@firestartr/cli 2.11.0-snapshot-orgsettings-binding-2 → 2.11.0-snapshot-objects-in-patches-2

package/build/index.js

@@ -280314,7 +280314,7 @@ function getCronNextInterval(cronLine, tz) {
 
 /***/ }),
 
-/***/ 3342:
+/***/ 99029:
 /***/ ((__unused_webpack_module, __webpack_exports__, __nccwpck_require__) => {
 
 // ESM COMPAT FLAG
@@ -285979,66 +285979,6 @@ async function encryptRepoSecret(owner, repo, section, plaintextValue, octokit)
     }
 }
 
-;// CONCATENATED MODULE: ../github/src/orgSecrets.ts
-
-
-
-async function getOrgPublicKey(org, section, octokit) {
-    logger.info(`Retrieving org public key for ${org} (${section})`);
-    try {
-        if (!octokit) {
-            octokit = await getOctokitForOrg(org);
-        }
-        const { data } = await octokit.rest[`${section}`].getOrgPublicKey({
-            org,
-        });
-        return data;
-    }
-    catch (error) {
-        logger.error(`Error retrieving org public key (${section}) for ${org}: ${error}`);
-        throw error;
-    }
-}
-async function encryptOrgSecret(org, section, plaintextValue, preFetchedKey, octokit) {
-    try {
-        const { key_id, key } = preFetchedKey
-            ? preFetchedKey
-            : await getOrgPublicKey(org, section, octokit);
-        await libsodium_wrappers.ready;
-        const publicKey = libsodium_wrappers.from_base64(key, libsodium_wrappers.base64_variants.ORIGINAL);
-        const secretBytes = libsodium_wrappers.from_string(plaintextValue);
-        const encryptedBytes = libsodium_wrappers.crypto_box_seal(secretBytes, publicKey);
-        const encryptedValue = libsodium_wrappers.to_base64(encryptedBytes, libsodium_wrappers.base64_variants.ORIGINAL);
-        return {
-            key_id,
-            encrypted_value: encryptedValue,
-        };
-    }
-    catch (err) {
-        logger.error(`Error encrypting org secret (${section}) for ${org}: ${err}`);
-        throw err;
-    }
-}
-async function getOrgSecret(org, section, name, octokit) {
-    logger.info(`Checking org secret ${name} (${section}) for ${org}`);
-    try {
-        if (!octokit) {
-            octokit = await getOctokitForOrg(org);
-        }
-        const response = await octokit.rest[`${section}`].getOrgSecret({
-            org,
-            secret_name: name,
-        });
-        return response.data;
-    }
-    catch (err) {
-        if (err && err.status === 404) {
-            return null;
-        }
-        throw err;
-    }
-}
-
 ;// CONCATENATED MODULE: ../github/src/profile.ts
 // Profile definitions and store for github package (immutable and ambient profiles)
 const profileStore = new Map();
@@ -286472,7 +286412,6 @@ function withProfile(profileName) {
 
 
 
-
 /* harmony default export */ const github = ({
     org: organization,
     repo: repository,
@@ -286495,9 +286434,6 @@ function withProfile(profileName) {
     encryption: {
         encryptRepoSecret: encryptRepoSecret,
         getRepoPublicKey: getRepoPublicKey,
-        getOrgPublicKey: getOrgPublicKey,
-        encryptOrgSecret: encryptOrgSecret,
-        getOrgSecret: getOrgSecret,
     },
     withProfile: withProfile,
     createProfile: createProfile,
@@ -319398,8 +319334,8 @@ var dist = __nccwpck_require__(44516);
 var dist_default = /*#__PURE__*/__nccwpck_require__.n(dist);
 // EXTERNAL MODULE: ../catalog_common/index.ts + 44 modules
 var catalog_common = __nccwpck_require__(78542);
-// EXTERNAL MODULE: ../github/index.ts + 38 modules
-var github = __nccwpck_require__(3342);
+// EXTERNAL MODULE: ../github/index.ts + 37 modules
+var github = __nccwpck_require__(99029);
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/patches/base.ts
 class BasePatches {
     constructor() { }
@@ -322167,31 +322103,6 @@ function extractAllRefs(claimData) {
                     }
                 }
             }
-            const orgSecrets = parsedClaim.providers?.github?.org_secrets;
-            if (orgSecrets && typeof orgSecrets === 'object') {
-                const secretRefRegex = /^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$/;
-                for (const section of ['actions', 'codespaces', 'dependabot']) {
-                    const secrets = orgSecrets[section];
-                    if (!Array.isArray(secrets))
-                        continue;
-                    for (const secret of secrets) {
-                        if (secret.value) {
-                            const match = secret.value.match(secretRefRegex);
-                            if (match) {
-                                refs.push(`SecretsClaim-${match[1]}`);
-                            }
-                        }
-                        if (Array.isArray(secret.selected_repositories)) {
-                            for (const repoRef of secret.selected_repositories) {
-                                const compMatch = repoRef.match(/^component:(.+)$/);
-                                if (compMatch) {
-                                    refs.push(`ComponentClaim-${compMatch[1]}`);
-                                }
-                            }
-                        }
-                    }
-                }
-            }
             break;
         }
     }
@@ -323363,30 +323274,6 @@ const organizationSettingsProperties = {
             ],
         },
     },
-    org_secrets: {
-        type: 'object',
-        properties: {
-            actions: {
-                type: 'array',
-                items: {
-                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                },
-            },
-            codespaces: {
-                type: 'array',
-                items: {
-                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                },
-            },
-            dependabot: {
-                type: 'array',
-                items: {
-                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                },
-            },
-        },
-        additionalProperties: false,
-    },
 };
 /* harmony default export */ const github_orgsettings_schema = ({
     $schema: SCHEMA,
@@ -323574,75 +323461,6 @@ const organizationSettingsProperties = {
     },
 });
 
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/github/orgSecrets.schema.ts
-
-/* harmony default export */ const orgSecrets_schema = ({
-    $schema: SCHEMA,
-    $id: 'GithubOrgClaimSecrets',
-    definitions: {
-        GithubOrgClaimSecrets: {
-            $id: 'firestartr.dev://github/GithubOrgClaimSecrets',
-            type: 'object',
-            description: 'Organization-level GitHub Actions secrets',
-            properties: {
-                actions: {
-                    type: 'array',
-                    items: {
-                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                    },
-                },
-                codespaces: {
-                    type: 'array',
-                    items: {
-                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                    },
-                },
-                dependabot: {
-                    type: 'array',
-                    items: {
-                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
-                    },
-                },
-            },
-            additionalProperties: false,
-        },
-        GithubOrgClaimSecretRef: {
-            $id: 'firestartr.dev://github/GithubOrgClaimSecretRef',
-            type: 'string',
-            description: 'the reference of the secret',
-            pattern: '^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$',
-        },
-        GithubOrgClaimSecret: {
-            $id: 'firestartr.dev://github/GithubOrgClaimSecret',
-            type: 'object',
-            description: 'An organization-level secret for GitHub Actions',
-            properties: {
-                name: {
-                    type: 'string',
-                    description: 'the name of the secret',
-                },
-                value: {
-                    $ref: 'firestartr.dev://github/GithubOrgClaimSecretRef',
-                },
-                visibility: {
-                    type: 'string',
-                    enum: ['all', 'selected', 'private'],
-                    description: 'which repositories can access the secret',
-                },
-                selected_repositories: {
-                    type: 'array',
-                    items: {
-                        type: 'string',
-                    },
-                    description: 'list of repository refs when visibility is selected',
-                },
-            },
-            required: ['name', 'value'],
-            additionalProperties: false,
-        },
-    },
-});
-
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/github/index.ts
 
 
@@ -323652,7 +323470,6 @@ const organizationSettingsProperties = {
 
 
 
-
 const GithubSchemas = [
     github_group_schema,
     github_user_schema,
@@ -323662,7 +323479,6 @@ const GithubSchemas = [
     github_orgsettings_schema,
     component_secrets_vars_schema,
     component_labels_schema,
-    orgSecrets_schema,
 ];
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/tfworkspaces/terraform.schema.ts
@@ -325193,7 +325009,7 @@ var ajv_default = /*#__PURE__*/__nccwpck_require__.n(dist_ajv);
                     type: 'string',
                 },
                 value: {
-                    type: 'string',
+                    type: ['string', 'object', 'array', 'number', 'boolean', 'null'],
                 },
             },
             required: ['name', 'op', 'path'],
@@ -327674,382 +327490,6 @@ var FirestartrGithubMembershipSpecContextProviderRefKind;
     /** FirestartrProviderConfig */
     FirestartrGithubMembershipSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
 })(FirestartrGithubMembershipSpecContextProviderRefKind || (FirestartrGithubMembershipSpecContextProviderRefKind = {}));
-/**
- * A resource to handle GitHub Organization Actions Secrets.
- *
- * @schema FirestartrGithubOrganizationSecretSection
- */
-class FirestartrGithubOrganizationSecretSection extends lib.ApiObject {
-    /**
-     * Renders a Kubernetes manifest for "FirestartrGithubOrganizationSecretSection".
-     *
-     * This can be used to inline resource manifests inside other objects (e.g. as templates).
-     *
-     * @param props initialization props
-     */
-    static manifest(props) {
-        return {
-            ...FirestartrGithubOrganizationSecretSection.GVK,
-            ...toJson_FirestartrGithubOrganizationSecretSectionProps(props),
-        };
-    }
-    /**
-     * Defines a "FirestartrGithubOrganizationSecretSection" API object
-     * @param scope the scope in which to define this object
-     * @param id a scope-local name for the object
-     * @param props initialization props
-     */
-    constructor(scope, id, props) {
-        super(scope, id, {
-            ...FirestartrGithubOrganizationSecretSection.GVK,
-            ...props,
-        });
-    }
-    /**
-     * Renders the object to Kubernetes JSON.
-     */
-    toJson() {
-        const resolved = super.toJson();
-        return {
-            ...FirestartrGithubOrganizationSecretSection.GVK,
-            ...toJson_FirestartrGithubOrganizationSecretSectionProps(resolved),
-        };
-    }
-}
-/**
- * Returns the apiVersion and kind for "FirestartrGithubOrganizationSecretSection"
- */
-FirestartrGithubOrganizationSecretSection.GVK = {
-    apiVersion: 'firestartr.dev/v1',
-    kind: 'FirestartrGithubOrganizationSecretSection',
-};
-
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionProps' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionProps(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'metadata': obj.metadata,
-        'spec': toJson_FirestartrGithubOrganizationSecretSectionSpec(obj.spec),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpec' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpec(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'org': obj.org,
-        'secrets': toJson_FirestartrGithubOrganizationSecretSectionSpecSecrets(obj.secrets),
-        'context': toJson_FirestartrGithubOrganizationSecretSectionSpecContext(obj.context),
-        'firestartr': toJson_FirestartrGithubOrganizationSecretSectionSpecFirestartr(obj.firestartr),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecrets' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecrets(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'actions': obj.actions?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActions(y)),
-        'codespaces': obj.codespaces?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces(y)),
-        'dependabot': obj.dependabot?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot(y)),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContext' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecContext(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'backend': toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackend(obj.backend),
-        'provider': toJson_FirestartrGithubOrganizationSecretSectionSpecContextProvider(obj.provider),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecFirestartr' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecFirestartr(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'tfStateKey': obj.tfStateKey,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsActions' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActions(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'name': obj.name,
-        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef(obj.ref),
-        'visibility': obj.visibility,
-        'selectedRepositories': obj.selectedRepositories?.map(y => y),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'name': obj.name,
-        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef(obj.ref),
-        'visibility': obj.visibility,
-        'selectedRepositories': obj.selectedRepositories?.map(y => y),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'name': obj.name,
-        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef(obj.ref),
-        'visibility': obj.visibility,
-        'selectedRepositories': obj.selectedRepositories?.map(y => y),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextBackend' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackend(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackendRef(obj.ref),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextProvider' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecContextProvider(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecContextProviderRef(obj.ref),
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'kind': obj.kind,
-        'name': obj.name,
-        'key': obj.key,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-/**
- * Which repositories can access the secret.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility) {
-    /** all */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["ALL"] = "all";
-    /** selected */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["SELECTED"] = "selected";
-    /** private */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["PRIVATE"] = "private";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility = {}));
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'kind': obj.kind,
-        'name': obj.name,
-        'key': obj.key,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-/**
- * Which repositories can access the secret.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility) {
-    /** all */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["ALL"] = "all";
-    /** selected */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["SELECTED"] = "selected";
-    /** private */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["PRIVATE"] = "private";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility = {}));
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'kind': obj.kind,
-        'name': obj.name,
-        'key': obj.key,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-/**
- * Which repositories can access the secret.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility) {
-    /** all */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["ALL"] = "all";
-    /** selected */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["SELECTED"] = "selected";
-    /** private */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["PRIVATE"] = "private";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility = {}));
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextBackendRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackendRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'kind': obj.kind,
-        'name': obj.name,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/**
- * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextProviderRef' to JSON representation.
- */
-/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-function toJson_FirestartrGithubOrganizationSecretSectionSpecContextProviderRef(obj) {
-    if (obj === undefined) {
-        return undefined;
-    }
-    const result = {
-        'kind': obj.kind,
-        'name': obj.name,
-    };
-    // filter undefined values
-    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
-}
-/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
-/**
- * The type of Kubernetes resource to reference.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind) {
-    /** Secret */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind["SECRET"] = "Secret";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind = {}));
-/**
- * The type of Kubernetes resource to reference.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind) {
-    /** Secret */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind["SECRET"] = "Secret";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind = {}));
-/**
- * The type of Kubernetes resource to reference.
- *
- * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind
- */
-var FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind;
-(function (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind) {
-    /** Secret */
-    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind["SECRET"] = "Secret";
-})(FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind = {}));
-/**
- * @schema FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind
- */
-var FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind;
-(function (FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind) {
-    /** FirestartrProviderConfig */
-    FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
-})(FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind || (FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind = {}));
-/**
- * @schema FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind
- */
-var FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind;
-(function (FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind) {
-    /** FirestartrProviderConfig */
-    FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
-})(FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind || (FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind = {}));
 /**
  * A resource to handle GitHub Organization Settings.
  *
@@ -330810,8 +330250,12 @@ class BaseChart extends lib.Chart {
             template = await patch.apply(template, this.ctx());
             patch.validate(template);
         }
+        template = await this.postRenderTransform(template);
         return this.instanceApiObject(template);
     }
+    async postRenderTransform(template) {
+        return template;
+    }
     ctx() {
         return new ChartContext(this);
     }
@@ -331120,6 +330564,7 @@ class RepoSecretsSectionChart extends BaseGithubChart {
 
 
 
+
 class GithubRepositoryChart extends BaseGithubChart {
     template() {
         const claim = this.get('claim');
@@ -331193,6 +330638,26 @@ class GithubRepositoryChart extends BaseGithubChart {
         await this.postRenderSecretsSection(this.get('rendered-cr'));
         return this;
     }
+    async postRenderTransform(template) {
+        const labels = template?.spec?.repo?.labels;
+        if (Array.isArray(labels)) {
+            const seen = new Map();
+            const deduped = [];
+            for (const label of labels) {
+                const key = String(label.name).trim();
+                if (seen.has(key)) {
+                    logger.warn(`[cdk8s-renderer] ${template.metadata?.name ?? ''} duplicate label '${key}' dropped; the first (Claim/CR) declaration wins`);
+                    continue;
+                }
+                seen.set(key, true);
+                deduped.push(label);
+            }
+            if (deduped.length !== labels.length) {
+                template.spec.repo.labels = deduped;
+            }
+        }
+        return template;
+    }
     gvk() {
         return FirestartrGithubRepository.GVK;
     }
@@ -331464,78 +330929,6 @@ class GithubOrgVariableSectionChart extends BaseGithubChart {
     }
 }
 
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/orgSecretSectionChart.ts
-
-
-
-class GithubOrgSecretSectionChart extends BaseGithubChart {
-    template() {
-        const claim = this.get('claim');
-        const firestartrId = this.get('firestartrId');
-        const githubProvider = claim.providers.github;
-        const orgSecrets = githubProvider.org_secrets || {};
-        const renderSecrets = (section) => {
-            const secrets = orgSecrets[section];
-            if (!Array.isArray(secrets))
-                return [];
-            return secrets.map((secret) => {
-                const parts = secret.value.split(':');
-                const selectedRepositories = (secret.selected_repositories || []).map((ref) => {
-                    const match = ref.match(/^component:(.+)$/);
-                    if (!match) {
-                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Invalid component ref "${ref}" in selected_repositories. Expected format: component:<name>`);
-                    }
-                    const componentName = match[1];
-                    const resolvedCr = this.refResolver('ComponentClaim', componentName);
-                    const org = resolvedCr?.spec?.org;
-                    const repoName = resolvedCr?.metadata?.annotations?.['firestartr.dev/external-name'] || resolvedCr?.metadata?.name?.replace(/-[0-9a-f-]{36}$/, '');
-                    if (!org || !repoName) {
-                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Referenced component "${componentName}" has no GitHub provider configured`);
-                    }
-                    return `${org}/${repoName}`;
-                });
-                return {
-                    name: secret.name,
-                    ref: {
-                        kind: 'Secret',
-                        name: parts[2],
-                        key: parts[3],
-                    },
-                    visibility: secret.visibility || 'all',
-                    selectedRepositories,
-                };
-            });
-        };
-        const template = {
-            metadata: {
-                name: `${githubProvider.name}-secrets`,
-            },
-            spec: {
-                org: githubProvider.org,
-                secrets: {
-                    actions: renderSecrets('actions'),
-                    codespaces: renderSecrets('codespaces'),
-                    dependabot: renderSecrets('dependabot'),
-                },
-                firestartr: {
-                    tfStateKey: firestartrId ? `${firestartrId}-secrets` : firestartrId,
-                },
-                writeConnectionSecretToRef: {
-                    name: `firestartrgithuborganizationsecretsection-${githubProvider.name}-secrets-outputs`.toLowerCase(),
-                    outputs: [{ key: 'managed_secrets' }, { key: 'secret_ids' }],
-                },
-            },
-        };
-        return JSON.parse(JSON.stringify(template));
-    }
-    gvk() {
-        return FirestartrGithubOrganizationSecretSection.GVK;
-    }
-    instanceApiObject(template) {
-        return new FirestartrGithubOrganizationSecretSection(this, template.metadata.name, template);
-    }
-}
-
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/index.ts
 
 
@@ -331544,7 +330937,6 @@ class GithubOrgSecretSectionChart extends BaseGithubChart {
 
 
 
-
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/catalog/base.ts
 
 class BaseCatalogChart extends BaseChart {
@@ -332293,7 +331685,6 @@ class SecretsChart extends BaseSecretsChart {
     GithubOrgWebhookChart: GithubOrgWebhookChart,
     GithubOrgSettingsChart: GithubOrgSettingsChart,
     GithubOrgVariableSectionChart: GithubOrgVariableSectionChart,
-    GithubOrgSecretSectionChart: GithubOrgSecretSectionChart,
 });
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-render.ts
@@ -332345,21 +331736,16 @@ async function renderClaims(catalogScope, firestartrScope, data) {
             const variableSectionPreviousCR = claim.kind === 'OrgSettingsClaim'
                 ? getPreviousCRfromClaim({ kind: claim.kind, name: `${claim.name}-variable-section` }, crs, 'FirestartrGithubOrganizationVariableSection')
                 : false;
-            const secretSectionPreviousCR = claim.kind === 'OrgSettingsClaim'
-                ? getPreviousCRfromClaim({ kind: claim.kind, name: `${claim.name}-secret-section` }, crs, 'FirestartrGithubOrganizationSecretSection')
-                : false;
             const patches = await extractPatches(renderClaims[claimKey], previousCR);
             let variableSectionPatches = undefined;
-            let secretSectionPatches = undefined;
             if (claim.kind === 'OrgSettingsClaim') {
                 variableSectionPatches = await extractPatches(renderClaims[claimKey], variableSectionPreviousCR);
-                secretSectionPatches = await extractPatches(renderClaims[claimKey], secretSectionPreviousCR);
             }
             if (!previousCR) {
                 logger.debug(`No CR found for claim ${claimKey}, it will be rendered from scratch`);
             }
             const claimPath = renderClaims[claimKey].claimPath;
-            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR, claimPath, variableSectionPreviousCR, variableSectionPatches, secretSectionPreviousCR, secretSectionPatches);
+            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR, claimPath, variableSectionPreviousCR, variableSectionPatches);
             if (catalogEntity) {
                 result[`${catalogEntity.kind}-${catalogEntity.metadata.name}`] =
                     catalogEntity.toJson();
@@ -332388,7 +331774,7 @@ async function renderClaims(catalogScope, firestartrScope, data) {
     }
     return result;
 }
-async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null, claimPath, variableSectionPreviousCR = false, variableSectionPatches, secretSectionPreviousCR = false, secretSectionPatches) {
+async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null, claimPath, variableSectionPreviousCR = false, variableSectionPatches) {
     let catalogEntity = undefined;
     let firestartrEntity = undefined;
     const extraCharts = [];
@@ -332557,27 +331943,6 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
                     },
                     chart: variableSectionObject,
                 });
-                const secretSectionFirestartrId = secretSectionPreviousCR
-                    ? secretSectionPreviousCR.spec?.firestartr?.tfStateKey
-                    : firestartrId
-                        ? `${firestartrId}-secrets`
-                        : null;
-                const ssRenderPatches = secretSectionPatches
-                    ? secretSectionPatches.filter((patch) => !patch.isPostPatch)
-                    : renderPatches;
-                const ssPostPatches = secretSectionPatches
-                    ? secretSectionPatches.filter((patch) => patch.isPostPatch)
-                    : postPatches;
-                const secretSectionChart = new charts.GithubOrgSecretSectionChart(firestartrScope, `github-secrets-${chartId}`, secretSectionFirestartrId, claim, ssRenderPatches);
-                await secretSectionChart.render();
-                const secretSectionObject = await secretSectionChart.postRenderer(ssPostPatches);
-                extraCharts.push({
-                    claim: {
-                        kind: claim.kind,
-                        name: `${claim.name}-secret-section`,
-                    },
-                    chart: secretSectionObject,
-                });
             }
             break;
         default:
@@ -332700,33 +332065,8 @@ function searchSecretKey(secretClaim, key) {
 }
 function validateOrgSettingsComponentRefs(ref, renderClaims) {
     const claim = renderClaims[ref].claim;
-    validateOrgSecretsSelectedRepositories(claim, renderClaims);
     validateActionsVariablesSelectedRepositories(claim, renderClaims);
 }
-function validateOrgSecretsSelectedRepositories(claim, renderClaims) {
-    const orgSecrets = claim?.providers?.github?.org_secrets;
-    if (!orgSecrets || typeof orgSecrets !== 'object')
-        return;
-    for (const section of ['actions', 'codespaces', 'dependabot']) {
-        const secrets = orgSecrets[section];
-        if (!Array.isArray(secrets))
-            continue;
-        for (const secret of secrets) {
-            if (!secret.selected_repositories)
-                continue;
-            for (const repoRef of secret.selected_repositories) {
-                const match = repoRef.match(COMPONENT_REF_PATTERN);
-                if (!match)
-                    continue;
-                const [, componentName] = match;
-                const expectedKey = `ComponentClaim-${componentName}`;
-                if (!renderClaims[expectedKey]) {
-                    throw new Error(`CrossReference error: OrgSettingsClaim/${claim.name} references a non-existent component "${componentName}" in org_secrets.${section}.${secret.name}.selected_repositories`);
-                }
-            }
-        }
-    }
-}
 function validateActionsVariablesSelectedRepositories(claim, renderClaims) {
     const actionsVariables = claim?.providers?.github?.actions_variables;
     if (!Array.isArray(actionsVariables))
@@ -332857,116 +332197,6 @@ function validateActionsVariablesUniqueness(crs) {
     }
 }
 
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/githubOrgSecretSection.ts
-const GITHUB_ORG_SECRET_SECTION_KIND = 'FirestartrGithubOrganizationSecretSection';
-const githubOrgSecretSection_FIRESTARTR_CLAIM_REF_ANNOTATION = 'firestartr.dev/claim-ref';
-const githubOrgSecretSection_CLAIM_REF_LABEL = 'claim-ref';
-const SECRETS_CLAIM_REF_PATTERN = /^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$/;
-function githubOrgSecretSection_formatResourceRef(name, claimRef) {
-    return claimRef ? `${name} (claim: ${claimRef})` : name;
-}
-function validateGithubOrgSecretSectionSingleton(crs) {
-    const refsByOrg = new Map();
-    const seenClaimRefs = new Map();
-    for (const crKey of Object.keys(crs)) {
-        const cr = crs[crKey];
-        if (cr.kind !== GITHUB_ORG_SECRET_SECTION_KIND)
-            continue;
-        const org = cr.spec?.org;
-        if (typeof org !== 'string' || !org)
-            continue;
-        const name = cr.metadata?.name || crKey;
-        const claimRef = cr.metadata?.annotations?.[githubOrgSecretSection_FIRESTARTR_CLAIM_REF_ANNOTATION] ||
-            cr.metadata?.labels?.[githubOrgSecretSection_CLAIM_REF_LABEL];
-        const normalizedOrg = org.toLowerCase();
-        if (claimRef) {
-            const seen = seenClaimRefs.get(normalizedOrg) || new Set();
-            if (seen.has(claimRef))
-                continue;
-            seen.add(claimRef);
-            seenClaimRefs.set(normalizedOrg, seen);
-        }
-        const refs = refsByOrg.get(normalizedOrg) || [];
-        refs.push(githubOrgSecretSection_formatResourceRef(name, claimRef));
-        refsByOrg.set(normalizedOrg, refs);
-    }
-    for (const [org, refs] of refsByOrg.entries()) {
-        if (refs.length < 2)
-            continue;
-        throw new Error(`Duplicate ${GITHUB_ORG_SECRET_SECTION_KIND} resources found for GitHub organization "${org}": ${refs.join(', ')}`);
-    }
-}
-function validateSecretNamesUniqueness(crs) {
-    for (const crKey of Object.keys(crs)) {
-        const cr = crs[crKey];
-        if (cr.kind !== GITHUB_ORG_SECRET_SECTION_KIND)
-            continue;
-        const secrets = cr.spec?.secrets;
-        if (!secrets || typeof secrets !== 'object')
-            continue;
-        for (const section of ['actions', 'codespaces', 'dependabot']) {
-            const sectionSecrets = secrets[section];
-            if (!Array.isArray(sectionSecrets))
-                continue;
-            const names = new Set();
-            for (const secret of sectionSecrets) {
-                const secretName = secret?.name;
-                if (!secretName)
-                    continue;
-                if (names.has(secretName)) {
-                    const org = cr.spec?.org || 'unknown';
-                    throw new Error(`Duplicate secret name "${secretName}" found in ${section} section of ${GITHUB_ORG_SECRET_SECTION_KIND} for organization "${org}"`);
-                }
-                names.add(secretName);
-            }
-        }
-    }
-}
-function validateOrgSecretsCrossReferences(renderClaims) {
-    for (const claimKey of Object.keys(renderClaims)) {
-        if (!claimKey.startsWith('OrgSettingsClaim-'))
-            continue;
-        const claimData = renderClaims[claimKey];
-        const claim = claimData?.claim;
-        const orgSecrets = claim?.providers?.github?.org_secrets;
-        if (!orgSecrets || typeof orgSecrets !== 'object')
-            continue;
-        for (const section of ['actions', 'codespaces', 'dependabot']) {
-            const secrets = orgSecrets[section];
-            if (!Array.isArray(secrets))
-                continue;
-            for (const secret of secrets) {
-                if (!secret.value)
-                    continue;
-                const match = secret.value.match(SECRETS_CLAIM_REF_PATTERN);
-                if (!match)
-                    continue;
-                const [, secretClaimName, secretKey] = match;
-                const expectedKey = `SecretsClaim-${secretClaimName}`;
-                if (!renderClaims[expectedKey])
-                    continue;
-                const secretClaim = renderClaims[expectedKey]?.claim;
-                const externalSecrets = secretClaim?.providers?.external_secrets?.externalSecrets?.secrets;
-                const pushSecrets = secretClaim?.providers?.external_secrets?.pushSecrets;
-                let keyFound = false;
-                if (Array.isArray(pushSecrets)) {
-                    keyFound =
-                        pushSecrets.find((s) => s.secretName === secretKey) !==
-                            undefined;
-                }
-                if (!keyFound && Array.isArray(externalSecrets)) {
-                    keyFound =
-                        externalSecrets.find((s) => s.secretName === secretKey) !==
-                            undefined;
-                }
-                if (!keyFound) {
-                    throw new Error(`CrossReference error: OrgSettingsClaim/${claim.name} references a non-existent secret key "${secretKey}" in SecretsClaim/${secretClaimName} via org_secrets.${section}.${secret.name}`);
-                }
-            }
-        }
-    }
-}
-
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/renderer.ts
 
 
@@ -332978,7 +332208,6 @@ function validateOrgSecretsCrossReferences(renderClaims) {
 
 
 
-
 /*
  * Function called when rendering but not importing
  *
@@ -333000,13 +332229,10 @@ async function renderer_render(catalogScope, firestartrScope, claimList) {
     try {
         validateSubReferences(data.renderClaims);
         validateComponentPagesPath(data.renderClaims);
-        validateOrgSecretsCrossReferences(data.renderClaims);
         validateTfStateKeyUniqueness(result);
         validateGithubOrgSettingsSingleton(fullCrSet);
         validateGithubOrgVariableSectionSingleton(fullCrSet);
         validateActionsVariablesUniqueness(result);
-        validateGithubOrgSecretSectionSingleton(fullCrSet);
-        validateSecretNamesUniqueness(result);
         validateCrSizes(result);
         validatePermissionsUniqueness(result);
     }
@@ -335339,7 +334565,6 @@ const kindPluralMap = {
     githuborgwebhooks: 'FirestartrGithubOrgWebhook',
     githuborganizationsettings: 'FirestartrGithubOrganizationSettings',
     githuborganizationvariablesections: 'FirestartrGithubOrganizationVariableSection',
-    githuborganizationsecretsections: 'FirestartrGithubOrganizationSecretSection',
     terraformworkspaces: 'FirestartrTerraformWorkspace',
     terraformworkspaceplans: 'FirestartrTerraformWorkspacePlan',
     providerconfigs: 'FirestartrProviderConfig',
@@ -337318,7 +336543,6 @@ const kindsWithFinalizer = [
     'FirestartrGithubOrgWebhook',
     'FirestartrGithubOrganizationSettings',
     'FirestartrGithubOrganizationVariableSection',
-    'FirestartrGithubOrganizationSecretSection',
     'FirestartrGithubRepositorySecretsSection',
 ];
 const kindsWithDependants = [
@@ -340268,7 +339492,7 @@ async function configGit() {
     }
     // Import github dynamically to avoid Jest ESM issues when not specifically running this function
     // (see CONSTITUTION and RULES: must not change test machinery)
-    const githubModule = await Promise.resolve(/* import() */).then(__nccwpck_require__.bind(__nccwpck_require__, 3342));
+    const githubModule = await Promise.resolve(/* import() */).then(__nccwpck_require__.bind(__nccwpck_require__, 99029));
     const github = githubModule.default || githubModule;
     if (external_fs_.existsSync(gitconfigPath)) {
         external_fs_.rmSync(gitconfigPath);
@@ -343865,11 +343089,6 @@ const MODULES = {
         // github-org-variables-section-v0.1.0
         ref: 'fb9c01d0a1e03e5134479da13d0faf55891dfedf',
     },
-    FirestartrGithubOrganizationSecretSection: {
-        module: 'git::https://github.com/prefapp/tfm.git//modules/github-org-secrets-section',
-        // feat/1364-feat-add-github-org-secrets-section-module
-        ref: '170e6cf',
-    },
 };
 function getFirestartrDefaultTFM(kind) {
     if (kind in MODULES) {
@@ -345760,206 +344979,6 @@ class EntityGHOrgVarsSection extends base_Entity {
     async loadAddressesToImport() { }
 }
 
-;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgsecretsection/secrets.ts
-
-
-
-
-const secrets_SECTIONS = ['actions', 'codespaces', 'dependabot'];
-
-async function provisionOrgSecrets(entity, secrets) {
-    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} provisioning org secrets`);
-    for (const section of secrets_SECTIONS) {
-        const sectionSecrets = secrets[section] || [];
-        if (sectionSecrets.length === 0)
-            continue;
-        let preFetchedKey;
-        try {
-            preFetchedKey = await fetchOrgPublicKey(entity, section);
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            throw new Error(`[gh-provisioner] ${entity.k8sId} failed to fetch ${section} org public key: ${message}`);
-        }
-        for (const secret of sectionSecrets) {
-            await provisionOrgSecret(entity, section, secret, preFetchedKey);
-        }
-    }
-}
-async function fetchOrgPublicKey(entity, section) {
-    return (await entity.runWithGithubProvider(async () => {
-        return await github["default"].encryption.getOrgPublicKey(entity.cr.spec.org, section);
-    }));
-}
-async function provisionOrgSecret(entity, section, secret, preFetchedKey) {
-    gh_provisioner_src_logger.info(`[gh-provisioner] provisioning org secret ${entity.k8sId}/${section}/${secret.name}`);
-    if (process.env['AVOID_PROVIDER_SECRET_ENCRYPTION']) {
-        await secrets_createUnencryptedSecret(entity, section, secret);
-    }
-    else {
-        await secrets_createEncryptedSecret(entity, section, secret, preFetchedKey);
-    }
-    gh_provisioner_src_logger.info(`[gh-provisioner] org secret provisioned ${section}/${secret.name}`);
-}
-async function secrets_createEncryptedSecret(entity, section, secret, preFetchedKey) {
-    const plainSecret = base_Entity.refResolver(secret.ref);
-    const plainTextSecret = plainSecret.getOutput(secret.ref.key);
-    const plaintextSha256 = external_crypto_default().createHash('sha256')
-        .update(plainTextSecret)
-        .digest('hex');
-    const { encrypted_value } = (await entity.runWithGithubProvider(async () => {
-        return await github["default"].encryption.encryptOrgSecret(entity.cr.spec.org, section, plainTextSecret, preFetchedKey);
-    }));
-    entity.patchData({
-        op: PatchOperations.add,
-        path: `/config/${section}/${secret.name}`,
-        value: {
-            value: encrypted_value,
-            visibility: secret.visibility || 'all',
-            ...(secret.selectedRepositories && secret.selectedRepositories.length > 0
-                ? { selected_repositories: secret.selectedRepositories }
-                : {}),
-        },
-    });
-    entity.patchData({
-        op: PatchOperations.add,
-        path: `/config/${section}_sha256/${secret.name}`,
-        value: plaintextSha256,
-    });
-}
-async function secrets_createUnencryptedSecret(entity, section, secret) {
-    const plainSecret = base_Entity.refResolver(secret.ref);
-    const plainTextSecret = plainSecret.getOutput(secret.ref.key);
-    const plaintextSha256 = external_crypto_default().createHash('sha256')
-        .update(plainTextSecret)
-        .digest('hex');
-    entity.patchData({
-        op: PatchOperations.add,
-        path: `/config/${section}/${secret.name}`,
-        value: {
-            value: plainTextSecret,
-            visibility: secret.visibility || 'all',
-            ...(secret.selectedRepositories && secret.selectedRepositories.length > 0
-                ? { selected_repositories: secret.selectedRepositories }
-                : {}),
-        },
-    });
-    entity.patchData({
-        op: PatchOperations.add,
-        path: `/config/${section}_sha256/${secret.name}`,
-        value: plaintextSha256,
-    });
-}
-async function adoptSecretsIfNeeded(entity, secrets) {
-    const managedSecrets = entity.cr.fResolveSelfOutputs('managed_secrets') || [];
-    for (const section of secrets_SECTIONS) {
-        const sectionSecrets = secrets[section] || [];
-        if (sectionSecrets.length === 0)
-            continue;
-        const declaredNames = sectionSecrets.map((s) => s.name);
-        const newToModule = declaredNames.filter((name) => !managedSecrets.includes(name));
-        if (newToModule.length === 0) {
-            gh_provisioner_src_logger.debug(`[gh-provisioner] ${entity.k8sId} all declared ${section} secrets are already managed`);
-            continue;
-        }
-        if (managedSecrets.length === 0) {
-            gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} no managed_secrets output — first reconciliation, treating all ${newToModule.length} ${section} secret(s) as new to module`);
-        }
-        for (const secretName of newToModule) {
-            try {
-                const existing = (await entity.runWithGithubProvider(async () => {
-                    return await github["default"].encryption.getOrgSecret(entity.cr.spec.org, section, secretName);
-                }));
-                if (existing) {
-                    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} adopting pre-existing ${section} secret '${secretName}' on GitHub org '${entity.cr.spec.org}'`);
-                    const resourceType = `github_${section}_organization_secret`;
-                    entity.patchImportData({
-                        op: PatchOperations.add,
-                        path: '/imports/-',
-                        value: {
-                            to: `${resourceType}.this["${secretName}"]`,
-                            id: secretName,
-                        },
-                    });
-                    const secretEntry = sectionSecrets.find((s) => s.name === secretName);
-                    if (secretEntry &&
-                        secretEntry.visibility === 'selected' &&
-                        (section === 'actions' || section === 'dependabot')) {
-                        const bindingType = `github_${section}_organization_secret_repositories`;
-                        entity.patchImportData({
-                            op: PatchOperations.add,
-                            path: '/imports/-',
-                            value: {
-                                to: `${bindingType}.this["${secretName}"]`,
-                                id: secretName,
-                            },
-                        });
-                    }
-                }
-            }
-            catch (err) {
-                if (err && err.status === 404) {
-                    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} ${section} secret '${secretName}' not found on GitHub org '${entity.cr.spec.org}' — will be created by TFM`);
-                }
-                else if (err && (err.status === 401 || err.status === 403)) {
-                    gh_provisioner_src_logger.warn(`[gh-provisioner] ${entity.k8sId} token lacks scope to check ${section} secret '${secretName}' on org '${entity.cr.spec.org}' — skipping adoption gracefully`);
-                }
-                else {
-                    gh_provisioner_src_logger.warn(`[gh-provisioner] ${entity.k8sId} unexpected error checking ${section} secret '${secretName}' on org '${entity.cr.spec.org}': ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgsecretsection/index.ts
-
-
-
-class EntityGHOrgSecretSection extends base_Entity {
-    constructor(artifact) {
-        super(artifact, {
-            config: {
-                org: '',
-                actions: {},
-                codespaces: {},
-                dependabot: {},
-                actions_sha256: {},
-                codespaces_sha256: {},
-                dependabot_sha256: {},
-            },
-        });
-    }
-    async loadResources(tfOp) {
-        gh_provisioner_src_logger.info(`[gh-provisioner] running ${tfOp} on ${this.k8sId}`);
-        try {
-            const cr = this.cr;
-            const org = cr.spec.org;
-            const secrets = cr.spec.secrets || {};
-            this.patchData({
-                op: PatchOperations.replace,
-                path: '/config/org',
-                value: org,
-            });
-            await provisionOrgSecrets(this, secrets);
-            const redactedDoc = JSON.parse(JSON.stringify(this._document, (key, value) => typeof value === 'string' && value.length > 50 ? '[REDACTED]' : value));
-            this.synthMessage(`[gh-provisioner] ${this.k8sId} config:\n${JSON.stringify(redactedDoc, null, 2)}`);
-            this.synthEnd(`[gh-provisioner] ${this.k8sId} loaded its data`);
-            if (tfOp === 'apply') {
-                await adoptSecretsIfNeeded(this, secrets);
-            }
-            gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} loaded its data`);
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            gh_provisioner_src_logger.error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
-            throw new Error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
-        }
-    }
-    async postProvision(_tfOp) { }
-    async loadAddressesToImport() { }
-}
-
 ;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgwebhook/index.ts
 
 
@@ -346037,7 +345056,6 @@ class EntityGHOrgWebHook extends base_Entity {
 
 
 
-
 function entities_getEntity(cr) {
     const entityClass = getEntityClass(cr.kind);
     return new entityClass(cr);
@@ -346060,8 +345078,6 @@ function getEntityClass(kind) {
             return EntityGHOrgSettings;
         case 'FirestartrGithubOrganizationVariableSection':
             return EntityGHOrgVarsSection;
-        case 'FirestartrGithubOrganizationSecretSection':
-            return EntityGHOrgSecretSection;
         default:
             throw new Error(`kind ${kind} has no entity associated`);
     }
@@ -347811,7 +346827,6 @@ const provisionImplementations = {
     githuborgwebhooks: process_operation_processOperation,
     githuborganizationsettings: process_operation_processOperation,
     githuborganizationvariablesections: process_operation_processOperation,
-    githuborganizationsecretsections: process_operation_processOperation,
     fsdummiesa: processFirestartrDummies,
     fsdummiesb: processFirestartrDummies,
     fsdummiesc: processFirestartrDummies,
@@ -526630,7 +525645,7 @@ const crsStatusSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = JSON.parse('{"i8":"2.11.0-snapshot-orgsettings-binding-2"}');
+const package_namespaceObject = JSON.parse('{"i8":"2.11.0-snapshot-objects-in-patches-2"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"i8":"2.10.0"};
 // EXTERNAL MODULE: ../../node_modules/semver/index.js