@firestartr/cli 2.11.0-snapshot-patch-claims-4 → 2.11.0-snapshot-org-secrets-01

package/build/index.js

@@ -128395,7 +128395,7 @@ function trasformLeg(leg) {
 
 
 function getFeatureRenderedPathForEntity(entity, featureName, basePath = '/tmp') {
-    const entityFolderName = `${entity.metadata?.name ?? entity.name}`.toLowerCase();
+    const entityFolderName = `${entity.metadata.name}`.toLowerCase();
     return external_path_default().join(basePath, entityFolderName, featureName);
 }
 function getFeatureRenderedConfigForComponent(entity, featureName, basePath = '/tmp/features') {
@@ -128727,7 +128727,7 @@ function getCronNextInterval(cronLine, tz) {
 
 /***/ }),
 
-/***/ 99029:
+/***/ 3342:
 /***/ ((__unused_webpack_module, __webpack_exports__, __nccwpck_require__) => {
 
 // ESM COMPAT FLAG
@@ -134407,6 +134407,66 @@ async function encryptRepoSecret(owner, repo, section, plaintextValue, octokit)
     }
 }
 
+;// CONCATENATED MODULE: ../github/src/orgSecrets.ts
+
+
+
+async function getOrgPublicKey(org, section, octokit) {
+    logger.info(`Retrieving org public key for ${org} (${section})`);
+    try {
+        if (!octokit) {
+            octokit = await getOctokitForOrg(org);
+        }
+        const { data } = await octokit.rest[`${section}`].getOrgPublicKey({
+            org,
+        });
+        return data;
+    }
+    catch (error) {
+        logger.error(`Error retrieving org public key (${section}) for ${org}: ${error}`);
+        throw error;
+    }
+}
+async function encryptOrgSecret(org, section, plaintextValue, preFetchedKey, octokit) {
+    try {
+        const { key_id, key } = preFetchedKey
+            ? preFetchedKey
+            : await getOrgPublicKey(org, section, octokit);
+        await libsodium_wrappers.ready;
+        const publicKey = libsodium_wrappers.from_base64(key, libsodium_wrappers.base64_variants.ORIGINAL);
+        const secretBytes = libsodium_wrappers.from_string(plaintextValue);
+        const encryptedBytes = libsodium_wrappers.crypto_box_seal(secretBytes, publicKey);
+        const encryptedValue = libsodium_wrappers.to_base64(encryptedBytes, libsodium_wrappers.base64_variants.ORIGINAL);
+        return {
+            key_id,
+            encrypted_value: encryptedValue,
+        };
+    }
+    catch (err) {
+        logger.error(`Error encrypting org secret (${section}) for ${org}: ${err}`);
+        throw err;
+    }
+}
+async function getOrgSecret(org, section, name, octokit) {
+    logger.info(`Checking org secret ${name} (${section}) for ${org}`);
+    try {
+        if (!octokit) {
+            octokit = await getOctokitForOrg(org);
+        }
+        const response = await octokit.rest[`${section}`].getOrgSecret({
+            org,
+            secret_name: name,
+        });
+        return response.data;
+    }
+    catch (err) {
+        if (err && err.status === 404) {
+            return null;
+        }
+        throw err;
+    }
+}
+
 ;// CONCATENATED MODULE: ../github/src/profile.ts
 // Profile definitions and store for github package (immutable and ambient profiles)
 const profileStore = new Map();
@@ -134841,6 +134901,7 @@ function withProfile(profileName) {
 
 
 
+
 /* harmony default export */ const github = ({
     org: organization,
     repo: repository,
@@ -134863,6 +134924,9 @@ function withProfile(profileName) {
     encryption: {
         encryptRepoSecret: encryptRepoSecret,
         getRepoPublicKey: getRepoPublicKey,
+        getOrgPublicKey: getOrgPublicKey,
+        encryptOrgSecret: encryptOrgSecret,
+        getOrgSecret: getOrgSecret,
     },
     withProfile: withProfile,
     createProfile: createProfile,
@@ -159640,8 +159704,8 @@ var dist = __nccwpck_require__(44516);
 var dist_default = /*#__PURE__*/__nccwpck_require__.n(dist);
 // EXTERNAL MODULE: ../catalog_common/index.ts + 44 modules
 var catalog_common = __nccwpck_require__(78542);
-// EXTERNAL MODULE: ../github/index.ts + 37 modules
-var github = __nccwpck_require__(99029);
+// EXTERNAL MODULE: ../github/index.ts + 38 modules
+var github = __nccwpck_require__(3342);
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/patches/base.ts
 class BasePatches {
     constructor() { }
@@ -162502,6 +162566,31 @@ function extractAllRefs(claimData) {
                     }
                 }
             }
+            const orgSecrets = parsedClaim.providers?.github?.org_secrets;
+            if (orgSecrets && typeof orgSecrets === 'object') {
+                const secretRefRegex = /^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$/;
+                for (const section of ['actions', 'codespaces', 'dependabot']) {
+                    const secrets = orgSecrets[section];
+                    if (!Array.isArray(secrets))
+                        continue;
+                    for (const secret of secrets) {
+                        if (secret.value) {
+                            const match = secret.value.match(secretRefRegex);
+                            if (match) {
+                                refs.push(`SecretsClaim-${match[1]}`);
+                            }
+                        }
+                        if (Array.isArray(secret.selected_repositories)) {
+                            for (const repoRef of secret.selected_repositories) {
+                                const compMatch = repoRef.match(/^component:(.+)$/);
+                                if (compMatch) {
+                                    refs.push(`ComponentClaim-${compMatch[1]}`);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
             break;
         }
     }
@@ -163660,6 +163749,30 @@ const organizationSettingsProperties = {
             ],
         },
     },
+    org_secrets: {
+        type: 'object',
+        properties: {
+            actions: {
+                type: 'array',
+                items: {
+                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                },
+            },
+            codespaces: {
+                type: 'array',
+                items: {
+                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                },
+            },
+            dependabot: {
+                type: 'array',
+                items: {
+                    $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                },
+            },
+        },
+        additionalProperties: false,
+    },
 };
 /* harmony default export */ const github_orgsettings_schema = ({
     $schema: SCHEMA,
@@ -163884,6 +163997,75 @@ const organizationSettingsProperties = {
     },
 });
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/github/orgSecrets.schema.ts
+
+/* harmony default export */ const orgSecrets_schema = ({
+    $schema: SCHEMA,
+    $id: 'GithubOrgClaimSecrets',
+    definitions: {
+        GithubOrgClaimSecrets: {
+            $id: 'firestartr.dev://github/GithubOrgClaimSecrets',
+            type: 'object',
+            description: 'Organization-level GitHub Actions secrets',
+            properties: {
+                actions: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                    },
+                },
+                codespaces: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                    },
+                },
+                dependabot: {
+                    type: 'array',
+                    items: {
+                        $ref: 'firestartr.dev://github/GithubOrgClaimSecret',
+                    },
+                },
+            },
+            additionalProperties: false,
+        },
+        GithubOrgClaimSecretRef: {
+            $id: 'firestartr.dev://github/GithubOrgClaimSecretRef',
+            type: 'string',
+            description: 'the reference of the secret',
+            pattern: '^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$',
+        },
+        GithubOrgClaimSecret: {
+            $id: 'firestartr.dev://github/GithubOrgClaimSecret',
+            type: 'object',
+            description: 'An organization-level secret for GitHub Actions',
+            properties: {
+                name: {
+                    type: 'string',
+                    description: 'the name of the secret',
+                },
+                value: {
+                    $ref: 'firestartr.dev://github/GithubOrgClaimSecretRef',
+                },
+                visibility: {
+                    type: 'string',
+                    enum: ['all', 'selected', 'private'],
+                    description: 'which repositories can access the secret',
+                },
+                selected_repositories: {
+                    type: 'array',
+                    items: {
+                        type: 'string',
+                    },
+                    description: 'list of repository refs when visibility is selected',
+                },
+            },
+            required: ['name', 'value'],
+            additionalProperties: false,
+        },
+    },
+});
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/github/index.ts
 
 
@@ -163894,6 +164076,7 @@ const organizationSettingsProperties = {
 
 
 
+
 const GithubSchemas = [
     github_group_schema,
     github_user_schema,
@@ -163904,6 +164087,7 @@ const GithubSchemas = [
     component_secrets_vars_schema,
     component_labels_schema,
     pages_schema,
+    orgSecrets_schema,
 ];
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/tfworkspaces/terraform.schema.ts
@@ -164550,6 +164734,771 @@ const base_secrets_schema = 'firestartr.dev://common/SecretsClaim';
     SecretsClaimSchema: base_secrets_schema,
 });
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/lazy_loader.ts
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+// We need to ensure the grep command is a gnu version
+let IS_GNU_GREP = false;
+let GREP_ON_CHECK = false;
+// this loop is for avoid race conditions
+// once a check is running no more checks
+async function waitForCheck() {
+    const f_wait = () => new Promise((timeOut) => setTimeout(timeOut, 10));
+    do {
+        await f_wait();
+    } while (GREP_ON_CHECK);
+}
+function checkGrep() {
+    return new Promise((ok, ko) => {
+        // idempotency: already checked
+        if (IS_GNU_GREP)
+            return ok();
+        // a check is already running no new checks
+        if (GREP_ON_CHECK)
+            return waitForCheck();
+        logger.info('Checking the grep command');
+        GREP_ON_CHECK = true;
+        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['--version']);
+        handler.on('close', (code) => {
+            GREP_ON_CHECK = false;
+            if (code === 0) {
+                logger.debug('Grep is a gnu grep');
+                IS_GNU_GREP = true;
+                ok();
+            }
+            else {
+                ko('Lazy evaluation needs a gnu-grep command');
+            }
+        });
+    });
+}
+async function loadClaim(claimRef, org, defaults = loadClaimDefaults(), patchClaim = loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, existingRefs = {}, postValidations = new Map()) {
+    await checkGrep();
+    let result = existingRefs;
+    logger.info(`Load reference ${claimRef}`);
+    initVirtualClaims(org);
+    logger.info(`Load reference (parts) ${claimRef.split(/-/)[0]} ${claimRef.replace(/^[^-]+-/, '')}`);
+    // cargas datos con grep
+    try {
+        const claimData = await lazyGetClaim(claimRef.split(/-/)[0], claimRef.replace(/^[^-]+-/, ''), org, cwd);
+        const claim = patchClaim(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(claimData), defaults);
+        let variants = [];
+        if (claim.kind === 'TFWorkspaceClaim' &&
+            claim.providers?.terraform?.variants) {
+            variants = claim.providers.terraform.variants;
+            delete claim.providers.terraform.variants;
+        }
+        logger.silly(`Patched claim is:
+		 ---
+			${catalog_common/* default.io.toYaml */.Z.io.toYaml(claim)}`);
+        try {
+            validateClaim(claim, base[`${claim.kind}Schema`]);
+            await optionalValidation(claim);
+        }
+        catch (error) {
+            let errorMsg = '';
+            if (Array.isArray(error)) {
+                for (const data of error) {
+                    errorMsg = `${errorMsg}
+  - ${data.instancePath}: ${data.message}`;
+                }
+            }
+            else {
+                errorMsg = error instanceof Error ? error.message : String(error);
+            }
+            throw new Error(`Error when validating claim ${claimRef}: ${errorMsg}`);
+        }
+        result[claimRef] = {};
+        result[claimRef]['claim'] = claim;
+        result[claimRef]['claimPath'] = VisitedClaims[claimRef];
+        if (VisitedClaims[claimRef] === 'virtual') {
+            result = await setVirtualClaimAdditionalData(result, claim, claimRef);
+        }
+        else {
+            result = await setNonVirtualClaimAdditionalData(result, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
+        }
+        const claimKind = claim.kind;
+        const references = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(claim));
+        for (const ref of references) {
+            if (!result[ref]) {
+                const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
+                result = lodash_default().merge(result, resolvedReferences);
+            }
+        }
+        if (variants.length > 0) {
+            const parentClaimPath = VisitedClaims[claimRef];
+            for (const variant of variants) {
+                if (!variant.name || !variant.overrides) {
+                    throw new Error(`Variant in claim ${claimRef} is missing required field 'name' or 'overrides'`);
+                }
+                const prohibitedOverrideFields = ['source', 'module', 'name'];
+                for (const field of prohibitedOverrideFields) {
+                    if (field in variant.overrides) {
+                        throw new Error(`Variant '${variant.name}' in claim ${claimRef} cannot override '${field}'`);
+                    }
+                }
+                const composedName = claim.providers.terraform.name + '-' + variant.name;
+                const variantClaim = lodash_default().cloneDeep(claim);
+                variantClaim._parentClaimName = claim.name;
+                variantClaim.name = composedName;
+                variantClaim.providers.terraform = lodash_default().merge({}, claim.providers.terraform, variant.overrides);
+                variantClaim.providers.terraform.name = composedName;
+                if (!variantClaim.annotations) {
+                    variantClaim.annotations = {};
+                }
+                variantClaim.annotations['firestartr.dev/variant-of'] =
+                    claim.providers.terraform.name;
+                const variantRef = `TFWorkspaceClaim-${composedName}`;
+                if (result[variantRef]) {
+                    throw new Error(`Variant name '${variant.name}' (composed: '${composedName}') from claim '${claimRef}' conflicts with existing claim '${variantRef}'`);
+                }
+                logger.info(`Creating synthetic variant claim ${variantRef}`);
+                result[variantRef] = {};
+                result[variantRef]['claim'] = variantClaim;
+                result[variantRef]['claimPath'] = parentClaimPath;
+                result = await setNonVirtualClaimAdditionalData(result, variantClaim, variantRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
+                const variantReferences = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(variantClaim));
+                for (const ref of variantReferences) {
+                    if (!result[ref]) {
+                        const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
+                        result = lodash_default().merge(result, resolvedReferences);
+                    }
+                }
+            }
+        }
+    }
+    catch (err) {
+        throw `Lazy Loading: ${err}`;
+    }
+    return [result, postValidations];
+}
+let LoadedClaims = {};
+let VisitedClaims = {};
+let DuplicatedClaims = {};
+function resetLazyLoader() {
+    LoadedClaims = {};
+    VisitedClaims = {};
+    DuplicatedClaims = {};
+}
+async function lazyGetClaim(kind, name, org, cwd) {
+    const indice = `${kind}-${name}`;
+    logger.info(`Lazy loading ${kind}-${name} with index ${indice}`);
+    if (indice in LoadedClaims)
+        return LoadedClaims[indice];
+    if (isVirtualClaim(kind, name)) {
+        await loadVirtualClaim(kind, name, org);
+    }
+    else {
+        await getClaimsByName(name, cwd);
+    }
+    if (indice in LoadedClaims) {
+        return LoadedClaims[indice];
+    }
+    else {
+        throw new Error(`Error: ${kind}-${name} not found`);
+    }
+}
+async function getClaimsByName(name, cwd = '.') {
+    return new Promise((ok, ko) => {
+        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['-r', '-l', '--include=*', '-E', `name: "?${name}"?`, '.'], {
+            cwd: cwd,
+        });
+        logger.info(`Running ${['grep', '-r', '-l', '--include', '-E', 'name: "' + name + '"?', '.'].join(' ')}`);
+        const entradas = [];
+        const chunks = [];
+        handler.stdout.on('data', (data) => {
+            chunks.push(data.toString('utf-8'));
+        });
+        handler.on('close', () => {
+            const dataFinal = chunks.join('');
+            const fileNameList = dataFinal.split(/\n/).filter((line) => line !== '');
+            for (const fileName of fileNameList) {
+                // only yaml files
+                if (!fileName.match(/\.yml$|\.yaml$/)) {
+                    continue;
+                }
+                // only entries not already visited
+                if (Object.values(VisitedClaims).includes(fileName)) {
+                    continue;
+                }
+                entradas.push(external_path_.join(cwd, fileName));
+            }
+            return Promise.all(entradas.map((entrada) => {
+                return loadRawClaim(entrada);
+            }))
+                .then(() => {
+                ok();
+            })
+                .catch((err) => {
+                ko(err);
+            });
+        });
+    });
+}
+async function loadRawClaim(entry) {
+    return new Promise((ok, ko) => {
+        external_fs_.readFile(entry, 'utf-8', (error, data) => {
+            if (error)
+                return ko(`Reading ${entry}: ${error}`);
+            const claim = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
+            if (!('kind' in claim && 'name' in claim)) {
+                logger.warn(`Invalid claim file ${entry}`);
+            }
+            else {
+                const claimKey = `${claim.kind}-${claim.name}`;
+                if (Object.keys(DuplicatedClaims).includes(claimKey) &&
+                    DuplicatedClaims[claimKey] !== entry) {
+                    return ko(`Duplicated claim ${claimKey} found files: ${DuplicatedClaims[claimKey]} and ${entry}`);
+                }
+                LoadedClaims[claimKey] = data;
+                VisitedClaims[claimKey] = entry;
+                DuplicatedClaims[claimKey] = entry;
+                ok();
+            }
+        });
+    });
+}
+async function setVirtualClaimAdditionalData(renderedData, claim, claimRef) {
+    const virtualClaim = getVirtualClaim(claim.kind, claim.name);
+    renderedData[claimRef]['initializers'] = [
+        new UUIDInitializer(claim),
+        new InitializerClaimRef(),
+        new InitializerDefault(virtualClaim.getDefaultConfig()),
+    ];
+    renderedData[claimRef]['globals'] = [];
+    renderedData[claimRef]['overrides'] = [];
+    renderedData[claimRef]['normalizers'] = [new NameNormalizer()];
+    return renderedData;
+}
+async function setNonVirtualClaimAdditionalData(renderedData, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers) {
+    renderedData[claimRef]['initializers'] = await loadInitializers(claim, renderedData[claimRef]['claimPath']);
+    renderedData[claimRef]['globals'] = await loadGlobals(claim);
+    renderedData[claimRef]['overrides'] = loadOverrides(claim);
+    renderedData[claimRef]['normalizers'] = await loadNormalizers(claim, renderedData[claimRef]['claimPath']);
+    return renderedData;
+}
+async function loadVirtualClaim(kind, name, org) {
+    const virtualClaim = getVirtualClaim(kind, name);
+    const expandedClaim = await virtualClaim.expand({ org });
+    logger.info(`Loading virtual claim ${kind} ${name} ${org}`);
+    LoadedClaims[`${kind}-${name}`] = catalog_common/* default.io.toYaml */.Z.io.toYaml(expandedClaim);
+    VisitedClaims[`${kind}-${name}`] = 'virtual';
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/claimsDefaulter.ts
+
+
+
+/*
+ * Default blocks are objects that cannot be merged but applied as a whole. Meaning:
+ * - If the object is defined at the claim-level it is maintained *AS IT IS* (no merge)
+ * - If the block is missing at the claim-level, the default block is applied
+ */
+const defaultBlocksPaths = ['/providers/terraform/sync'];
+function applyBlockAwareDefaults(claim, defaultClaim) {
+    // we always work with a clone of the original
+    const claimClone = JSON.parse(JSON.stringify(claim));
+    // if the block is claim-level defined we store it here
+    const defaultBlocks = new Map();
+    // we remove the blocks entirely of the claim
+    // to achieve an add copy
+    for (const defaultBlockPath of defaultBlocksPaths) {
+        if (claimsDefaulter_hasDeepPath(claimClone, defaultBlockPath) !== true)
+            continue;
+        const originalValue = fast_json_patch_default().getValueByPointer(claimClone, defaultBlockPath);
+        if (originalValue) {
+            logger.silly(`${claim.kind}/${claim.name}: has an original ${defaultBlockPath}: preserving`);
+            defaultBlocks.set(defaultBlockPath, originalValue);
+            fast_json_patch_default().applyPatch(claimClone, [{ op: 'remove', path: defaultBlockPath }]);
+        }
+    }
+    // if the patch has the same path of a block
+    // and the block was defined at claim-level
+    // we interchange the value with the original value
+    // otherwise we use the default
+    const jsonPatchOps = fast_json_patch_default().compare(claimClone, defaultClaim)
+        .filter((jp) => jp.op === 'add')
+        .map((jp) => {
+        if (defaultBlocks.has(jp.path)) {
+            return {
+                ...jp,
+                value: defaultBlocks.get(jp.path),
+            };
+        }
+        else {
+            return jp;
+        }
+    });
+    return fast_json_patch_default().applyPatch(claimClone, jsonPatchOps).newDocument;
+}
+function claimsDefaulter_hasDeepPath(data, deepPath) {
+    return lodash_default().has(data, deepPath.replace(/\//g, '.').replace(/^\./, ''));
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/loader.ts
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+const isYamlFile = new RegExp(/\.(yaml|yml)$/);
+/**
+ *
+ * @returns Virtual Claims
+ */
+const virtualClaims = [new FirestartrAllClaim()];
+/*
+ * Loads all applicable globals for a given claim and stores them into a list.
+ *
+ * Input:
+ * - claim: our custom claim object, with which we check if the global is applicable
+ *
+ * Returns:
+ * - A GlobalSection array promise, containing all the globals loaded for this claim
+ *
+ */
+async function loadGlobals(claim) {
+    const result = [];
+    await crawl(getPath('globals'), (entry) => {
+        return isYamlFile.test(entry);
+    }, async (entry, data) => {
+        const globalData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
+        const ext = external_path_.extname(entry);
+        const name = external_path_.basename(entry, ext);
+        if (name in SECTIONS_BY_FILE_NAME) {
+            const section = new SECTIONS_BY_FILE_NAME[name](globalData);
+            if (!(await section.validate(SCHEMAS_BY_SECTION_NAME[name] || {}))) {
+                throw new Error(`Invalid ${name} global file`);
+            }
+            if (globalData.kind === claim.kind) {
+                result.push(section);
+            }
+            else {
+                logger.debug(`Skipping global ${name} because it is not applicable to ${claim.kind}`);
+            }
+        }
+    });
+    logger.info(`Loaded globals ${result}`);
+    return result;
+}
+/*
+ * If the input claim is a GithubRepositoryClaim, it loads all it's applicable
+ * overrides and stores them into a list. Otherwise, it returns an empty list.
+ *
+ * Input:
+ * - claim: our custom claim object, which should be a GithubRepositoryClaim
+ *
+ * Returns:
+ * - An Overrider array, with a GithubRepositoryOverrider if the claim
+ *   was a GithubRepositoryClaim, or empty if it was not.
+ *
+ */
+function loadOverrides(claim) {
+    const overrides = [];
+    if (claim.kind === 'ComponentClaim' && claim.providers.github.overrides) {
+        overrides.push(new GithubRepositoryOverrider());
+    }
+    return overrides;
+}
+/**
+ * Load all normalizers and stores them into a list.
+ * @param claim
+ * @returns
+ */
+async function loadNormalizers(_claim, path) {
+    const result = [];
+    for (const normalizer of NORMALIZERS) {
+        result.push(new normalizer({ path: path }));
+    }
+    return result;
+}
+/*
+ * Loads all applicable initializers for a given claim and stores them into a list.
+ *
+ * Input:
+ * - claim: our custom claim object, with which we check if the initializer is applicable
+ *
+ * Returns:
+ * - An Initializer array promise, containing all the initializers loaded for this claim
+ *
+ */
+let loadedInitializers = false;
+async function loadInitializers(claim, claimPath, initializersPath = getPath('initializers')) {
+    const result = [];
+    await crawl(initializersPath, (entry) => {
+        return isYamlFile.test(entry);
+    }, async (entry, data) => {
+        const initializerData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
+        const ext = external_path_.extname(entry);
+        const name = external_path_.basename(entry, ext);
+        if (name in INITIALIZERS_BY_FILE_NAME) {
+            const initializerBfN = new INITIALIZERS_BY_FILE_NAME[name](initializerData);
+            if (!(await initializerBfN.validate(SCHEMAS_BY_INITIALIZER_NAME[name] || {}))) {
+                throw new Error(`Invalid ${name} initializer file`);
+            }
+            if (initializerData.kind === claim.kind) {
+                result.push(initializerBfN);
+            }
+            else {
+                logger.debug(`Skipping initializer ${name} because it is not applicable to ${claim.kind}`);
+            }
+        }
+    });
+    for (const initializer of INITIALIZERS) {
+        if (initializer.applicableKinds.includes(claim.kind)) {
+            result.push(new initializer({ path: claimPath }));
+        }
+    }
+    logger.info(`Loaded initializers ${JSON.stringify(result)}`);
+    loadedInitializers = result;
+    return loadedInitializers;
+}
+function loadClaimDefaults() {
+    try {
+        return catalog_common/* default.io.fromYaml */.Z.io.fromYaml(external_fs_.readFileSync(`${getPath('claimsDefaults')}/claims_defaults.yaml`, 'utf-8'));
+    }
+    catch (error) {
+        const errMsg = `Could not read claims defaults file in path ${getPath('claimsDefaults')}/claims_defaults.yaml: ${error}`;
+        logger.error(errMsg);
+        throw new Error(errMsg);
+    }
+}
+/*
+ * Using fast-json-patch, compares a claim to its kind's defaults, then patches it.
+ *
+ * Input:
+ * - claim: our custom claim object, which we want to patch
+ * - defaultsClaims: an object, containing the defaults for each claim kind,
+ *   with the same structure that we use for the actual claims
+ *
+ * Returns:
+ * - The patched claim
+ *
+ */
+function loader_patchClaim(claim, defaultsClaims) {
+    if (defaultsClaims[claim.kind]) {
+        claim = applyBlockAwareDefaults(claim, defaultsClaims[claim.kind]);
+    }
+    return claim;
+}
+async function loadCRsWithFullSet(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
+    const result = {};
+    const fullResult = {};
+    await crawlWithExclusions(crsPath, (entry) => {
+        return isYamlFile.test(entry);
+    }, async (entry, data) => {
+        const yamlData = stripKnownRelations(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data));
+        const metadata = yamlData?.metadata;
+        if (!(yamlData &&
+            typeof yamlData === 'object' &&
+            'kind' in yamlData &&
+            metadata &&
+            typeof metadata === 'object' &&
+            'name' in metadata)) {
+            logger.warn(`Invalid CR file ${entry}`);
+        }
+        else {
+            const crKey = `${yamlData.kind}-${metadata.name}`;
+            if (fullResult[crKey]) {
+                logger.error(`Duplicate CR ${crKey}`);
+            }
+            // Keep the complete CR set for validations that need repository-wide context.
+            fullResult[crKey] = yamlData;
+            // Keep the filtered CR set for previous-CR lookup during claim rendering.
+            if (allowedClaimReferences.length === 0 ||
+                allowedClaimReferences.includes(yamlData.metadata?.annotations?.[catalog_common/* default.generic.getFirestartrAnnotation */.Z.generic.getFirestartrAnnotation('claim-ref')])) {
+                result[crKey] = yamlData;
+            }
+        }
+    }, excludedPaths.concat(getAdditionalPaths()));
+    return { crs: result, fullCrs: fullResult };
+}
+async function loadCRs(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
+    const { crs } = await loadCRsWithFullSet(crsPath, excludedPaths, allowedClaimReferences);
+    return crs;
+}
+/*
+ * Description: Get the renamed using claimRef annotation
+ * Input: claims: any, crs: any
+ * Output: renames: IRenameResult[]
+ */
+async function loadRenames(claims, crs) {
+    /*
+     * If checkRenames is false, we don't need to check for renames
+     */
+    const renamesEnabled = getRenamesEnabled();
+    if (!renamesEnabled)
+        return [];
+    const result = [];
+    /**
+     * For each CR, look for a claim that does not match the name with CR's firestartr.dev/claim-ref annotation
+     */
+    for (const cr of Object.values(crs)) {
+        const anyCr = cr;
+        if (!anyCr?.metadata?.annotations)
+            continue;
+        // if the annotation is a claimRef
+        const annotationName = common.generic.getFirestartrAnnotation('claim-ref');
+        const annotations = anyCr?.metadata?.annotations || {};
+        if (annotationName in annotations) {
+            const claimRef = anyCr.metadata.annotations[annotationName];
+            // split the annotation into kind and name
+            const [kind, name] = claimRef.split('/');
+            // if the claim exists, check if the name is different for the given provider
+            const referencedClaim = claims[`${kind}-${name}`].claim;
+            const oldName = anyCr.metadata.name;
+            const newName = referencedClaim.providers[getConfiguredProvider()].name;
+            if (oldName !== newName) {
+                result.push({
+                    kind: referencedClaim.kind,
+                    claimPath: claims[`${kind}-${name}`].claimPath,
+                    claimName: referencedClaim.name,
+                    oldName,
+                    newName,
+                });
+            }
+        }
+    }
+    return result;
+}
+async function loadClaimsList(claimRefList, claimsPath = getPath('claims')) {
+    const data = {
+        renderClaims: {},
+        crs: {},
+        fullCrs: {},
+    };
+    const defaults = loadClaimDefaults();
+    for await (const claimRef of claimRefList) {
+        const [renderedClaimData] = await loadClaim(claimRef, getOrg(), defaults, loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, claimsPath);
+        data.renderClaims = lodash_default().merge(data.renderClaims, renderedClaimData);
+    }
+    const crClaimReferences = [];
+    for (const ref of Object.keys(data.renderClaims)) {
+        // Replaces only the first instance of '-'
+        crClaimReferences.push(ref.replace('-', '/'));
+    }
+    const loadedCrs = await loadCRsWithFullSet(getPath('crs'), [getPath('globals'), getPath('initializers')], crClaimReferences);
+    data['crs'] = loadedCrs.crs;
+    data['fullCrs'] = loadedCrs.fullCrs;
+    return data;
+}
+function getOrg() {
+    const groupOrg = catalog_common/* default.environment.getFromEnvironmentWithDefault */.Z.environment.getFromEnvironmentWithDefault(catalog_common/* default.types.envVars.org */.Z.types.envVars.org, '');
+    return groupOrg;
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/references.ts
+function validateTfStateKeyUniqueness(crs) {
+    const tfStateKeys = {};
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (!isTerraformWorkspace(cr))
+            continue;
+        const tfKey = cr.spec.firestartr.tfStateKey;
+        if (tfStateKeys[tfKey]) {
+            throw new Error(`❗❗ ❌ RENDER ERROR ❌ ❗❗
+
+The tfStateKey ${tfKey} is not unique,
+
+It is being used by the following CRs:
+
+- ${tfStateKeys[tfKey].kind} ${tfStateKeys[tfKey].metadata.name}
+
+- ${cr.kind} ${cr.metadata.name}
+
+Check the following Claims to ensure that the tfStateKey is unique:
+
+- ${tfStateKeys[tfKey].metadata.annotations['firestartr.dev/claim-ref']}
+
+- ${cr.metadata.annotations['firestartr.dev/claim-ref']}
+`);
+        }
+        tfStateKeys[cr.spec.firestartr.tfStateKey] = cr;
+    }
+}
+function references_isCatalogEntity(cr) {
+    return [
+        'Component',
+        'Domain',
+        'System',
+        'User',
+        'Group',
+        'Resource',
+    ].includes(cr.kind);
+}
+function isTerraformWorkspace(cr) {
+    return cr.kind === 'FirestartrTerraformWorkspace';
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/crSize.ts
+
+const K8S_OBJECT_SIZE_LIMIT = 1572864; // 1.5 MiB in bytes, etcd recommended limit: https://etcd.io/docs/latest/dev-guide/limit/
+function validateCrSizes(crs) {
+    for (const key of Object.keys(crs)) {
+        const cr = crs[key];
+        const serialized = catalog_common/* default.io.toYaml */.Z.io.toYaml(cr);
+        const size = Buffer.byteLength(serialized, 'utf8');
+        if (size > K8S_OBJECT_SIZE_LIMIT) {
+            throw new Error(`CR "${cr.kind}-${cr.metadata.name}" exceeds the Kubernetes object size limit by ${size - K8S_OBJECT_SIZE_LIMIT} bytes. Maximum allowed is ${K8S_OBJECT_SIZE_LIMIT} bytes (1.5MiB).`);
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/permissions.ts
+
+function validatePermissionsUniqueness(crs) {
+    for (const crkey in crs) {
+        const cr = crs[crkey];
+        if (cr.kind === 'FirestartrGithubRepository') {
+            const permissions = cr.spec.permissions;
+            logger.debug(`Validating Permissions Uniqueness of ${crkey}`);
+            if (permissions) {
+                const rolesByIdentifier = new Map();
+                for (const perm of permissions) {
+                    const identifier = perm.collaborator
+                        ? perm.collaborator
+                        : `ref:${perm.ref.kind}:${perm.ref.name}`;
+                    const role = perm.role;
+                    const prevRole = rolesByIdentifier.get(identifier);
+                    if (prevRole === undefined) {
+                        rolesByIdentifier.set(identifier, role);
+                    }
+                    else if (prevRole !== role) {
+                        throw new Error(`Conflicting permission role in FirestartrGithubRepository ${crkey}: ${identifier} has roles "${prevRole}" and "${role}".\nFull CR: ${JSON.stringify(cr, null, 2)}`);
+                    }
+                }
+            }
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/backstageAnnotations.ts
+const backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX = 'firestartr.backstage.dev/';
+const CATALOG_KINDS = new Set([
+    'User',
+    'Group',
+    'Component',
+    'System',
+    'Domain',
+    'API',
+    'Resource',
+    'CatalogKubernetesResource',
+    'CatalogTerraformWorkspace',
+    'CatalogArgoDeploy',
+    'CatalogOrgWebhook',
+    'CatalogSecrets',
+]);
+function validateNoBackstageAnnotationsInK8sCrs(crs) {
+    for (const crKey in crs) {
+        const cr = crs[crKey];
+        if (CATALOG_KINDS.has(cr.kind))
+            continue;
+        if (cr.metadata?.annotations) {
+            const backstageKeys = Object.keys(cr.metadata.annotations).filter((k) => k.startsWith(backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX));
+            if (backstageKeys.length > 0) {
+                throw new Error(`K8s CR ${crKey} contains Backstage-only annotations (${backstageKeys.join(', ')}). ` +
+                    `Annotations with prefix ${backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX} must only appear on Backstage catalog entities, not on Kubernetes CRs.`);
+            }
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/refsSorter/refsSorter.ts
+
+/**
+ * @param renderClaims renderClaims to sort
+ * @param kinds kinds to get from renderClaims
+ * @returns renderClaims with only the kinds specified
+ */
+function sortRenderClaimsByKind(renderClaims, kinds) {
+    let result = {};
+    for (const kind of kinds) {
+        for (const key in renderClaims) {
+            if (renderClaims[key].claim.kind === kind) {
+                result[key] = renderClaims[key];
+            }
+        }
+        result = sortSelfKindRefs(result, kind);
+    }
+    return result;
+}
+function sortSelfKindRefs(renderClaims, kind) {
+    if (!hasSelfRefs(kind)) {
+        return renderClaims;
+    }
+    const newRenderClaims = {};
+    const data = extractRefs(renderClaims, kind);
+    const ordered = [];
+    const visiting = [];
+    const visited = [];
+    for (const key of Object.keys(data)) {
+        if (!visited.find((obj) => obj.name === key)) {
+            sortRefs(data, data[key], ordered, visiting, visited);
+        }
+    }
+    for (const cr of ordered) {
+        newRenderClaims[cr.name] = renderClaims[cr.name];
+    }
+    return newRenderClaims;
+}
+function sortRefs(data, claim, ordered = [], visiting = [], visited = []) {
+    if (visiting.find((obj) => obj.name === claim.name)) {
+        throw new Error(`Circular dependency detected for '${claim.name}'`);
+    }
+    if (!visited.find((obj) => obj.name === claim.name)) {
+        visiting.push(claim);
+        if (claim.refs) {
+            for (const ref of claim.refs) {
+                const referencedObject = data[ref];
+                if (!referencedObject) {
+                    throw new Error(`Reference '${ref}' does not exist for '${claim.name}'`);
+                }
+                sortRefs(data, referencedObject, ordered, visiting, visited);
+            }
+        }
+        visited.push(visiting.pop());
+        ordered.push(claim);
+    }
+}
+function hasSelfRefs(kind) {
+    return ['TFWorkspaceClaim', 'GroupClaim'].includes(kind);
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-sorter.ts
+
+function sortKinds(orderedKinds, claims) {
+    const result = [];
+    for (const kind of orderedKinds) {
+        const kindRenderClaims = sortRenderClaimsByKind(claims, [kind]);
+        result.push(kindRenderClaims);
+    }
+    return result;
+}
+
 ;// CONCATENATED MODULE: ../features_renderer/src/common.ts
 
 function isDirectory(path) {
@@ -164589,16 +165538,6 @@ var ajv_default = /*#__PURE__*/__nccwpck_require__.n(dist_ajv);
                         $ref: '#/definitions/File',
                     },
                 },
-                claimPatches: {
-                    type: 'array',
-                    items: {
-                        $ref: '#/definitions/Patch',
-                    },
-                },
-                // Legacy field kept for backward compatibility. Real feature packages
-                // (prefapp/features) ship `patches` in the provider-keyed object
-                // shape. The renderer ignores it for claim-level behaviour; claim-level
-                // patches must come from `claimPatches`.
                 patches: {
                     type: 'object',
                     patternProperties: {
@@ -164630,7 +165569,7 @@ var ajv_default = /*#__PURE__*/__nccwpck_require__.n(dist_ajv);
                     },
                 },
             },
-            required: ['args', 'feature_name', 'files'],
+            required: ['args', 'feature_name', 'files', 'patches'],
             title: 'root',
         },
         Args: {
@@ -164710,10 +165649,10 @@ var ajv_default = /*#__PURE__*/__nccwpck_require__.n(dist_ajv);
                     type: 'string',
                 },
                 value: {
-                    type: ['string', 'object', 'array', 'number', 'boolean', 'null'],
+                    type: 'string',
                 },
             },
-            required: ['op', 'path'],
+            required: ['name', 'op', 'path'],
             title: 'Patch',
         },
     },
@@ -164735,10 +165674,10 @@ function validate(featurePath) {
 }
 function __validateDirStructure(featurePath) {
     if (!isDirectory(featurePath)) {
-        throw new Error(`Feature: ${featurePath} not a directory`);
+        throw `Feature: ${featurePath} not a directory`;
     }
     if (!isFile(external_path_.join(featurePath, 'config.yaml'))) {
-        throw new Error(`Feature: ${featurePath}/config.yaml not found or not a file`);
+        throw `Feature: ${featurePath}/config.yaml not found or not a file`;
     }
 }
 function __validateFeatureConfig(featurePath) {
@@ -164748,16 +165687,10 @@ function __validateFeatureConfig(featurePath) {
         return configData;
     }
     catch (error) {
-        throw new Error(`Feature: loading config.yaml: ${error}`);
+        throw `Feature: loading config.yaml: ${error}`;
     }
 }
 function __validateFeatureConfigData(configData) {
-    // Detect old provider-keyed claimPatches shape for migration hint.
-    if (configData.claimPatches &&
-        !Array.isArray(configData.claimPatches) &&
-        typeof configData.claimPatches === 'object') {
-        throw new Error(`Feature: config.yaml invalid claimPatches: expected flat array of claimPatches (claim-relative pointers like /annotations/backstage.io~1techdocs-ref), but got provider-keyed object ${JSON.stringify(Object.keys(configData.claimPatches))}. Migrate: claimPatches: { catalog: [...] } → claimPatches: [{ op, path: /annotations/backstage.io~1techdocs-ref, value }]. $ref paths also migrate: [spec, org] → [providers, github, org], [metadata, annotations, firestartr.dev/external-name] → [providers, github, name]`);
-    }
     const ajv = new (ajv_default())({
         allowUnionTypes: true,
     });
@@ -164768,7 +165701,7 @@ function __validateFeatureConfigData(configData) {
     const validate = ajv.compile(activeSchema);
     const valid = validate(configData);
     if (!valid) {
-        throw new Error(`Feature: config.yaml invalid ${JSON.stringify(validate.errors)}`);
+        throw `Feature: config.yaml invalid ${JSON.stringify(validate.errors)}`;
     }
 }
 function stripAnchoringConstraints(schemaDef) {
@@ -164779,26 +165712,12 @@ function stripAnchoringConstraints(schemaDef) {
     return clone;
 }
 function __validateJsonPatches(configData) {
-    const patches = configData.claimPatches;
-    if (!Array.isArray(patches))
-        return;
-    const err = fast_json_patch_default().validate(patches);
-    if (err) {
-        throw new Error(`Feature: config.yaml -> claimPatches: invalid claimPatches ${JSON.stringify(err.message ?? err)}`);
-    }
-    // Legacy provider-keyed `patches` field is accepted for backward
-    // compatibility. Its values are per-provider arrays of the same Patch
-    // shape, so validate each of them too.
-    const legacyPatches = configData.patches;
-    if (legacyPatches && typeof legacyPatches === 'object') {
-        for (const key of Object.keys(legacyPatches)) {
-            const arr = legacyPatches[key];
-            if (!Array.isArray(arr)) {
-                throw new Error(`Feature: config.yaml -> patches.${key}: expected an array of patches, got ${typeof arr}`);
-            }
-            const legacyErr = fast_json_patch_default().validate(arr);
-            if (legacyErr) {
-                throw new Error(`Feature: config.yaml -> patches.${key}: invalid patch ${JSON.stringify(legacyErr.message ?? legacyErr)}`);
+    const keys = Object.keys(configData.patches);
+    for (const key of keys) {
+        if (configData.patches[key]) {
+            if (fast_json_patch_default().validate(configData.patches[key])) {
+                const errors = JSON.stringify(fast_json_patch_default().validate(configData.patches[key]).message);
+                throw `Feature: config.yaml -> patches: invalid patches ${errors}`;
             }
         }
     }
@@ -165645,12 +166564,10 @@ const renderTestsSchema = {
             items: {
                 type: 'object',
                 additionalProperties: false,
-                required: ['name'],
-                anyOf: [{ required: ['cr'] }, { required: ['claim'] }],
+                required: ['name', 'cr'],
                 properties: {
                     name: { type: 'string', minLength: 1 },
                     cr: { type: 'string', minLength: 1 },
-                    claim: { type: 'string', minLength: 1 },
                     args: { type: 'object' },
                 },
             },
@@ -165705,9 +166622,6 @@ function resolveCrPath(featurePath, crRelPath) {
     }
     return resolved;
 }
-function resolveClaimPath(featurePath, claimRelPath) {
-    return resolveCrPath(featurePath, claimRelPath);
-}
 function listYamlFiles(dir) {
     if (!fs.existsSync(dir))
         return [];
@@ -165771,7 +166685,7 @@ function buildExpectedOutput(config, renderDir) {
     }));
     return {
         files,
-        claimPatches: config.claimPatches || [],
+        patches: config.patches || [],
         traceability: {},
     };
 }
@@ -165826,7 +166740,6 @@ async function createRenderContext(prefix = 'feature-render-') {
     buildExpectedOutput,
     loadAndValidateRenderTests,
     resolveCrPath,
-    resolveClaimPath,
 });
 
 ;// CONCATENATED MODULE: ../features_renderer/src/featureArgsValidation.ts
@@ -165919,7 +166832,7 @@ function render(featurePath, featureRenderPath, entity, firestartrConfig = {}, f
             resolveInside(featureRenderPath, dest, 'file dest', 'render target directory');
         }
     }
-    const output = { files: [], claimPatches: [] };
+    const output = { files: [] };
     context.config.files.forEach((file) => {
         const { src, dest } = file;
         // For now let's keep upgradable flag for backward compatibility
@@ -165940,125 +166853,30 @@ function render(featurePath, featureRenderPath, entity, firestartrConfig = {}, f
             userManaged: userManaged,
             targetBranch,
         });
+        output.patches = context.config.patches;
+        // Not used anymore
+        // output.unpatches = context.config.unpatches
     });
-    // claimPatches are applied to the claim during claim stitching. Present in
-    // the output even when empty or when the feature renders no files. The
-    // legacy `patches` field is deliberately not copied: it is accepted in
-    // config.yaml for backward compatibility but ignored for claim-level
-    // behaviour.
-    output.claimPatches = context.config.claimPatches || [];
     output.traceability = context.traceability;
-    external_fs_default().mkdirSync(featureRenderPath, { recursive: true });
     external_fs_default().writeFileSync(external_path_default().join(featureRenderPath, 'config.json'), JSON.stringify(context.config));
     // write the output file
     const configFile = external_path_default().join(featureRenderPath, 'output.json');
     external_fs_default().writeFileSync(configFile, JSON.stringify(output));
     return output;
 }
-function getClaimPatches(featurePath, entity, firestartrConfig = {}, featureArgs = {}) {
-    const configData = validate(featurePath);
-    validateFeatureArgs(featurePath, featureArgs);
-    const context = buildContext(entity, configData.args, firestartrConfig, featureArgs);
-    const rendered = JSON.parse(renderContent(JSON.stringify(configData), context));
-    return rendered.claimPatches ?? [];
-}
-function buildContext(stitchedClaim, args, firestartrConfig, featureArgs) {
+function buildContext(entity, args, firestartrConfig, featureArgs) {
     const context = {};
-    const resolveRef = (doc, ref) => {
-        const v = lodash_default().get(doc, ref);
-        if (v !== undefined)
-            return v;
-        // Fallback for transition: try CR-shaped alternatives when stitchedClaim is CR-shaped
-        // and vice versa. Covers the ADR 0006 table plus legacy feature_a provisioner paths.
-        const altTable = {
-            'providers,github,org': [
-                ['spec', 'org'],
-                ['spec', 'provisioner', 'org'],
-            ],
-            'providers,github,branchStrategy,defaultBranch': [
-                ['spec', 'repo', 'defaultBranch'],
-                ['spec', 'provisioner', 'repo', 'defaultBranch'],
-            ],
-            'providers,github,name': [
-                ['metadata', 'annotations', 'firestartr.dev/external-name'],
-                ['metadata', 'name'],
-            ],
-            'providers,github,technology,stack': [
-                ['spec', 'firestartr', 'technology', 'stack'],
-                ['spec', 'provisioner', 'technology', 'stack'],
-            ],
-            name: [['metadata', 'name']],
-            'annotations,firestartr.dev/dest-annotation': [
-                ['metadata', 'annotations', 'firestartr.dev/dest-annotation'],
-            ],
-        };
-        const key = ref.join(',');
-        const alts = altTable[key];
-        if (alts) {
-            for (const alt of alts) {
-                const av = lodash_default().get(doc, alt);
-                if (av !== undefined)
-                    return av;
-            }
-        }
-        // Reverse fallback: if ref is CR-shaped, try claim-shaped
-        const reverseTable = {
-            'spec,org': ['providers', 'github', 'org'],
-            'spec,provisioner,technology,stack': [
-                'providers',
-                'github',
-                'technology',
-                'stack',
-            ],
-            'spec,firestartr,technology,stack': [
-                'providers',
-                'github',
-                'technology',
-                'stack',
-            ],
-            'metadata,name': ['name'],
-            'metadata,annotations,firestartr.dev/dest-annotation': [
-                'annotations',
-                'firestartr.dev/dest-annotation',
-            ],
-            'spec,provisioner,org': ['providers', 'github', 'org'],
-            'spec,provisioner,repo,defaultBranch': [
-                'providers',
-                'github',
-                'branchStrategy',
-                'defaultBranch',
-            ],
-            'spec,repo,defaultBranch': [
-                'providers',
-                'github',
-                'branchStrategy',
-                'defaultBranch',
-            ],
-            'metadata,annotations,firestartr.dev/external-name': [
-                'providers',
-                'github',
-                'name',
-            ],
-        };
-        const rev = reverseTable[ref.join(',')];
-        if (rev) {
-            const rv = lodash_default().get(doc, rev);
-            if (rv !== undefined)
-                return rv;
-        }
-        return v;
-    };
     Object.entries(args).forEach(([key, arg]) => {
         if ('$default' in arg) {
             if (Array.isArray(arg['$default'])) {
-                context[key] = resolveRef(stitchedClaim, arg['$default']);
+                context[key] = lodash_default().get(entity, arg['$default']);
             }
             else {
                 context[key] = arg['$default'];
             }
         }
         if ('$ref' in arg) {
-            const refValue = resolveRef(stitchedClaim, arg['$ref']);
+            const refValue = lodash_default().get(entity, arg['$ref']);
             context[key] = refValue;
         }
         else if ('$lit' in arg) {
@@ -166188,7 +167006,6 @@ function updateFileContent(featureRenderPath, filePath, content) {
 
 
 
-
 /* harmony default export */ const features_renderer = ({
     validate: validate,
     render: render,
@@ -166198,7 +167015,6 @@ function updateFileContent(featureRenderPath, filePath, content) {
     renderContent: renderContent,
     expandFiles: expandFiles,
     validateFeatureArgs: validateFeatureArgs,
-    getClaimPatches: getClaimPatches,
 });
 
 ;// CONCATENATED MODULE: ../features_preparer/src/logger.ts
@@ -166223,13 +167039,6 @@ function renderFeature(featureName, version, owner, repo, featureOwner, renderPa
 function renderFeatureFromPath(extractPath, renderedPath, featureOwner, featureArgs = {}) {
     return features_renderer.render(extractPath, renderedPath, featureOwner, {}, featureArgs);
 }
-function getFeatureClaimPatches(featureName, version, owner, repo, featureOwner, featureArgs = {}) {
-    const extractPath = external_path_default().join(catalog_common/* default.features.tarballs.getFeaturesExtractPath */.Z.features.tarballs.getFeaturesExtractPath(featureName, version, owner, repo), 'packages', featureName);
-    return getClaimPatches(extractPath, featureOwner, {}, featureArgs);
-}
-function getFeatureClaimPatchesFromPath(extractPath, featureOwner, featureArgs = {}) {
-    return getClaimPatches(extractPath, featureOwner, {}, featureArgs);
-}
 
 // EXTERNAL MODULE: ../../node_modules/adm-zip/adm-zip.js
 var adm_zip = __nccwpck_require__(7993);
@@ -166280,7 +167089,6 @@ featureArgs = {}, repo = 'features', owner = 'prefapp') {
 async function processFeature(featureName, reference, featureOwner, // -> cr
 featureArgs = {}, repo = 'features', owner = 'prefapp') {
     await downloadFeatureZip(repo, featureName, reference, owner);
-    featureArgs = { ...(featureArgs ?? {}) };
     const commitInfo = await resolveFeatureCommit(owner, repo, reference);
     featureArgs['traceability'] = {
         version: reference,
@@ -166294,27 +167102,6 @@ featureArgs = {}, repo = 'features', owner = 'prefapp') {
     };
     return renderFeature(featureName, reference, owner, repo, featureOwner, '/tmp', featureArgs);
 }
-async function installer_getFeatureClaimPatches(featureName, version, featureOwner, featureArgs = {}, repo = 'features', owner = 'prefapp') {
-    const reference = `${featureName}-v${version}`;
-    return processFeatureClaimPatches(featureName, reference, featureOwner, featureArgs, repo, owner);
-}
-async function getFeatureClaimPatchesFromRef(featureName, featureRef, featureOwner, featureArgs = {}, repo = 'features', owner = 'prefapp') {
-    const reference = `${featureRef}`;
-    return processFeatureClaimPatches(featureName, reference, featureOwner, featureArgs, repo, owner);
-}
-async function processFeatureClaimPatches(featureName, reference, featureOwner, featureArgs = {}, repo = 'features', owner = 'prefapp') {
-    await downloadFeatureZip(repo, featureName, reference, owner);
-    featureArgs = { ...(featureArgs ?? {}) };
-    featureArgs['traceability'] = {
-        version: reference,
-        owner,
-        repo,
-        name: featureName,
-        ref: reference,
-        url: `https://github.com/${owner}/${repo}/tree/${reference}/packages/${featureName}`,
-    };
-    return getFeatureClaimPatches(featureName, reference, owner, repo, featureOwner, featureArgs);
-}
 async function resolveFeatureCommit(owner, repo, reference) {
     try {
         const octokit = await github["default"].getOctokitForOrg(owner, true);
@@ -166402,9 +167189,6 @@ async function downloadFeatureZip(repo, featureName, reference, owner = 'prefapp
 /* harmony default export */ const src = ({
     renderFeature: renderFeature,
     renderFeatureFromPath: renderFeatureFromPath,
-    getFeatureClaimPatches: installer_getFeatureClaimPatches,
-    getFeatureClaimPatchesFromRef: getFeatureClaimPatchesFromRef,
-    getFeatureClaimPatchesFromPath: getFeatureClaimPatchesFromPath,
     getFeatureConfigFromRef: getFeatureConfigFromRef,
     getFeatureConfig: getFeatureConfig,
     prepareFeature: prepareFeature,
@@ -166419,1266 +167203,8 @@ async function downloadFeatureZip(repo, featureName, reference, owner = 'prefapp
     renderFeatureFromPath: src.renderFeatureFromPath,
     getFeatureConfig: src.getFeatureConfig,
     getFeatureConfigFromRef: src.getFeatureConfigFromRef,
-    getFeatureClaimPatches: src.getFeatureClaimPatches,
-    getFeatureClaimPatchesFromRef: src.getFeatureClaimPatchesFromRef,
-    getFeatureClaimPatchesFromPath: src.getFeatureClaimPatchesFromPath,
 });
 
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/stitching/protectedPaths.ts
-// Platform-curated protected claim paths — features may not write to these.
-// Stored as JSON Pointers (RFC 6901). Supports wildcard `*` for a single segment.
-// Example: /providers/STAR/org matches /providers/github/org where STAR is *.
-const PROTECTED_CLAIM_PATHS = [
-    '/kind',
-    '/name',
-    '/providers/*/org',
-    '/providers/github/org',
-    '/providers/github/name',
-    '/providers/*/features',
-    '/metadata/name',
-    '/metadata/namespace',
-];
-function isProtectedPath(patchPath) {
-    const normalizedPatch = normalizePointer(patchPath);
-    for (const protectedPath of PROTECTED_CLAIM_PATHS) {
-        if (matchesProtected(protectedPath, normalizedPatch)) {
-            return true;
-        }
-    }
-    return false;
-}
-function normalizePointer(pointer) {
-    // '' is RFC 6901's whole-document (root) pointer. Replacing the root touches
-    // every protected field, so it must keep its identity for classification
-    // instead of being rewritten to '/' (the "" empty-string member).
-    if (pointer === '')
-        return pointer;
-    if (!pointer.startsWith('/')) {
-        return '/' + pointer;
-    }
-    return pointer;
-}
-function matchesProtected(protectedPointer, patchPointer) {
-    const protectedSegments = protectedPointer
-        .split('/')
-        .slice(1)
-        .map(unescapePointer);
-    const patchSegments = patchPointer.split('/').slice(1).map(unescapePointer);
-    // Treat ancestor/descendant as protected: a patch to a parent (e.g. /metadata)
-    // would replace the protected child (/metadata/name), and a patch to a child
-    // (e.g. /metadata/name/extra) is also under the protected tree. Match when
-    // the shorter prefix equals the longer prefix (with wildcard support).
-    const minLen = Math.min(protectedSegments.length, patchSegments.length);
-    for (let i = 0; i < minLen; i++) {
-        if (protectedSegments[i] === '*')
-            continue;
-        if (protectedSegments[i] !== patchSegments[i])
-            return false;
-    }
-    return true;
-}
-function unescapePointer(segment) {
-    return segment.replace(/~1/g, '/').replace(/~0/g, '~');
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/stitching/errors.ts
-class StitchingError extends Error {
-    constructor(violations) {
-        const lines = violations.map((v) => `  - ${v.message}`).join('\n');
-        super(`Claim stitching failed with ${violations.length} violation(s):\n${lines}`);
-        this.name = 'StitchingError';
-        this.violations = violations;
-    }
-}
-function formatStitchingError(error) {
-    return error.message;
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/stitching/validateFeatureDescriptors.ts
-
-
-let validateFeatureDescriptors_validate;
-let validateFeatureDescriptors_ajv;
-function getValidate() {
-    if (!validateFeatureDescriptors_validate) {
-        validateFeatureDescriptors_ajv = new (_2020_default())();
-        validateFeatureDescriptors_ajv.addSchema(feature_schema.definitions.GithubComponentFeatureClaim);
-        validateFeatureDescriptors_validate = validateFeatureDescriptors_ajv.compile({
-            type: 'array',
-            items: { $ref: 'firestartr.dev://github/GithubComponentFeatureClaim' },
-        });
-    }
-    return validateFeatureDescriptors_validate;
-}
-// Validates the `providers.github.features` descriptor array against the same
-// GithubComponentFeatureClaim schema used by claim-kind AJV validation. This
-// runs BEFORE any feature preparer (auth/network) is invoked, so malformed or
-// unauthorized `repo`/`ref`/`version` values are rejected without triggering
-// GitHub downloads. Full AJV validation of the stitched claim is still applied
-// after stitching.
-function validateFeatureDescriptors(claim) {
-    const typedClaim = claim;
-    const features = typedClaim.providers?.github?.features;
-    if (!Array.isArray(features))
-        return;
-    const v = getValidate();
-    if (v(features))
-        return;
-    const details = (v.errors ?? [])
-        .map((e) => {
-        const formatted = `${e.instancePath || '/'} ${e.message}`;
-        return `  - ${formatted}`;
-    })
-        .join('\n');
-    throw new Error(`Invalid feature descriptor(s):\n${details}\nFix the claim before stitching or rendering.`);
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/stitching/stitching.ts
-
-
-
-
-
-let MOCK_FEATURES_FN;
-function MOCK_STITCHING_FEATURES(mock) {
-    MOCK_FEATURES_FN = mock;
-}
-// Non-enumerable stamp marking a claim as already stitched. Lets stitching be
-// once-only at each entry point (e.g. renderFromImports) without re-running
-// feature downloads or re-applying gates on the same claim object.
-const STITCHED_CLAIM = Symbol('firestartr.stitchedClaim');
-function stitching_unescapePointer(segment) {
-    return segment.replace(/~1/g, '/').replace(/~0/g, '~');
-}
-function pointerExists(doc, pointer) {
-    const segments = pointer.split('/').slice(1).map(stitching_unescapePointer);
-    let cur = doc;
-    for (const seg of segments) {
-        if (cur === null || cur === undefined || typeof cur !== 'object')
-            return false;
-        if (!Object.prototype.hasOwnProperty.call(cur, seg))
-            return false;
-        cur = cur[seg];
-    }
-    return true;
-}
-function isAppendPointer(pointer) {
-    return pointer.endsWith('/-');
-}
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-// Deduplication identity for a feature patch (Phase 1 silent dedup). Two
-// patches are only considered identical intent when the operation, the
-// normalized pointer, and — for array appends (`add ... /-`) — the appended
-// element's `name` all match, e.g. two features adding the same label. The
-// operation is part of the identity so an `add` and a `replace` on the same
-// pointer are never deduplicated against each other.
-function dedupIdentity(patch) {
-    const path = normalizePointer(patch.path);
-    if (patch.op === 'add' &&
-        isAppendPointer(path) &&
-        isRecord(patch.value) &&
-        typeof patch.value.name === 'string') {
-        return `${patch.op} ${path}#${patch.value.name}`;
-    }
-    return `${patch.op} ${path}`;
-}
-// Write region for a feature patch — the claim locations the patch occupies.
-// For a regular op it is the unescaped pointer segments; for an array append
-// (`add ... /-`) carrying a `name` it is the array parent plus the element
-// `name`, so two appends of distinct names stay sibling writes while an append
-// and a whole-array write overlap.
-function writeRegion(patch) {
-    const path = normalizePointer(patch.path);
-    const segments = path.split('/').slice(1).map(stitching_unescapePointer);
-    if (patch.op === 'add' &&
-        isAppendPointer(path) &&
-        isRecord(patch.value) &&
-        typeof patch.value.name === 'string') {
-        return [...segments.slice(0, -1), patch.value.name];
-    }
-    return segments;
-}
-// Ancestor/descendant (or identical) regions conflict: under JSON Patch
-// semantics a parent write replaces its whole subtree, so the composed result
-// would depend on feature order. Distinct-name appends yield sibling regions
-// and stay composable.
-function regionsOverlap(a, b) {
-    const minLen = Math.min(a.length, b.length);
-    for (let i = 0; i < minLen; i++) {
-        if (a[i] !== b[i])
-            return false;
-    }
-    return true;
-}
-function isStitchedClaim(claim) {
-    return (isRecord(claim) &&
-        claim[STITCHED_CLAIM] === true);
-}
-function markStitched(claim) {
-    if (isRecord(claim)) {
-        Object.defineProperty(claim, STITCHED_CLAIM, {
-            value: true,
-            enumerable: false,
-            writable: false,
-            configurable: true,
-        });
-    }
-    return claim;
-}
-// Check whether an array at `appendPath`'s parent already contains an element
-// whose `name` matches `value.name`.  Used for the "claim wins" gate: when a
-// feature tries to append an array element that already exists in the claim,
-// the patch is silently dropped.
-function arrayElementExists(doc, appendPath, value) {
-    if (!isRecord(value) || typeof value.name !== 'string')
-        return false;
-    const parentPath = appendPath.slice(0, -2); // strip trailing /-
-    const segments = parentPath.split('/').slice(1).map(stitching_unescapePointer);
-    let cur = doc;
-    for (const seg of segments) {
-        if (cur === null || cur === undefined || typeof cur !== 'object')
-            return false;
-        if (!Object.prototype.hasOwnProperty.call(cur, seg))
-            return false;
-        cur = cur[seg];
-    }
-    if (!Array.isArray(cur))
-        return false;
-    return cur.some((el) => isRecord(el) && el.name === value.name);
-}
-// fast-json-patch does not create intermediate containers for `add`, and
-// appending to an array requires the array to already exist. Ensure every
-// ancestor segment exists before applying an `add`: missing containers are
-// created as objects, except the immediate parent of a `/-` append, which is
-// created as an array. Existing (user/default-declared) values are never
-// overwritten.
-function ensureAddParents(doc, patch) {
-    const segments = patch.path.split('/').slice(1);
-    let prefix = '';
-    for (let i = 0; i < segments.length - 1; i++) {
-        prefix += '/' + segments[i];
-        if (pointerExists(doc, prefix))
-            continue;
-        const isArrayParent = isAppendPointer(patch.path) && i === segments.length - 2;
-        const value = isArrayParent ? [] : {};
-        try {
-            doc = fast_json_patch.applyPatch(doc, [{ op: 'add', path: prefix, value }], false, false).newDocument;
-        }
-        catch {
-            // Concurrent structural conflict — let the actual patch surface the error.
-        }
-    }
-    return doc;
-}
-async function stitchClaim(claimAfterDefaults, preCollectedEnvelopes, originalClaim) {
-    if (isStitchedClaim(claimAfterDefaults)) {
-        return claimAfterDefaults;
-    }
-    const envelopes = preCollectedEnvelopes ?? (await collectFeaturePatches(claimAfterDefaults));
-    if (envelopes.length === 0) {
-        return markStitched(claimAfterDefaults);
-    }
-    // Normalize all patches once so every gate and the apply phase use the same pointers.
-    const normalizedEnvelopes = envelopes.map((env) => ({
-        feature: env.feature,
-        patches: env.patches.map((p) => ({
-            ...p,
-            path: normalizePointer(p.path),
-            _raw: p.path,
-        })),
-    }));
-    // ── Phase 1: silently drop patches that should not be applied ──────────
-    //  • Array append whose element already exists in the claim → claim wins
-    //    (never for protected claim paths, which are rejected in Phase 2)
-    //  • Duplicate identity with identical value across features → silent dedup
-    //    (a feature's own ordered patches are always retained verbatim)
-    const dropped = new Set(); // "envelopeIdx:patchIdx"
-    const seenIdentities = new Map();
-    for (let ei = 0; ei < normalizedEnvelopes.length; ei++) {
-        const envelope = normalizedEnvelopes[ei];
-        for (let pi = 0; pi < envelope.patches.length; pi++) {
-            const patch = envelope.patches[pi];
-            const key = `${ei}:${pi}`;
-            // Array claim-wins: element already in claim → drop (protected paths
-            // are exempt so every attempt on them is rejected in Phase 2)
-            if (patch.op === 'add' &&
-                isAppendPointer(patch.path) &&
-                !isProtectedPath(patch.path)) {
-                if (arrayElementExists(claimAfterDefaults, patch.path, patch.value)) {
-                    dropped.add(key);
-                    continue;
-                }
-            }
-            // Silent dedup across features only: same op + destination + value from
-            // a DIFFERENT feature → drop. A feature's own ordered patches (e.g. a
-            // repeated append, or a scalar written twice) are always retained.
-            const identity = dedupIdentity(patch);
-            const existing = seenIdentities.get(identity);
-            if (existing && existing.feature !== envelope.feature) {
-                if (JSON.stringify(existing.value) === JSON.stringify(patch.value)) {
-                    dropped.add(key);
-                    continue;
-                }
-                // Different value — kept here, caught as a violation in Phase 2.
-            }
-            // Refresh the recorded writer/value so later features compare against
-            // the latest write by this feature.
-            seenIdentities.set(identity, {
-                feature: envelope.feature,
-                value: patch.value,
-            });
-        }
-    }
-    // ── Phase 2: collect violations on non-dropped patches ─────────────────
-    const violations = [];
-    // Writers observed so far (write region + feature). Gate 2 compares every new
-    // patch's region against prior writers from OTHER features, covering both
-    // identical destinations and ancestor/descendant destinations.
-    const priorWrites = [];
-    for (let ei = 0; ei < normalizedEnvelopes.length; ei++) {
-        const envelope = normalizedEnvelopes[ei];
-        // Per-feature shadow document: tracks mutations within this envelope so that
-        // ordered sequences like add → replace within one feature resolve correctly.
-        let shadow = JSON.parse(JSON.stringify(claimAfterDefaults));
-        for (let pi = 0; pi < envelope.patches.length; pi++) {
-            if (dropped.has(`${ei}:${pi}`))
-                continue;
-            const patch = envelope.patches[pi];
-            const path = patch.path;
-            const raw = patch._raw ?? path;
-            // Gate 1: protected path
-            if (isProtectedPath(path)) {
-                violations.push({
-                    feature: envelope.feature,
-                    op: patch.op,
-                    path,
-                    reason: 'protected-path',
-                    message: `Feature '${envelope.feature}' patch ${patch.op} ${raw} (normalized ${path}) targets protected claim path`,
-                });
-            }
-            // Gate 2: conflicting write from a DIFFERENT feature to the same
-            // destination or an ancestor/descendant of it (region-based, op-agnostic
-            // — see writeRegion). A feature's own ordered patches never self-conflict.
-            const region = writeRegion(patch);
-            const overlapping = priorWrites.find((w) => w.feature !== envelope.feature && regionsOverlap(w.region, region));
-            if (overlapping) {
-                violations.push({
-                    feature: envelope.feature,
-                    op: patch.op,
-                    path,
-                    reason: 'duplicate-path',
-                    conflictingFeature: overlapping.feature,
-                    message: `Feature '${envelope.feature}' and '${overlapping.feature}' both write overlapping paths (${raw} overlaps ${overlapping.path}); compose them in one feature instead`,
-                });
-            }
-            priorWrites.push({ region, feature: envelope.feature, path });
-            // Gate 3: replace / remove to a path absent from this feature's mutation
-            //        sequence (tracked via shadow), not the static claimAfterDefaults.
-            if (['replace', 'remove'].includes(patch.op)) {
-                if (!pointerExists(shadow, path)) {
-                    violations.push({
-                        feature: envelope.feature,
-                        op: patch.op,
-                        path,
-                        reason: 'overwrite-protected',
-                        message: `Feature '${envelope.feature}' patch ${patch.op} ${raw} (normalized ${path}) targets absent path (replace/remove requires existing value)`,
-                    });
-                }
-            }
-            // Gate 4: non-append ops must not overwrite a user-declared field
-            // (overwrite protection). The user's own claim wins over any feature.
-            // Only the patch's target field itself is protected: adding a sibling
-            // field under a user-declared parent (e.g. a new field in
-            // /providers/github) is allowed. Array appends (`add ... /-`) are
-            // exempt: the appended element is deduplicated against the claim in
-            // Phase 1, preserving original values, while distinct elements from
-            // multiple features may be added.
-            if (originalClaim && !isAppendPointer(path)) {
-                if (pointerExists(originalClaim, path)) {
-                    violations.push({
-                        feature: envelope.feature,
-                        op: patch.op,
-                        path,
-                        reason: 'user-declared-path',
-                        message: `Feature '${envelope.feature}' patch ${patch.op} ${raw} (normalized ${path}) targets a field declared by the user (overwrite protection)`,
-                    });
-                }
-            }
-            // Update shadow for subsequent patches within this feature
-            try {
-                if (patch.op === 'add')
-                    shadow = ensureAddParents(shadow, patch);
-                shadow = fast_json_patch.applyPatch(shadow, [patch], false, false).newDocument;
-            }
-            catch {
-                /* leave shadow unchanged — Gate 3 stays conservative */
-            }
-        }
-    }
-    if (violations.length > 0) {
-        throw new StitchingError(violations);
-    }
-    // ── Phase 3: apply remaining patches ───────────────────────────────────
-    let stitched = JSON.parse(JSON.stringify(claimAfterDefaults));
-    for (let ei = 0; ei < normalizedEnvelopes.length; ei++) {
-        const envelope = normalizedEnvelopes[ei];
-        const patchesToApply = envelope.patches.filter((_, pi) => !dropped.has(`${ei}:${pi}`));
-        if (patchesToApply.length === 0)
-            continue;
-        // ── Apply each patch in order, creating parents for adds as needed ───
-        for (const patch of patchesToApply) {
-            if (patch.op === 'add') {
-                stitched = ensureAddParents(stitched, patch);
-            }
-            const result = fast_json_patch.applyPatch(stitched, [patch], false, false);
-            stitched = result.newDocument;
-        }
-    }
-    return markStitched(stitched);
-}
-async function collectFeaturePatches(claim) {
-    if (MOCK_FEATURES_FN) {
-        return MOCK_FEATURES_FN(claim);
-    }
-    const typedClaim = claim;
-    const features = typedClaim.providers?.github?.features;
-    if (features === undefined)
-        return [];
-    if (!Array.isArray(features)) {
-        throw new Error('Invalid feature descriptor(s): /providers/github/features must be an array');
-    }
-    if (features.length === 0)
-        return [];
-    // Gate 0: reject malformed feature descriptors (repo/ref/version shape)
-    // BEFORE any preparer call, so no auth/network work is triggered by data
-    // that claim-kind AJV validation would reject.
-    validateFeatureDescriptors(claim);
-    const envelopes = [];
-    for (const feature of features) {
-        const featureName = feature.name;
-        const versionOrRef = feature.ref ?? feature.version ?? '';
-        const repo = feature.repo
-            ? (feature.repo.split('/')[1] ?? 'features')
-            : 'features';
-        const owner = feature.repo
-            ? (feature.repo.split('/')[0] ?? 'prefapp')
-            : 'prefapp';
-        const args = feature.args ?? {};
-        try {
-            let patchesOrRendered;
-            const preparerAny = features_preparer;
-            if (feature.ref) {
-                if (typeof preparerAny.getFeatureClaimPatchesFromRef === 'function') {
-                    patchesOrRendered = await preparerAny.getFeatureClaimPatchesFromRef(featureName, versionOrRef, claim, args, repo, owner);
-                }
-                else {
-                    patchesOrRendered = await preparerAny.getFeatureConfigFromRef(featureName, versionOrRef, claim, args, repo, owner);
-                }
-            }
-            else {
-                if (typeof preparerAny.getFeatureClaimPatches === 'function') {
-                    patchesOrRendered = await preparerAny.getFeatureClaimPatches(featureName, versionOrRef, claim, args, repo, owner);
-                }
-                else {
-                    patchesOrRendered = await preparerAny.getFeatureConfig(featureName, versionOrRef, claim, args, repo, owner);
-                }
-            }
-            const patches = Array.isArray(patchesOrRendered)
-                ? patchesOrRendered
-                : extractClaimPatches(patchesOrRendered);
-            envelopes.push({ feature: featureName, patches });
-        }
-        catch (err) {
-            throw new Error(`Failed to collect claimPatches for feature '${featureName}': ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
-    return envelopes;
-}
-function extractClaimPatches(rendered) {
-    const patches = rendered.claimPatches;
-    if (!patches)
-        return [];
-    if (Array.isArray(patches))
-        return patches;
-    throw new Error(`Feature claimPatches must be a flat array (claim-relative pointers like /annotations/...), got ${typeof patches}: ${JSON.stringify(patches).slice(0, 200)}`);
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/lazy_loader.ts
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-// We need to ensure the grep command is a gnu version
-let IS_GNU_GREP = false;
-let GREP_ON_CHECK = false;
-// this loop is for avoid race conditions
-// once a check is running no more checks
-async function waitForCheck() {
-    const f_wait = () => new Promise((timeOut) => setTimeout(timeOut, 10));
-    do {
-        await f_wait();
-    } while (GREP_ON_CHECK);
-}
-function checkGrep() {
-    return new Promise((ok, ko) => {
-        // idempotency: already checked
-        if (IS_GNU_GREP)
-            return ok();
-        // a check is already running no new checks
-        if (GREP_ON_CHECK)
-            return waitForCheck();
-        logger.info('Checking the grep command');
-        GREP_ON_CHECK = true;
-        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['--version']);
-        handler.on('close', (code) => {
-            GREP_ON_CHECK = false;
-            if (code === 0) {
-                logger.debug('Grep is a gnu grep');
-                IS_GNU_GREP = true;
-                ok();
-            }
-            else {
-                ko('Lazy evaluation needs a gnu-grep command');
-            }
-        });
-    });
-}
-async function loadClaim(claimRef, org, defaults = loadClaimDefaults(), patchClaim = loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, existingRefs = {}, postValidations = new Map()) {
-    await checkGrep();
-    let result = existingRefs;
-    logger.info(`Load reference ${claimRef}`);
-    initVirtualClaims(org);
-    logger.info(`Load reference (parts) ${claimRef.split(/-/)[0]} ${claimRef.replace(/^[^-]+-/, '')}`);
-    // cargas datos con grep
-    try {
-        const claimData = await lazyGetClaim(claimRef.split(/-/)[0], claimRef.replace(/^[^-]+-/, ''), org, cwd);
-        const rawClaim = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(claimData);
-        let claim = patchClaim(rawClaim, defaults);
-        // Claim stitching: feature claim-patches with gates before AJV
-        try {
-            claim = await stitchClaim(claim, undefined, rawClaim);
-        }
-        catch (e) {
-            throw new Error(`Error when stitching claim ${claimRef}: ${e instanceof Error ? e.message : String(e)}`);
-        }
-        let variants = [];
-        if (claim.kind === 'TFWorkspaceClaim' &&
-            claim.providers?.terraform?.variants) {
-            variants = claim.providers.terraform.variants;
-            delete claim.providers.terraform.variants;
-        }
-        logger.silly(`Patched claim is:
-		 ---
-			${catalog_common/* default.io.toYaml */.Z.io.toYaml(claim)}`);
-        try {
-            validateClaim(claim, base[`${claim.kind}Schema`]);
-            await optionalValidation(claim);
-        }
-        catch (error) {
-            let errorMsg = '';
-            if (Array.isArray(error)) {
-                for (const data of error) {
-                    errorMsg = `${errorMsg}
-  - ${data.instancePath}: ${data.message}`;
-                }
-            }
-            else {
-                errorMsg = error instanceof Error ? error.message : String(error);
-            }
-            throw new Error(`Error when validating claim ${claimRef}: ${errorMsg}`);
-        }
-        result[claimRef] = {};
-        result[claimRef]['claim'] = claim;
-        result[claimRef]['claimPath'] = VisitedClaims[claimRef];
-        if (VisitedClaims[claimRef] === 'virtual') {
-            result = await setVirtualClaimAdditionalData(result, claim, claimRef);
-        }
-        else {
-            result = await setNonVirtualClaimAdditionalData(result, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
-        }
-        const claimKind = claim.kind;
-        const references = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(claim));
-        for (const ref of references) {
-            if (!result[ref]) {
-                const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
-                result = lodash_default().merge(result, resolvedReferences);
-            }
-        }
-        if (variants.length > 0) {
-            const parentClaimPath = VisitedClaims[claimRef];
-            for (const variant of variants) {
-                if (!variant.name || !variant.overrides) {
-                    throw new Error(`Variant in claim ${claimRef} is missing required field 'name' or 'overrides'`);
-                }
-                const prohibitedOverrideFields = ['source', 'module', 'name'];
-                for (const field of prohibitedOverrideFields) {
-                    if (field in variant.overrides) {
-                        throw new Error(`Variant '${variant.name}' in claim ${claimRef} cannot override '${field}'`);
-                    }
-                }
-                const composedName = claim.providers.terraform.name + '-' + variant.name;
-                const variantClaim = lodash_default().cloneDeep(claim);
-                variantClaim._parentClaimName = claim.name;
-                variantClaim.name = composedName;
-                variantClaim.providers.terraform = lodash_default().merge({}, claim.providers.terraform, variant.overrides);
-                variantClaim.providers.terraform.name = composedName;
-                if (!variantClaim.annotations) {
-                    variantClaim.annotations = {};
-                }
-                variantClaim.annotations['firestartr.dev/variant-of'] =
-                    claim.providers.terraform.name;
-                const variantRef = `TFWorkspaceClaim-${composedName}`;
-                if (result[variantRef]) {
-                    throw new Error(`Variant name '${variant.name}' (composed: '${composedName}') from claim '${claimRef}' conflicts with existing claim '${variantRef}'`);
-                }
-                logger.info(`Creating synthetic variant claim ${variantRef}`);
-                result[variantRef] = {};
-                result[variantRef]['claim'] = variantClaim;
-                result[variantRef]['claimPath'] = parentClaimPath;
-                result = await setNonVirtualClaimAdditionalData(result, variantClaim, variantRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
-                const variantReferences = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(variantClaim));
-                for (const ref of variantReferences) {
-                    if (!result[ref]) {
-                        const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
-                        result = lodash_default().merge(result, resolvedReferences);
-                    }
-                }
-            }
-        }
-    }
-    catch (err) {
-        throw `Lazy Loading: ${err}`;
-    }
-    return [result, postValidations];
-}
-let LoadedClaims = {};
-let VisitedClaims = {};
-let DuplicatedClaims = {};
-function resetLazyLoader() {
-    LoadedClaims = {};
-    VisitedClaims = {};
-    DuplicatedClaims = {};
-}
-async function lazyGetClaim(kind, name, org, cwd) {
-    const indice = `${kind}-${name}`;
-    logger.info(`Lazy loading ${kind}-${name} with index ${indice}`);
-    if (indice in LoadedClaims)
-        return LoadedClaims[indice];
-    if (isVirtualClaim(kind, name)) {
-        await loadVirtualClaim(kind, name, org);
-    }
-    else {
-        await getClaimsByName(name, cwd);
-    }
-    if (indice in LoadedClaims) {
-        return LoadedClaims[indice];
-    }
-    else {
-        throw new Error(`Error: ${kind}-${name} not found`);
-    }
-}
-async function getClaimsByName(name, cwd = '.') {
-    return new Promise((ok, ko) => {
-        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['-r', '-l', '--include=*', '-E', `name: "?${name}"?`, '.'], {
-            cwd: cwd,
-        });
-        logger.info(`Running ${['grep', '-r', '-l', '--include', '-E', 'name: "' + name + '"?', '.'].join(' ')}`);
-        const entradas = [];
-        const chunks = [];
-        handler.stdout.on('data', (data) => {
-            chunks.push(data.toString('utf-8'));
-        });
-        handler.on('close', () => {
-            const dataFinal = chunks.join('');
-            const fileNameList = dataFinal.split(/\n/).filter((line) => line !== '');
-            for (const fileName of fileNameList) {
-                // only yaml files
-                if (!fileName.match(/\.yml$|\.yaml$/)) {
-                    continue;
-                }
-                // only entries not already visited
-                if (Object.values(VisitedClaims).includes(fileName)) {
-                    continue;
-                }
-                entradas.push(external_path_.join(cwd, fileName));
-            }
-            return Promise.all(entradas.map((entrada) => {
-                return loadRawClaim(entrada);
-            }))
-                .then(() => {
-                ok();
-            })
-                .catch((err) => {
-                ko(err);
-            });
-        });
-    });
-}
-async function loadRawClaim(entry) {
-    return new Promise((ok, ko) => {
-        external_fs_.readFile(entry, 'utf-8', (error, data) => {
-            if (error)
-                return ko(`Reading ${entry}: ${error}`);
-            const claim = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
-            if (!('kind' in claim && 'name' in claim)) {
-                logger.warn(`Invalid claim file ${entry}`);
-            }
-            else {
-                const claimKey = `${claim.kind}-${claim.name}`;
-                if (Object.keys(DuplicatedClaims).includes(claimKey) &&
-                    DuplicatedClaims[claimKey] !== entry) {
-                    return ko(`Duplicated claim ${claimKey} found files: ${DuplicatedClaims[claimKey]} and ${entry}`);
-                }
-                LoadedClaims[claimKey] = data;
-                VisitedClaims[claimKey] = entry;
-                DuplicatedClaims[claimKey] = entry;
-                ok();
-            }
-        });
-    });
-}
-async function setVirtualClaimAdditionalData(renderedData, claim, claimRef) {
-    const virtualClaim = getVirtualClaim(claim.kind, claim.name);
-    renderedData[claimRef]['initializers'] = [
-        new UUIDInitializer(claim),
-        new InitializerClaimRef(),
-        new InitializerDefault(virtualClaim.getDefaultConfig()),
-    ];
-    renderedData[claimRef]['globals'] = [];
-    renderedData[claimRef]['overrides'] = [];
-    renderedData[claimRef]['normalizers'] = [new NameNormalizer()];
-    return renderedData;
-}
-async function setNonVirtualClaimAdditionalData(renderedData, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers) {
-    renderedData[claimRef]['initializers'] = await loadInitializers(claim, renderedData[claimRef]['claimPath']);
-    renderedData[claimRef]['globals'] = await loadGlobals(claim);
-    renderedData[claimRef]['overrides'] = loadOverrides(claim);
-    renderedData[claimRef]['normalizers'] = await loadNormalizers(claim, renderedData[claimRef]['claimPath']);
-    return renderedData;
-}
-async function loadVirtualClaim(kind, name, org) {
-    const virtualClaim = getVirtualClaim(kind, name);
-    const expandedClaim = await virtualClaim.expand({ org });
-    logger.info(`Loading virtual claim ${kind} ${name} ${org}`);
-    LoadedClaims[`${kind}-${name}`] = catalog_common/* default.io.toYaml */.Z.io.toYaml(expandedClaim);
-    VisitedClaims[`${kind}-${name}`] = 'virtual';
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/claimsDefaulter.ts
-
-
-
-/*
- * Default blocks are objects that cannot be merged but applied as a whole. Meaning:
- * - If the object is defined at the claim-level it is maintained *AS IT IS* (no merge)
- * - If the block is missing at the claim-level, the default block is applied
- */
-const defaultBlocksPaths = ['/providers/terraform/sync'];
-function applyBlockAwareDefaults(claim, defaultClaim) {
-    // we always work with a clone of the original
-    const claimClone = JSON.parse(JSON.stringify(claim));
-    // if the block is claim-level defined we store it here
-    const defaultBlocks = new Map();
-    // we remove the blocks entirely of the claim
-    // to achieve an add copy
-    for (const defaultBlockPath of defaultBlocksPaths) {
-        if (claimsDefaulter_hasDeepPath(claimClone, defaultBlockPath) !== true)
-            continue;
-        const originalValue = fast_json_patch_default().getValueByPointer(claimClone, defaultBlockPath);
-        if (originalValue) {
-            logger.silly(`${claim.kind}/${claim.name}: has an original ${defaultBlockPath}: preserving`);
-            defaultBlocks.set(defaultBlockPath, originalValue);
-            fast_json_patch_default().applyPatch(claimClone, [{ op: 'remove', path: defaultBlockPath }]);
-        }
-    }
-    // if the patch has the same path of a block
-    // and the block was defined at claim-level
-    // we interchange the value with the original value
-    // otherwise we use the default
-    const jsonPatchOps = fast_json_patch_default().compare(claimClone, defaultClaim)
-        .filter((jp) => jp.op === 'add')
-        .map((jp) => {
-        if (defaultBlocks.has(jp.path)) {
-            return {
-                ...jp,
-                value: defaultBlocks.get(jp.path),
-            };
-        }
-        else {
-            return jp;
-        }
-    });
-    return fast_json_patch_default().applyPatch(claimClone, jsonPatchOps).newDocument;
-}
-function claimsDefaulter_hasDeepPath(data, deepPath) {
-    return lodash_default().has(data, deepPath.replace(/\//g, '.').replace(/^\./, ''));
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/loader.ts
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-const isYamlFile = new RegExp(/\.(yaml|yml)$/);
-/**
- *
- * @returns Virtual Claims
- */
-const virtualClaims = [new FirestartrAllClaim()];
-/*
- * Loads all applicable globals for a given claim and stores them into a list.
- *
- * Input:
- * - claim: our custom claim object, with which we check if the global is applicable
- *
- * Returns:
- * - A GlobalSection array promise, containing all the globals loaded for this claim
- *
- */
-async function loadGlobals(claim) {
-    const result = [];
-    await crawl(getPath('globals'), (entry) => {
-        return isYamlFile.test(entry);
-    }, async (entry, data) => {
-        const globalData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
-        const ext = external_path_.extname(entry);
-        const name = external_path_.basename(entry, ext);
-        if (name in SECTIONS_BY_FILE_NAME) {
-            const section = new SECTIONS_BY_FILE_NAME[name](globalData);
-            if (!(await section.validate(SCHEMAS_BY_SECTION_NAME[name] || {}))) {
-                throw new Error(`Invalid ${name} global file`);
-            }
-            if (globalData.kind === claim.kind) {
-                result.push(section);
-            }
-            else {
-                logger.debug(`Skipping global ${name} because it is not applicable to ${claim.kind}`);
-            }
-        }
-    });
-    logger.info(`Loaded globals ${result}`);
-    return result;
-}
-/*
- * If the input claim is a GithubRepositoryClaim, it loads all it's applicable
- * overrides and stores them into a list. Otherwise, it returns an empty list.
- *
- * Input:
- * - claim: our custom claim object, which should be a GithubRepositoryClaim
- *
- * Returns:
- * - An Overrider array, with a GithubRepositoryOverrider if the claim
- *   was a GithubRepositoryClaim, or empty if it was not.
- *
- */
-function loadOverrides(claim) {
-    const overrides = [];
-    if (claim.kind === 'ComponentClaim' && claim.providers.github.overrides) {
-        overrides.push(new GithubRepositoryOverrider());
-    }
-    return overrides;
-}
-/**
- * Load all normalizers and stores them into a list.
- * @param claim
- * @returns
- */
-async function loadNormalizers(_claim, path) {
-    const result = [];
-    for (const normalizer of NORMALIZERS) {
-        result.push(new normalizer({ path: path }));
-    }
-    return result;
-}
-/*
- * Loads all applicable initializers for a given claim and stores them into a list.
- *
- * Input:
- * - claim: our custom claim object, with which we check if the initializer is applicable
- *
- * Returns:
- * - An Initializer array promise, containing all the initializers loaded for this claim
- *
- */
-let loadedInitializers = false;
-async function loadInitializers(claim, claimPath, initializersPath = getPath('initializers')) {
-    const result = [];
-    await crawl(initializersPath, (entry) => {
-        return isYamlFile.test(entry);
-    }, async (entry, data) => {
-        const initializerData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
-        const ext = external_path_.extname(entry);
-        const name = external_path_.basename(entry, ext);
-        if (name in INITIALIZERS_BY_FILE_NAME) {
-            const initializerBfN = new INITIALIZERS_BY_FILE_NAME[name](initializerData);
-            if (!(await initializerBfN.validate(SCHEMAS_BY_INITIALIZER_NAME[name] || {}))) {
-                throw new Error(`Invalid ${name} initializer file`);
-            }
-            if (initializerData.kind === claim.kind) {
-                result.push(initializerBfN);
-            }
-            else {
-                logger.debug(`Skipping initializer ${name} because it is not applicable to ${claim.kind}`);
-            }
-        }
-    });
-    for (const initializer of INITIALIZERS) {
-        if (initializer.applicableKinds.includes(claim.kind)) {
-            result.push(new initializer({ path: claimPath }));
-        }
-    }
-    logger.info(`Loaded initializers ${JSON.stringify(result)}`);
-    loadedInitializers = result;
-    return loadedInitializers;
-}
-function loadClaimDefaults() {
-    try {
-        return catalog_common/* default.io.fromYaml */.Z.io.fromYaml(external_fs_.readFileSync(`${getPath('claimsDefaults')}/claims_defaults.yaml`, 'utf-8'));
-    }
-    catch (error) {
-        const errMsg = `Could not read claims defaults file in path ${getPath('claimsDefaults')}/claims_defaults.yaml: ${error}`;
-        logger.error(errMsg);
-        throw new Error(errMsg);
-    }
-}
-/*
- * Using fast-json-patch, compares a claim to its kind's defaults, then patches it.
- *
- * Input:
- * - claim: our custom claim object, which we want to patch
- * - defaultsClaims: an object, containing the defaults for each claim kind,
- *   with the same structure that we use for the actual claims
- *
- * Returns:
- * - The patched claim
- *
- */
-function loader_patchClaim(claim, defaultsClaims) {
-    if (defaultsClaims[claim.kind]) {
-        claim = applyBlockAwareDefaults(claim, defaultsClaims[claim.kind]);
-    }
-    return claim;
-}
-async function loadCRsWithFullSet(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
-    const result = {};
-    const fullResult = {};
-    await crawlWithExclusions(crsPath, (entry) => {
-        return isYamlFile.test(entry);
-    }, async (entry, data) => {
-        const yamlData = stripKnownRelations(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data));
-        const metadata = yamlData?.metadata;
-        if (!(yamlData &&
-            typeof yamlData === 'object' &&
-            'kind' in yamlData &&
-            metadata &&
-            typeof metadata === 'object' &&
-            'name' in metadata)) {
-            logger.warn(`Invalid CR file ${entry}`);
-        }
-        else {
-            const crKey = `${yamlData.kind}-${metadata.name}`;
-            if (fullResult[crKey]) {
-                logger.error(`Duplicate CR ${crKey}`);
-            }
-            // Keep the complete CR set for validations that need repository-wide context.
-            fullResult[crKey] = yamlData;
-            // Keep the filtered CR set for previous-CR lookup during claim rendering.
-            if (allowedClaimReferences.length === 0 ||
-                allowedClaimReferences.includes(yamlData.metadata?.annotations?.[catalog_common/* default.generic.getFirestartrAnnotation */.Z.generic.getFirestartrAnnotation('claim-ref')])) {
-                result[crKey] = yamlData;
-            }
-        }
-    }, excludedPaths.concat(getAdditionalPaths()));
-    return { crs: result, fullCrs: fullResult };
-}
-async function loadCRs(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
-    const { crs } = await loadCRsWithFullSet(crsPath, excludedPaths, allowedClaimReferences);
-    return crs;
-}
-/*
- * Description: Get the renamed using claimRef annotation
- * Input: claims: any, crs: any
- * Output: renames: IRenameResult[]
- */
-async function loadRenames(claims, crs) {
-    /*
-     * If checkRenames is false, we don't need to check for renames
-     */
-    const renamesEnabled = getRenamesEnabled();
-    if (!renamesEnabled)
-        return [];
-    const result = [];
-    /**
-     * For each CR, look for a claim that does not match the name with CR's firestartr.dev/claim-ref annotation
-     */
-    for (const cr of Object.values(crs)) {
-        const anyCr = cr;
-        if (!anyCr?.metadata?.annotations)
-            continue;
-        // if the annotation is a claimRef
-        const annotationName = common.generic.getFirestartrAnnotation('claim-ref');
-        const annotations = anyCr?.metadata?.annotations || {};
-        if (annotationName in annotations) {
-            const claimRef = anyCr.metadata.annotations[annotationName];
-            // split the annotation into kind and name
-            const [kind, name] = claimRef.split('/');
-            // if the claim exists, check if the name is different for the given provider
-            const referencedClaim = claims[`${kind}-${name}`].claim;
-            const oldName = anyCr.metadata.name;
-            const newName = referencedClaim.providers[getConfiguredProvider()].name;
-            if (oldName !== newName) {
-                result.push({
-                    kind: referencedClaim.kind,
-                    claimPath: claims[`${kind}-${name}`].claimPath,
-                    claimName: referencedClaim.name,
-                    oldName,
-                    newName,
-                });
-            }
-        }
-    }
-    return result;
-}
-async function loadClaimsList(claimRefList, claimsPath = getPath('claims')) {
-    const data = {
-        renderClaims: {},
-        crs: {},
-        fullCrs: {},
-    };
-    const defaults = loadClaimDefaults();
-    for await (const claimRef of claimRefList) {
-        const [renderedClaimData] = await loadClaim(claimRef, getOrg(), defaults, loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, claimsPath);
-        data.renderClaims = lodash_default().merge(data.renderClaims, renderedClaimData);
-    }
-    const crClaimReferences = [];
-    for (const ref of Object.keys(data.renderClaims)) {
-        // Replaces only the first instance of '-'
-        crClaimReferences.push(ref.replace('-', '/'));
-    }
-    const loadedCrs = await loadCRsWithFullSet(getPath('crs'), [getPath('globals'), getPath('initializers')], crClaimReferences);
-    data['crs'] = loadedCrs.crs;
-    data['fullCrs'] = loadedCrs.fullCrs;
-    return data;
-}
-function getOrg() {
-    const groupOrg = catalog_common/* default.environment.getFromEnvironmentWithDefault */.Z.environment.getFromEnvironmentWithDefault(catalog_common/* default.types.envVars.org */.Z.types.envVars.org, '');
-    return groupOrg;
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/references.ts
-function validateTfStateKeyUniqueness(crs) {
-    const tfStateKeys = {};
-    for (const crKey of Object.keys(crs)) {
-        const cr = crs[crKey];
-        if (!isTerraformWorkspace(cr))
-            continue;
-        const tfKey = cr.spec.firestartr.tfStateKey;
-        if (tfStateKeys[tfKey]) {
-            throw new Error(`❗❗ ❌ RENDER ERROR ❌ ❗❗
-
-The tfStateKey ${tfKey} is not unique,
-
-It is being used by the following CRs:
-
-- ${tfStateKeys[tfKey].kind} ${tfStateKeys[tfKey].metadata.name}
-
-- ${cr.kind} ${cr.metadata.name}
-
-Check the following Claims to ensure that the tfStateKey is unique:
-
-- ${tfStateKeys[tfKey].metadata.annotations['firestartr.dev/claim-ref']}
-
-- ${cr.metadata.annotations['firestartr.dev/claim-ref']}
-`);
-        }
-        tfStateKeys[cr.spec.firestartr.tfStateKey] = cr;
-    }
-}
-function references_isCatalogEntity(cr) {
-    return [
-        'Component',
-        'Domain',
-        'System',
-        'User',
-        'Group',
-        'Resource',
-    ].includes(cr.kind);
-}
-function isTerraformWorkspace(cr) {
-    return cr.kind === 'FirestartrTerraformWorkspace';
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/crSize.ts
-
-const K8S_OBJECT_SIZE_LIMIT = 1572864; // 1.5 MiB in bytes, etcd recommended limit: https://etcd.io/docs/latest/dev-guide/limit/
-function validateCrSizes(crs) {
-    for (const key of Object.keys(crs)) {
-        const cr = crs[key];
-        const serialized = catalog_common/* default.io.toYaml */.Z.io.toYaml(cr);
-        const size = Buffer.byteLength(serialized, 'utf8');
-        if (size > K8S_OBJECT_SIZE_LIMIT) {
-            throw new Error(`CR "${cr.kind}-${cr.metadata.name}" exceeds the Kubernetes object size limit by ${size - K8S_OBJECT_SIZE_LIMIT} bytes. Maximum allowed is ${K8S_OBJECT_SIZE_LIMIT} bytes (1.5MiB).`);
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/permissions.ts
-
-function validatePermissionsUniqueness(crs) {
-    for (const crkey in crs) {
-        const cr = crs[crkey];
-        if (cr.kind === 'FirestartrGithubRepository') {
-            const permissions = cr.spec.permissions;
-            logger.debug(`Validating Permissions Uniqueness of ${crkey}`);
-            if (permissions) {
-                const rolesByIdentifier = new Map();
-                for (const perm of permissions) {
-                    const identifier = perm.collaborator
-                        ? perm.collaborator
-                        : `ref:${perm.ref.kind}:${perm.ref.name}`;
-                    const role = perm.role;
-                    const prevRole = rolesByIdentifier.get(identifier);
-                    if (prevRole === undefined) {
-                        rolesByIdentifier.set(identifier, role);
-                    }
-                    else if (prevRole !== role) {
-                        throw new Error(`Conflicting permission role in FirestartrGithubRepository ${crkey}: ${identifier} has roles "${prevRole}" and "${role}".\nFull CR: ${JSON.stringify(cr, null, 2)}`);
-                    }
-                }
-            }
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/backstageAnnotations.ts
-const backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX = 'firestartr.backstage.dev/';
-const CATALOG_KINDS = new Set([
-    'User',
-    'Group',
-    'Component',
-    'System',
-    'Domain',
-    'API',
-    'Resource',
-    'CatalogKubernetesResource',
-    'CatalogTerraformWorkspace',
-    'CatalogArgoDeploy',
-    'CatalogOrgWebhook',
-    'CatalogSecrets',
-]);
-function validateNoBackstageAnnotationsInK8sCrs(crs) {
-    for (const crKey in crs) {
-        const cr = crs[crKey];
-        if (CATALOG_KINDS.has(cr.kind))
-            continue;
-        if (cr.metadata?.annotations) {
-            const backstageKeys = Object.keys(cr.metadata.annotations).filter((k) => k.startsWith(backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX));
-            if (backstageKeys.length > 0) {
-                throw new Error(`K8s CR ${crKey} contains Backstage-only annotations (${backstageKeys.join(', ')}). ` +
-                    `Annotations with prefix ${backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX} must only appear on Backstage catalog entities, not on Kubernetes CRs.`);
-            }
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/refsSorter/refsSorter.ts
-
-/**
- * @param renderClaims renderClaims to sort
- * @param kinds kinds to get from renderClaims
- * @returns renderClaims with only the kinds specified
- */
-function sortRenderClaimsByKind(renderClaims, kinds) {
-    let result = {};
-    for (const kind of kinds) {
-        for (const key in renderClaims) {
-            if (renderClaims[key].claim.kind === kind) {
-                result[key] = renderClaims[key];
-            }
-        }
-        result = sortSelfKindRefs(result, kind);
-    }
-    return result;
-}
-function sortSelfKindRefs(renderClaims, kind) {
-    if (!hasSelfRefs(kind)) {
-        return renderClaims;
-    }
-    const newRenderClaims = {};
-    const data = extractRefs(renderClaims, kind);
-    const ordered = [];
-    const visiting = [];
-    const visited = [];
-    for (const key of Object.keys(data)) {
-        if (!visited.find((obj) => obj.name === key)) {
-            sortRefs(data, data[key], ordered, visiting, visited);
-        }
-    }
-    for (const cr of ordered) {
-        newRenderClaims[cr.name] = renderClaims[cr.name];
-    }
-    return newRenderClaims;
-}
-function sortRefs(data, claim, ordered = [], visiting = [], visited = []) {
-    if (visiting.find((obj) => obj.name === claim.name)) {
-        throw new Error(`Circular dependency detected for '${claim.name}'`);
-    }
-    if (!visited.find((obj) => obj.name === claim.name)) {
-        visiting.push(claim);
-        if (claim.refs) {
-            for (const ref of claim.refs) {
-                const referencedObject = data[ref];
-                if (!referencedObject) {
-                    throw new Error(`Reference '${ref}' does not exist for '${claim.name}'`);
-                }
-                sortRefs(data, referencedObject, ordered, visiting, visited);
-            }
-        }
-        visited.push(visiting.pop());
-        ordered.push(claim);
-    }
-}
-function hasSelfRefs(kind) {
-    return ['TFWorkspaceClaim', 'GroupClaim'].includes(kind);
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-sorter.ts
-
-function sortKinds(orderedKinds, claims) {
-    const result = [];
-    for (const kind of orderedKinds) {
-        const kindRenderClaims = sortRenderClaimsByKind(claims, [kind]);
-        result.push(kindRenderClaims);
-    }
-    return result;
-}
-
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/overriders/utils.ts
 
 
@@ -167729,12 +167255,14 @@ async function utils_renderFeature(featureName, featureVersion, featureOutputObj
 
 
 
+
+
 // this is the only way currently to make
 // work the system and inject our code
 // without having to download a feature
-let featureOverride_MOCK_FEATURES_FN;
+let MOCK_FEATURES_FN;
 function MOCK_FEATURES(mock) {
-    featureOverride_MOCK_FEATURES_FN = mock;
+    MOCK_FEATURES_FN = mock;
     if (mock) {
         log.warn('⚠️ Warning features system downloader has been mocked, it should only happen in unit testing');
     }
@@ -167765,8 +167293,8 @@ class FeaturesOverrider extends OverriderPatches {
         let owner = 'prefapp';
         let versionOrRef = this.featureVersion;
         let renderer = 'getFeatureConfig';
-        if (featureOverride_MOCK_FEATURES_FN) {
-            return featureOverride_MOCK_FEATURES_FN();
+        if (MOCK_FEATURES_FN) {
+            return MOCK_FEATURES_FN();
         }
         if (this.featureRepo) {
             [owner, repo] = this.featureRepo.split(/\//);
@@ -167784,8 +167312,8 @@ class FeaturesOverrider extends OverriderPatches {
         const featureName = this.featureName;
         const featureVersion = this.featureVersion || this.featureRef;
         const featureArgs = this.featureArgs;
-        const fSetUpAndRunRenderer = function (target) {
-            return this.setUpAndRunRenderer(target);
+        const fSetUpAndRunRenderer = function (cr) {
+            return this.setUpAndRunRenderer(cr);
         }.bind(this);
         let renderedFeatureConfig = null;
         return [
@@ -167794,7 +167322,7 @@ class FeaturesOverrider extends OverriderPatches {
                     return true;
                 },
                 async apply(cr) {
-                    renderedFeatureConfig = await fSetUpAndRunRenderer(claim);
+                    renderedFeatureConfig = await fSetUpAndRunRenderer(cr);
                     return cr;
                 },
                 identify() {
@@ -167807,6 +167335,28 @@ class FeaturesOverrider extends OverriderPatches {
                     return utils_renderFeature(featureName, featureVersion, renderedFeatureConfig, cr, claim.name);
                 },
             },
+            {
+                isPostPatch: true,
+                validate() {
+                    return true;
+                },
+                async apply(cr) {
+                    if (!renderedFeatureConfig) {
+                        logger.warn(`Feature ${featureName}: renderedFeatureConfig is null, skipping post-patch`);
+                        return cr;
+                    }
+                    const provider = helperCTX(this).provider;
+                    const jsonPatches = renderedFeatureConfig.patches?.[provider] || [];
+                    fast_json_patch_default().applyPatch(cr, jsonPatches);
+                    return cr;
+                },
+                identify() {
+                    return `feature-json-patch/${featureName}`;
+                },
+                applicable() {
+                    return { applicableProviders: ['catalog', 'github'] };
+                },
+            },
         ];
     }
 }
@@ -168634,6 +168184,412 @@ var FirestartrGithubMembershipSpecContextProviderRefKind;
     /** FirestartrProviderConfig */
     FirestartrGithubMembershipSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
 })(FirestartrGithubMembershipSpecContextProviderRefKind || (FirestartrGithubMembershipSpecContextProviderRefKind = {}));
+/**
+ * A resource to handle GitHub Organization Actions Secrets.
+ *
+ * @schema FirestartrGithubOrganizationSecretSection
+ */
+class FirestartrGithubOrganizationSecretSection extends lib.ApiObject {
+    /**
+     * Renders a Kubernetes manifest for "FirestartrGithubOrganizationSecretSection".
+     *
+     * This can be used to inline resource manifests inside other objects (e.g. as templates).
+     *
+     * @param props initialization props
+     */
+    static manifest(props) {
+        return {
+            ...FirestartrGithubOrganizationSecretSection.GVK,
+            ...toJson_FirestartrGithubOrganizationSecretSectionProps(props),
+        };
+    }
+    /**
+     * Defines a "FirestartrGithubOrganizationSecretSection" API object
+     * @param scope the scope in which to define this object
+     * @param id a scope-local name for the object
+     * @param props initialization props
+     */
+    constructor(scope, id, props) {
+        super(scope, id, {
+            ...FirestartrGithubOrganizationSecretSection.GVK,
+            ...props,
+        });
+    }
+    /**
+     * Renders the object to Kubernetes JSON.
+     */
+    toJson() {
+        const resolved = super.toJson();
+        return {
+            ...FirestartrGithubOrganizationSecretSection.GVK,
+            ...toJson_FirestartrGithubOrganizationSecretSectionProps(resolved),
+        };
+    }
+}
+/**
+ * Returns the apiVersion and kind for "FirestartrGithubOrganizationSecretSection"
+ */
+FirestartrGithubOrganizationSecretSection.GVK = {
+    apiVersion: 'firestartr.dev/v1',
+    kind: 'FirestartrGithubOrganizationSecretSection',
+};
+
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionProps' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionProps(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'metadata': obj.metadata,
+        'spec': toJson_FirestartrGithubOrganizationSecretSectionSpec(obj.spec),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpec' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpec(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'org': obj.org,
+        'secrets': toJson_FirestartrGithubOrganizationSecretSectionSpecSecrets(obj.secrets),
+        'context': toJson_FirestartrGithubOrganizationSecretSectionSpecContext(obj.context),
+        'firestartr': toJson_FirestartrGithubOrganizationSecretSectionSpecFirestartr(obj.firestartr),
+        'writeConnectionSecretToRef': toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef(obj.writeConnectionSecretToRef),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecrets' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecrets(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'actions': obj.actions?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActions(y)),
+        'codespaces': obj.codespaces?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces(y)),
+        'dependabot': obj.dependabot?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot(y)),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContext' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContext(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'backend': toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackend(obj.backend),
+        'provider': toJson_FirestartrGithubOrganizationSecretSectionSpecContextProvider(obj.provider),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecFirestartr' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecFirestartr(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'tfStateKey': obj.tfStateKey,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'outputs': obj.outputs?.map(y => toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs(y)),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsActions' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActions(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef(obj.ref),
+        'visibility': obj.visibility,
+        'selectedRepositories': obj.selectedRepositories?.map(y => y),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespaces(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef(obj.ref),
+        'visibility': obj.visibility,
+        'selectedRepositories': obj.selectedRepositories?.map(y => y),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabot(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'name': obj.name,
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef(obj.ref),
+        'visibility': obj.visibility,
+        'selectedRepositories': obj.selectedRepositories?.map(y => y),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextBackend' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackend(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackendRef(obj.ref),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextProvider' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContextProvider(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'ref': toJson_FirestartrGithubOrganizationSecretSectionSpecContextProviderRef(obj.ref),
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecWriteConnectionSecretToRefOutputs(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * Which repositories can access the secret.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility) {
+    /** all */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["ALL"] = "all";
+    /** selected */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["SELECTED"] = "selected";
+    /** private */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility["PRIVATE"] = "private";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsVisibility = {}));
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * Which repositories can access the secret.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility) {
+    /** all */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["ALL"] = "all";
+    /** selected */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["SELECTED"] = "selected";
+    /** private */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility["PRIVATE"] = "private";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesVisibility = {}));
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+        'key': obj.key,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * Which repositories can access the secret.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility) {
+    /** all */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["ALL"] = "all";
+    /** selected */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["SELECTED"] = "selected";
+    /** private */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility["PRIVATE"] = "private";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility || (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotVisibility = {}));
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextBackendRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContextBackendRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/**
+ * Converts an object of type 'FirestartrGithubOrganizationSecretSectionSpecContextProviderRef' to JSON representation.
+ */
+/* eslint-disable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+function toJson_FirestartrGithubOrganizationSecretSectionSpecContextProviderRef(obj) {
+    if (obj === undefined) {
+        return undefined;
+    }
+    const result = {
+        'kind': obj.kind,
+        'name': obj.name,
+    };
+    // filter undefined values
+    return Object.entries(result).reduce((r, i) => (i[1] === undefined) ? r : ({ ...r, [i[0]]: i[1] }), {});
+}
+/* eslint-enable max-len, @stylistic/max-len, quote-props, @stylistic/quote-props */
+/**
+ * The type of Kubernetes resource to reference.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind) {
+    /** Secret */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind["SECRET"] = "Secret";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsActionsRefKind = {}));
+/**
+ * The type of Kubernetes resource to reference.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind) {
+    /** Secret */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind["SECRET"] = "Secret";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsCodespacesRefKind = {}));
+/**
+ * The type of Kubernetes resource to reference.
+ *
+ * @schema FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind) {
+    /** Secret */
+    FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind["SECRET"] = "Secret";
+})(FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind || (FirestartrGithubOrganizationSecretSectionSpecSecretsDependabotRefKind = {}));
+/**
+ * @schema FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind) {
+    /** FirestartrProviderConfig */
+    FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
+})(FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind || (FirestartrGithubOrganizationSecretSectionSpecContextBackendRefKind = {}));
+/**
+ * @schema FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind
+ */
+var FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind;
+(function (FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind) {
+    /** FirestartrProviderConfig */
+    FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind["FIRESTARTR_PROVIDER_CONFIG"] = "FirestartrProviderConfig";
+})(FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind || (FirestartrGithubOrganizationSecretSectionSpecContextProviderRefKind = {}));
 /**
  * A resource to handle GitHub Organization Settings.
  *
@@ -172089,6 +172045,78 @@ class GithubOrgVariableSectionChart extends BaseGithubChart {
     }
 }
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/orgSecretSectionChart.ts
+
+
+
+class GithubOrgSecretSectionChart extends BaseGithubChart {
+    template() {
+        const claim = this.get('claim');
+        const firestartrId = this.get('firestartrId');
+        const githubProvider = claim.providers.github;
+        const orgSecrets = githubProvider.org_secrets || {};
+        const renderSecrets = (section) => {
+            const secrets = orgSecrets[section];
+            if (!Array.isArray(secrets))
+                return [];
+            return secrets.map((secret) => {
+                const parts = secret.value.split(':');
+                const selectedRepositories = (secret.selected_repositories || []).map((ref) => {
+                    const match = ref.match(/^component:(.+)$/);
+                    if (!match) {
+                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Invalid component ref "${ref}" in selected_repositories. Expected format: component:<name>`);
+                    }
+                    const componentName = match[1];
+                    const resolvedCr = this.refResolver('ComponentClaim', componentName);
+                    const org = resolvedCr?.spec?.org;
+                    const repoName = resolvedCr?.metadata?.annotations?.['firestartr.dev/external-name'] || resolvedCr?.metadata?.name?.replace(/-[0-9a-f-]{36}$/, '');
+                    if (!org || !repoName) {
+                        throw new ChartRenderError('OrgSettingsClaim', claim.name, `Referenced component "${componentName}" has no GitHub provider configured`);
+                    }
+                    return `${org}/${repoName}`;
+                });
+                return {
+                    name: secret.name,
+                    ref: {
+                        kind: 'Secret',
+                        name: parts[2],
+                        key: parts[3],
+                    },
+                    visibility: secret.visibility || 'all',
+                    selectedRepositories,
+                };
+            });
+        };
+        const template = {
+            metadata: {
+                name: githubProvider.name,
+            },
+            spec: {
+                org: githubProvider.org,
+                secrets: {
+                    actions: renderSecrets('actions'),
+                    codespaces: renderSecrets('codespaces'),
+                    dependabot: renderSecrets('dependabot'),
+                },
+                firestartr: {
+                    tfStateKey: firestartrId,
+                },
+                writeConnectionSecretToRef: {
+                    name: `firestartrgithuborganizationsecretsection-${githubProvider.name}-secrets-outputs`.toLowerCase(),
+                    outputs: [{ key: 'managed_secrets' }, { key: 'secret_ids' }],
+                },
+            },
+        };
+        return JSON.parse(JSON.stringify(template));
+    }
+    gvk() {
+        return FirestartrGithubOrganizationSecretSection.GVK;
+    }
+    instanceApiObject(template) {
+        return new FirestartrGithubOrganizationSecretSection(this, template.metadata.name, template);
+    }
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/index.ts
 
 
@@ -172097,6 +172125,7 @@ class GithubOrgVariableSectionChart extends BaseGithubChart {
 
 
 
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/catalog/base.ts
 
 class BaseCatalogChart extends BaseChart {
@@ -172859,6 +172888,7 @@ class SecretsChart extends BaseSecretsChart {
     GithubOrgWebhookChart: GithubOrgWebhookChart,
     GithubOrgSettingsChart: GithubOrgSettingsChart,
     GithubOrgVariableSectionChart: GithubOrgVariableSectionChart,
+    GithubOrgSecretSectionChart: GithubOrgSecretSectionChart,
 });
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-render.ts
@@ -172910,16 +172940,21 @@ async function renderClaims(catalogScope, firestartrScope, data) {
             const variableSectionPreviousCR = claim.kind === 'OrgSettingsClaim'
                 ? getPreviousCRfromClaim(claim, crs, 'FirestartrGithubOrganizationVariableSection')
                 : false;
+            const secretSectionPreviousCR = claim.kind === 'OrgSettingsClaim'
+                ? getPreviousCRfromClaim({ kind: claim.kind, name: `${claim.name}-secret-section` }, crs, 'FirestartrGithubOrganizationSecretSection')
+                : false;
             const patches = await extractPatches(renderClaims[claimKey], previousCR, crs);
             let variableSectionPatches = undefined;
+            let secretSectionPatches = undefined;
             if (claim.kind === 'OrgSettingsClaim') {
                 variableSectionPatches = await extractPatches(renderClaims[claimKey], variableSectionPreviousCR, crs);
+                secretSectionPatches = await extractPatches(renderClaims[claimKey], secretSectionPreviousCR);
             }
             if (!previousCR) {
                 logger.debug(`No CR found for claim ${claimKey}, it will be rendered from scratch`);
             }
             const claimPath = renderClaims[claimKey].claimPath;
-            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR, claimPath, variableSectionPreviousCR, variableSectionPatches, crs);
+            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR, claimPath, variableSectionPreviousCR, variableSectionPatches, crs, secretSectionPreviousCR, secretSectionPatches);
             if (catalogEntity) {
                 result[`${catalogEntity.kind}-${catalogEntity.metadata.name}`] =
                     catalogEntity.toJson();
@@ -172948,7 +172983,7 @@ async function renderClaims(catalogScope, firestartrScope, data) {
     }
     return result;
 }
-async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null, claimPath, variableSectionPreviousCR = false, variableSectionPatches, crs) {
+async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null, claimPath, variableSectionPreviousCR = false, variableSectionPatches, crs, secretSectionPreviousCR = false, secretSectionPatches) {
     let catalogEntity = undefined;
     let firestartrEntity = undefined;
     const extraCharts = [];
@@ -173118,6 +173153,27 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
                     },
                     chart: variableSectionObject,
                 });
+                const secretSectionFirestartrId = secretSectionPreviousCR
+                    ? secretSectionPreviousCR.spec?.firestartr?.tfStateKey
+                    : firestartrId
+                        ? `${firestartrId}-secrets`
+                        : null;
+                const ssRenderPatches = secretSectionPatches
+                    ? secretSectionPatches.filter((patch) => !patch.isPostPatch)
+                    : renderPatches;
+                const ssPostPatches = secretSectionPatches
+                    ? secretSectionPatches.filter((patch) => patch.isPostPatch)
+                    : postPatches;
+                const secretSectionChart = new charts.GithubOrgSecretSectionChart(firestartrScope, `github-secrets-${chartId}`, secretSectionFirestartrId, claim, ssRenderPatches);
+                await secretSectionChart.render();
+                const secretSectionObject = await secretSectionChart.postRenderer(ssPostPatches);
+                extraCharts.push({
+                    claim: {
+                        kind: claim.kind,
+                        name: `${claim.name}-secret-section`,
+                    },
+                    chart: secretSectionObject,
+                });
             }
             break;
         default:
@@ -173240,8 +173296,33 @@ function searchSecretKey(secretClaim, key) {
 }
 function validateOrgSettingsComponentRefs(ref, renderClaims) {
     const claim = renderClaims[ref].claim;
+    validateOrgSecretsSelectedRepositories(claim, renderClaims);
     validateActionsVariablesSelectedRepositories(claim, renderClaims);
 }
+function validateOrgSecretsSelectedRepositories(claim, renderClaims) {
+    const orgSecrets = claim?.providers?.github?.org_secrets;
+    if (!orgSecrets || typeof orgSecrets !== 'object')
+        return;
+    for (const section of ['actions', 'codespaces', 'dependabot']) {
+        const secrets = orgSecrets[section];
+        if (!Array.isArray(secrets))
+            continue;
+        for (const secret of secrets) {
+            if (!secret.selected_repositories)
+                continue;
+            for (const repoRef of secret.selected_repositories) {
+                const match = repoRef.match(COMPONENT_REF_PATTERN);
+                if (!match)
+                    continue;
+                const [, componentName] = match;
+                const expectedKey = `ComponentClaim-${componentName}`;
+                if (!renderClaims[expectedKey]) {
+                    throw new Error(`CrossReference error: OrgSettingsClaim/${claim.name} references a non-existent component "${componentName}" in org_secrets.${section}.${secret.name}.selected_repositories`);
+                }
+            }
+        }
+    }
+}
 function validateActionsVariablesSelectedRepositories(claim, renderClaims) {
     const actionsVariables = claim?.providers?.github?.actions_variables;
     if (!Array.isArray(actionsVariables))
@@ -173372,6 +173453,116 @@ function validateActionsVariablesUniqueness(crs) {
     }
 }
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/githubOrgSecretSection.ts
+const GITHUB_ORG_SECRET_SECTION_KIND = 'FirestartrGithubOrganizationSecretSection';
+const githubOrgSecretSection_FIRESTARTR_CLAIM_REF_ANNOTATION = 'firestartr.dev/claim-ref';
+const githubOrgSecretSection_CLAIM_REF_LABEL = 'claim-ref';
+const SECRETS_CLAIM_REF_PATTERN = /^ref:secretsclaim:([a-zA-Z0-9_-]+):([a-zA-Z0-9_-]+)$/;
+function githubOrgSecretSection_formatResourceRef(name, claimRef) {
+    return claimRef ? `${name} (claim: ${claimRef})` : name;
+}
+function validateGithubOrgSecretSectionSingleton(crs) {
+    const refsByOrg = new Map();
+    const seenClaimRefs = new Map();
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (cr.kind !== GITHUB_ORG_SECRET_SECTION_KIND)
+            continue;
+        const org = cr.spec?.org;
+        if (typeof org !== 'string' || !org)
+            continue;
+        const name = cr.metadata?.name || crKey;
+        const claimRef = cr.metadata?.annotations?.[githubOrgSecretSection_FIRESTARTR_CLAIM_REF_ANNOTATION] ||
+            cr.metadata?.labels?.[githubOrgSecretSection_CLAIM_REF_LABEL];
+        const normalizedOrg = org.toLowerCase();
+        if (claimRef) {
+            const seen = seenClaimRefs.get(normalizedOrg) || new Set();
+            if (seen.has(claimRef))
+                continue;
+            seen.add(claimRef);
+            seenClaimRefs.set(normalizedOrg, seen);
+        }
+        const refs = refsByOrg.get(normalizedOrg) || [];
+        refs.push(githubOrgSecretSection_formatResourceRef(name, claimRef));
+        refsByOrg.set(normalizedOrg, refs);
+    }
+    for (const [org, refs] of refsByOrg.entries()) {
+        if (refs.length < 2)
+            continue;
+        throw new Error(`Duplicate ${GITHUB_ORG_SECRET_SECTION_KIND} resources found for GitHub organization "${org}": ${refs.join(', ')}`);
+    }
+}
+function validateSecretNamesUniqueness(crs) {
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (cr.kind !== GITHUB_ORG_SECRET_SECTION_KIND)
+            continue;
+        const secrets = cr.spec?.secrets;
+        if (!secrets || typeof secrets !== 'object')
+            continue;
+        for (const section of ['actions', 'codespaces', 'dependabot']) {
+            const sectionSecrets = secrets[section];
+            if (!Array.isArray(sectionSecrets))
+                continue;
+            const names = new Set();
+            for (const secret of sectionSecrets) {
+                const secretName = secret?.name;
+                if (!secretName)
+                    continue;
+                if (names.has(secretName)) {
+                    const org = cr.spec?.org || 'unknown';
+                    throw new Error(`Duplicate secret name "${secretName}" found in ${section} section of ${GITHUB_ORG_SECRET_SECTION_KIND} for organization "${org}"`);
+                }
+                names.add(secretName);
+            }
+        }
+    }
+}
+function validateOrgSecretsCrossReferences(renderClaims) {
+    for (const claimKey of Object.keys(renderClaims)) {
+        if (!claimKey.startsWith('OrgSettingsClaim-'))
+            continue;
+        const claimData = renderClaims[claimKey];
+        const claim = claimData?.claim;
+        const orgSecrets = claim?.providers?.github?.org_secrets;
+        if (!orgSecrets || typeof orgSecrets !== 'object')
+            continue;
+        for (const section of ['actions', 'codespaces', 'dependabot']) {
+            const secrets = orgSecrets[section];
+            if (!Array.isArray(secrets))
+                continue;
+            for (const secret of secrets) {
+                if (!secret.value)
+                    continue;
+                const match = secret.value.match(SECRETS_CLAIM_REF_PATTERN);
+                if (!match)
+                    continue;
+                const [, secretClaimName, secretKey] = match;
+                const expectedKey = `SecretsClaim-${secretClaimName}`;
+                if (!renderClaims[expectedKey])
+                    continue;
+                const secretClaim = renderClaims[expectedKey]?.claim;
+                const externalSecrets = secretClaim?.providers?.external_secrets?.externalSecrets?.secrets;
+                const pushSecrets = secretClaim?.providers?.external_secrets?.pushSecrets;
+                let keyFound = false;
+                if (Array.isArray(pushSecrets)) {
+                    keyFound =
+                        pushSecrets.find((s) => s.secretName === secretKey) !==
+                            undefined;
+                }
+                if (!keyFound && Array.isArray(externalSecrets)) {
+                    keyFound =
+                        externalSecrets.find((s) => s.secretName === secretKey) !==
+                            undefined;
+                }
+                if (!keyFound) {
+                    throw new Error(`CrossReference error: OrgSettingsClaim/${claim.name} references a non-existent secret key "${secretKey}" in SecretsClaim/${secretClaimName} via org_secrets.${section}.${secret.name}`);
+                }
+            }
+        }
+    }
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/renderer.ts
 
 
@@ -173384,6 +173575,7 @@ function validateActionsVariablesUniqueness(crs) {
 
 
 
+
 /*
  * Function called when rendering but not importing
  *
@@ -173405,10 +173597,13 @@ async function renderer_render(catalogScope, firestartrScope, claimList) {
     try {
         validateSubReferences(data.renderClaims);
         validateComponentPagesPath(data.renderClaims);
+        validateOrgSecretsCrossReferences(data.renderClaims);
         validateTfStateKeyUniqueness(result);
         validateGithubOrgSettingsSingleton(fullCrSet);
         validateGithubOrgVariableSectionSingleton(fullCrSet);
         validateActionsVariablesUniqueness(result);
+        validateGithubOrgSecretSectionSingleton(fullCrSet);
+        validateSecretNamesUniqueness(result);
         validateCrSizes(result);
         validatePermissionsUniqueness(result);
         validateNoBackstageAnnotationsInK8sCrs(result);
@@ -173721,7 +173916,6 @@ function walkArray(arr, symbolsToResolve, renderClaim) {
 
 
 
-
 /*
  * Function called when rendering from the importer class.
  *
@@ -173764,19 +173958,11 @@ async function renderFromImports(rClaims, crs = {}, catalogOutputDir = '/tmp/.ca
     // after resolving imported refs, preventing setRenderedClaim() from throwing
     // 'already rendered' for claims that were previously seeded
     emptyRenderedClaims();
-    // After resolving the imported-refs, each claim goes through the same
-    // defaults → stitching → AJV pipeline as loadClaim so feature claim-patches
-    // are applied and validated at the import boundary too. Stitching is
-    // once-only: already stitched claims are left untouched (no feature
-    // re-download, no gates re-applied).
+    // after resolving the imported-refs, we need to validate the claims again, and apply the defaults if needed
     for (const renderClaim of Object.values(rClaims)) {
-        if (renderClaim.claim && renderClaim.claim[STITCHED_CLAIM]) {
-            validateClaim(renderClaim.claim, `firestartr.dev://common/${renderClaim.claim.kind}`);
-            continue;
+        if (defaults) {
+            renderClaim.claim = loader_patchClaim(renderClaim.claim, defaults);
         }
-        const rawClaim = renderClaim.claim;
-        const claim = defaults ? loader_patchClaim(rawClaim, defaults) : rawClaim;
-        renderClaim.claim = await stitchClaim(claim, undefined, rawClaim);
         validateClaim(renderClaim.claim, `firestartr.dev://common/${renderClaim.claim.kind}`);
     }
     const catalogScope = new lib.App({
@@ -357697,6 +357883,7 @@ const kindPluralMap = {
     githuborgwebhooks: 'FirestartrGithubOrgWebhook',
     githuborganizationsettings: 'FirestartrGithubOrganizationSettings',
     githuborganizationvariablesections: 'FirestartrGithubOrganizationVariableSection',
+    githuborganizationsecretsections: 'FirestartrGithubOrganizationSecretSection',
     terraformworkspaces: 'FirestartrTerraformWorkspace',
     terraformworkspaceplans: 'FirestartrTerraformWorkspacePlan',
     providerconfigs: 'FirestartrProviderConfig',
@@ -360097,6 +360284,7 @@ const kindsWithFinalizer = [
     'FirestartrGithubOrgWebhook',
     'FirestartrGithubOrganizationSettings',
     'FirestartrGithubOrganizationVariableSection',
+    'FirestartrGithubOrganizationSecretSection',
     'FirestartrGithubRepositorySecretsSection',
 ];
 const kindsWithDependants = [
@@ -363135,7 +363323,7 @@ async function configGit() {
     }
     // Import github dynamically to avoid Jest ESM issues when not specifically running this function
     // (see CONSTITUTION and RULES: must not change test machinery)
-    const githubModule = await Promise.resolve(/* import() */).then(__nccwpck_require__.bind(__nccwpck_require__, 99029));
+    const githubModule = await Promise.resolve(/* import() */).then(__nccwpck_require__.bind(__nccwpck_require__, 3342));
     const github = githubModule.default || githubModule;
     if (external_fs_.existsSync(gitconfigPath)) {
         external_fs_.rmSync(gitconfigPath);
@@ -364840,7 +365028,7 @@ function helperCreateCheckRunName(cmd, item) {
 
 ;// CONCATENATED MODULE: ../operator/src/utils/index.ts
 const secretRegex = /\$\{\{ secrets\.(.*?) \}\}/g;
-function utils_isRecord(value) {
+function isRecord(value) {
     return typeof value === 'object' && value !== null;
 }
 function getFirstNonEmptyString(...values) {
@@ -364878,7 +365066,7 @@ function replaceInlineSecrets(inline, secrets) {
     return result;
 }
 function extractErrorDetails(error) {
-    const exitCode = utils_isRecord(error) && typeof error.exitCode === 'number'
+    const exitCode = isRecord(error) && typeof error.exitCode === 'number'
         ? error.exitCode
         : undefined;
     if (typeof error === 'string') {
@@ -364889,7 +365077,7 @@ function extractErrorDetails(error) {
         const output = getFirstNonEmptyString(errorWithOutput.output, error.message);
         return { output: output ?? String(error), exitCode };
     }
-    if (utils_isRecord(error)) {
+    if (isRecord(error)) {
         const output = getFirstNonEmptyString(error.output, error.message, error.error);
         if (output !== undefined) {
             return { output, exitCode };
@@ -366981,6 +367169,11 @@ const MODULES = {
         // github-org-variables-section-v0.1.0
         ref: 'fb9c01d0a1e03e5134479da13d0faf55891dfedf',
     },
+    FirestartrGithubOrganizationSecretSection: {
+        module: 'git::https://github.com/prefapp/tfm.git//modules/github-org-secrets-section',
+        // feat/1364-feat-add-github-org-secrets-section-module
+        ref: '170e6cf',
+    },
 };
 function getFirestartrDefaultTFM(kind) {
     if (kind in MODULES) {
@@ -368893,6 +369086,215 @@ class EntityGHOrgVarsSection extends base_Entity {
     async loadAddressesToImport() { }
 }
 
+;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgsecretsection/secrets.ts
+
+
+
+
+const secrets_SECTIONS = ['actions', 'codespaces', 'dependabot'];
+
+async function provisionOrgSecrets(entity, secrets) {
+    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} provisioning org secrets`);
+    for (const section of secrets_SECTIONS) {
+        const sectionSecrets = secrets[section] || [];
+        if (sectionSecrets.length === 0)
+            continue;
+        let preFetchedKey;
+        try {
+            preFetchedKey = await fetchOrgPublicKey(entity, section);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new Error(`[gh-provisioner] ${entity.k8sId} failed to fetch ${section} org public key: ${message}`);
+        }
+        for (const secret of sectionSecrets) {
+            await provisionOrgSecret(entity, section, secret, preFetchedKey);
+        }
+    }
+}
+async function fetchOrgPublicKey(entity, section) {
+    return (await entity.runWithGithubProvider(async () => {
+        return await github["default"].encryption.getOrgPublicKey(entity.cr.spec.org, section);
+    }));
+}
+async function provisionOrgSecret(entity, section, secret, preFetchedKey) {
+    gh_provisioner_src_logger.info(`[gh-provisioner] provisioning org secret ${entity.k8sId}/${section}/${secret.name}`);
+    if (process.env['AVOID_PROVIDER_SECRET_ENCRYPTION']) {
+        await secrets_createUnencryptedSecret(entity, section, secret);
+    }
+    else {
+        await secrets_createEncryptedSecret(entity, section, secret, preFetchedKey);
+    }
+    gh_provisioner_src_logger.info(`[gh-provisioner] org secret provisioned ${section}/${secret.name}`);
+}
+async function secrets_createEncryptedSecret(entity, section, secret, preFetchedKey) {
+    const plainSecret = base_Entity.refResolver(secret.ref);
+    if (!plainSecret) {
+        throw new Error(`[gh-provisioner] ${entity.k8sId} cannot resolve secret ref: ${secret.ref.kind}/${secret.ref.name}:${secret.ref.key} — ensure the referenced resource is available as a dependency`);
+    }
+    const plainTextSecret = plainSecret.getOutput(secret.ref.key);
+    const plaintextSha256 = external_crypto_default().createHash('sha256')
+        .update(plainTextSecret)
+        .digest('hex');
+    const { encrypted_value } = (await entity.runWithGithubProvider(async () => {
+        return await github["default"].encryption.encryptOrgSecret(entity.cr.spec.org, section, plainTextSecret, preFetchedKey);
+    }));
+    entity.patchData({
+        op: PatchOperations.add,
+        path: `/config/${section}/${secret.name}`,
+        value: {
+            value: encrypted_value,
+            visibility: secret.visibility || 'all',
+            ...(secret.selectedRepositories && secret.selectedRepositories.length > 0
+                ? { selected_repositories: secret.selectedRepositories }
+                : {}),
+        },
+    });
+    entity.patchData({
+        op: PatchOperations.add,
+        path: `/config/${section}_sha256/${secret.name}`,
+        value: plaintextSha256,
+    });
+}
+async function secrets_createUnencryptedSecret(entity, section, secret) {
+    const plainSecret = base_Entity.refResolver(secret.ref);
+    const plainTextSecret = plainSecret.getOutput(secret.ref.key);
+    const plaintextSha256 = external_crypto_default().createHash('sha256')
+        .update(plainTextSecret)
+        .digest('hex');
+    entity.patchData({
+        op: PatchOperations.add,
+        path: `/config/${section}/${secret.name}`,
+        value: {
+            value: plainTextSecret,
+            visibility: secret.visibility || 'all',
+            ...(secret.selectedRepositories && secret.selectedRepositories.length > 0
+                ? { selected_repositories: secret.selectedRepositories }
+                : {}),
+        },
+    });
+    entity.patchData({
+        op: PatchOperations.add,
+        path: `/config/${section}_sha256/${secret.name}`,
+        value: plaintextSha256,
+    });
+}
+async function adoptSecretsIfNeeded(entity, secrets) {
+    const managedSecrets = entity.cr.fResolveSelfOutputs('managed_secrets') || [];
+    for (const section of secrets_SECTIONS) {
+        const sectionSecrets = secrets[section] || [];
+        if (sectionSecrets.length === 0)
+            continue;
+        const declaredNames = sectionSecrets.map((s) => s.name);
+        const newToModule = declaredNames.filter((name) => !managedSecrets.includes(name));
+        if (newToModule.length === 0) {
+            gh_provisioner_src_logger.debug(`[gh-provisioner] ${entity.k8sId} all declared ${section} secrets are already managed`);
+            continue;
+        }
+        if (managedSecrets.length === 0) {
+            gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} no managed_secrets output — first reconciliation, treating all ${newToModule.length} ${section} secret(s) as new to module`);
+        }
+        for (const secretName of newToModule) {
+            try {
+                const existing = (await entity.runWithGithubProvider(async () => {
+                    return await github["default"].encryption.getOrgSecret(entity.cr.spec.org, section, secretName);
+                }));
+                if (existing) {
+                    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} adopting pre-existing ${section} secret '${secretName}' on GitHub org '${entity.cr.spec.org}'`);
+                    const resourceType = `github_${section}_organization_secret`;
+                    entity.patchImportData({
+                        op: PatchOperations.add,
+                        path: '/imports/-',
+                        value: {
+                            to: `${resourceType}.this["${secretName}"]`,
+                            id: secretName,
+                        },
+                    });
+                    const secretEntry = sectionSecrets.find((s) => s.name === secretName);
+                    if (secretEntry &&
+                        secretEntry.visibility === 'selected' &&
+                        (section === 'actions' || section === 'dependabot')) {
+                        const bindingType = `github_${section}_organization_secret_repositories`;
+                        entity.patchImportData({
+                            op: PatchOperations.add,
+                            path: '/imports/-',
+                            value: {
+                                to: `${bindingType}.this["${secretName}"]`,
+                                id: secretName,
+                            },
+                        });
+                    }
+                }
+            }
+            catch (err) {
+                if (err && err.status === 404) {
+                    gh_provisioner_src_logger.info(`[gh-provisioner] ${entity.k8sId} ${section} secret '${secretName}' not found on GitHub org '${entity.cr.spec.org}' — will be created by TFM`);
+                }
+                else if (err && (err.status === 401 || err.status === 403)) {
+                    gh_provisioner_src_logger.warn(`[gh-provisioner] ${entity.k8sId} token lacks scope to check ${section} secret '${secretName}' on org '${entity.cr.spec.org}' — skipping adoption gracefully`);
+                }
+                else {
+                    gh_provisioner_src_logger.warn(`[gh-provisioner] ${entity.k8sId} unexpected error checking ${section} secret '${secretName}' on org '${entity.cr.spec.org}': ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgsecretsection/index.ts
+
+
+
+class EntityGHOrgSecretSection extends base_Entity {
+    constructor(artifact) {
+        super(artifact, {
+            config: {
+                org: '',
+                actions: {},
+                codespaces: {},
+                dependabot: {},
+                actions_sha256: {},
+                codespaces_sha256: {},
+                dependabot_sha256: {},
+            },
+        });
+    }
+    async loadResources(tfOp) {
+        gh_provisioner_src_logger.info(`[gh-provisioner] running ${tfOp} on ${this.k8sId}`);
+        try {
+            const cr = this.cr;
+            const org = cr.spec.org;
+            const secrets = cr.spec.secrets || {};
+            this.patchData({
+                op: PatchOperations.replace,
+                path: '/config/org',
+                value: org,
+            });
+            await provisionOrgSecrets(this, secrets);
+            const redactedDoc = JSON.parse(JSON.stringify(this._document, (key, value) => {
+                if (key === 'value' && typeof value === 'string')
+                    return '[REDACTED]';
+                return typeof value === 'string' && value.length > 50
+                    ? '[REDACTED]'
+                    : value;
+            }));
+            this.synthMessage(`[gh-provisioner] ${this.k8sId} config:\n${JSON.stringify(redactedDoc, null, 2)}`);
+            this.synthEnd(`[gh-provisioner] ${this.k8sId} loaded its data`);
+            if (tfOp === 'apply') {
+                await adoptSecretsIfNeeded(this, secrets);
+            }
+            gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} loaded its data`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            gh_provisioner_src_logger.error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
+            throw new Error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
+        }
+    }
+    async postProvision(_tfOp) { }
+    async loadAddressesToImport() { }
+}
+
 ;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgwebhook/index.ts
 
 
@@ -368970,6 +369372,7 @@ class EntityGHOrgWebHook extends base_Entity {
 
 
 
+
 function entities_getEntity(cr) {
     const entityClass = getEntityClass(cr.kind);
     return new entityClass(cr);
@@ -368992,6 +369395,8 @@ function getEntityClass(kind) {
             return EntityGHOrgSettings;
         case 'FirestartrGithubOrganizationVariableSection':
             return EntityGHOrgVarsSection;
+        case 'FirestartrGithubOrganizationSecretSection':
+            return EntityGHOrgSecretSection;
         default:
             throw new Error(`kind ${kind} has no entity associated`);
     }
@@ -370819,6 +371224,7 @@ const provisionImplementations = {
     githuborgwebhooks: process_operation_processOperation,
     githuborganizationsettings: process_operation_processOperation,
     githuborganizationvariablesections: process_operation_processOperation,
+    githuborganizationsecretsections: process_operation_processOperation,
     fsdummiesa: processFirestartrDummies,
     fsdummiesb: processFirestartrDummies,
     fsdummiesc: processFirestartrDummies,
@@ -715271,7 +715677,7 @@ const crsStatusSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = JSON.parse('{"i8":"2.11.0-snapshot-patch-claims-4"}');
+const package_namespaceObject = JSON.parse('{"i8":"2.11.0-snapshot-org-secrets-01"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"i8":"2.10.0"};
 // EXTERNAL MODULE: ../../node_modules/semver/index.js