be applied ──────────
+    //  • Array append whose element already exists in the claim → claim wins
+    //    (never for protected claim paths, which are rejected in Phase 2)
+    //  • Duplicate identity with identical value across features → silent dedup
+    //    (a feature's own ordered patches are always retained verbatim)
+    const dropped = new Set(); // "envelopeIdx:patchIdx"
+    const seenIdentities = new Map();
+    for (let ei = 0; ei < normalizedEnvelopes.length; ei++) {
+        const envelope = normalizedEnvelopes[ei];
+        for (let pi = 0; pi < envelope.patches.length; pi++) {
+            const patch = envelope.patches[pi];
+            const key = `${ei}:${pi}`;
+            // Array claim-wins: element already in claim → drop (protected paths
+            // are exempt so every attempt on them is rejected in Phase 2)
+            if (patch.op === 'add' &&
+                isAppendPointer(patch.path) &&
+                !isProtectedPath(patch.path)) {
+                if (arrayElementExists(claimAfterDefaults, patch.path, patch.value)) {
+                    dropped.add(key);
+                    continue;
+                }
+            }
+            // Silent dedup across features only: same op + destination + value from
+            // a DIFFERENT feature → drop. A feature's own ordered patches (e.g. a
+            // repeated append, or a scalar written twice) are always retained.
+            const identity = dedupIdentity(patch);
+            const existing = seenIdentities.get(identity);
+            if (existing && existing.feature !== envelope.feature) {
+                if (JSON.stringify(existing.value) === JSON.stringify(patch.value)) {
+                    dropped.add(key);
+                    continue;
+                }
+                // Different value — kept here, caught as a violation in Phase 2.
+            }
+            // Refresh the recorded writer/value so later features compare against
+            // the latest write by this feature.
+            seenIdentities.set(identity, {
+                feature: envelope.feature,
+                value: patch.value,
+            });
+        }
+    }
+    // ── Phase 2: collect violations on non-dropped patches ─────────────────
+    const violations = [];
+    // Writers observed so far (write region + feature). Gate 2 compares every new
+    // patch's region against prior writers from OTHER features, covering both
+    // identical destinations and ancestor/descendant destinations.
+    const priorWrites = [];
+    for (let ei = 0; ei < normalizedEnvelopes.length; ei++) {
+        const envelope = normalizedEnvelopes[ei];
+        // Per-feature shadow document: tracks mutations within this envelope so that
+        // ordered sequences like add → replace within one feature resolve correctly.
+        let shadow = JSON.parse(JSON.stringify(claimAfterDefaults));
+        for (let pi = 0; pi < envelope.patches.length; pi++) {
+            if (dropped.has(`${ei}:${pi}`))
+                continue;
+            const patch = envelope.patches[pi];
+            const path = patch.path;
+            const raw = patch._raw ?? path;
+            // Gate 1: protected path
+            if (isProtectedPath(path)) {
+                violations.push({
+                    feature: envelope.feature,
+                    op: patch.op,
+                    path,
+                    reason: 'protected-path',
+                    message: `Feature '${envelope.feature}' patch ${patch.op} ${raw} (normalized ${path}) targets protected claim path`,
+                });
+            }
+            // Gate 2: conflicting write from a DIFFERENT feature to the same
+            // destination or an ancestor/descendant of it (region-based, op-agnostic
+            // — see writeRegion). A feature's own ordered patches never self-conflict.
+            const region = writeRegion(patch);
+            const overlapping = priorWrites.find((w) => w.feature !== envelope.feature && regionsOverlap(w.region, region));
+            if (overlapping) {
+                violations.push({
+                    feature: envelope.feature,
+                    op: patch.op,
+                    path,
+                    reason: 'duplicate-path',
+                    conflictingFeature: overlapping.feature,
+                    message: `Feature '${envelope.feature}' and '${overlapping.feature}' both write overlapping paths (${raw} overlaps ${overlapping.path}); compose them in one feature instead`,
+                });
+            }
+            priorWrites.push({ region, feature: envelope.feature, path });
+            // Gate 3: replace / remove to a path absent from this feature's mutation
+            //        sequence (tracked via shadow), not the static claimAfterDefaults.
+            if (['replace', 'remove'].includes(patch.op)) {
+                if (!pointerExists(shadow, path)) {
+                    violations.push({
+                        feature: envelope.feature,
+                        op: patch.op,
+                        path,
+                        reason: 'overwrite-protected',
+                        message: `Feature '${envelope.feature}' patch ${patch.op} ${raw} (normalized ${path}) targets absent path (replace/remove requires existing value)`,
+                    });
+                }
+            }
+            // Gate 4: non-append ops must not overwrite a user-declared field
+            // (overwrite protection). The user's own claim wins over any feature.
+            // Only the patch's target field itself is protected: adding a sibling
+            // field under a user-declared parent (e.g. a new field in
+            // /providers/github) is allowed. Array appends (`add ... /-`) are
+            // exempt: the appended element is deduplicated against the claim in
+            // Phase 1, preserving original values, while distinct elements from
+            // multiple features may be added.
+            if (originalClaim && !isAppendPointer(path)) {
+                if (pointerExists(originalClaim, path)) {
+                    violations.push({
+                        feature: envelope.feature,
+                        op: patch.op,
+                        path,
+                        reason: 'user-declared-path',
+                        message: `Feature '${envelope.feature}' patch ${patch.op} ${raw} (normalized ${path}) targets a field declared by the user (overwrite protection)`,
+                    });
+                }
+            }
+            // Update shadow for subsequent patches within this feature
+            try {
+                if (patch.op === 'add')
+                    shadow = ensureAddParents(shadow, patch);
+                shadow = fast_json_patch.applyPatch(shadow, [patch], false, false).newDocument;
+            }
+            catch {
+                /* leave shadow unchanged — Gate 3 stays conservative */
+            }
+        }
+    }
+    if (violations.length > 0) {
+        throw new StitchingError(violations);
+    }
+    // ── Phase 3: apply remaining patches ───────────────────────────────────
+    let stitched = JSON.parse(JSON.stringify(claimAfterDefaults));
+    for (let ei = 0; ei < normalizedEnvelopes.length; ei++) {
+        const envelope = normalizedEnvelopes[ei];
+        const patchesToApply = envelope.patches.filter((_, pi) => !dropped.has(`${ei}:${pi}`));
+        if (patchesToApply.length === 0)
+            continue;
+        // ── Apply each patch in order, creating parents for adds as needed ───
+        for (const patch of patchesToApply) {
+            if (patch.op === 'add') {
+                stitched = ensureAddParents(stitched, patch);
+            }
+            const result = fast_json_patch.applyPatch(stitched, [patch], false, false);
+            stitched = result.newDocument;
+        }
+    }
+    return markStitched(stitched);
+}
+async function collectFeaturePatches(claim) {
+    if (MOCK_FEATURES_FN) {
+        return MOCK_FEATURES_FN(claim);
+    }
+    const typedClaim = claim;
+    const features = typedClaim.providers?.github?.features;
+    if (features === undefined)
+        return [];
+    if (!Array.isArray(features)) {
+        throw new Error('Invalid feature descriptor(s): /providers/github/features must be an array');
+    }
+    if (features.length === 0)
+        return [];
+    // Gate 0: reject malformed feature descriptors (repo/ref/version shape)
+    // BEFORE any preparer call, so no auth/network work is triggered by data
+    // that claim-kind AJV validation would reject.
+    validateFeatureDescriptors(claim);
+    const envelopes = [];
+    for (const feature of features) {
+        const featureName = feature.name;
+        const versionOrRef = feature.ref ?? feature.version ?? '';
+        const repo = feature.repo
+            ? (feature.repo.split('/')[1] ?? 'features')
+            : 'features';
+        const owner = feature.repo
+            ? (feature.repo.split('/')[0] ?? 'prefapp')
+            : 'prefapp';
+        const args = feature.args ?? {};
+        try {
+            let patchesOrRendered;
+            const preparerAny = features_preparer;
+            if (feature.ref) {
+                if (typeof preparerAny.getFeatureClaimPatchesFromRef === 'function') {
+                    patchesOrRendered = await preparerAny.getFeatureClaimPatchesFromRef(featureName, versionOrRef, claim, args, repo, owner);
+                }
+                else {
+                    patchesOrRendered = await preparerAny.getFeatureConfigFromRef(featureName, versionOrRef, claim, args, repo, owner);
+                }
+            }
+            else {
+                if (typeof preparerAny.getFeatureClaimPatches === 'function') {
+                    patchesOrRendered = await preparerAny.getFeatureClaimPatches(featureName, versionOrRef, claim, args, repo, owner);
+                }
+                else {
+                    patchesOrRendered = await preparerAny.getFeatureConfig(featureName, versionOrRef, claim, args, repo, owner);
+                }
+            }
+            const patches = Array.isArray(patchesOrRendered)
+                ? patchesOrRendered
+                : extractClaimPatches(patchesOrRendered);
+            envelopes.push({ feature: featureName, patches });
+        }
+        catch (err) {
+            throw new Error(`Failed to collect claimPatches for feature '${featureName}': ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return envelopes;
+}
+function extractClaimPatches(rendered) {
+    const patches = rendered.claimPatches;
+    if (!patches)
+        return [];
+    if (Array.isArray(patches))
+        return patches;
+    throw new Error(`Feature claimPatches must be a flat array (claim-relative pointers like /annotations/...), got ${typeof patches}: ${JSON.stringify(patches).slice(0, 200)}`);
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/lazy_loader.ts
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+// We need to ensure the grep command is a gnu version
+let IS_GNU_GREP = false;
+let GREP_ON_CHECK = false;
+// this loop is for avoid race conditions
+// once a check is running no more checks
+async function waitForCheck() {
+    const f_wait = () => new Promise((timeOut) => setTimeout(timeOut, 10));
+    do {
+        await f_wait();
+    } while (GREP_ON_CHECK);
+}
+function checkGrep() {
+    return new Promise((ok, ko) => {
+        // idempotency: already checked
+        if (IS_GNU_GREP)
+            return ok();
+        // a check is already running no new checks
+        if (GREP_ON_CHECK)
+            return waitForCheck();
+        logger.info('Checking the grep command');
+        GREP_ON_CHECK = true;
+        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['--version']);
+        handler.on('close', (code) => {
+            GREP_ON_CHECK = false;
+            if (code === 0) {
+                logger.debug('Grep is a gnu grep');
+                IS_GNU_GREP = true;
+                ok();
+            }
+            else {
+                ko('Lazy evaluation needs a gnu-grep command');
+            }
+        });
+    });
+}
+async function loadClaim(claimRef, org, defaults = loadClaimDefaults(), patchClaim = loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, existingRefs = {}, postValidations = new Map()) {
+    await checkGrep();
+    let result = existingRefs;
+    logger.info(`Load reference ${claimRef}`);
+    initVirtualClaims(org);
+    logger.info(`Load reference (parts) ${claimRef.split(/-/)[0]} ${claimRef.replace(/^[^-]+-/, '')}`);
+    // cargas datos con grep
+    try {
+        const claimData = await lazyGetClaim(claimRef.split(/-/)[0], claimRef.replace(/^[^-]+-/, ''), org, cwd);
+        const rawClaim = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(claimData);
+        let claim = patchClaim(rawClaim, defaults);
+        // Claim stitching: feature claim-patches with gates before AJV
+        try {
+            claim = await stitchClaim(claim, undefined, rawClaim);
+        }
+        catch (e) {
+            throw new Error(`Error when stitching claim ${claimRef}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+        let variants = [];
+        if (claim.kind === 'TFWorkspaceClaim' &&
+            claim.providers?.terraform?.variants) {
+            variants = claim.providers.terraform.variants;
+            delete claim.providers.terraform.variants;
+        }
+        logger.silly(`Patched claim is:
+		 ---
+			${catalog_common/* default.io.toYaml */.Z.io.toYaml(claim)}`);
+        try {
+            validateClaim(claim, base[`${claim.kind}Schema`]);
+            await optionalValidation(claim);
+        }
+        catch (error) {
+            let errorMsg = '';
+            if (Array.isArray(error)) {
+                for (const data of error) {
+                    errorMsg = `${errorMsg}
+  - ${data.instancePath}: ${data.message}`;
+                }
+            }
+            else {
+                errorMsg = error instanceof Error ? error.message : String(error);
+            }
+            throw new Error(`Error when validating claim ${claimRef}: ${errorMsg}`);
+        }
+        result[claimRef] = {};
+        result[claimRef]['claim'] = claim;
+        result[claimRef]['claimPath'] = VisitedClaims[claimRef];
+        if (VisitedClaims[claimRef] === 'virtual') {
+            result = await setVirtualClaimAdditionalData(result, claim, claimRef);
+        }
+        else {
+            result = await setNonVirtualClaimAdditionalData(result, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
+        }
+        const claimKind = claim.kind;
+        const references = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(claim));
+        for (const ref of references) {
+            if (!result[ref]) {
+                const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
+                result = lodash_default().merge(result, resolvedReferences);
+            }
+        }
+        if (variants.length > 0) {
+            const parentClaimPath = VisitedClaims[claimRef];
+            for (const variant of variants) {
+                if (!variant.name || !variant.overrides) {
+                    throw new Error(`Variant in claim ${claimRef} is missing required field 'name' or 'overrides'`);
+                }
+                const prohibitedOverrideFields = ['source', 'module', 'name'];
+                for (const field of prohibitedOverrideFields) {
+                    if (field in variant.overrides) {
+                        throw new Error(`Variant '${variant.name}' in claim ${claimRef} cannot override '${field}'`);
+                    }
+                }
+                const composedName = claim.providers.terraform.name + '-' + variant.name;
+                const variantClaim = lodash_default().cloneDeep(claim);
+                variantClaim._parentClaimName = claim.name;
+                variantClaim.name = composedName;
+                variantClaim.providers.terraform = lodash_default().merge({}, claim.providers.terraform, variant.overrides);
+                variantClaim.providers.terraform.name = composedName;
+                if (!variantClaim.annotations) {
+                    variantClaim.annotations = {};
+                }
+                variantClaim.annotations['firestartr.dev/variant-of'] =
+                    claim.providers.terraform.name;
+                const variantRef = `TFWorkspaceClaim-${composedName}`;
+                if (result[variantRef]) {
+                    throw new Error(`Variant name '${variant.name}' (composed: '${composedName}') from claim '${claimRef}' conflicts with existing claim '${variantRef}'`);
+                }
+                logger.info(`Creating synthetic variant claim ${variantRef}`);
+                result[variantRef] = {};
+                result[variantRef]['claim'] = variantClaim;
+                result[variantRef]['claimPath'] = parentClaimPath;
+                result = await setNonVirtualClaimAdditionalData(result, variantClaim, variantRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
+                const variantReferences = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(variantClaim));
+                for (const ref of variantReferences) {
+                    if (!result[ref]) {
+                        const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
+                        result = lodash_default().merge(result, resolvedReferences);
+                    }
+                }
+            }
+        }
+    }
+    catch (err) {
+        throw `Lazy Loading: ${err}`;
+    }
+    return [result, postValidations];
+}
+let LoadedClaims = {};
+let VisitedClaims = {};
+let DuplicatedClaims = {};
+function resetLazyLoader() {
+    LoadedClaims = {};
+    VisitedClaims = {};
+    DuplicatedClaims = {};
+}
+async function lazyGetClaim(kind, name, org, cwd) {
+    const indice = `${kind}-${name}`;
+    logger.info(`Lazy loading ${kind}-${name} with index ${indice}`);
+    if (indice in LoadedClaims)
+        return LoadedClaims[indice];
+    if (isVirtualClaim(kind, name)) {
+        await loadVirtualClaim(kind, name, org);
+    }
+    else {
+        await getClaimsByName(name, cwd);
+    }
+    if (indice in LoadedClaims) {
+        return LoadedClaims[indice];
+    }
+    else {
+        throw new Error(`Error: ${kind}-${name} not found`);
+    }
+}
+async function getClaimsByName(name, cwd = '.') {
+    return new Promise((ok, ko) => {
+        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['-r', '-l', '--include=*', '-E', `name: "?${name}"?`, '.'], {
+            cwd: cwd,
+        });
+        logger.info(`Running ${['grep', '-r', '-l', '--include', '-E', 'name: "' + name + '"?', '.'].join(' ')}`);
+        const entradas = [];
+        const chunks = [];
+        handler.stdout.on('data', (data) => {
+            chunks.push(data.toString('utf-8'));
+        });
+        handler.on('close', () => {
+            const dataFinal = chunks.join('');
+            const fileNameList = dataFinal.split(/\n/).filter((line) => line !== '');
+            for (const fileName of fileNameList) {
+                // only yaml files
+                if (!fileName.match(/\.yml$|\.yaml$/)) {
+                    continue;
+                }
+                // only entries not already visited
+                if (Object.values(VisitedClaims).includes(fileName)) {
+                    continue;
+                }
+                entradas.push(external_path_.join(cwd, fileName));
+            }
+            return Promise.all(entradas.map((entrada) => {
+                return loadRawClaim(entrada);
+            }))
+                .then(() => {
+                ok();
+            })
+                .catch((err) => {
+                ko(err);
+            });
+        });
+    });
+}
+async function loadRawClaim(entry) {
+    return new Promise((ok, ko) => {
+        external_fs_.readFile(entry, 'utf-8', (error, data) => {
+            if (error)
+                return ko(`Reading ${entry}: ${error}`);
+            const claim = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
+            if (!('kind' in claim && 'name' in claim)) {
+                logger.warn(`Invalid claim file ${entry}`);
+            }
+            else {
+                const claimKey = `${claim.kind}-${claim.name}`;
+                if (Object.keys(DuplicatedClaims).includes(claimKey) &&
+                    DuplicatedClaims[claimKey] !== entry) {
+                    return ko(`Duplicated claim ${claimKey} found files: ${DuplicatedClaims[claimKey]} and ${entry}`);
+                }
+                LoadedClaims[claimKey] = data;
+                VisitedClaims[claimKey] = entry;
+                DuplicatedClaims[claimKey] = entry;
+                ok();
+            }
+        });
+    });
+}
+async function setVirtualClaimAdditionalData(renderedData, claim, claimRef) {
+    const virtualClaim = getVirtualClaim(claim.kind, claim.name);
+    renderedData[claimRef]['initializers'] = [
+        new UUIDInitializer(claim),
+        new InitializerClaimRef(),
+        new InitializerDefault(virtualClaim.getDefaultConfig()),
+    ];
+    renderedData[claimRef]['globals'] = [];
+    renderedData[claimRef]['overrides'] = [];
+    renderedData[claimRef]['normalizers'] = [new NameNormalizer()];
+    return renderedData;
+}
+async function setNonVirtualClaimAdditionalData(renderedData, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers) {
+    renderedData[claimRef]['initializers'] = await loadInitializers(claim, renderedData[claimRef]['claimPath']);
+    renderedData[claimRef]['globals'] = await loadGlobals(claim);
+    renderedData[claimRef]['overrides'] = loadOverrides(claim);
+    renderedData[claimRef]['normalizers'] = await loadNormalizers(claim, renderedData[claimRef]['claimPath']);
+    return renderedData;
+}
+async function loadVirtualClaim(kind, name, org) {
+    const virtualClaim = getVirtualClaim(kind, name);
+    const expandedClaim = await virtualClaim.expand({ org });
+    logger.info(`Loading virtual claim ${kind} ${name} ${org}`);
+    LoadedClaims[`${kind}-${name}`] = catalog_common/* default.io.toYaml */.Z.io.toYaml(expandedClaim);
+    VisitedClaims[`${kind}-${name}`] = 'virtual';
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/claimsDefaulter.ts
+
+
+
+/*
+ * Default blocks are objects that cannot be merged but applied as a whole. Meaning:
+ * - If the object is defined at the claim-level it is maintained *AS IT IS* (no merge)
+ * - If the block is missing at the claim-level, the default block is applied
+ */
+const defaultBlocksPaths = ['/providers/terraform/sync'];
+function applyBlockAwareDefaults(claim, defaultClaim) {
+    // we always work with a clone of the original
+    const claimClone = JSON.parse(JSON.stringify(claim));
+    // if the block is claim-level defined we store it here
+    const defaultBlocks = new Map();
+    // we remove the blocks entirely of the claim
+    // to achieve an add copy
+    for (const defaultBlockPath of defaultBlocksPaths) {
+        if (claimsDefaulter_hasDeepPath(claimClone, defaultBlockPath) !== true)
+            continue;
+        const originalValue = fast_json_patch_default().getValueByPointer(claimClone, defaultBlockPath);
+        if (originalValue) {
+            logger.silly(`${claim.kind}/${claim.name}: has an original ${defaultBlockPath}: preserving`);
+            defaultBlocks.set(defaultBlockPath, originalValue);
+            fast_json_patch_default().applyPatch(claimClone, [{ op: 'remove', path: defaultBlockPath }]);
+        }
+    }
+    // if the patch has the same path of a block
+    // and the block was defined at claim-level
+    // we interchange the value with the original value
+    // otherwise we use the default
+    const jsonPatchOps = fast_json_patch_default().compare(claimClone, defaultClaim)
+        .filter((jp) => jp.op === 'add')
+        .map((jp) => {
+        if (defaultBlocks.has(jp.path)) {
+            return {
+                ...jp,
+                value: defaultBlocks.get(jp.path),
+            };
+        }
+        else {
+            return jp;
+        }
+    });
+    return fast_json_patch_default().applyPatch(claimClone, jsonPatchOps).newDocument;
+}
+function claimsDefaulter_hasDeepPath(data, deepPath) {
+    return lodash_default().has(data, deepPath.replace(/\//g, '.').replace(/^\./, ''));
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/loader.ts
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+const isYamlFile = new RegExp(/\.(yaml|yml)$/);
+/**
+ *
+ * @returns Virtual Claims
+ */
+const virtualClaims = [new FirestartrAllClaim()];
+/*
+ * Loads all applicable globals for a given claim and stores them into a list.
+ *
+ * Input:
+ * - claim: our custom claim object, with which we check if the global is applicable
+ *
+ * Returns:
+ * - A GlobalSection array promise, containing all the globals loaded for this claim
+ *
+ */
+async function loadGlobals(claim) {
+    const result = [];
+    await crawl(getPath('globals'), (entry) => {
+        return isYamlFile.test(entry);
+    }, async (entry, data) => {
+        const globalData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
+        const ext = external_path_.extname(entry);
+        const name = external_path_.basename(entry, ext);
+        if (name in SECTIONS_BY_FILE_NAME) {
+            const section = new SECTIONS_BY_FILE_NAME[name](globalData);
+            if (!(await section.validate(SCHEMAS_BY_SECTION_NAME[name] || {}))) {
+                throw new Error(`Invalid ${name} global file`);
+            }
+            if (globalData.kind === claim.kind) {
+                result.push(section);
+            }
+            else {
+                logger.debug(`Skipping global ${name} because it is not applicable to ${claim.kind}`);
+            }
+        }
+    });
+    logger.info(`Loaded globals ${result}`);
+    return result;
+}
+/*
+ * If the input claim is a GithubRepositoryClaim, it loads all it's applicable
+ * overrides and stores them into a list. Otherwise, it returns an empty list.
+ *
+ * Input:
+ * - claim: our custom claim object, which should be a GithubRepositoryClaim
+ *
+ * Returns:
+ * - An Overrider array, with a GithubRepositoryOverrider if the claim
+ *   was a GithubRepositoryClaim, or empty if it was not.
+ *
+ */
+function loadOverrides(claim) {
+    const overrides = [];
+    if (claim.kind === 'ComponentClaim' && claim.providers.github.overrides) {
+        overrides.push(new GithubRepositoryOverrider());
+    }
+    return overrides;
+}
+/**
+ * Load all normalizers and stores them into a list.
+ * @param claim
+ * @returns
+ */
+async function loadNormalizers(_claim, path) {
+    const result = [];
+    for (const normalizer of NORMALIZERS) {
+        result.push(new normalizer({ path: path }));
+    }
+    return result;
+}
+/*
+ * Loads all applicable initializers for a given claim and stores them into a list.
+ *
+ * Input:
+ * - claim: our custom claim object, with which we check if the initializer is applicable
+ *
+ * Returns:
+ * - An Initializer array promise, containing all the initializers loaded for this claim
+ *
+ */
+let loadedInitializers = false;
+async function loadInitializers(claim, claimPath, initializersPath = getPath('initializers')) {
+    const result = [];
+    await crawl(initializersPath, (entry) => {
+        return isYamlFile.test(entry);
+    }, async (entry, data) => {
+        const initializerData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
+        const ext = external_path_.extname(entry);
+        const name = external_path_.basename(entry, ext);
+        if (name in INITIALIZERS_BY_FILE_NAME) {
+            const initializerBfN = new INITIALIZERS_BY_FILE_NAME[name](initializerData);
+            if (!(await initializerBfN.validate(SCHEMAS_BY_INITIALIZER_NAME[name] || {}))) {
+                throw new Error(`Invalid ${name} initializer file`);
+            }
+            if (initializerData.kind === claim.kind) {
+                result.push(initializerBfN);
+            }
+            else {
+                logger.debug(`Skipping initializer ${name} because it is not applicable to ${claim.kind}`);
+            }
+        }
+    });
+    for (const initializer of INITIALIZERS) {
+        if (initializer.applicableKinds.includes(claim.kind)) {
+            result.push(new initializer({ path: claimPath }));
+        }
+    }
+    logger.info(`Loaded initializers ${JSON.stringify(result)}`);
+    loadedInitializers = result;
+    return loadedInitializers;
+}
+function loadClaimDefaults() {
+    try {
+        return catalog_common/* default.io.fromYaml */.Z.io.fromYaml(external_fs_.readFileSync(`${getPath('claimsDefaults')}/claims_defaults.yaml`, 'utf-8'));
+    }
+    catch (error) {
+        const errMsg = `Could not read claims defaults file in path ${getPath('claimsDefaults')}/claims_defaults.yaml: ${error}`;
+        logger.error(errMsg);
+        throw new Error(errMsg);
+    }
+}
+/*
+ * Using fast-json-patch, compares a claim to its kind's defaults, then patches it.
+ *
+ * Input:
+ * - claim: our custom claim object, which we want to patch
+ * - defaultsClaims: an object, containing the defaults for each claim kind,
+ *   with the same structure that we use for the actual claims
+ *
+ * Returns:
+ * - The patched claim
+ *
+ */
+function loader_patchClaim(claim, defaultsClaims) {
+    if (defaultsClaims[claim.kind]) {
+        claim = applyBlockAwareDefaults(claim, defaultsClaims[claim.kind]);
+    }
+    return claim;
+}
+async function loadCRsWithFullSet(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
+    const result = {};
+    const fullResult = {};
+    await crawlWithExclusions(crsPath, (entry) => {
+        return isYamlFile.test(entry);
+    }, async (entry, data) => {
+        const yamlData = stripKnownRelations(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data));
+        const metadata = yamlData?.metadata;
+        if (!(yamlData &&
+            typeof yamlData === 'object' &&
+            'kind' in yamlData &&
+            metadata &&
+            typeof metadata === 'object' &&
+            'name' in metadata)) {
+            logger.warn(`Invalid CR file ${entry}`);
+        }
+        else {
+            const crKey = `${yamlData.kind}-${metadata.name}`;
+            if (fullResult[crKey]) {
+                logger.error(`Duplicate CR ${crKey}`);
+            }
+            // Keep the complete CR set for validations that need repository-wide context.
+            fullResult[crKey] = yamlData;
+            // Keep the filtered CR set for previous-CR lookup during claim rendering.
+            if (allowedClaimReferences.length === 0 ||
+                allowedClaimReferences.includes(yamlData.metadata?.annotations?.[catalog_common/* default.generic.getFirestartrAnnotation */.Z.generic.getFirestartrAnnotation('claim-ref')])) {
+                result[crKey] = yamlData;
+            }
+        }
+    }, excludedPaths.concat(getAdditionalPaths()));
+    return { crs: result, fullCrs: fullResult };
+}
+async function loadCRs(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
+    const { crs } = await loadCRsWithFullSet(crsPath, excludedPaths, allowedClaimReferences);
+    return crs;
+}
+/*
+ * Description: Get the renamed using claimRef annotation
+ * Input: claims: any, crs: any
+ * Output: renames: IRenameResult[]
+ */
+async function loadRenames(claims, crs) {
+    /*
+     * If checkRenames is false, we don't need to check for renames
+     */
+    const renamesEnabled = getRenamesEnabled();
+    if (!renamesEnabled)
+        return [];
+    const result = [];
+    /**
+     * For each CR, look for a claim that does not match the name with CR's firestartr.dev/claim-ref annotation
+     */
+    for (const cr of Object.values(crs)) {
+        const anyCr = cr;
+        if (!anyCr?.metadata?.annotations)
+            continue;
+        // if the annotation is a claimRef
+        const annotationName = common.generic.getFirestartrAnnotation('claim-ref');
+        const annotations = anyCr?.metadata?.annotations || {};
+        if (annotationName in annotations) {
+            const claimRef = anyCr.metadata.annotations[annotationName];
+            // split the annotation into kind and name
+            const [kind, name] = claimRef.split('/');
+            // if the claim exists, check if the name is different for the given provider
+            const referencedClaim = claims[`${kind}-${name}`].claim;
+            const oldName = anyCr.metadata.name;
+            const newName = referencedClaim.providers[getConfiguredProvider()].name;
+            if (oldName !== newName) {
+                result.push({
+                    kind: referencedClaim.kind,
+                    claimPath: claims[`${kind}-${name}`].claimPath,
+                    claimName: referencedClaim.name,
+                    oldName,
+                    newName,
+                });
+            }
+        }
+    }
+    return result;
+}
+async function loadClaimsList(claimRefList, claimsPath = getPath('claims')) {
+    const data = {
+        renderClaims: {},
+        crs: {},
+        fullCrs: {},
+    };
+    const defaults = loadClaimDefaults();
+    for await (const claimRef of claimRefList) {
+        const [renderedClaimData] = await loadClaim(claimRef, getOrg(), defaults, loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, claimsPath);
+        data.renderClaims = lodash_default().merge(data.renderClaims, renderedClaimData);
+    }
+    const crClaimReferences = [];
+    for (const ref of Object.keys(data.renderClaims)) {
+        // Replaces only the first instance of '-'
+        crClaimReferences.push(ref.replace('-', '/'));
+    }
+    const loadedCrs = await loadCRsWithFullSet(getPath('crs'), [getPath('globals'), getPath('initializers')], crClaimReferences);
+    data['crs'] = loadedCrs.crs;
+    data['fullCrs'] = loadedCrs.fullCrs;
+    return data;
+}
+function getOrg() {
+    const groupOrg = catalog_common/* default.environment.getFromEnvironmentWithDefault */.Z.environment.getFromEnvironmentWithDefault(catalog_common/* default.types.envVars.org */.Z.types.envVars.org, '');
+    return groupOrg;
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/references.ts
+function validateTfStateKeyUniqueness(crs) {
+    const tfStateKeys = {};
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (!isTerraformWorkspace(cr))
+            continue;
+        const tfKey = cr.spec.firestartr.tfStateKey;
+        if (tfStateKeys[tfKey]) {
+            throw new Error(`❗❗ ❌ RENDER ERROR ❌ ❗❗
+
+The tfStateKey ${tfKey} is not unique,
+
+It is being used by the following CRs:
+
+- ${tfStateKeys[tfKey].kind} ${tfStateKeys[tfKey].metadata.name}
+
+- ${cr.kind} ${cr.metadata.name}
+
+Check the following Claims to ensure that the tfStateKey is unique:
+
+- ${tfStateKeys[tfKey].metadata.annotations['firestartr.dev/claim-ref']}
+
+- ${cr.metadata.annotations['firestartr.dev/claim-ref']}
+`);
+        }
+        tfStateKeys[cr.spec.firestartr.tfStateKey] = cr;
+    }
+}
+function references_isCatalogEntity(cr) {
+    return [
+        'Component',
+        'Domain',
+        'System',
+        'User',
+        'Group',
+        'Resource',
+    ].includes(cr.kind);
+}
+function isTerraformWorkspace(cr) {
+    return cr.kind === 'FirestartrTerraformWorkspace';
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/crSize.ts
+
+const K8S_OBJECT_SIZE_LIMIT = 1572864; // 1.5 MiB in bytes, etcd recommended limit: https://etcd.io/docs/latest/dev-guide/limit/
+function validateCrSizes(crs) {
+    for (const key of Object.keys(crs)) {
+        const cr = crs[key];
+        const serialized = catalog_common/* default.io.toYaml */.Z.io.toYaml(cr);
+        const size = Buffer.byteLength(serialized, 'utf8');
+        if (size > K8S_OBJECT_SIZE_LIMIT) {
+            throw new Error(`CR "${cr.kind}-${cr.metadata.name}" exceeds the Kubernetes object size limit by ${size - K8S_OBJECT_SIZE_LIMIT} bytes. Maximum allowed is ${K8S_OBJECT_SIZE_LIMIT} bytes (1.5MiB).`);
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/permissions.ts
+
+function validatePermissionsUniqueness(crs) {
+    for (const crkey in crs) {
+        const cr = crs[crkey];
+        if (cr.kind === 'FirestartrGithubRepository') {
+            const permissions = cr.spec.permissions;
+            logger.debug(`Validating Permissions Uniqueness of ${crkey}`);
+            if (permissions) {
+                const rolesByIdentifier = new Map();
+                for (const perm of permissions) {
+                    const identifier = perm.collaborator
+                        ? perm.collaborator
+                        : `ref:${perm.ref.kind}:${perm.ref.name}`;
+                    const role = perm.role;
+                    const prevRole = rolesByIdentifier.get(identifier);
+                    if (prevRole === undefined) {
+                        rolesByIdentifier.set(identifier, role);
+                    }
+                    else if (prevRole !== role) {
+                        throw new Error(`Conflicting permission role in FirestartrGithubRepository ${crkey}: ${identifier} has roles "${prevRole}" and "${role}".\nFull CR: ${JSON.stringify(cr, null, 2)}`);
+                    }
+                }
+            }
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/backstageAnnotations.ts
+const backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX = 'firestartr.backstage.dev/';
+const CATALOG_KINDS = new Set([
+    'User',
+    'Group',
+    'Component',
+    'System',
+    'Domain',
+    'API',
+    'Resource',
+    'CatalogKubernetesResource',
+    'CatalogTerraformWorkspace',
+    'CatalogArgoDeploy',
+    'CatalogOrgWebhook',
+    'CatalogSecrets',
+]);
+function validateNoBackstageAnnotationsInK8sCrs(crs) {
+    for (const crKey in crs) {
+        const cr = crs[crKey];
+        if (CATALOG_KINDS.has(cr.kind))
+            continue;
+        if (cr.metadata?.annotations) {
+            const backstageKeys = Object.keys(cr.metadata.annotations).filter((k) => k.startsWith(backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX));
+            if (backstageKeys.length > 0) {
+                throw new Error(`K8s CR ${crKey} contains Backstage-only annotations (${backstageKeys.join(', ')}). ` +
+                    `Annotations with prefix ${backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX} must only appear on Backstage catalog entities, not on Kubernetes CRs.`);
+            }
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/refsSorter/refsSorter.ts
+
+/**
+ * @param renderClaims renderClaims to sort
+ * @param kinds kinds to get from renderClaims
+ * @returns renderClaims with only the kinds specified
+ */
+function sortRenderClaimsByKind(renderClaims, kinds) {
+    let result = {};
+    for (const kind of kinds) {
+        for (const key in renderClaims) {
+            if (renderClaims[key].claim.kind === kind) {
+                result[key] = renderClaims[key];
+            }
+        }
+        result = sortSelfKindRefs(result, kind);
+    }
+    return result;
+}
+function sortSelfKindRefs(renderClaims, kind) {
+    if (!hasSelfRefs(kind)) {
+        return renderClaims;
+    }
+    const newRenderClaims = {};
+    const data = extractRefs(renderClaims, kind);
+    const ordered = [];
+    const visiting = [];
+    const visited = [];
+    for (const key of Object.keys(data)) {
+        if (!visited.find((obj) => obj.name === key)) {
+            sortRefs(data, data[key], ordered, visiting, visited);
+        }
+    }
+    for (const cr of ordered) {
+        newRenderClaims[cr.name] = renderClaims[cr.name];
+    }
+    return newRenderClaims;
+}
+function sortRefs(data, claim, ordered = [], visiting = [], visited = []) {
+    if (visiting.find((obj) => obj.name === claim.name)) {
+        throw new Error(`Circular dependency detected for '${claim.name}'`);
+    }
+    if (!visited.find((obj) => obj.name === claim.name)) {
+        visiting.push(claim);
+        if (claim.refs) {
+            for (const ref of claim.refs) {
+                const referencedObject = data[ref];
+                if (!referencedObject) {
+                    throw new Error(`Reference '${ref}' does not exist for '${claim.name}'`);
+                }
+                sortRefs(data, referencedObject, ordered, visiting, visited);
+            }
+        }
+        visited.push(visiting.pop());
+        ordered.push(claim);
+    }
+}
+function hasSelfRefs(kind) {
+    return ['TFWorkspaceClaim', 'GroupClaim'].includes(kind);
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-sorter.ts
+
+function sortKinds(orderedKinds, claims) {
+    const result = [];
+    for (const kind of orderedKinds) {
+        const kindRenderClaims = sortRenderClaimsByKind(claims, [kind]);
+        result.push(kindRenderClaims);
+    }
+    return result;
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/overriders/utils.ts
 
 
@@ -167255,14 +167729,12 @@ async function utils_renderFeature(featureName, featureVersion, featureOutputObj
 
 
 
-
-
 // this is the only way currently to make
 // work the system and inject our code
 // without having to download a feature
-let MOCK_FEATURES_FN;
+let featureOverride_MOCK_FEATURES_FN;
 function MOCK_FEATURES(mock) {
-    MOCK_FEATURES_FN = mock;
+    featureOverride_MOCK_FEATURES_FN = mock;
     if (mock) {
         log.warn('⚠️ Warning features system downloader has been mocked, it should only happen in unit testing');
     }
@@ -167293,8 +167765,8 @@ class FeaturesOverrider extends OverriderPatches {
         let owner = 'prefapp';
         let versionOrRef = this.featureVersion;
         let renderer = 'getFeatureConfig';
-        if (MOCK_FEATURES_FN) {
-            return MOCK_FEATURES_FN();
+        if (featureOverride_MOCK_FEATURES_FN) {
+            return featureOverride_MOCK_FEATURES_FN();
         }
         if (this.featureRepo) {
             [owner, repo] = this.featureRepo.split(/\//);
@@ -167312,8 +167784,8 @@ class FeaturesOverrider extends OverriderPatches {
         const featureName = this.featureName;
         const featureVersion = this.featureVersion || this.featureRef;
         const featureArgs = this.featureArgs;
-        const fSetUpAndRunRenderer = function (cr) {
-            return this.setUpAndRunRenderer(cr);
+        const fSetUpAndRunRenderer = function (target) {
+            return this.setUpAndRunRenderer(target);
         }.bind(this);
         let renderedFeatureConfig = null;
         return [
@@ -167322,7 +167794,7 @@ class FeaturesOverrider extends OverriderPatches {
                     return true;
                 },
                 async apply(cr) {
-                    renderedFeatureConfig = await fSetUpAndRunRenderer(cr);
+                    renderedFeatureConfig = await fSetUpAndRunRenderer(claim);
                     return cr;
                 },
                 identify() {
@@ -167335,28 +167807,6 @@ class FeaturesOverrider extends OverriderPatches {
                     return utils_renderFeature(featureName, featureVersion, renderedFeatureConfig, cr, claim.name);
                 },
             },
-            {
-                isPostPatch: true,
-                validate() {
-                    return true;
-                },
-                async apply(cr) {
-                    if (!renderedFeatureConfig) {
-                        logger.warn(`Feature ${featureName}: renderedFeatureConfig is null, skipping post-patch`);
-                        return cr;
-                    }
-                    const provider = helperCTX(this).provider;
-                    const jsonPatches = renderedFeatureConfig.patches?.[provider] || [];
-                    fast_json_patch_default().applyPatch(cr, jsonPatches);
-                    return cr;
-                },
-                identify() {
-                    return `feature-json-patch/${featureName}`;
-                },
-                applicable() {
-                    return { applicableProviders: ['catalog', 'github'] };
-                },
-            },
         ];
     }
 }
@@ -168184,412 +168634,6 @@ var FirestartrGithubMembershipSpecContextProviderRefKind;
     /** FirestartrProviderConfig */
     FirestartrGithubMembershipSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
 })(FirestartrGithubMembershipSpecContextProviderRefKind || (FirestartrGithubMembershipSpecContextProviderRefKind = {}));
-/**
- * A resource to handle GitHub Organization Actions Secrets.
- *
- * @schema FirestartrGithubOrganizationSecretSection
- */
-class FirestartrGithubOrganizationSecretSection extends lib.ApiObject {
-    /**
-     * Renders a Kubernetes manifest for "FirestartrGithubOrganizationSecretSection".
-     *
-     * This can be used to inline resource manifests inside other objects (e.g. as templates).
-     *
-     * @param props initialization props
-     */
-    static manifest(props) {
-        return {
-            ...FirestartrGithubOrganizationSecretSection.GVK,
-            ...toJson_FirestartrGithubOrganizationSecretSectionProps(props),
-        };
-    }
-    /**
-     * Defines a "FirestartrGithubOrganizationSecretSection" API object
-     * @param scope the scope in which to define this object
-     * @param id a scope-local name for the object
-     * @param props initialization props
-     */
-    constructor(scope, id, props) {
-        super(scope, id, {
-            ...FirestartrGithubOrganizationSecretSection.GVK,
-            ...props,
-        });
-    }
-    /**
-     * Renders the object to Kubernetes JSON.
-     */
-    toJson() {
-        const resolved = super.toJson();
-        return {
-            ...FirestartrGithubOrganizationSecretSection.GVK,
-            ...toJson_FirestartrGithubOrganizationSecretSectionProps(resolved),
-        };
-    }
-}
-/**
- * Returns the apiVersion and kind for "FirestartrGithubOrganizationSecretSection"
- */
-FirestartrGithubOrganizationSecretSection.GVK = {
-    apiVersion: 'firestartr.dev/v1',
-    kind: 'FirestartrGithubOrganizationSecretSection',
-};
-
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionProps' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionProps(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'metadata': obj.metadata,
-        'spec': toJson_FirestartrGithubOrganizationSecretSectionSpec(obj.spec),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpec' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpec(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'org': obj.org,
-        'secrets': toJson_FirestartrGithubOrganizationSecretSectionSpecSecrets(obj.secrets),
-        'context': toJson_FirestartrGithubOrganizationSecretSectionSpecContext(obj.context),
-        'firestartr': toJson_FirestartrGithubOrganizationSecretSectionSpecFirestartr(obj.firestartr),
-        'writeConnectionSecretToRef': toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef(obj.writeConnectionSecretToRef),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecrets' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecrets(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'actions': obj.actions?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActions(y)),
-        'codespaces': obj.codespaces?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces(y)),
-        'dependabot': obj.dependabot?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot(y)),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContext' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecContext(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'backend': toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackend(obj.backend),
-        'provider': toJson_FirestartrGithubOrganizationSecretSectionSpecContextProvider(obj.provider),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecFirestartr' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecFirestartr(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'tfStateKey': obj.tfStateKey,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'name': obj.name,
-        'outputs': obj.outputs?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs(y)),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsActions' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActions(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'name': obj.name,
-        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef(obj.ref),
-        'visibility': obj.visibility,
-        'selectedRepositories': obj.selectedRepositories?.map(y => y),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'name': obj.name,
-        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef(obj.ref),
-        'visibility': obj.visibility,
-        'selectedRepositories': obj.selectedRepositories?.map(y => y),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'name': obj.name,
-        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef(obj.ref),
-        'visibility': obj.visibility,
-        'selectedRepositories': obj.selectedRepositories?.map(y => y),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextBackend' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackend(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackendRef(obj.ref),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextProvider' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecContextProvider(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecContextProviderRef(obj.ref),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'key': obj.key,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'kind': obj.kind,
-        'name': obj.name,
-        'key': obj.key,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-/**
- * Which repositories can access the secret.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility) {
-    /** all */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["ALL"] = "all";
-    /** selected */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["SELECTED"] = "selected";
-    /** private */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["PRIVATE"] = "private";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility = {}));
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'kind': obj.kind,
-        'name': obj.name,
-        'key': obj.key,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-/**
- * Which repositories can access the secret.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility) {
-    /** all */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["ALL"] = "all";
-    /** selected */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["SELECTED"] = "selected";
-    /** private */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["PRIVATE"] = "private";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility = {}));
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'kind': obj.kind,
-        'name': obj.name,
-        'key': obj.key,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-/**
- * Which repositories can access the secret.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility) {
-    /** all */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["ALL"] = "all";
-    /** selected */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["SELECTED"] = "selected";
-    /** private */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["PRIVATE"] = "private";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility = {}));
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextBackendRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackendRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'kind': obj.kind,
-        'name': obj.name,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextProviderRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecContextProviderRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'kind': obj.kind,
-        'name': obj.name,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-/**
- * The type of Kubernetes resource to reference.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind) {
-    /** Secret */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind["SECRET"] = "Secret";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind = {}));
-/**
- * The type of Kubernetes resource to reference.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind) {
-    /** Secret */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind["SECRET"] = "Secret";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind = {}));
-/**
- * The type of Kubernetes resource to reference.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind) {
-    /** Secret */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind["SECRET"] = "Secret";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind = {}));
-/**
- * @schema FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind
- */
-var FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind;
-(function (FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind) {
-    /** FirestartrProviderConfig */
-    FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
-})(FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind || (FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind = {}));
-/**
- * @schema FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind
- */
-var FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind;
-(function (FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind) {
-    /** FirestartrProviderConfig */
-    FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
-})(FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind || (FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind = {}));
 /**
  * A resource to handle GitHub Organization Settings.
  *
@@ -172045,78 +172089,6 @@ class GithubOrgVariableSectionChart extends BaseGithubChart {
     }
 }
 
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/orgSecretSectionChart.ts
-
-
-
-class GithubOrgSecretSectionChart extends BaseGithubChart {
-    template() {
-        const claim = this.get('claim');
-        const firestartrId = this.get('firestartrId');
-        const githubProvider = claim.providers.github;
-        const orgSecrets = githubProvider.org_secrets || {};
-        const renderSecrets = (section) => {
-            const secrets = orgSecrets[section];
-            if (!Array.isArray(secrets))
-                return [];
-            return secrets.map((secret) => {
-                const parts = secret.value.split(':');
-                const selectedRepositories = (secret.selected_repositories || []).map((ref) => {
-                    const match = ref.match(/^component:(.+)$/);
-                    if (!match) {
-                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Invalid component ref "${ref}" in selected_repositories. Expected format: component:<name>`);
-                    }
-                    const componentName = match[1];
-                    const resolvedCr = this.refResolver('ComponentClaim', componentName);
-                    const org = resolvedCr?.spec?.org;
-                    const repoName = resolvedCr?.metadata?.annotations?.['firestartr.dev/external-name'] || resolvedCr?.metadata?.name?.replace(/-[0-9a-f-]{36}$/, '');
-                    if (!org || !repoName) {
-                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Referenced component "${componentName}" has no GitHub provider configured`);
-                    }
-                    return `${org}/${repoName}`;
-                });
-                return {
-                    name: secret.name,
-                    ref: {
-                        kind: 'Secret',
-                        name: parts[2],
-                        key: parts[3],
-                    },
-                    visibility: secret.visibility || 'all',
-                    selectedRepositories,
-                };
-            });
-        };
-        const template = {
-            metadata: {
-                name: githubProvider.name,
-            },
-            spec: {
-                org: githubProvider.org,
-                secrets: {
-                    actions: renderSecrets('actions'),
-                    codespaces: renderSecrets('codespaces'),
-                    dependabot: renderSecrets('dependabot'),
-                },
-                firestartr: {
-                    tfStateKey: firestartrId,
-                },
-                writeConnectionSecretToRef: {
-                    name: `firestartrgithuborganizationsecretsection-${githubProvider.name}-secrets-outputs`.toLowerCase(),
-                    outputs: [{ key: 'managed_secrets' }, { key: 'secret_ids' }],
-                },
-            },
-        };
-        return JSON.parse(JSON.stringify(template));
-    }
-    gvk() {
-        return FirestartrGithubOrganizationSecretSection.GVK;
-    }
-    instanceApiObject(template) {
-        return new FirestartrGithubOrganizationSecretSection(this, template.metadata.name, template);
-    }
-}
-
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/index.ts
 
 
@@ -172125,7 +172097,6 @@ class GithubOrgSecretSectionChart extends BaseGithubChart {
 
 
 
-
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/catalog/base.ts
 
 class BaseCatalogChart extends BaseChart {
@@ -172888,7 +172859,6 @@ class SecretsChart extends BaseSecretsChart {
     GithubOrgWebhookChart: GithubOrgWebhookChart,
     GithubOrgSettingsChart: GithubOrgSettingsChart,
     GithubOrgVariableSectionChart: GithubOrgVariableSectionChart,
-    GithubOrgSecretSectionChart: GithubOrgSecretSectionChart,
 });
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-render.ts
@@ -172940,21 +172910,16 @@ async function renderClaims(catalogScope, firestartrScope, data) {
             const variableSectionPreviousCR = claim.kind === 'OrgSettingsClaim'
                 ? getPreviousCRfromClaim(claim, crs, 'FirestartrGithubOrganizationVariableSection')
                 : false;
-            const secretSectionPreviousCR = claim.kind === 'OrgSettingsClaim'
-                ? getPreviousCRfromClaim({ kind: claim.kind, name: `${claim.name}-secret-section` }, crs, 'FirestartrGithubOrganizationSecretSection')
-                : false;
             const patches = await extractPatches(renderClaims[claimKey], previousCR, crs);
             let variableSectionPatches = undefined;
-            let secretSectionPatches = undefined;
             if (claim.kind === 'OrgSettingsClaim') {
                 variableSectionPatches = await extractPatches(renderClaims[claimKey], variableSectionPreviousCR, crs);
-                secretSectionPatches = await extractPatches(renderClaims[claimKey], secretSectionPreviousCR);
             }
             if (!previousCR) {
                 logger.debug(`No CR found for claim ${claimKey}, it will be rendered from scratch`);
             }
             const claimPath = renderClaims[claimKey].claimPath;
-            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR, claimPath, variableSectionPreviousCR, variableSectionPatches, crs, secretSectionPreviousCR, secretSectionPatches);
+            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR, claimPath, variableSectionPreviousCR, variableSectionPatches, crs);
             if (catalogEntity) {
                 result[`${catalogEntity.kind}-${catalogEntity.metadata.name}`] =
                     catalogEntity.toJson();
@@ -172983,7 +172948,7 @@ async function renderClaims(catalogScope, firestartrScope, data) {
     }
     return result;
 }
-async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null, claimPath, variableSectionPreviousCR = false, variableSectionPatches, crs, secretSectionPreviousCR = false, secretSectionPatches) {
+async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null, claimPath, variableSectionPreviousCR = false, variableSectionPatches, crs) {
     let catalogEntity = undefined;
     let firestartrEntity = undefined;
     const extraCharts = [];
@@ -173153,27 +173118,6 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
                     },
                     chart: variableSectionObject,
                 });
-                const secretSectionFirestartrId = secretSectionPreviousCR
-                    ? secretSectionPreviousCR.spec?.firestartr?.tfStateKey
-                    : firestartrId
-                        ? `${firestartrId}-secrets`
-                        : null;
-                const ssRenderPatches = secretSectionPatches
-                    ? secretSectionPatches.filter((patch) => !patch.isPostPatch)
-                    : renderPatches;
-                const ssPostPatches = secretSectionPatches
-                    ? secretSectionPatches.filter((patch) => patch.isPostPatch)
-                    : postPatches;
-                const secretSectionChart = new charts.GithubOrgSecretSectionChart(firestartrScope, `github-secrets-${chartId}`, secretSectionFirestartrId, claim, ssRenderPatches);
-                await secretSectionChart.render();
-                const secretSectionObject = await secretSectionChart.postRenderer(ssPostPatches);
-                extraCharts.push({
-                    claim: {
-                        kind: claim.kind,
-                        name: `${claim.name}-secret-section`,
-                    },
-                    chart: secretSectionObject,
-                });
             }
             break;
         default:
@@ -173296,33 +173240,8 @@ function searchSecretKey(secretClaim, key) {
 }
 function validateOrgSettingsComponentRefs(ref, renderClaims) {
     const claim = renderClaims[ref].claim;
-    validateOrgSecretsSelectedRepositories(claim, renderClaims);
     validateActionsVariablesSelectedRepositories(claim, renderClaims);
 }
-function validateOrgSecretsSelectedRepositories(claim, renderClaims) {
-    const orgSecrets = claim?.providers?.github?.org_secrets;
-    if (!orgSecrets || typeof orgSecrets !== 'object')
-        return;
-    for (const section of ['actions', 'codespaces', 'dependabot']) {
-        const secrets = orgSecrets[section];
-        if (!Array.isArray(secrets))
-            continue;
-        for (const secret of secrets) {
-            if (!secret.selected_repositories)
-                continue;
-            for (const repoRef of secret.selected_repositories) {
-                const match = repoRef.match(COMPONENT_REF_PATTERN);
-                if (!match)
-                    continue;
-                const [, componentName] = match;
-                const expectedKey = `ComponentClaim-${componentName}`;
-                if (!renderClaims[expectedKey]) {
-                    throw new Error(`CrossReference error: OrgSettingsClaim/${claim.name} references a non-existent component "${componentName}" in org_secrets.${section}.${secret.name}.selected_repositories`);
-                }
-            }
-        }
-    }
-}
 function validateActionsVariablesSelectedRepositories(claim, renderClaims) {
     const actionsVariables = claim?.providers?.github?.actions_variables;
     if (!Array.isArray(actionsVariables))
@@ -173453,116 +173372,6 @@ function validateActionsVariablesUniqueness(crs) {
     }
 }
 
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/githubOrgSecretSection.ts
-const GITHUB_ORG_SECRET_SECTION_KIND = 'FirestartrGithubOrganizationSecretSection';
-const githubOrgSecretSection_FIRESTARTR_CLAIM_REF_ANNOTATION = 'firestartr.dev/claim-ref';
-const githubOrgSecretSection_CLAIM_REF_LABEL = 'claim-ref';
-const SECRETS_CLAIM_REF_PATTERN = /^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$/;
-function githubOrgSecretSection_formatResourceRef(name, claimRef) {
-    return claimRef ? `${name} (claim: ${claimRef})` : name;
-}
-function validateGithubOrgSecretSectionSingleton(crs) {
-    const refsByOrg = new Map();
-    const seenClaimRefs = new Map();
-    for (const crKey of Object.keys(crs)) {
-        const cr = crs[crKey];
-        if (cr.kind !== GITHUB_ORG_SECRET_SECTION_KIND)
-            continue;
-        const org = cr.spec?.org;
-        if (typeof org !== 'string' || !org)
-            continue;
-        const name = cr.metadata?.name || crKey;
-        const claimRef = cr.metadata?.annotations?.[githubOrgSecretSection_FIRESTARTR_CLAIM_REF_ANNOTATION] ||
-            cr.metadata?.labels?.[githubOrgSecretSection_CLAIM_REF_LABEL];
-        const normalizedOrg = org.toLowerCase();
-        if (claimRef) {
-            const seen = seenClaimRefs.get(normalizedOrg) || new Set();
-            if (seen.has(claimRef))
-                continue;
-            seen.add(claimRef);
-            seenClaimRefs.set(normalizedOrg, seen);
-        }
-        const refs = refsByOrg.get(normalizedOrg) || [];
-        refs.push(githubOrgSecretSection_formatResourceRef(name, claimRef));
-        refsByOrg.set(normalizedOrg, refs);
-    }
-    for (const [org, refs] of refsByOrg.entries()) {
-        if (refs.length < 2)
-            continue;
-        throw new Error(`Duplicate ${GITHUB_ORG_SECRET_SECTION_KIND} resources found for GitHub organization "${org}": ${refs.join(', ')}`);
-    }
-}
-function validateSecretNamesUniqueness(crs) {
-    for (const crKey of Object.keys(crs)) {
-        const cr = crs[crKey];
-        if (cr.kind !== GITHUB_ORG_SECRET_SECTION_KIND)
-            continue;
-        const secrets = cr.spec?.secrets;
-        if (!secrets || typeof secrets !== 'object')
-            continue;
-        for (const section of ['actions', 'codespaces', 'dependabot']) {
-            const sectionSecrets = secrets[section];
-            if (!Array.isArray(sectionSecrets))
-                continue;
-            const names = new Set();
-            for (const secret of sectionSecrets) {
-                const secretName = secret?.name;
-                if (!secretName)
-                    continue;
-                if (names.has(secretName)) {
-                    const org = cr.spec?.org || 'unknown';
-                    throw new Error(`Duplicate secret name "${secretName}" found in ${section} section of ${GITHUB_ORG_SECRET_SECTION_KIND} for organization "${org}"`);
-                }
-                names.add(secretName);
-            }
-        }
-    }
-}
-function validateOrgSecretsCrossReferences(renderClaims) {
-    for (const claimKey of Object.keys(renderClaims)) {
-        if (!claimKey.startsWith('OrgSettingsClaim-'))
-            continue;
-        const claimData = renderClaims[claimKey];
-        const claim = claimData?.claim;
-        const orgSecrets = claim?.providers?.github?.org_secrets;
-        if (!orgSecrets || typeof orgSecrets !== 'object')
-            continue;
-        for (const section of ['actions', 'codespaces', 'dependabot']) {
-            const secrets = orgSecrets[section];
-            if (!Array.isArray(secrets))
-                continue;
-            for (const secret of secrets) {
-                if (!secret.value)
-                    continue;
-                const match = secret.value.match(SECRETS_CLAIM_REF_PATTERN);
-                if (!match)
-                    continue;
-                const [, secretClaimName, secretKey] = match;
-                const expectedKey = `SecretsClaim-${secretClaimName}`;
-                if (!renderClaims[expectedKey])
-                    continue;
-                const secretClaim = renderClaims[expectedKey]?.claim;
-                const externalSecrets = secretClaim?.providers?.external_secrets?.externalSecrets?.secrets;
-                const pushSecrets = secretClaim?.providers?.external_secrets?.pushSecrets;
-                let keyFound = false;
-                if (Array.isArray(pushSecrets)) {
-                    keyFound =
-                        pushSecrets.find((s) => s.secretName === secretKey) !==
-                            undefined;
-                }
-                if (!keyFound && Array.isArray(externalSecrets)) {
-                    keyFound =
-                        externalSecrets.find((s) => s.secretName === secretKey) !==
-                            undefined;
-                }
-                if (!keyFound) {
-                    throw new Error(`CrossReference error: OrgSettingsClaim/${claim.name} references a non-existent secret key "${secretKey}" in SecretsClaim/${secretClaimName} via org_secrets.${section}.${secret.name}`);
-                }
-            }
-        }
-    }
-}
-
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/renderer.ts
 
 
@@ -173575,7 +173384,6 @@ function validateOrgSecretsCrossReferences(renderClaims) {
 
 
 
-
 /*
  * Function called when rendering but not importing
  *
@@ -173597,13 +173405,10 @@ async function renderer_render(catalogScope, firestartrScope, claimList) {
     try {
         validateSubReferences(data.renderClaims);
         validateComponentPagesPath(data.renderClaims);
-        validateOrgSecretsCrossReferences(data.renderClaims);
         validateTfStateKeyUniqueness(result);
         validateGithubOrgSettingsSingleton(fullCrSet);
         validateGithubOrgVariableSectionSingleton(fullCrSet);
         validateActionsVariablesUniqueness(result);
-        validateGithubOrgSecretSectionSingleton(fullCrSet);
-        validateSecretNamesUniqueness(result);
         validateCrSizes(result);
         validatePermissionsUniqueness(result);
         validateNoBackstageAnnotationsInK8sCrs(result);
@@ -173916,6 +173721,7 @@ function walkArray(arr, symbolsToResolve, renderClaim) {
 
 
 
+
 /*
  * Function called when rendering from the importer class.
  *
@@ -173958,11 +173764,19 @@ async function renderFromImports(rClaims, crs = {}, catalogOutputDir = '/tmp/.ca
     // after resolving imported refs, preventing setRenderedClaim() from throwing
     // 'already rendered' for claims that were previously seeded
     emptyRenderedClaims();
-    // after resolving the imported-refs, we need to validate the claims again, and apply the defaults if needed
+    // After resolving the imported-refs, each claim goes through the same
+    // defaults → stitching → AJV pipeline as loadClaim so feature claim-patches
+    // are applied and validated at the import boundary too. Stitching is
+    // once-only: already stitched claims are left untouched (no feature
+    // re-download, no gates re-applied).
     for (const renderClaim of Object.values(rClaims)) {
-        if (defaults) {
-            renderClaim.claim = loader_patchClaim(renderClaim.claim, defaults);
+        if (renderClaim.claim && renderClaim.claim[STITCHED_CLAIM]) {
+            validateClaim(renderClaim.claim, `firestartr.dev://common/${renderClaim.claim.kind}`);
+            continue;
         }
+        const rawClaim = renderClaim.claim;
+        const claim = defaults ? loader_patchClaim(rawClaim, defaults) : rawClaim;
+        renderClaim.claim = await stitchClaim(claim, undefined, rawClaim);
         validateClaim(renderClaim.claim, `firestartr.dev://common/${renderClaim.claim.kind}`);
     }
     const catalogScope = new lib.App({
@@ -357883,7 +357697,6 @@ const kindPluralMap = {
     githuborgwebhooks: 'FirestartrGithubOrgWebhook',
     githuborganizationsettings: 'FirestartrGithubOrganizationSettings',
     githuborganizationvariablesections: 'FirestartrGithubOrganizationVariableSection',
-    githuborganizationsecretsections: 'FirestartrGithubOrganizationSecretSection',
     terraformworkspaces: 'FirestartrTerraformWorkspace',
     terraformworkspaceplans: 'FirestartrTerraformWorkspacePlan',
     providerconfigs: 'FirestartrProviderConfig',
@@ -360284,7 +360097,6 @@ const kindsWithFinalizer = [
     'FirestartrGithubOrgWebhook',
     'FirestartrGithubOrganizationSettings',
     'FirestartrGithubOrganizationVariableSection',
-    'FirestartrGithubOrganizationSecretSection',
     'FirestartrGithubRepositorySecretsSection',
 ];
 const kindsWithDependants = [
@@ -363323,7 +363135,7 @@ async function configGit() {
     }
     // Import github dynamically to avoid Jest ESM issues when not specifically running this function
     // (see CONSTITUTION and RULES: must not change test machinery)
-    const githubModule = await Promise.resolve(/* import() */).then(__nccwpck_require__.bind(__nccwpck_require__, 3342));
+    const githubModule = await Promise.resolve(/* import() */).then(__nccwpck_require__.bind(__nccwpck_require__, 99029));
     const github = githubModule.default || githubModule;
     if (external_fs_.existsSync(gitconfigPath)) {
         external_fs_.rmSync(gitconfigPath);
@@ -365028,7 +364840,7 @@ function helperCreateCheckRunName(cmd, item) {
 
 ;// CONCATENATED MODULE: ../operator/src/utils/index.ts
 const secretRegex = /\$\{\{ secrets\.(.*?) \}\}/g;
-function isRecord(value) {
+function utils_isRecord(value) {
     return typeof value === 'object' && value !== null;
 }
 function getFirstNonEmptyString(...values) {
@@ -365066,7 +364878,7 @@ function replaceInlineSecrets(inline, secrets) {
     return result;
 }
 function extractErrorDetails(error) {
-    const exitCode = isRecord(error) && typeof error.exitCode === 'number'
+    const exitCode = utils_isRecord(error) && typeof error.exitCode === 'number'
         ? error.exitCode
         : undefined;
     if (typeof error === 'string') {
@@ -365077,7 +364889,7 @@ function extractErrorDetails(error) {
         const output = getFirstNonEmptyString(errorWithOutput.output, error.message);
         return { output: output ?? String(error), exitCode };
     }
-    if (isRecord(error)) {
+    if (utils_isRecord(error)) {
         const output = getFirstNonEmptyString(error.output, error.message, error.error);
         if (output !== undefined) {
             return { output, exitCode };
@@ -367169,11 +366981,6 @@ const MODULES = {
         // github-org-variables-section-v0.1.0
         ref: 'fb9c01d0a1e03e5134479da13d0faf55891dfedf',
     },
-    FirestartrGithubOrganizationSecretSection: {
-        module: 'git::https://github.com/prefapp/tfm.git//modules/github-org-secrets-section',
-        // feat/1364-feat-add-github-org-secrets-section-module
-        ref: '170e6cf',
-    },
 };
 function getFirestartrDefaultTFM(kind) {
     if (kind in MODULES) {
@@ -369086,215 +368893,6 @@ class EntityGHOrgVarsSection extends base_Entity {
     async loadAddressesToImport() { }
 }
 
-;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgsecretsection/secrets.ts
-
-
-
-
-const secrets_SECTIONS = ['actions', 'codespaces', 'dependabot'];
-
-async function provisionOrgSecrets(entity, secrets) {
-    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} provisioning org secrets`);
-    for (const section of secrets_SECTIONS) {
-        const sectionSecrets = secrets[section] || [];
-        if (sectionSecrets.length === 0)
-            continue;
-        let preFetchedKey;
-        try {
-            preFetchedKey = await fetchOrgPublicKey(entity, section);
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            throw new Error(`[gh-provisioner] ${entity.k8sId} failed to fetch ${section} org public key: ${message}`);
-        }
-        for (const secret of sectionSecrets) {
-            await provisionOrgSecret(entity, section, secret, preFetchedKey);
-        }
-    }
-}
-async function fetchOrgPublicKey(entity, section) {
-    return (await entity.runWithGithubProvider(async () => {
-        return await github["default"].encryption.getOrgPublicKey(entity.cr.spec.org, section);
-    }));
-}
-async function provisionOrgSecret(entity, section, secret, preFetchedKey) {
-    gh_provisioner_src_logger.info(`[gh-provisioner] provisioning org secret ${entity.k8sId}/${section}/${secret.name}`);
-    if (process.env['AVOID_PROVIDER_SECRET_ENCRYPTION']) {
-        await secrets_createUnencryptedSecret(entity, section, secret);
-    }
-    else {
-        await secrets_createEncryptedSecret(entity, section, secret, preFetchedKey);
-    }
-    gh_provisioner_src_logger.info(`[gh-provisioner] org secret provisioned ${section}/${secret.name}`);
-}
-async function secrets_createEncryptedSecret(entity, section, secret, preFetchedKey) {
-    const plainSecret = base_Entity.refResolver(secret.ref);
-    if (!plainSecret) {
-        throw new Error(`[gh-provisioner] ${entity.k8sId} cannot resolve secret ref: ${secret.ref.kind}/${secret.ref.name}:${secret.ref.key} — ensure the referenced resource is available as a dependency`);
-    }
-    const plainTextSecret = plainSecret.getOutput(secret.ref.key);
-    const plaintextSha256 = external_crypto_default().createHash('sha256')
-        .update(plainTextSecret)
-        .digest('hex');
-    const { encrypted_value } = (await entity.runWithGithubProvider(async () => {
-        return await github["default"].encryption.encryptOrgSecret(entity.cr.spec.org, section, plainTextSecret, preFetchedKey);
-    }));
-    entity.patchData({
-        op: PatchOperations.add,
-        path: `/config/${section}/${secret.name}`,
-        value: {
-            value: encrypted_value,
-            visibility: secret.visibility || 'all',
-            ...(secret.selectedRepositories && secret.selectedRepositories.length > 0
-                ? { selected_repositories: secret.selectedRepositories }
-                : {}),
-        },
-    });
-    entity.patchData({
-        op: PatchOperations.add,
-        path: `/config/${section}_sha256/${secret.name}`,
-        value: plaintextSha256,
-    });
-}
-async function secrets_createUnencryptedSecret(entity, section, secret) {
-    const plainSecret = base_Entity.refResolver(secret.ref);
-    const plainTextSecret = plainSecret.getOutput(secret.ref.key);
-    const plaintextSha256 = external_crypto_default().createHash('sha256')
-        .update(plainTextSecret)
-        .digest('hex');
-    entity.patchData({
-        op: PatchOperations.add,
-        path: `/config/${section}/${secret.name}`,
-        value: {
-            value: plainTextSecret,
-            visibility: secret.visibility || 'all',
-            ...(secret.selectedRepositories && secret.selectedRepositories.length > 0
-                ? { selected_repositories: secret.selectedRepositories }
-                : {}),
-        },
-    });
-    entity.patchData({
-        op: PatchOperations.add,
-        path: `/config/${section}_sha256/${secret.name}`,
-        value: plaintextSha256,
-    });
-}
-async function adoptSecretsIfNeeded(entity, secrets) {
-    const managedSecrets = entity.cr.fResolveSelfOutputs('managed_secrets') || [];
-    for (const section of secrets_SECTIONS) {
-        const sectionSecrets = secrets[section] || [];
-        if (sectionSecrets.length === 0)
-            continue;
-        const declaredNames = sectionSecrets.map((s) => s.name);
-        const newToModule = declaredNames.filter((name) => !managedSecrets.includes(name));
-        if (newToModule.length === 0) {
-            gh_provisioner_src_logger.debug(`[gh-provisioner] ${entity.k8sId} all declared ${section} secrets are already managed`);
-            continue;
-        }
-        if (managedSecrets.length === 0) {
-            gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} no managed_secrets output — first reconciliation, treating all ${newToModule.length} ${section} secret(s) as new to module`);
-        }
-        for (const secretName of newToModule) {
-            try {
-                const existing = (await entity.runWithGithubProvider(async () => {
-                    return await github["default"].encryption.getOrgSecret(entity.cr.spec.org, section, secretName);
-                }));
-                if (existing) {
-                    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} adopting pre-existing ${section} secret '${secretName}' on GitHub org '${entity.cr.spec.org}'`);
-                    const resourceType = `github_${section}_organization_secret`;
-                    entity.patchImportData({
-                        op: PatchOperations.add,
-                        path: '/imports/-',
-                        value: {
-                            to: `${resourceType}.this["${secretName}"]`,
-                            id: secretName,
-                        },
-                    });
-                    const secretEntry = sectionSecrets.find((s) => s.name === secretName);
-                    if (secretEntry &&
-                        secretEntry.visibility === 'selected' &&
-                        (section === 'actions' || section === 'dependabot')) {
-                        const bindingType = `github_${section}_organization_secret_repositories`;
-                        entity.patchImportData({
-                            op: PatchOperations.add,
-                            path: '/imports/-',
-                            value: {
-                                to: `${bindingType}.this["${secretName}"]`,
-                                id: secretName,
-                            },
-                        });
-                    }
-                }
-            }
-            catch (err) {
-                if (err && err.status === 404) {
-                    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} ${section} secret '${secretName}' not found on GitHub org '${entity.cr.spec.org}' — will be created by TFM`);
-                }
-                else if (err && (err.status === 401 || err.status === 403)) {
-                    gh_provisioner_src_logger.warn(`[gh-provisioner] ${entity.k8sId} token lacks scope to check ${section} secret '${secretName}' on org '${entity.cr.spec.org}' — skipping adoption gracefully`);
-                }
-                else {
-                    gh_provisioner_src_logger.warn(`[gh-provisioner] ${entity.k8sId} unexpected error checking ${section} secret '${secretName}' on org '${entity.cr.spec.org}': ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgsecretsection/index.ts
-
-
-
-class EntityGHOrgSecretSection extends base_Entity {
-    constructor(artifact) {
-        super(artifact, {
-            config: {
-                org: '',
-                actions: {},
-                codespaces: {},
-                dependabot: {},
-                actions_sha256: {},
-                codespaces_sha256: {},
-                dependabot_sha256: {},
-            },
-        });
-    }
-    async loadResources(tfOp) {
-        gh_provisioner_src_logger.info(`[gh-provisioner] running ${tfOp} on ${this.k8sId}`);
-        try {
-            const cr = this.cr;
-            const org = cr.spec.org;
-            const secrets = cr.spec.secrets || {};
-            this.patchData({
-                op: PatchOperations.replace,
-                path: '/config/org',
-                value: org,
-            });
-            await provisionOrgSecrets(this, secrets);
-            const redactedDoc = JSON.parse(JSON.stringify(this._document, (key, value) => {
-                if (key === 'value' && typeof value === 'string')
-                    return '[REDACTED]';
-                return typeof value === 'string' && value.length > 50
-                    ? '[REDACTED]'
-                    : value;
-            }));
-            this.synthMessage(`[gh-provisioner] ${this.k8sId} config:\n${JSON.stringify(redactedDoc, null, 2)}`);
-            this.synthEnd(`[gh-provisioner] ${this.k8sId} loaded its data`);
-            if (tfOp === 'apply') {
-                await adoptSecretsIfNeeded(this, secrets);
-            }
-            gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} loaded its data`);
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            gh_provisioner_src_logger.error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
-            throw new Error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
-        }
-    }
-    async postProvision(_tfOp) { }
-    async loadAddressesToImport() { }
-}
-
 ;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgwebhook/index.ts
 
 
@@ -369372,7 +368970,6 @@ class EntityGHOrgWebHook extends base_Entity {
 
 
 
-
 function entities_getEntity(cr) {
     const entityClass = getEntityClass(cr.kind);
     return new entityClass(cr);
@@ -369395,8 +368992,6 @@ function getEntityClass(kind) {
             return EntityGHOrgSettings;
         case 'FirestartrGithubOrganizationVariableSection':
             return EntityGHOrgVarsSection;
-        case 'FirestartrGithubOrganizationSecretSection':
-            return EntityGHOrgSecretSection;
         default:
             throw new Error(`kind ${kind} has no entity associated`);
     }
@@ -371224,7 +370819,6 @@ const provisionImplementations = {
     githuborgwebhooks: process_operation_processOperation,
     githuborganizationsettings: process_operation_processOperation,
     githuborganizationvariablesections: process_operation_processOperation,
-    githuborganizationsecretsections: process_operation_processOperation,
     fsdummiesa: processFirestartrDummies,
     fsdummiesb: processFirestartrDummies,
     fsdummiesc: processFirestartrDummies,
@@ -715677,7 +715271,7 @@ const crsStatusSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = JSON.parse('{"i8":"2.11.0-snapshot-org-secrets-00"}');
+const package_namespaceObject = JSON.parse('{"i8":"2.11.0-snapshot-patch-claims-4"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"i8":"2.10.0"};
 // EXTERNAL MODULE: ../../node_modules/semver/index.js