@firestartr/cli 2.7.0-snapshot-13 → 2.7.0-snapshot-15

package/build/index.js

@@ -239466,7 +239466,7 @@ class SimpleTokenizer {
 ;// CONCATENATED MODULE: ../catalog_common/src/codeowners/index.ts
 // Common CODEOWNERS machinery (pure TypeScript/data; NO IO, NO classes)
 // Strictly follows GitHub CODEOWNERS syntax.
-// Spec: see specs/common/001-common-codeowners-machinery/spec.md
+// Design: see packages/catalog_common/docs/adr/0001-codeowners-machinery-is-pure-data.md
 
 const OWNER_RE = /^@[\w.-]+(\/[\w.-]+)?$/;
 function parse(raw) {
@@ -278569,6 +278569,9 @@ class InitializerPatches extends BasePatches {
         if (data?.defaultValues) {
             this.data['values'] = data.defaultValues;
         }
+        if (data?.path) {
+            this.data['path'] = data.path;
+        }
     }
     static FILE_NAME() {
         if (!this.fileName) {
@@ -278738,6 +278741,7 @@ UUIDInitializer.applicableKinds = [
     'ComponentClaim',
     'TFWorkspaceClaim',
     'OrgWebhookClaim',
+    'OrgSettingsClaim',
 ];
 
 
@@ -279392,6 +279396,7 @@ InitializerClaimRef.applicableKinds = [
     'ComponentClaim',
     'TFWorkspaceClaim',
     'OrgWebhookClaim',
+    'OrgSettingsClaim',
 ];
 
 
@@ -279722,6 +279727,20 @@ var external_fs_default = /*#__PURE__*/__nccwpck_require__.n(external_fs_);
 // List of currently set path variables for each entity type
 const __PATH_VARIABLES = {};
 const __EXCLUDED_PATHS = [];
+let repositoryUrl;
+let defaultBranch = 'main';
+function setRepositoryUrl(url) {
+    repositoryUrl = url;
+}
+function getRepositoryUrl() {
+    return repositoryUrl;
+}
+function setDefaultBranch(branch) {
+    defaultBranch = branch;
+}
+function getDefaultBranch() {
+    return defaultBranch;
+}
 function setExcludedPaths(excludedPaths) {
     __EXCLUDED_PATHS.length = 0;
     for (const path of excludedPaths) {
@@ -280379,6 +280398,8 @@ TechnologyInitializer.applicableKinds = ['ComponentClaim'];
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/initializers/backstage.ts
 
+
+
 class BackstageInitializer extends InitializerPatches {
     constructor() {
         super(...arguments);
@@ -280388,6 +280409,16 @@ class BackstageInitializer extends InitializerPatches {
         return true;
     }
     async __patches(claim, _) {
+        const claimPath = this.data?.path;
+        const repoUrl = getRepositoryUrl();
+        let relativePath;
+        if (repoUrl && claimPath) {
+            const claimsRoot = getPath('claims');
+            relativePath = external_path_.relative(claimsRoot, claimPath)
+                .split(external_path_.sep)
+                .map((segment) => encodeURIComponent(segment))
+                .join('/');
+        }
         return [
             {
                 validate() {
@@ -280433,10 +280464,41 @@ class BackstageInitializer extends InitializerPatches {
                     };
                 },
             },
+            {
+                validate() {
+                    return true;
+                },
+                apply(cr) {
+                    if (!repoUrl || !relativePath)
+                        return cr;
+                    cr.metadata.annotations = cr.metadata.annotations ?? {};
+                    cr.metadata.annotations['backstage.io/edit-url'] =
+                        `${repoUrl}/blob/${getDefaultBranch()}/${relativePath}`;
+                    return cr;
+                },
+                identify() {
+                    return 'initializers/BackstageInitializer';
+                },
+                applicable() {
+                    return {
+                        applicableProviders: ['catalog'],
+                    };
+                },
+            },
         ];
     }
 }
-BackstageInitializer.applicableKinds = ['ComponentClaim'];
+BackstageInitializer.applicableKinds = [
+    'ComponentClaim',
+    'SystemClaim',
+    'DomainClaim',
+    'GroupClaim',
+    'UserClaim',
+    'TFWorkspaceClaim',
+    'SecretsClaim',
+    'ArgoDeployClaim',
+    'OrgWebhookClaim',
+];
 
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/initializers/syncer.ts
@@ -280688,6 +280750,7 @@ const INITIALIZERS_BY_FILE_NAME = {
     defaults_github_membership: InitializerDefault,
     defaults_github_group: InitializerDefault,
     defaults_github_orgwebhook: InitializerDefault,
+    defaults_github_orgsettings: InitializerDefault,
 };
 const SCHEMAS_BY_INITIALIZER_NAME = {
     [TechnologyInitializer.FILE_NAME()]: technologies,
@@ -281838,6 +281901,38 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
     },
 });
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/base/schemas/orgsettings.schema.ts
+
+/* harmony default export */ const orgsettings_schema = ({
+    $schema: SCHEMA,
+    $id: 'OrgSettingsClaim',
+    definitions: {
+        OrgSettingsClaim: {
+            $id: 'firestartr.dev://common/OrgSettingsClaim',
+            type: 'object',
+            description: 'A GitHub organization settings claim',
+            unevaluatedProperties: false,
+            allOf: [
+                { $ref: 'firestartr.dev://common/ClaimEnvelope' },
+                {
+                    type: 'object',
+                    properties: {
+                        providers: {
+                            type: 'object',
+                            properties: {
+                                github: {
+                                    $ref: 'firestartr.dev://github/GithubOrgSettingsClaim',
+                                },
+                            },
+                            additionalProperties: false,
+                        },
+                    },
+                },
+            ],
+        },
+    },
+});
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/github/group.schema.ts
 
 /* harmony default export */ const github_group_schema = ({
@@ -282180,6 +282275,116 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
     },
 });
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/github/orgsettings.schema.ts
+
+const organizationSettingsProperties = {
+    name: {
+        type: 'string',
+    },
+    tfStateKey: {
+        $ref: 'firestartr.dev://common/TerraformStateKey',
+    },
+    org: {
+        $ref: 'firestartr.dev://common/ClaimName',
+    },
+    billing_email: {
+        type: 'string',
+    },
+    twitter_username: {
+        type: 'string',
+    },
+    company: {
+        type: 'string',
+    },
+    blog: {
+        type: 'string',
+    },
+    email: {
+        type: 'string',
+    },
+    location: {
+        type: 'string',
+    },
+    description: {
+        type: 'string',
+    },
+    has_organization_projects: {
+        type: 'boolean',
+    },
+    has_repository_projects: {
+        type: 'boolean',
+    },
+    default_repository_permission: {
+        type: 'string',
+        enum: ['read', 'write', 'admin', 'none'],
+    },
+    members_can_create_repositories: {
+        type: 'boolean',
+    },
+    members_can_create_public_repositories: {
+        type: 'boolean',
+    },
+    members_can_create_private_repositories: {
+        type: 'boolean',
+    },
+    members_can_create_internal_repositories: {
+        type: 'boolean',
+    },
+    members_can_create_pages: {
+        type: 'boolean',
+    },
+    members_can_create_public_pages: {
+        type: 'boolean',
+    },
+    members_can_create_private_pages: {
+        type: 'boolean',
+    },
+    members_can_fork_private_repositories: {
+        type: 'boolean',
+    },
+    web_commit_signoff_required: {
+        type: 'boolean',
+    },
+    advanced_security_enabled_for_new_repositories: {
+        type: 'boolean',
+    },
+    dependabot_alerts_enabled_for_new_repositories: {
+        type: 'boolean',
+    },
+    dependabot_security_updates_enabled_for_new_repositories: {
+        type: 'boolean',
+    },
+    dependency_graph_enabled_for_new_repositories: {
+        type: 'boolean',
+    },
+    secret_scanning_enabled_for_new_repositories: {
+        type: 'boolean',
+    },
+    secret_scanning_push_protection_enabled_for_new_repositories: {
+        type: 'boolean',
+    },
+};
+/* harmony default export */ const github_orgsettings_schema = ({
+    $schema: SCHEMA,
+    $id: 'GithubOrgSettingsClaim',
+    definitions: {
+        GithubOrgSettingsClaim: {
+            $id: 'firestartr.dev://github/GithubOrgSettingsClaim',
+            type: 'object',
+            description: 'A Github Organization Settings claim',
+            allOf: [
+                { $ref: 'firestartr.dev://common/ClaimProviderEnvelope' },
+                {
+                    type: 'object',
+                    properties: organizationSettingsProperties,
+                    additionalProperties: false,
+                    required: ['org', 'billing_email'],
+                },
+            ],
+        },
+    },
+});
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/github/feature.schema.ts
 
 /* harmony default export */ const feature_schema = ({
@@ -282326,7 +282531,7 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
                     type: 'string',
                     minLength: 1,
                     maxLength: 50,
-                    pattern: '^(?!\\s+$)[^"\\\\]+$',
+                    pattern: '^[^"\\\\\\s]+(?: +[^"\\\\\\s]+)*$',
                     description: 'Label name (1-50 chars, no " or \\ characters)',
                 },
                 color: {
@@ -282353,12 +282558,14 @@ const external_node_child_process_namespaceObject = __WEBPACK_EXTERNAL_createReq
 
 
 
+
 const GithubSchemas = [
     github_group_schema,
     github_user_schema,
     feature_schema,
     github_component_schema,
     github_orgwebhook_schema,
+    github_orgsettings_schema,
     component_secrets_vars_schema,
     component_labels_schema,
 ];
@@ -282764,6 +282971,7 @@ const SecretsSchemas = [external_secrets_schema];
 
 
 
+
 const schemas = {
     root: root_schema,
     schemas: [
@@ -282781,6 +282989,7 @@ const schemas = {
         SecretsSchemas,
         secrets_schema,
         orgwebhook_schema,
+        orgsettings_schema,
     ],
 };
 /* harmony default export */ const base_schemas = (schemas);
@@ -282887,6 +283096,9 @@ const deploy_schema = 'firestartr.dev://common/ArgoDeployClaim';
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/base/orgWebhook.ts
 const orgWebhook_schema = 'firestartr.dev://common/OrgWebhookClaim';
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/base/orgSettings.ts
+const orgSettings_schema = 'firestartr.dev://common/OrgSettingsClaim';
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/base/secrets.ts
 const base_secrets_schema = 'firestartr.dev://common/SecretsClaim';
 
@@ -282900,6 +283112,7 @@ const base_secrets_schema = 'firestartr.dev://common/SecretsClaim';
 
 
 
+
 /* harmony default export */ const base = ({
     UserClaimSchema: schema,
     GroupClaimSchema: base_group_schema,
@@ -282909,6 +283122,7 @@ const base_secrets_schema = 'firestartr.dev://common/SecretsClaim';
     TFWorkspaceClaimSchema: workspace_schema,
     ArgoDeployClaimSchema: deploy_schema,
     OrgWebhookClaimSchema: orgWebhook_schema,
+    OrgSettingsClaimSchema: orgSettings_schema,
     SecretsClaimSchema: base_secrets_schema,
 });
 
@@ -283116,7 +283330,7 @@ async function setVirtualClaimAdditionalData(renderedData, claim, claimRef) {
     return renderedData;
 }
 async function setNonVirtualClaimAdditionalData(renderedData, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers) {
-    renderedData[claimRef]['initializers'] = await loadInitializers(claim);
+    renderedData[claimRef]['initializers'] = await loadInitializers(claim, renderedData[claimRef]['claimPath']);
     renderedData[claimRef]['globals'] = await loadGlobals(claim);
     renderedData[claimRef]['overrides'] = loadOverrides(claim);
     renderedData[claimRef]['normalizers'] = await loadNormalizers(claim, renderedData[claimRef]['claimPath']);
@@ -283278,7 +283492,7 @@ async function loadNormalizers(_claim, path) {
  *
  */
 let loadedInitializers = false;
-async function loadInitializers(claim, initializersPath = getPath('initializers')) {
+async function loadInitializers(claim, claimPath, initializersPath = getPath('initializers')) {
     const result = [];
     await crawl(initializersPath, (entry) => {
         return isYamlFile.test(entry);
@@ -283301,7 +283515,7 @@ async function loadInitializers(claim, initializersPath = getPath('initializers'
     });
     for (const initializer of INITIALIZERS) {
         if (initializer.applicableKinds.includes(claim.kind)) {
-            result.push(new initializer());
+            result.push(new initializer({ path: claimPath }));
         }
     }
     logger.info(`Loaded initializers ${JSON.stringify(result)}`);
@@ -283336,35 +283550,41 @@ function loader_patchClaim(claim, defaultsClaims) {
     }
     return claim;
 }
-/*
- * Loads all CRs and stores them into a object.
- *
- * This function receives no input.
- *
- * Returns:
- * - An object promise which contains each loaded CR
- *
- */
-async function loadCRs(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
+async function loadCRsWithFullSet(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
     const result = {};
+    const fullResult = {};
     await crawlWithExclusions(crsPath, (entry) => {
         return isYamlFile.test(entry);
     }, async (entry, data) => {
         const yamlData = stripKnownRelations(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data));
-        if (!('kind' in yamlData && 'name' in yamlData.metadata)) {
-            logger.warn(`Invalid claim file ${entry}`);
-        }
-        else {
-            if (result[`${yamlData.kind}-${yamlData.metadata.name}`]) {
-                logger.error(`Duplicate CR ${yamlData.kind}-${yamlData.metadata.name}`);
-            }
+        const metadata = yamlData?.metadata;
+        if (!(yamlData &&
+            typeof yamlData === 'object' &&
+            'kind' in yamlData &&
+            metadata &&
+            typeof metadata === 'object' &&
+            'name' in metadata)) {
+            logger.warn(`Invalid CR file ${entry}`);
+        }
+        else {
+            const crKey = `${yamlData.kind}-${metadata.name}`;
+            if (fullResult[crKey]) {
+                logger.error(`Duplicate CR ${crKey}`);
+            }
+            // Keep the complete CR set for validations that need repository-wide context.
+            fullResult[crKey] = yamlData;
+            // Keep the filtered CR set for previous-CR lookup during claim rendering.
             if (allowedClaimReferences.length === 0 ||
                 allowedClaimReferences.includes(yamlData.metadata?.annotations?.[catalog_common/* default.generic.getFirestartrAnnotation */.Z.generic.getFirestartrAnnotation('claim-ref')])) {
-                result[`${yamlData.kind}-${yamlData.metadata.name}`] = yamlData;
+                result[crKey] = yamlData;
             }
         }
     }, excludedPaths.concat(getAdditionalPaths()));
-    return result;
+    return { crs: result, fullCrs: fullResult };
+}
+async function loadCRs(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
+    const { crs } = await loadCRsWithFullSet(crsPath, excludedPaths, allowedClaimReferences);
+    return crs;
 }
 /*
  * Description: Get the renamed using claimRef annotation
@@ -283414,6 +283634,7 @@ async function loadClaimsList(claimRefList, claimsPath = getPath('claims')) {
     const data = {
         renderClaims: {},
         crs: {},
+        fullCrs: {},
     };
     const defaults = loadClaimDefaults();
     for await (const claimRef of claimRefList) {
@@ -283425,7 +283646,9 @@ async function loadClaimsList(claimRefList, claimsPath = getPath('claims')) {
         // Replaces only the first instance of '-'
         crClaimReferences.push(ref.replace('-', '/'));
     }
-    data['crs'] = await loadCRs(getPath('crs'), [getPath('globals'), getPath('initializers')], crClaimReferences);
+    const loadedCrs = await loadCRsWithFullSet(getPath('crs'), [getPath('globals'), getPath('initializers')], crClaimReferences);
+    data['crs'] = loadedCrs.crs;
+    data['fullCrs'] = loadedCrs.fullCrs;
     return data;
 }
 function getOrg() {
@@ -285198,6 +285421,9 @@ class FeaturesOverrider extends OverriderPatches {
                 identify() {
                     return `feature/${featureName}`;
                 },
+                applicable() {
+                    return { applicableProviders: ['catalog', 'github'] };
+                },
                 async post(cr) {
                     return utils_renderFeature(featureName, featureVersion, renderedFeatureConfig, cr, claim.name);
                 },
@@ -285208,8 +285434,12 @@ class FeaturesOverrider extends OverriderPatches {
                     return true;
                 },
                 async apply(cr) {
+                    if (!renderedFeatureConfig) {
+                        logger.warn(`Feature ${featureName}: renderedFeatureConfig is null, skipping post-patch`);
+                        return cr;
+                    }
                     const provider = helperCTX(this).provider;
-                    const jsonPatches = renderedFeatureConfig.patches[provider] || [];
+                    const jsonPatches = renderedFeatureConfig.patches?.[provider] || [];
                     fast_json_patch_default().applyPatch(cr, jsonPatches);
                     return cr;
                 },
@@ -288975,12 +289205,71 @@ class GithubOrgWebhookChart extends BaseGithubChart {
     }
 }
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/orgSettingsChart.ts
+
+
+class GithubOrgSettingsChart extends BaseGithubChart {
+    template() {
+        const claim = this.get('claim');
+        const firestartrId = this.get('firestartrId');
+        const githubProvider = claim.providers.github;
+        const template = {
+            metadata: {
+                name: githubProvider.name,
+            },
+            spec: {
+                org: githubProvider.org,
+                billingEmail: githubProvider.billing_email,
+                company: githubProvider.company,
+                blog: githubProvider.blog,
+                email: githubProvider.email,
+                twitterUsername: githubProvider.twitter_username,
+                location: githubProvider.location,
+                description: githubProvider.description,
+                hasOrganizationProjects: githubProvider.has_organization_projects,
+                hasRepositoryProjects: githubProvider.has_repository_projects,
+                defaultRepositoryPermission: githubProvider.default_repository_permission,
+                membersCanCreateRepositories: githubProvider.members_can_create_repositories,
+                membersCanCreatePublicRepositories: githubProvider.members_can_create_public_repositories,
+                membersCanCreatePrivateRepositories: githubProvider.members_can_create_private_repositories,
+                membersCanCreateInternalRepositories: githubProvider.members_can_create_internal_repositories,
+                membersCanCreatePages: githubProvider.members_can_create_pages,
+                membersCanCreatePublicPages: githubProvider.members_can_create_public_pages,
+                membersCanCreatePrivatePages: githubProvider.members_can_create_private_pages,
+                membersCanForkPrivateRepositories: githubProvider.members_can_fork_private_repositories,
+                webCommitSignoffRequired: githubProvider.web_commit_signoff_required,
+                advancedSecurityEnabledForNewRepositories: githubProvider.advanced_security_enabled_for_new_repositories,
+                dependabotAlertsEnabledForNewRepositories: githubProvider.dependabot_alerts_enabled_for_new_repositories,
+                dependabotSecurityUpdatesEnabledForNewRepositories: githubProvider.dependabot_security_updates_enabled_for_new_repositories,
+                dependencyGraphEnabledForNewRepositories: githubProvider.dependency_graph_enabled_for_new_repositories,
+                secretScanningEnabledForNewRepositories: githubProvider.secret_scanning_enabled_for_new_repositories,
+                secretScanningPushProtectionEnabledForNewRepositories: githubProvider.secret_scanning_push_protection_enabled_for_new_repositories,
+                firestartr: {
+                    tfStateKey: firestartrId,
+                },
+                writeConnectionSecretToRef: {
+                    name: `firestartrgithuborganizationsettings-${githubProvider.name}-outputs`.toLowerCase(),
+                    outputs: [],
+                },
+            },
+        };
+        return JSON.parse(JSON.stringify(template));
+    }
+    gvk() {
+        return FirestartrGithubOrganizationSettings.GVK;
+    }
+    instanceApiObject(template) {
+        return new FirestartrGithubOrganizationSettings(this, template.metadata.name, template);
+    }
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/github/index.ts
 
 
 
 
 
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/charts/catalog/base.ts
 
 class BaseCatalogChart extends BaseChart {
@@ -289724,6 +290013,7 @@ class SecretsChart extends BaseSecretsChart {
     ArgoDeployChart: ArgoDeployChart,
     SecretsChart: SecretsChart,
     GithubOrgWebhookChart: GithubOrgWebhookChart,
+    GithubOrgSettingsChart: GithubOrgSettingsChart,
 });
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-render.ts
@@ -289735,6 +290025,7 @@ class SecretsChart extends BaseSecretsChart {
 
 
 
+
 function normalizeProvidesApis(providesApis) {
     if (!providesApis)
         return [];
@@ -289756,6 +290047,7 @@ async function renderClaims(catalogScope, firestartrScope, data) {
         'TFWorkspaceClaim',
         'ArgoDeployClaim',
         'OrgWebhookClaim',
+        'OrgSettingsClaim',
     ], renderClaims);
     for (const renderClaims of sortedKinds) {
         for (const claimKey of Object.keys(renderClaims)) {
@@ -289770,7 +290062,8 @@ async function renderClaims(catalogScope, firestartrScope, data) {
             if (!previousCR) {
                 logger.debug(`No CR found for claim ${claimKey}, it will be rendered from scratch`);
             }
-            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR);
+            const claimPath = renderClaims[claimKey].claimPath;
+            const { firestartrEntity, extraCharts, catalogEntity } = await renderClaim(catalogScope, firestartrScope, claim, patches, previousCR, claimPath);
             if (catalogEntity) {
                 result[`${catalogEntity.kind}-${catalogEntity.metadata.name}`] =
                     catalogEntity.toJson();
@@ -289799,7 +290092,7 @@ async function renderClaims(catalogScope, firestartrScope, data) {
     }
     return result;
 }
-async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null) {
+async function renderClaim(catalogScope, firestartrScope, claim, patches, previousCR = null, claimPath) {
     let catalogEntity = undefined;
     let firestartrEntity = undefined;
     const extraCharts = [];
@@ -289867,6 +290160,20 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
                         .join('/');
                     const definitionUrl = `https://github.com/${org}/${repoName}/blob/${defaultBranch}/${encodedDefinitionFilePath}`;
                     const sanitizedApiName = sanitizeApiEntityName(apiDefinition.name);
+                    const repoUrl = getRepositoryUrl();
+                    const apiAnnotations = {
+                        ...(claim.annotations || {}),
+                        title: apiDefinition.name,
+                    };
+                    if (repoUrl && claimPath) {
+                        const claimsRoot = getPath('claims');
+                        const relativePath = external_path_.relative(claimsRoot, claimPath)
+                            .split(external_path_.sep)
+                            .map((segment) => encodeURIComponent(segment))
+                            .join('/');
+                        apiAnnotations['backstage.io/edit-url'] =
+                            `${repoUrl}/blob/${defaultBranch}/${relativePath}`;
+                    }
                     const apiChart = new charts.CatalogApiChart(catalogScope, `${chartId}-api-${sanitizedApiName}`, firestartrId, {
                         name: sanitizedApiName,
                         type: apiDefinition.type,
@@ -289874,10 +290181,7 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
                         owner: claim.owner,
                         system: claim.system,
                         definitionUrl,
-                        annotations: {
-                            ...(claim.annotations || {}),
-                            title: apiDefinition.name,
-                        },
+                        annotations: apiAnnotations,
                     }, []);
                     await apiChart.render();
                     const apiObject = await apiChart.postRenderer([]);
@@ -289930,6 +290234,11 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
                 firestartrEntity = new charts.GithubOrgWebhookChart(firestartrScope, `github-${chartId}`, firestartrId, claim, renderPatches);
             }
             break;
+        case 'OrgSettingsClaim':
+            if (loadGithub) {
+                firestartrEntity = new charts.GithubOrgSettingsChart(firestartrScope, `github-${chartId}`, firestartrId, claim, renderPatches);
+            }
+            break;
         default:
             console.error(`Unknown claim kind: ${claim.kind}`);
             break;
@@ -289946,7 +290255,7 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
      *
      */
     const [catalogChart, firestartrEntityChart] = await Promise.all([
-        loadCatalog ? catalogEntity.render() : Promise.resolve(undefined),
+        catalogEntity ? catalogEntity.render() : Promise.resolve(undefined),
         firestartrEntity?.render(),
     ]);
     /*
@@ -289955,7 +290264,7 @@ async function renderClaim(catalogScope, firestartrScope, claim, patches, previo
      *
      */
     return {
-        catalogEntity: loadCatalog
+        catalogEntity: catalogChart
             ? await catalogChart.postRenderer(postPatches)
             : undefined,
         firestartrEntity: await (firestartrEntityChart
@@ -290044,6 +290353,39 @@ function validateComponentPagesPath(_renderClaims) {
     return;
 }
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/githubOrgSettings.ts
+const GITHUB_ORG_SETTINGS_KIND = 'FirestartrGithubOrganizationSettings';
+const FIRESTARTR_CLAIM_REF_ANNOTATION = 'firestartr.dev/claim-ref';
+const CLAIM_REF_LABEL = 'claim-ref';
+function formatResourceRef(name, claimRef) {
+    return claimRef ? `${name} (claim: ${claimRef})` : name;
+}
+// Render-time singleton: at most one FirestartrGithubOrganizationSettings per
+// GitHub org (case-insensitive) across the whole rendered set. See ADR 0003.
+function validateGithubOrgSettingsSingleton(crs) {
+    const refsByOrg = new Map();
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (cr.kind !== GITHUB_ORG_SETTINGS_KIND)
+            continue;
+        const org = cr.spec?.org;
+        if (typeof org !== 'string' || !org)
+            continue;
+        const name = cr.metadata?.name || crKey;
+        const claimRef = cr.metadata?.annotations?.[FIRESTARTR_CLAIM_REF_ANNOTATION] ||
+            cr.metadata?.labels?.[CLAIM_REF_LABEL];
+        const normalizedOrg = org.toLowerCase();
+        const refs = refsByOrg.get(normalizedOrg) || [];
+        refs.push(formatResourceRef(name, claimRef));
+        refsByOrg.set(normalizedOrg, refs);
+    }
+    for (const [org, refs] of refsByOrg.entries()) {
+        if (refs.length < 2)
+            continue;
+        throw new Error(`Duplicate ${GITHUB_ORG_SETTINGS_KIND} resources found for GitHub organization "${org}": ${refs.join(', ')}`);
+    }
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/renderer.ts
 
 
@@ -290053,6 +290395,7 @@ function validateComponentPagesPath(_renderClaims) {
 
 
 
+
 /*
  * Function called when rendering but not importing
  *
@@ -290067,10 +290410,15 @@ function validateComponentPagesPath(_renderClaims) {
 async function renderer_render(catalogScope, firestartrScope, claimList) {
     const data = await loadClaimsList(claimList);
     const result = await renderClaims(catalogScope, firestartrScope, data);
+    const fullCrSet = {
+        ...data.fullCrs,
+        ...result,
+    };
     try {
         validateSubReferences(data.renderClaims);
         validateComponentPagesPath(data.renderClaims);
         validateTfStateKeyUniqueness(result);
+        validateGithubOrgSettingsSingleton(fullCrSet);
         validateCrSizes(result);
         validatePermissionsUniqueness(result);
     }
@@ -290500,6 +290848,8 @@ async function addLastStateAndLastClaimAnnotations(filePath, lastStatePRLink, la
     INITIALIZERS_BY_FILE_NAME: INITIALIZERS_BY_FILE_NAME,
     NORMALIZERS: NORMALIZERS,
     AllowedProviders: AllowedProviders,
+    setRepositoryUrl: setRepositoryUrl,
+    setDefaultBranch: setDefaultBranch,
     runComparer: runComparer,
     isCatalogEntity: isCatalogEntity,
     loadCRs: loadCRs,
@@ -290523,7 +290873,7 @@ async function addLastStateAndLastClaimAnnotations(filePath, lastStatePRLink, la
  * This function returns nothing.
  *
  */
-async function runRenderer(globalsPath, initializersPath, claimsPath, crsPath, claimsDefaults, outputCatalogDir, outputCrDir, renamesEnabled, provider, excludedPaths = [], validateReferentialIntegrity, claimRefs = '', claimFilesList = '') {
+async function runRenderer(globalsPath, initializersPath, claimsPath, crsPath, claimsDefaults, outputCatalogDir, outputCrDir, renamesEnabled, provider, excludedPaths = [], validateReferentialIntegrity, claimRefs = '', claimFilesList = '', repositoryUrl, defaultBranch) {
     configureProvider(provider);
     setPath('initializers', initializersPath);
     setPath('crs', crsPath);
@@ -290532,6 +290882,8 @@ async function runRenderer(globalsPath, initializersPath, claimsPath, crsPath, c
     setPath('claimsDefaults', claimsDefaults);
     setRenamesEnabled(renamesEnabled);
     setExcludedPaths(excludedPaths);
+    setRepositoryUrl(repositoryUrl);
+    setDefaultBranch(defaultBranch ?? 'main');
     const catalogApp = new lib.App({
         outdir: outputCatalogDir,
         outputFileExtension: '.yaml',
@@ -291058,6 +291410,107 @@ MemberCollectionGithubDecanter.collectionKind = 'gh-members';
 applyCollectionMixins(MemberCollectionGithubDecanter);
 /* harmony default export */ const github_member_collection = (MemberCollectionGithubDecanter);
 
+;// CONCATENATED MODULE: ../importer/src/decanter/gh/github_org_settings.ts
+
+
+const ORG_SETTINGS_OPTIONAL_FIELDS = [
+    'twitter_username',
+    'company',
+    'blog',
+    'email',
+    'location',
+    'description',
+    'has_organization_projects',
+    'has_repository_projects',
+    'default_repository_permission',
+    'members_can_create_repositories',
+    'members_can_create_public_repositories',
+    'members_can_create_private_repositories',
+    'members_can_create_internal_repositories',
+    'members_can_create_pages',
+    'members_can_create_public_pages',
+    'members_can_create_private_pages',
+    'members_can_fork_private_repositories',
+    'web_commit_signoff_required',
+    'advanced_security_enabled_for_new_repositories',
+    'dependabot_alerts_enabled_for_new_repositories',
+    'dependabot_security_updates_enabled_for_new_repositories',
+    'dependency_graph_enabled_for_new_repositories',
+    'secret_scanning_enabled_for_new_repositories',
+    'secret_scanning_push_protection_enabled_for_new_repositories',
+];
+class OrgSettingsGithubDecanter extends GithubDecanter {
+    constructor() {
+        super(...arguments);
+        this.claimKind = 'OrgSettingsClaim';
+    }
+    __decantStart() {
+        this.claim = {
+            kind: this.claimKind,
+            version: this.VERSION(),
+            name: this.orgSettingsName(),
+        };
+    }
+    __decantProviders() {
+        importer_src_logger.info(`Decanting GitHub organization settings providers for ${this.org}`);
+        this.__patchClaim({
+            op: 'add',
+            value: {
+                github: this.data.providerPayload,
+            },
+            path: '/providers',
+        });
+    }
+    async __gatherOrgSettings() {
+        importer_src_logger.info(`Gathering GitHub organization settings for ${this.org}`);
+        this.data.orgSettings = await this.github.org.getOrgInfo(this.org);
+    }
+    __gatherProviderPayload() {
+        const billingEmail = this.data.orgSettings.billing_email;
+        if (typeof billingEmail !== 'string' || billingEmail.trim() === '') {
+            throw new Error(`GitHub organization ${this.org} did not return billing_email. ` +
+                'billing_email is required for OrgSettingsClaim / FirestartrGithubOrganizationSettings. ' +
+                'Run importer with credentials that can read billing email or create/manage the claim manually.');
+        }
+        const providerPayload = {
+            name: this.orgSettingsName(),
+            org: this.org,
+            billing_email: billingEmail,
+        };
+        for (const field of ORG_SETTINGS_OPTIONAL_FIELDS) {
+            const value = this.data.orgSettings[field];
+            if (value !== undefined && value !== null) {
+                providerPayload[field] = value;
+            }
+        }
+        this.data.providerPayload = providerPayload;
+        importer_src_logger.info(`Prepared GitHub organization settings claim payload for ${this.org}`);
+    }
+    async __adaptInitializerBase(_claim) {
+        return await this.__loadInitializer('defaults_github_orgsettings.yaml');
+    }
+    orgSettingsName() {
+        return `${this.org.toLowerCase()}-org-settings`;
+    }
+}
+
+;// CONCATENATED MODULE: ../importer/src/decanter/gh/github_org_settings_collection.ts
+
+
+
+class OrgSettingsCollectionGithubDecanter extends GithubDecanter {
+    async collection(filters = []) {
+        if (this.IS_SKIP_SET(filters, OrgSettingsCollectionGithubDecanter.collectionKind)) {
+            return [];
+        }
+        const filteredOrgs = await this.filter(OrgSettingsCollectionGithubDecanter.collectionKind, filters, [this.org]);
+        return filteredOrgs.map((orgName) => new OrgSettingsGithubDecanter({}, orgName));
+    }
+}
+OrgSettingsCollectionGithubDecanter.collectionKind = 'gh-org-settings';
+applyCollectionMixins(OrgSettingsCollectionGithubDecanter);
+/* harmony default export */ const github_org_settings_collection = (OrgSettingsCollectionGithubDecanter);
+
 ;// CONCATENATED MODULE: ../importer/src/utils/codeowner.ts
 function extractFromCodeOwners(codeOwnersContent) {
     if (!codeOwnersContent) {
@@ -291553,6 +292006,7 @@ applyCollectionMixins(RepoCollectionGithubDecanter);
 
 
 
+
 // A single claim can render multiple CRs.
 // Some of those rendered kinds are derived/child resources whose parent is the
 // main CR for the claim, so they do not correspond to claim files that should be moved.
@@ -291564,6 +292018,7 @@ let previousCRs = {};
 const collections = {
     GroupCollectionGithubDecanter: github_group_collection,
     MemberCollectionGithubDecanter: github_member_collection,
+    OrgSettingsCollectionGithubDecanter: github_org_settings_collection,
     RepoCollectionGithubDecanter: github_repo_collection,
 };
 function isInPreviousCRs(kind, name) {
@@ -291656,9 +292111,11 @@ function getClaimPathFromCR(claimsBasePath, cr) {
         FirestartrGithubGroup: 'groups',
         FirestartrGithubRepository: 'components',
         FirestartrGithubMembership: 'users',
+        // common.io.writeClaim derives OrgSettingsClaim -> orgsettingss.
+        FirestartrGithubOrganizationSettings: 'orgsettingss',
     };
     const claimRef = `${cr.metadata.annotations['firestartr.dev/claim-ref']}.yaml`.toLowerCase();
-    return external_path_.join(claimsBasePath, mapCrsToClaims[cr.kind], claimRef.replace(/^[^/]+/, ''));
+    return external_path_.join(claimsBasePath, mapCrsToClaims[cr.kind], claimRef.replace(/^[^/]+\//, ''));
 }
 function getCrPath(crsBasePath, cr) {
     return external_path_.join(crsBasePath, `${cr.kind}.${cr.metadata.name}.yaml`);
@@ -291669,6 +292126,7 @@ async function getDataFromKinds(org, filters = [], needsReImport) {
         importGithubMemberships(org, filters, needsReImport).then((memberships) => (data['memberships'] = memberships)),
         importGithubGroups(org, filters, needsReImport).then((groups) => (data['groups'] = groups)),
         importGithubRepositories(org, filters, needsReImport).then((repos) => (data['repos'] = repos)),
+        importGithubOrgSettings(org, filters, needsReImport).then((orgSettings) => (data['orgSettings'] = orgSettings)),
     ]);
     const renderClaims = {};
     const deps = {};
@@ -291695,6 +292153,12 @@ async function getDataFromKinds(org, filters = [], needsReImport) {
             membership.deps;
         postRender[`FirestartrGithubMembership-${membership.renderClaim.claim.name}`] = membership.postRenderFunctions;
     }
+    for (const orgSettings of data['orgSettings']) {
+        renderClaims[`OrgSettingsClaim-${orgSettings.renderClaim.claim.name}`] =
+            orgSettings.renderClaim;
+        deps[`FirestartrGithubOrganizationSettings-${orgSettings.renderClaim.claim.name}`] = orgSettings.deps;
+        postRender[`FirestartrGithubOrganizationSettings-${orgSettings.renderClaim.claim.name}`] = orgSettings.postRenderFunctions;
+    }
     return { renderClaims, deps: deps, postRender: postRender };
 }
 async function importGithubGroups(org, filters = [], needsReImport) {
@@ -291737,6 +292201,19 @@ async function importGithubMemberships(org, filters = [], needsReImport) {
     }
     return memberships;
 }
+async function importGithubOrgSettings(org, filters = [], needsReImport) {
+    const orgSettingsList = [];
+    const orgSettingsCollection = new github_org_settings_collection({}, org);
+    const collection = await orgSettingsCollection.collection(filters);
+    for (const orgSettings of collection) {
+        orgSettings.needsReImport = needsReImport;
+        await orgSettings.gather();
+        await orgSettings.decant();
+        orgSettingsList.push(await orgSettings.adapt());
+        orgSettings.render();
+    }
+    return orgSettingsList;
+}
 async function getPreviousCrs(crsPath) { }
 /* harmony default export */ const decanter = ({ importGithubGitopsRepository });
 
@@ -291788,6 +292265,7 @@ const KIND_TO_COLLECTION_FILTERS = {
     FirestartrGithubRepository: 'gh-repo',
     FirestartrGithubGroup: 'gh-group',
     FirestartrGithubMembership: 'gh-members',
+    FirestartrGithubOrganizationSettings: 'gh-org-settings',
 };
 const DEPENDANT_KINDS = [
     'FirestartrGithubRepositoryFeature',
@@ -291796,6 +292274,9 @@ const DEPENDANT_KINDS = [
 // we create a special Collection that will use
 class ReimportCollection {
     helperNameExtractor(cr) {
+        if (cr.kind === 'FirestartrGithubOrganizationSettings') {
+            return cr.spec.org;
+        }
         return cr.metadata.annotations['firestartr.dev/external-name'];
     }
     isSkipped(cr, generatedFilters) {
@@ -291962,19 +292443,25 @@ function buildFilters(filters, force, crsPath, generatedFilters) {
     return generatedFilters;
 }
 function createSkipFilters(filters) {
-    const includedCollections = filters.map((f) => f.split(',')[0]);
-    const allFilters = filters.filter((f) => f.split(',')[0] === 'all');
+    const crExistsFilter = 'all,FUNCTION=fCheckCRExistsOnDisk';
+    const includedCollections = filters
+        .filter((f) => f !== crExistsFilter)
+        .map((f) => f.split(',')[0]);
+    const allFilters = filters.filter((f) => f.split(',')[0] === 'all' && f !== crExistsFilter);
+    const hasExplicitFilters = includedCollections.length > 0;
     for (const collectionClass of Object.values(collections)) {
-        if (allFilters.length > 0) {
-            for (const allFilter of allFilters) {
-                const adaptedFilter = allFilter.replace('all', collectionClass.collectionKind);
-                filters.push(adaptedFilter);
+        const collectionKind = collectionClass.collectionKind;
+        if (allFilters.length > 0 || !hasExplicitFilters) {
+            for (const allFilter of [...allFilters, crExistsFilter]) {
+                filters.push(allFilter.replace('all', collectionKind));
             }
             continue;
         }
-        if (includedCollections.indexOf(collectionClass.collectionKind) === -1) {
-            filters.push(`${collectionClass.collectionKind},SKIP=SKIP`);
+        if (includedCollections.indexOf(collectionKind) === -1) {
+            filters.push(`${collectionKind},SKIP=SKIP`);
+            continue;
         }
+        filters.push(crExistsFilter.replace('all', collectionKind));
     }
     return filters;
 }
@@ -292246,6 +292733,7 @@ const kindPluralMap = {
     githubrepositorysecretssections: 'FirestartrGithubRepositorySecretsSection',
     terraformmodules: 'FirestartrTerraformModule',
     githuborgwebhooks: 'FirestartrGithubOrgWebhook',
+    githuborganizationsettings: 'FirestartrGithubOrganizationSettings',
     terraformworkspaces: 'FirestartrTerraformWorkspace',
     terraformworkspaceplans: 'FirestartrTerraformWorkspacePlan',
     providerconfigs: 'FirestartrProviderConfig',
@@ -292393,9 +292881,9 @@ function getOperatorProfile() {
 }
 async function getItem(kind, namespace, item) {
     const itemPath = `${namespace}/${kind}/${item.metadata.name}`;
-    return await getItemByItemPath(itemPath);
+    return await ctl_getItemByItemPath(itemPath);
 }
-async function getItemByItemPath(itemPath, apiGroup = catalog_common/* default.types.controller.FirestartrApiGroup */.Z.types.controller.FirestartrApiGroup, apiVersion = 'v1') {
+async function ctl_getItemByItemPath(itemPath, apiGroup = catalog_common/* default.types.controller.FirestartrApiGroup */.Z.types.controller.FirestartrApiGroup, apiVersion = 'v1') {
     try {
         operator_src_logger.debug(`The ctl is getting the item at '${itemPath}'.`);
         const { kc, opts } = await ctl_getConnection();
@@ -292419,6 +292907,39 @@ async function getItemByItemPath(itemPath, apiGroup = catalog_common/* default.t
         throw e;
     }
 }
+/**
+ * Like getItemByItemPath but returns null when the resource is not found
+ * (404) or there is a conflict (409), without logging those as errors.
+ * Use this when a missing resource is an expected condition (e.g. checking
+ * whether a parent CR has been provisioned before its children arrive).
+ */
+async function getItemByItemPathOrNull(itemPath, apiGroup = catalog_common/* default.types.controller.FirestartrApiGroup */.Z.types.controller.FirestartrApiGroup, apiVersion = 'v1') {
+    try {
+        operator_src_logger.debug(`The ctl is getting the item at '${itemPath}'.`);
+        const { kc, opts } = await ctl_getConnection();
+        opts.headers['Content-Type'] = 'application/json';
+        opts.headers['Accept'] = 'application/json';
+        const url = apiGroup === catalog_common/* default.types.controller.KubernetesApiGroup */.Z.types.controller.KubernetesApiGroup
+            ? `${kc.getCurrentCluster().server}/api/v1/namespaces/${itemPath}`
+            : `${kc.getCurrentCluster().server}/apis/${apiGroup}/${apiVersion}/namespaces/${itemPath}`;
+        operator_src_logger.silly(`Sending request ${url}`);
+        const r = await fetch(url, { method: 'get', headers: opts.headers });
+        if (r.status === 404 || r.status === 409) {
+            operator_src_logger.debug(`Item at '${itemPath}' returned ${r.status} (expected), returning null.`);
+            return null;
+        }
+        if (!r.ok) {
+            const err = new Error(`Error on getItemByItemPath: ${itemPath}: ${r.statusText}`);
+            operator_src_logger.error(`Error on getItemByItemPath: ${itemPath}: ${r.statusText}`);
+            throw err;
+        }
+        return await r.json();
+    }
+    catch (e) {
+        operator_src_logger.error(`Error on getItemByItemPath: ${e}`);
+        throw e;
+    }
+}
 async function writeManifest(kind, namespace, item, apiSlug) {
     const { kc, opts } = await ctl_getConnection();
     opts.headers['Content-Type'] = 'application/json';
@@ -292704,40 +293225,52 @@ async function checkIfRenamed(namespace, item) {
     }
 }
 async function upsertFinalizer(kind, namespace, item, finalizer) {
-    if ('finalizers' in item.metadata &&
-        item.metadata.finalizers.includes(finalizer)) {
-        operator_src_logger.debug(`The ctl tried to upsert the finalizer '${finalizer}' for '${kind}/${item.metadata.name}' in namespace '${namespace}', but it was already set.`);
-        return;
-    }
-    operator_src_logger.debug(`The ctl is setting the finalizer '${finalizer}' for '${kind}/${item.metadata.name}' in namespace '${namespace}'.`);
     const { kc, opts } = await ctl_getConnection();
     const url = `${kc.getCurrentCluster().server}/apis/firestartr.dev/v1/namespaces/${namespace}/${kind}/${item.metadata.name}`;
-    opts.headers['Content-Type'] = 'application/json-patch+json';
-    opts.headers['Accept'] = '*';
-    let patch;
-    if (!item['metadata']['finalizers']) {
-        patch = {
-            op: 'add',
-            path: '/metadata/finalizers',
-            value: [finalizer],
-        };
-    }
-    else {
-        patch = {
-            op: 'add',
-            path: '/metadata/finalizers/-',
-            value: finalizer,
-        };
-    }
-    const r = await fetch(url, {
-        method: 'PATCH',
-        headers: opts.headers,
-        body: JSON.stringify([patch]),
-    });
-    if (!r.ok) {
-        throw `Error on setFinalizer: ${namespace}/${kind}/${item['metadata']['name']}: ${r.statusText}`;
+    for (let attempt = 0; attempt < 5; attempt++) {
+        // Fresh GET to get current finalizers and resourceVersion
+        const getResp = await fetch(url, {
+            method: 'GET',
+            headers: { ...opts.headers, Accept: 'application/json' },
+        });
+        if (!getResp.ok) {
+            throw `Error fetching item for finalizer upsert: ${namespace}/${kind}/${item.metadata.name}: ${getResp.statusText}`;
+        }
+        const currentItem = await getResp.json();
+        const currentFinalizers = currentItem.metadata.finalizers || [];
+        if (currentFinalizers.includes(finalizer)) {
+            operator_src_logger.debug(`The ctl tried to upsert the finalizer '${finalizer}' for '${kind}/${item.metadata.name}' in namespace '${namespace}', but it was already set.`);
+            return;
+        }
+        operator_src_logger.debug(`The ctl is setting the finalizer '${finalizer}' for '${kind}/${item.metadata.name}' in namespace '${namespace}' (attempt ${attempt + 1}).`);
+        const newFinalizers = [...currentFinalizers, finalizer];
+        const body = JSON.stringify([
+            {
+                op: 'add',
+                path: '/metadata/finalizers',
+                value: newFinalizers,
+            },
+        ]);
+        const patchResp = await fetch(url, {
+            method: 'PATCH',
+            headers: {
+                ...opts.headers,
+                'Content-Type': 'application/json-patch+json',
+                Accept: '*',
+                'If-Match': currentItem.metadata.resourceVersion,
+            },
+            body,
+        });
+        if (patchResp.ok) {
+            return patchResp.json();
+        }
+        if (patchResp.status === 409) {
+            operator_src_logger.debug(`Conflict upserting finalizer '${finalizer}' for '${kind}/${item.metadata.name}' (attempt ${attempt + 1}), retrying.`);
+            continue;
+        }
+        throw `Error on upsertFinalizer: ${namespace}/${kind}/${item.metadata.name}: ${patchResp.statusText}`;
     }
-    return r.json();
+    throw `Failed to upsert finalizer '${finalizer}' for '${namespace}/${kind}/${item.metadata.name}' after 5 attempts.`;
 }
 /**
  * Remove the given finalizer
@@ -292751,30 +293284,57 @@ async function unsetFinalizer(kind, namespace, item, finalizer) {
     const { kc, opts } = await ctl_getConnection();
     let itemObj;
     if (typeof item === 'string') {
-        itemObj = await getItemByItemPath([namespace, kind, item].join('/'));
+        itemObj = await ctl_getItemByItemPath([namespace, kind, item].join('/'));
     }
     else {
         itemObj = item;
     }
     const name = itemObj.metadata.name;
-    operator_src_logger.debug(`The ctl is removing the finalizer '${finalizer}' from '${kind}/${name}' in namespace '${namespace}'.`);
     const url = `${kc.getCurrentCluster().server}/apis/firestartr.dev/v1/namespaces/${namespace}/${kind}/${name}`;
-    opts.headers['Content-Type'] = 'application/json-patch+json';
-    opts.headers['Accept'] = '*';
-    const patch = {
-        op: 'replace',
-        path: '/metadata/finalizers',
-        value: itemObj.metadata.finalizers.filter((f) => f !== finalizer),
-    };
-    const r = await fetch(url, {
-        method: 'PATCH',
-        headers: opts.headers,
-        body: JSON.stringify([patch]),
-    });
-    if (!r.ok) {
-        throw `Error on unsetFinalizer: ${namespace}/${kind}/${name}: ${r.statusText}`;
+    for (let attempt = 0; attempt < 5; attempt++) {
+        // Fresh GET to get current finalizers and resourceVersion
+        const getResp = await fetch(url, {
+            method: 'GET',
+            headers: { ...opts.headers, Accept: 'application/json' },
+        });
+        if (!getResp.ok) {
+            throw `Error fetching item for finalizer unset: ${namespace}/${kind}/${name}: ${getResp.statusText}`;
+        }
+        const currentItem = await getResp.json();
+        const currentFinalizers = currentItem.metadata.finalizers || [];
+        if (!currentFinalizers.includes(finalizer)) {
+            operator_src_logger.debug(`The ctl tried to unset the finalizer '${finalizer}' for '${kind}/${name}' in namespace '${namespace}', but it was not present.`);
+            return;
+        }
+        operator_src_logger.debug(`The ctl is removing the finalizer '${finalizer}' from '${kind}/${name}' in namespace '${namespace}' (attempt ${attempt + 1}).`);
+        const newFinalizers = currentFinalizers.filter((f) => f !== finalizer);
+        const body = JSON.stringify([
+            {
+                op: 'replace',
+                path: '/metadata/finalizers',
+                value: newFinalizers,
+            },
+        ]);
+        const patchResp = await fetch(url, {
+            method: 'PATCH',
+            headers: {
+                ...opts.headers,
+                'Content-Type': 'application/json-patch+json',
+                Accept: '*',
+                'If-Match': currentItem.metadata.resourceVersion,
+            },
+            body,
+        });
+        if (patchResp.ok) {
+            return patchResp.json();
+        }
+        if (patchResp.status === 409) {
+            operator_src_logger.debug(`Conflict unsetting finalizer '${finalizer}' for '${kind}/${name}' (attempt ${attempt + 1}), retrying.`);
+            continue;
+        }
+        throw `Error on unsetFinalizer: ${namespace}/${kind}/${name}: ${patchResp.statusText}`;
     }
-    return r.json();
+    throw `Failed to unset finalizer '${finalizer}' for '${namespace}/${kind}/${name}' after 5 attempts.`;
 }
 /**
  * @deprecated Misspelled export kept for backward compatibility.
@@ -293041,7 +293601,7 @@ function conditionsSorter(conditions) {
 
 
 async function upsertInitialStatus(pluralKind, namespace, item) {
-    item = await getItemByItemPath(`${namespace}/${pluralKind}/${item.metadata.name}`);
+    item = await ctl_getItemByItemPath(`${namespace}/${pluralKind}/${item.metadata.name}`);
     if (!('status' in item))
         item.status = {};
     if (!('conditions' in item.status))
@@ -293127,7 +293687,7 @@ function shouldForceReconcileByAnnotation(cr) {
 }
 async function updateSyncTransition(itemPath, reason, lastSyncTime, nextSyncTime, message, status) {
     operator_src_logger.info(`The item at '${itemPath}' transitioned to a new SYNCHRONIZED condition of '${status}'. The reason for the change is '${reason}' with the message: '${message}'.`);
-    const k8sItem = await getItemByItemPath(itemPath);
+    const k8sItem = await ctl_getItemByItemPath(itemPath);
     if (!('status' in k8sItem))
         k8sItem.status = {};
     if (!('conditions' in k8sItem.status))
@@ -293150,7 +293710,7 @@ async function updateSyncTransition(itemPath, reason, lastSyncTime, nextSyncTime
 async function updateRetryStatusInCR(pluralKind, namespace, name, retryCount, nextRetryTime) {
     const itemPath = `${namespace}/${pluralKind}/${name}`;
     try {
-        const item = await getItemByItemPath(itemPath);
+        const item = await ctl_getItemByItemPath(itemPath);
         if (!('status' in item) || item.status === null)
             item.status = {};
         item.status.retryCount = retryCount;
@@ -293196,7 +293756,7 @@ async function writePrioritizedStatus(kind, namespace, item) {
 }
 async function updateTransition(itemPath, reason, type, statusValue, message = '', updateStatusOnly = false) {
     operator_src_logger.info(`The item at '${itemPath}' transitioned to a new status of '${statusValue}' (type: '${type}'). The reason for the change is '${reason}' with the message: '${message}'. This was a status-only update: '${updateStatusOnly}'.`);
-    const k8sItem = await getItemByItemPath(itemPath);
+    const k8sItem = await ctl_getItemByItemPath(itemPath);
     if (!('status' in k8sItem))
         k8sItem.status = {};
     if (!('conditions' in k8sItem.status))
@@ -293269,7 +293829,7 @@ const SYNC_DEFAULT_ERROR_MESSAGE = 'An error occurred while executing the Sync o
 
 const DEFAULT_REVISION_TIME = '1m';
 async function createWatcherForItem(itemPath, itemCR) {
-    const item = itemCR ?? (await getItemByItemPath(itemPath));
+    const item = itemCR ?? (await ctl_getItemByItemPath(itemPath));
     const syncStatus = await getSyncStatus(itemPath, item);
     let nextTimeoutInMS = syncStatus.nextTimeoutInMS;
     // we have lapsed last interval
@@ -293301,7 +293861,7 @@ async function destroyWatcherForItem(watcher) {
     operator_src_logger.debug(`Disabled SyncWatcher for ${watcher.itemPath}`);
 }
 async function getSyncSpecs(itemPath, itemCR) {
-    const item = itemCR ?? (await getItemByItemPath(itemPath));
+    const item = itemCR ?? (await ctl_getItemByItemPath(itemPath));
     return {
         item,
         syncable: helperIsSyncable(item),
@@ -293313,7 +293873,7 @@ async function getSyncSpecs(itemPath, itemCR) {
     };
 }
 async function getSyncStatus(itemPath, itemCR) {
-    const item = itemCR ?? (await getItemByItemPath(itemPath));
+    const item = itemCR ?? (await ctl_getItemByItemPath(itemPath));
     const syncCondition = getConditionByType(item.status?.conditions ?? [], 'SYNCHRONIZED');
     // no sync condition present
     if (!syncCondition) {
@@ -293345,7 +293905,7 @@ async function getSyncStatus(itemPath, itemCR) {
     }
 }
 async function setSyncStatus(itemPath, reason, status, message) {
-    const item = await getItemByItemPath(itemPath);
+    const item = await ctl_getItemByItemPath(itemPath);
     const machinery = assessSyncCalculationMachinery(item);
     const syncStatus = await machinery(item, reason, status, message);
     syncStatus.itemPath = itemPath;
@@ -293595,7 +294155,7 @@ async function loopKeeper(api) {
     }
 }
 async function getItemIfNeededSync(watcher) {
-    const item = await getItemByItemPath(watcher.itemPath);
+    const item = await ctl_getItemByItemPath(watcher.itemPath);
     const isProvisioning = item.status?.conditions?.find((condition) => condition.type === 'PROVISIONING' && condition.status === 'True');
     if (isProvisioning)
         return null;
@@ -293685,7 +294245,7 @@ async function retry_loop(enqueueIfNeeded) {
 }
 async function getItemIfNeededRetry(watcher) {
     try {
-        const item = await getItemByItemPath(watcher.itemPath);
+        const item = await ctl_getItemByItemPath(watcher.itemPath);
         const isProvisioning = item.status?.conditions?.find((condition) => condition.type === 'PROVISIONING' && condition.status === 'True');
         if (isProvisioning)
             return null;
@@ -293869,6 +294429,7 @@ const kindsWithFinalizer = [
     'FirestartrGithubRepository',
     'FirestartrGithubRepositoryFeature',
     'FirestartrGithubOrgWebhook',
+    'FirestartrGithubOrganizationSettings',
     'FirestartrGithubRepositorySecretsSection',
 ];
 const kindsWithDependants = [
@@ -293973,7 +294534,7 @@ async function handleUnsetFinalizer(pluralKind, namespace, item) {
  */
 function enqueue(pluralKind, workItem, queue, compute, syncCtl, retryCtl) {
     workItem.getItem = () => {
-        return getItemByItemPath(informer_itemPath(pluralKind, workItem.item));
+        return ctl_getItemByItemPath(informer_itemPath(pluralKind, workItem.item));
     };
     workItem.isDeadLetter = false;
     workItem.handler = {
@@ -293992,7 +294553,7 @@ function enqueue(pluralKind, workItem, queue, compute, syncCtl, retryCtl) {
             return result;
         },
         writeConnectionSecret: writeConnectionSecret,
-        resolveReferences: () => resolve(workItem.item, getItemByItemPath, getSecret),
+        resolveReferences: () => resolve(workItem.item, ctl_getItemByItemPath, getSecret),
         resolveOwnOutputs: () => {
             return resolveSecretRef(workItem.item.metadata.namespace, workItem.item, getSecret);
         },
@@ -294063,7 +294624,7 @@ function enqueue(pluralKind, workItem, queue, compute, syncCtl, retryCtl) {
         if (needsUpdateSyncConditions) {
             if (operation === OperationType.SYNC) {
                 // Fetch the CR once and reuse for both hasSyncFailed check and ERROR guard
-                const currentItem = await getItemByItemPath(workItem.handler.itemPath());
+                const currentItem = await ctl_getItemByItemPath(workItem.handler.itemPath());
                 const syncStatus = await getSyncStatus(workItem.handler.itemPath(), currentItem);
                 if (syncStatus.hasSyncFailed) {
                     return;
@@ -294312,64 +294873,40 @@ function dummy_fWait(ms) {
     });
 }
 
-;// CONCATENATED MODULE: ../operator/src/ownership.ts
+;// CONCATENATED MODULE: ../operator/src/ctl_collections.ts
 
 
 
-async function getOwnerReferences(item) {
-    return item.metadata?.ownerReferences || [];
-}
-async function ownership_setOwnerReference(itemPath, namespace, ownerKind, ownerName, blockOwnerDeletion = true) {
-    let item = null;
+// generator function to traverse elements
+// it is async and iterable
+async function* traverseCRCollection(pluralKind, namespace, options = {}, apiGroup = 'firestartr.dev', apiVersion = 'v1') {
+    const { limit = 300 } = options; // between 250-300
     try {
-        // we need to search for the owner's uuid
-        const owner = await getItemByItemPath(`${namespace}/${ownerKind}/${ownerName}`);
-        const ownerReference = {
-            apiVersion: owner.apiVersion,
-            kind: owner.kind,
-            name: ownerName,
-            controller: true,
-            blockOwnerDeletion,
-            uid: owner.metadata.uid,
-        };
-        // we get the item (to prevent race conditions)
-        item = await getItemByItemPath(itemPath);
-        const ownerReferences = item.metadata.ownerReferences ?? [];
-        const existingRefIndex = ownerReferences.findIndex((ref) => ref.uid === ownerReference.uid);
-        if (existingRefIndex === -1) {
-            // Reference does not exist, add it
-            ownerReferences.push(ownerReference);
-        }
-        else {
-            ownerReferences[existingRefIndex] = ownerReference;
-        }
-        await writeOwnerReferences(definitions_getPluralFromKind(item.kind), item.metadata.namespace, item, ownerReferences);
+        let continueToken = undefined;
+        const { kc, opts } = await ctl_getConnection();
+        const k8sApi = kc.makeApiClient(client_node_dist.CustomObjectsApi);
+        const apiGroup = 'firestartr.dev';
+        const apiVersion = 'v1';
+        const apiPaths = `/apis/${apiGroup}/${apiVersion}/namespaces/${namespace}/${pluralKind}`;
+        do {
+            const res = await k8sApi.listNamespacedCustomObject(apiGroup, apiVersion, namespace, pluralKind, undefined, // pretty
+            undefined, // allowWatchBookmarks
+            continueToken, // _continue
+            undefined, // fieldSelector
+            undefined, // labelSelector
+            limit);
+            const body = res.body;
+            const items = body.items || [];
+            for (const item of items) {
+                yield item;
+            }
+            continueToken = body.metadata?.continue;
+        } while (continueToken);
     }
     catch (err) {
-        operator_src_logger.error(err);
-        throw `Setting OwnerReferences to ${item.kind}/${item.metadata.name}: ${err}`;
-    }
-}
-async function writeOwnerReferences(kind, namespace, item, ownerReferences) {
-    operator_src_logger.debug(`The ctl is setting the ownerReferences for '${kind}/${item.metadata.name}' in namespace '${namespace}'.`);
-    const { kc, opts } = await ctl_getConnection();
-    const url = `${kc.getCurrentCluster().server}/apis/firestartr.dev/v1/namespaces/${namespace}/${kind}/${item.metadata.name}`;
-    opts.headers['Content-Type'] = 'application/json-patch+json';
-    opts.headers['Accept'] = '*';
-    const patch = {
-        op: 'replace',
-        path: '/metadata/ownerReferences',
-        value: ownerReferences,
-    };
-    const r = await fetch(url, {
-        method: 'PATCH',
-        headers: opts.headers,
-        body: JSON.stringify([patch]),
-    });
-    if (!r.ok) {
-        throw `Error on setOwnerReferences: ${namespace}/${kind}/${item['metadata']['name']}: ${r.statusText}`;
+        operator_src_logger.error(`Error traversing ${namespace}/${pluralKind}: ${err}`);
+        throw new Error(`Error traversing ${namespace}/${pluralKind}: ${err}`);
     }
-    return r.json();
 }
 
 ;// CONCATENATED MODULE: ../operator/fdummies/index.ts
@@ -294378,6 +294915,11 @@ async function writeOwnerReferences(kind, namespace, item, ownerReferences) {
 
 
 
+
+const dummyChildrenMap = {
+    FirestartrDummyA: ['FirestartrDummyB'],
+    FirestartrDummyB: ['FirestartrDummyC'],
+};
 function processFirestartrDummies(item, op, handler) {
     operator_src_logger.info(`FirestartrDummies Processor: ${op}`);
     try {
@@ -294408,20 +294950,93 @@ async function* updated(item, op, handler) {
     for await (const transition of doRun(item, op, handler)) {
         yield transition;
     }
-    await handleOwnerReferences(item, handler);
+    await manageDummyOwnershipReferences(item, handler);
 }
 async function* created(item, op, handler) {
     for await (const transition of doRun(item, op, handler)) {
         yield transition;
     }
-    await handleOwnerReferences(item, handler);
+    await manageDummyOwnershipReferences(item, handler);
 }
-async function handleOwnerReferences(item, handler) {
+async function manageDummyOwnershipReferences(item, _handler) {
+    /*******************************************************************************
+    // suspended due to https://github.com/prefapp/gitops-k8s/issues/1767
+    if ('needs' in item.spec) {
+      const needs = item.spec.needs;
+      await setOwnerReference(
+        handler.itemPath(),
+        item.metadata.namespace,
+        getPluralFromKind(needs.kind),
+        needs.name,
+      );
+    }
+    ********************************************************************************/
     if ('needs' in item.spec) {
-        const needs = item.spec.needs;
-        await ownership_setOwnerReference(handler.itemPath(), item.metadata.namespace, definitions_getPluralFromKind(needs.kind), needs.name);
+        await installParentFinalizer(item);
     }
 }
+async function manageDummyOwnershipPostDeletion(item, _handler) {
+    if ('needs' in item.spec) {
+        await manageChildrenReferences(item);
+    }
+    if (Object.prototype.hasOwnProperty.call(dummyChildrenMap, item.kind)) {
+        await removeFinalizerIfNoMoreChildren(item);
+    }
+}
+async function installParentFinalizer(item) {
+    const needs = item.spec.needs;
+    const parentItem = await ctl_getItemByItemPath([item.metadata.namespace, definitions_getPluralFromKind(needs.kind), needs.name].join('/'));
+    await upsertFinalizer(definitions_getPluralFromKind(parentItem.kind), parentItem.metadata.namespace, parentItem, 'firestartr.dev/foreground-deletion');
+}
+async function manageChildrenReferences(item) {
+    const parentItem = await ctl_getItemByItemPath([
+        item.metadata.namespace,
+        definitions_getPluralFromKind(item.spec.needs.kind),
+        item.spec.needs.name,
+    ].join('/'));
+    await removeFinalizerIfNoMoreChildren(parentItem);
+}
+async function removeFinalizerIfNoMoreChildren(parentItem) {
+    try {
+        let numberOfChildren = 0;
+        const childKinds = dummyChildrenMap[parentItem.kind];
+        if (!childKinds)
+            return;
+        for (const childKind of childKinds) {
+            const children = await findDummiesWithNeeds(childKind, parentItem);
+            numberOfChildren += children.length;
+        }
+        if (numberOfChildren === 0) {
+            try {
+                await unsetFinalizer(definitions_getPluralFromKind(parentItem.kind), parentItem.metadata.namespace, parentItem, 'firestartr.dev/foreground-deletion');
+            }
+            catch (unsetErr) {
+                if (typeof unsetErr === 'string' && unsetErr.includes('Not Found')) {
+                    operator_src_logger.info(`${parentItem.kind}/${parentItem.metadata.name} was already deleted; skipping finalizer removal`);
+                }
+                else {
+                    throw unsetErr;
+                }
+            }
+        }
+    }
+    catch (err) {
+        operator_src_logger.error(`Error managing children references in item: ${parentItem.kind}/${parentItem.metadata.name}: ${err}`);
+        throw new Error(`Error managing children references in item: ${parentItem.kind}/${parentItem.metadata.name}: ${err}`);
+    }
+}
+async function findDummiesWithNeeds(kind, parentItem) {
+    const children = [];
+    const pluralKind = definitions_getPluralFromKind(kind);
+    for await (const crItem of traverseCRCollection(pluralKind, parentItem.metadata.namespace)) {
+        if ('needs' in crItem.spec &&
+            crItem.spec.needs.name === parentItem.metadata.name &&
+            crItem.spec.needs.kind === parentItem.kind) {
+            children.push(crItem);
+        }
+    }
+    return children;
+}
 async function renamed() {
     throw new Error('Renamed operation not prepared');
 }
@@ -294507,6 +295122,7 @@ async function* markedToDeletion(item, op, handler) {
             message: 'destroyed',
         };
         await handler.finalize(handler.pluralKind, item.metadata.namespace, item, 'firestartr.dev/finalizer');
+        await manageDummyOwnershipPostDeletion(item, handler);
         void handler.success();
     }
     catch (e) {
@@ -295203,12 +295819,20 @@ async function startQueueMetrics(meter, attributes) {
     const nWorkItemsInDeadLetterHandling = meter.createObservableGauge('firestartr_workitems_dead_letter_handling_total', {
         description: 'Number of workitems of the queue handled by the Dead Letter Handler',
     });
+    const nWorkItemsBlocked = meter.createObservableGauge('firestartr_workitems_blocked_total', {
+        description: 'Number of workitems currently blocked (children still being deleted, or parent not yet created/provisioned)',
+    });
+    const nWorkItemsDeferred = meter.createObservableGauge('firestartr_workitems_deferred_total', {
+        description: 'Number of workitems moved to the deferred segment after repeated blocking',
+    });
     const queueMetrics = getQueueMetrics();
     let total = queueMetrics.nItems;
     let pending = queueMetrics.nItemsPending;
     let processing = queueMetrics.nItemsProcessing;
     let finished = queueMetrics.nItemsFinished;
     let inDeadLetterHandling = queueMetrics.nItemsInDeadLetterHandling;
+    let nBlocked = queueMetrics.nItemsBlocked || 0;
+    let nDeferred = queueMetrics.nItemsDeferred || 0;
     nWorkItemsCounter.addCallback((observer) => observer.observe(total, { ...attributes, ...queueMetrics.nItemsTypes }));
     nWorkItemsPendingCounter.addCallback((observer) => observer.observe(pending, { ...attributes, ...queueMetrics.nItemsTypes }));
     nWorkItemsProcessingCounter.addCallback((observer) => observer.observe(processing, {
@@ -295220,6 +295844,8 @@ async function startQueueMetrics(meter, attributes) {
         ...attributes,
         ...queueMetrics.nItemsTypes,
     }));
+    nWorkItemsBlocked.addCallback((observer) => observer.observe(nBlocked, { ...attributes }));
+    nWorkItemsDeferred.addCallback((observer) => observer.observe(nDeferred, { ...attributes }));
     setInterval(() => {
         const queueMetrics = getQueueMetrics();
         total = queueMetrics.nItems;
@@ -295227,6 +295853,8 @@ async function startQueueMetrics(meter, attributes) {
         processing = queueMetrics.nItemsProcessing;
         finished = queueMetrics.nItemsFinished;
         inDeadLetterHandling = queueMetrics.nItemsInDeadLetterHandling;
+        nBlocked = queueMetrics.nItemsBlocked || 0;
+        nDeferred = queueMetrics.nItemsDeferred || 0;
     }, 1000);
 }
 async function startMemoryMetrics(meter, attributes) {
@@ -295401,15 +296029,131 @@ class ProcessItemSlot {
     }
 }
 
-;// CONCATENATED MODULE: ../operator/src/processItem.ts
-
-
-
-
+;// CONCATENATED MODULE: ../operator/src/parentDependency.ts
 
+const PARENT_KIND_MAP = {
+    FirestartrGithubRepositoryFeature: 'FirestartrGithubRepository',
+    FirestartrGithubRepositorySecretsSection: 'FirestartrGithubRepository',
+    FirestartrDummyB: 'FirestartrDummyA',
+    FirestartrDummyC: 'FirestartrDummyB',
+};
+const DEPENDENT_KINDS = new Set(Object.keys(PARENT_KIND_MAP));
+const RELEVANT_KINDS = new Set();
+for (const [child, parent] of Object.entries(PARENT_KIND_MAP)) {
+    RELEVANT_KINDS.add(child);
+    RELEVANT_KINDS.add(parent);
+}
+function getParentKindForDependent(kind) {
+    return PARENT_KIND_MAP[kind];
+}
+function isDependentKind(kind) {
+    return DEPENDENT_KINDS.has(kind);
+}
+function isRelevantKind(kind) {
+    return RELEVANT_KINDS.has(kind);
+}
+function getParentRef(workItem) {
+    const ref = workItem.item.spec?.repositoryTarget?.ref;
+    if (ref?.kind && ref?.name) {
+        return { kind: ref.kind, name: ref.name };
+    }
+    const needs = workItem.item.spec?.needs;
+    if (needs?.kind && needs?.name) {
+        return { kind: needs.kind, name: needs.name };
+    }
+    return null;
+}
+function buildActiveParentKeys(queue) {
+    const keys = new Set();
+    for (const w of queue) {
+        if (w.workStatus === WorkStatus.PENDING || w.isPicked) {
+            keys.add(`${w.item.kind}/${w.item.metadata?.name}`);
+        }
+    }
+    return keys;
+}
+/**
+ * Scan the queue for dependent children whose parent is not in the active set
+ * and verify whether each parent exists in the K8s cluster and has been
+ * provisioned. Parents that are absent from the queue and either missing from
+ * the cluster OR not yet provisioned are added to a deferred set, which
+ * `hasActiveParent` uses to block the child from being dispatched.
+ *
+ * A parent CR exists in the cluster immediately after `kubectl apply`, but it
+ * is not usable until the operator has reconciled it and set PROVISIONED=True.
+ * Checking only for cluster existence would let children slip through while
+ * the parent is still being processed. This function also checks the parent's
+ * status conditions so that children are deferred until the parent is fully
+ * provisioned.
+ *
+ * @param getItemByItemPath - function to look up a CR in the K8s cluster by
+ *   its item path (namespace/pluralKind/name). Should return null (not throw)
+ *   when the resource is absent or not yet available (e.g. 404/409), so that
+ *   missing parents are deferred without generating spurious error logs.
+ */
+async function buildDeferredParentKeys(queue, activeParentKeys, getItemByItemPath) {
+    const deferred = new Set();
+    const checked = new Set();
+    for (const w of queue) {
+        if (w.operation !== OperationType.CREATED)
+            continue;
+        if (!isDependentKind(w.item.kind))
+            continue;
+        const parentRef = getParentRef(w);
+        if (!parentRef)
+            continue;
+        const parentKey = `${parentRef.kind}/${parentRef.name}`;
+        if (checked.has(parentKey))
+            continue;
+        checked.add(parentKey);
+        if (activeParentKeys.has(parentKey))
+            continue;
+        const namespace = w.item.metadata?.namespace || 'default';
+        const pluralKind = definitions_getPluralFromKind(parentRef.kind);
+        if (!pluralKind)
+            continue;
+        try {
+            const parentCr = await getItemByItemPath(`${namespace}/${pluralKind}/${parentRef.name}`);
+            const isProvisioned = parentCr?.status?.conditions?.some((c) => c.type === 'PROVISIONED' && c.status === 'True');
+            if (!isProvisioned) {
+                deferred.add(parentKey);
+            }
+        }
+        catch {
+            deferred.add(parentKey);
+        }
+    }
+    return deferred;
+}
+function hasActiveParent(workItem, queueOrKeys, deferredParentKeys) {
+    if (workItem.operation !== OperationType.CREATED)
+        return false;
+    if (!DEPENDENT_KINDS.has(workItem.item.kind))
+        return false;
+    const parentRef = getParentRef(workItem);
+    if (!parentRef)
+        return false;
+    const { kind: parentKind, name: parentName } = parentRef;
+    const parentKey = `${parentKind}/${parentName}`;
+    if (queueOrKeys instanceof Set) {
+        if (queueOrKeys.has(parentKey))
+            return true;
+        if (deferredParentKeys?.has(parentKey))
+            return true;
+        return false;
+    }
+    const parentActive = queueOrKeys.some((w) => w.item.kind === parentKind &&
+        w.item.metadata?.name === parentName &&
+        (w.workStatus === WorkStatus.PENDING || w.isPicked));
+    if (parentActive)
+        return true;
+    if (deferredParentKeys?.has(parentKey))
+        return true;
+    return false;
+}
 
+;// CONCATENATED MODULE: ../operator/src/queueSort.ts
 
-const queue = [];
 const WEIGHTS = {
     RENAMED: 15,
     UPDATED: 10,
@@ -295419,6 +296163,73 @@ const WEIGHTS = {
     SYNC: 1,
     NOTHING: 0,
 };
+// we need to assign weight to the deletion operation
+// to avoid blockades
+// https://github.com/prefapp/gitops-k8s/issues/1864
+// ghrepo feat | grss -> ghrepo -> ghgroup -> membership
+const DELETION_WEIGHTS = {
+    // Leaf children first: C before B before A
+    FirestartrDummyC: 6,
+    FirestartrDummyB: 5,
+    FirestartrDummyA: 4,
+    FirestartrGithubRepositoryFeature: 5,
+    FirestartrGithubRepositorySecretsSection: 4,
+    FirestartrGithubRepository: 3,
+    FirestartrGithubGroup: 2,
+    FirestartrGithubMembership: 1,
+    FirestartrTerraformWorkspace: 1,
+    FirestartrGithubOrgWebhook: 1,
+};
+const CREATION_WEIGHTS = {
+    // DummyA is root parent; DummyB is both child-of-A and parent-of-C
+    FirestartrDummyA: 2,
+    FirestartrDummyB: 1,
+    FirestartrGithubRepository: 1,
+};
+function sortQueue(queue) {
+    const sortedQueue = queue.sort((wa, wb) => {
+        const weightA = WEIGHTS[wa.operation];
+        const weightB = WEIGHTS[wb.operation];
+        if (weightA !== weightB) {
+            return weightB - weightA;
+        }
+        if (wa.operation === 'MARKED_TO_DELETION' &&
+            wb.operation === 'MARKED_TO_DELETION') {
+            const deletionWeightA = DELETION_WEIGHTS[wa.item.kind] || 0;
+            const deletionWeightB = DELETION_WEIGHTS[wb.item.kind] || 0;
+            if (deletionWeightA !== deletionWeightB) {
+                return deletionWeightB - deletionWeightA;
+            }
+        }
+        if (wa.operation === 'CREATED' && wb.operation === 'CREATED') {
+            if (isRelevantKind(wa.item.kind) && isRelevantKind(wb.item.kind)) {
+                const creationWeightA = CREATION_WEIGHTS[wa.item.kind] || 0;
+                const creationWeightB = CREATION_WEIGHTS[wb.item.kind] || 0;
+                if (creationWeightA !== creationWeightB) {
+                    return creationWeightB - creationWeightA;
+                }
+            }
+        }
+        return wa.upsertTime - wb.upsertTime;
+    });
+    return sortedQueue;
+}
+
+;// CONCATENATED MODULE: ../operator/src/processItem.ts
+
+
+
+
+
+
+
+
+
+
+const queue = [];
+let _deferredBookkeeper = null;
+let _activeParentKeys = new Set();
+let _deferredParentKeys = new Set();
 // We get the number of max slots from the environment variable, if it is not set, we default to 1
 function getMaxSlotsFromEnvironment() {
     const rawMaxSlots = catalog_common/* default.environment.getFromEnvironment */.Z.environment.getFromEnvironment(catalog_common/* default.types.envVars.operatorNumberOfMaxSlots */.Z.types.envVars.operatorNumberOfMaxSlots);
@@ -295472,6 +296283,11 @@ function getQueueMetrics() {
         nItemsPending: queue.filter((workItem) => workItem.workStatus === WorkStatus.PENDING).length,
         nItemsProcessing: queue.filter((workItem) => workItem.workStatus === WorkStatus.PROCESSING).length,
         nItemsInDeadLetterHandling: queue.filter((workItem) => workItem.isDeadLetter === true).length,
+        nItemsBlocked: queue.filter((workItem) => workItem.isBlocked === true ||
+            hasActiveParent(workItem, _activeParentKeys, _deferredParentKeys)).length,
+        nItemsDeferred: _deferredBookkeeper
+            ? queue.filter((workItem) => _deferredBookkeeper.isDeferred(workItem)).length
+            : 0,
         nItemsTypes: {
             nothing,
             retry,
@@ -295484,30 +296300,21 @@ function getQueueMetrics() {
         },
     };
 }
-// we need to assign weight to the deletion operation
-// to avoid blockades
-// https://github.com/prefapp/gitops-k8s/issues/1864
-// ghrepo feat | grss -> ghrepo -> ghgroup -> membership
-const DELETION_WEIGHTS = {
-    FirestartrGithubRepositoryFeature: 5,
-    FirestartrGithubRepositorySecretsSection: 4,
-    FirestartrGithubRepository: 3,
-    FirestartrGithubGroup: 2,
-    FirestartrGithubMembership: 1,
-    FirestartrTerraformWorkspace: 1,
-    FirestartrGithubOrgWebhook: 1,
-};
-// Do the kinds need different weights for the operations?
-// We need to discuss this with the team in this issue: https://github.com/prefapp/gitops-k8s/issues/524
-// const KIND_WEIGHTS: any = {
-//   "FirestartrTerraformWorkspace": 1,
-//   "FirestartrGithubGroup": 1,
-//   "FirestartrGithubMembership": 1,
-//   "FirestartrGithubRepository": 1,
-//   "FirestartrGithubRepositoryFeature": 1,
-//   "FirestartrTerraformWorkspacePlan": 1,
-// }
 let INIT = false;
+let podIsTerminating = false;
+const handleTerminationSignal = (signal) => {
+    podIsTerminating = true;
+    // If there is no processor loop and no queued work, exit immediately so we don't
+    // wait on other event-loop handles (informer watches, keep-alives, etc.).
+    if (!INIT && queue.length === 0) {
+        operator_src_logger.info(`The processor is going to shut down (received ${signal}, no loop started)`);
+        process.exit(0);
+    }
+};
+initSignalsHandler(new Map([
+    ['SIGTERM', () => handleTerminationSignal('SIGTERM')],
+    ['SIGINT', () => handleTerminationSignal('SIGINT')],
+]));
 /**
  * Pushes a WorkItem to the queue
  * @param {WorkItem} workItem - WorkItem to process
@@ -295528,8 +296335,8 @@ async function processItem(workItem) {
  */
 async function processItem_loop() {
     loopWorkItemDebug(queue);
-    let podIsTerminating = false;
     const deferredBookkeeper = new DeferredSchedulingBookkeeper();
+    _deferredBookkeeper = deferredBookkeeper;
     const processItemSlotsManager = initProcessItemsSlots(MAX_SLOTS, true, (w) => deferredBookkeeper.incrementBlockedAttempt(w));
     if (process.env.GARBAGE_QUEUE_COLLECTOR) {
         void workItemGarbageCollector(queue, deferredBookkeeper);
@@ -295559,6 +296366,21 @@ async function processItem_loop() {
             process.exit(0);
             break;
         }
+        // Compute sort/partition + parent-key sets once per scheduling round so
+        // that buildDeferredParentKeys (which hits the API server) and the
+        // sort/partition are not repeated for every idle slot in the same iteration.
+        const sorted = sortQueue(queue);
+        const { nonDeferred, deferred } = deferredBookkeeper.partitionQueueByDeferred(sorted);
+        const activeParentKeys = buildActiveParentKeys(queue);
+        const deferredParentKeys = await buildDeferredParentKeys(queue, activeParentKeys, getItemByItemPathOrNull);
+        _activeParentKeys = activeParentKeys;
+        _deferredParentKeys = deferredParentKeys;
+        const pickEligible = (arr) => arr
+            .filter((w) => !w.isBlocked &&
+            !w.isPicked &&
+            !processItemSlotsManager.isWorkItemBlocked(w) &&
+            !hasActiveParent(w, activeParentKeys, deferredParentKeys))
+            .find((w) => w.workStatus === WorkStatus.PENDING);
         // every time an idle slot is available, we check if there is a work item to process and if there is, we process it
         // if there are more idle slots than work items, the next iterations of the loop will just do nothing
         // until there are new work items to process
@@ -295566,7 +296388,7 @@ async function processItem_loop() {
             if (podIsTerminating) {
                 break;
             }
-            const w = nextWorkItem();
+            const w = pickEligible(nonDeferred) || pickEligible(deferred);
             if (w) {
                 // synchronously mark the work item as picked
                 w.isPicked = true;
@@ -295578,41 +296400,10 @@ async function processItem_loop() {
                 void idleSlot.runWorkItem(w);
             }
         }
-        await wait();
+        await wait(podIsTerminating ? 200 : 2000);
     }
 }
-/**
- * Sorts the queue based on the operation type
- * @param {WorkItem[]} queue - store of WorkItems
- * @returns {WorkItem[]} - sorted queue
- */
-function sortQueue(queue) {
-    const sortedQueue = queue.sort((wa, wb) => {
-        // --- PRIMARY SORT: By Weight (Descending) ---
-        const weightA = WEIGHTS[wa.operation];
-        const weightB = WEIGHTS[wb.operation];
-        // Check if weights are different
-        if (weightA !== weightB) {
-            // Sort in descending order (higher weight first)
-            // If weightA is larger, return -1 (a comes before b)
-            return weightB - weightA;
-        }
-        // in case of deletions we need to
-        // establish a secondary sort by kind
-        if (wa.operation === 'MARKED_TO_DELETION' &&
-            wb.operation === 'MARKED_TO_DELETION') {
-            const deletionWeightA = DELETION_WEIGHTS[wa.item.kind] || 0;
-            const deletionWeightB = DELETION_WEIGHTS[wb.item.kind] || 0;
-            if (deletionWeightA !== deletionWeightB) {
-                return deletionWeightB - deletionWeightA;
-            }
-        }
-        // --- 3rd SORT: By upsertTime (Ascending) ---
-        // If weights are equal, sort by the oldest upsertTime (ascending)
-        return wa.upsertTime - wb.upsertTime;
-    });
-    return sortedQueue;
-}
+
 /**
  * Wait for a given time
  * @param t Time to wait in milliseconds
@@ -297943,11 +298734,9 @@ function tf_checkrun_operatorProfile() {
 async function TFCheckRun(cmd, item) {
     try {
         const prInfo = extractPrInfo(item);
-        const kind = item.kind;
         const checkRun = await tf_checkrun_operatorProfile().feedback.createCheckRun(prInfo.org, prInfo.repo, helperCreateCheckRunName(cmd, item), {
             pullNumber: Number(prInfo.prNumber),
-            includeCheckRunComment: true,
-            checkRunComment: `The ${kind} is being processed (cmd=${cmd}). Details: `,
+            // check-run comments removed: redundant with native checks widget (#1985)
         });
         checkRun.mdOptionsDetails({
             quotes: 'terraform',
@@ -299680,7 +300469,7 @@ async function ctx_buildContext(claim, namespace, command) {
         cr['metadata']['namespace'] = namespace;
         operator_src_logger.debug(`The Terraform workspace has finished rendering the custom resource '${cr.kind}/${cr.metadata.name}' in namespace '${cr.metadata.namespace}'.`);
         // Finally, we resolve the deps in the rendered CR
-        deps = await resolve(cr, getItemByItemPath, getSecret, namespace);
+        deps = await resolve(cr, ctl_getItemByItemPath, getSecret, namespace);
         operator_src_logger.debug(`The Terraform workspace has finished resolving all dependencies for claim '${claim.name}'.`);
     };
     compute['dryRunExec'] = async () => {
@@ -299846,7 +300635,7 @@ const MODULES = {
     FirestartrGithubRepository: {
         module: 'git::https://github.com/prefapp/tfm.git//modules/github-repo',
         // github-repo-v0.7.0
-        ref: '6bdbcd9b813837bec9d1c576952bd88744508883',
+        ref: 'd919ffbff4349c453f75a3b7246b8306a45b12e3',
     },
     FirestartrGithubRepositoryFeature: {
         module: 'git::https://github.com/prefapp/tfm.git//modules/github-files-set',
@@ -299863,6 +300652,11 @@ const MODULES = {
         // github-org-webhook-v0.2.0
         ref: '12d72ba15780647b2f9c2905938913344bfeaa4d',
     },
+    FirestartrGithubOrganizationSettings: {
+        module: 'git::https://github.com/prefapp/tfm.git//modules/github-org-settings',
+        // feat/org-settings-module at 2026-06-16
+        ref: '0e3f3f897ffff35a52285d0c681c0d81026d6d8a',
+    },
 };
 function getFirestartrDefaultTFM(kind) {
     if (kind in MODULES) {
@@ -301393,6 +302187,72 @@ class EntityGHMembership extends base_Entity {
     }
 }
 
+;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgsettings/index.ts
+
+
+class EntityGHOrgSettings extends base_Entity {
+    constructor(artifact) {
+        super(artifact, {
+            config: {},
+        });
+    }
+    async loadResources(tfOp) {
+        gh_provisioner_src_logger.info(`[gh-provisioner] running ${tfOp} on ${this.k8sId}`);
+        try {
+            const cr = this.cr;
+            this.patchData({
+                path: '/config',
+                op: PatchOperations.replace,
+                value: {
+                    billingEmail: cr.spec.billingEmail,
+                    company: cr.spec.company,
+                    blog: cr.spec.blog,
+                    email: cr.spec.email,
+                    twitterUsername: cr.spec.twitterUsername,
+                    location: cr.spec.location,
+                    name: cr.spec.name,
+                    description: cr.spec.description,
+                    hasOrganizationProjects: cr.spec.hasOrganizationProjects,
+                    hasRepositoryProjects: cr.spec.hasRepositoryProjects,
+                    defaultRepositoryPermission: cr.spec.defaultRepositoryPermission,
+                    membersCanCreateRepositories: cr.spec.membersCanCreateRepositories,
+                    membersCanCreatePublicRepositories: cr.spec.membersCanCreatePublicRepositories,
+                    membersCanCreatePrivateRepositories: cr.spec.membersCanCreatePrivateRepositories,
+                    membersCanCreateInternalRepositories: cr.spec.membersCanCreateInternalRepositories,
+                    membersCanCreatePages: cr.spec.membersCanCreatePages,
+                    membersCanCreatePublicPages: cr.spec.membersCanCreatePublicPages,
+                    membersCanCreatePrivatePages: cr.spec.membersCanCreatePrivatePages,
+                    membersCanForkPrivateRepositories: cr.spec.membersCanForkPrivateRepositories,
+                    webCommitSignoffRequired: cr.spec.webCommitSignoffRequired,
+                    advancedSecurityEnabledForNewRepositories: cr.spec.advancedSecurityEnabledForNewRepositories,
+                    dependabotAlertsEnabledForNewRepositories: cr.spec.dependabotAlertsEnabledForNewRepositories,
+                    dependabotSecurityUpdatesEnabledForNewRepositories: cr.spec.dependabotSecurityUpdatesEnabledForNewRepositories,
+                    dependencyGraphEnabledForNewRepositories: cr.spec.dependencyGraphEnabledForNewRepositories,
+                    secretScanningEnabledForNewRepositories: cr.spec.secretScanningEnabledForNewRepositories,
+                    secretScanningPushProtectionEnabledForNewRepositories: cr.spec.secretScanningPushProtectionEnabledForNewRepositories,
+                },
+            });
+            gh_provisioner_src_logger.debug(`[gh-provisioner] ${this.k8sId} loaded its data`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            gh_provisioner_src_logger.error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
+            throw new Error(`[gh-provisioner] ${this.k8sId} error loading resources: ${message}`);
+        }
+    }
+    async postProvision(tfOp) { }
+    async loadAddressesToImport() {
+        this.patchImportData({
+            op: PatchOperations.add,
+            path: '/imports/-',
+            value: {
+                to: 'github_organization_settings.this',
+                id: this.cr.spec.org,
+            },
+        });
+    }
+}
+
 ;// CONCATENATED MODULE: ../gh_provisioner/src/entities/ghorgwebhook/index.ts
 
 
@@ -301468,6 +302328,7 @@ class EntityGHOrgWebHook extends base_Entity {
 
 
 
+
 function entities_getEntity(cr) {
     const entityClass = getEntityClass(cr.kind);
     return new entityClass(cr);
@@ -301486,6 +302347,8 @@ function getEntityClass(kind) {
             return EntityGHMembership;
         case 'FirestartrGithubOrgWebhook':
             return EntityGHOrgWebHook;
+        case 'FirestartrGithubOrganizationSettings':
+            return EntityGHOrgSettings;
         default:
             throw new Error(`kind ${kind} has no entity associated`);
     }
@@ -301898,6 +302761,7 @@ const GITHUB_RESOURCE_KINDS = [
     'FirestartrGithubRepositoryFeature',
     'FirestartrGithubRepositorySecretsSection',
     'FirestartrGithubOrgWebhook',
+    'FirestartrGithubOrganizationSettings',
 ];
 const GITHUB_REPOSITORY_DEPENDENT_KINDS = [
     'FirestartrGithubRepositoryFeature',
@@ -302132,7 +302996,7 @@ function getPrAwareItemByItemPath(opts, currentStatus) {
         const baseResource = await getBaseGithubResource(itemPath, opts);
         if (baseResource)
             return baseResource;
-        return getItemByItemPath(itemPath, apiGroup, apiVersion);
+        return ctl_getItemByItemPath(itemPath, apiGroup, apiVersion);
     };
 }
 async function getBaseGithubResource(itemPath, opts) {
@@ -302293,40 +303157,64 @@ function getSafeCommandByStatus(status) {
     }
 }
 
-;// CONCATENATED MODULE: ../operator/src/ctl_collections.ts
+;// CONCATENATED MODULE: ../operator/src/ownership.ts
 
 
 
-// generator function to traverse elements
-// it is async and iterable
-async function* traverseCRCollection(pluralKind, namespace, options = {}, apiGroup = 'firestartr.dev', apiVersion = 'v1') {
-    const { limit = 300 } = options; // between 250-300
+async function getOwnerReferences(item) {
+    return item.metadata?.ownerReferences || [];
+}
+async function ownership_setOwnerReference(itemPath, namespace, ownerKind, ownerName, blockOwnerDeletion = true) {
+    let item = null;
     try {
-        let continueToken = undefined;
-        const { kc, opts } = await ctl_getConnection();
-        const k8sApi = kc.makeApiClient(client_node_dist.CustomObjectsApi);
-        const apiGroup = 'firestartr.dev';
-        const apiVersion = 'v1';
-        const apiPaths = `/apis/${apiGroup}/${apiVersion}/namespaces/${namespace}/${pluralKind}`;
-        do {
-            const res = await k8sApi.listNamespacedCustomObject(apiGroup, apiVersion, namespace, pluralKind, undefined, // pretty
-            undefined, // allowWatchBookmarks
-            continueToken, // _continue
-            undefined, // fieldSelector
-            undefined, // labelSelector
-            limit);
-            const body = res.body;
-            const items = body.items || [];
-            for (const item of items) {
-                yield item;
-            }
-            continueToken = body.metadata?.continue;
-        } while (continueToken);
+        // we need to search for the owner's uuid
+        const owner = await getItemByItemPath(`${namespace}/${ownerKind}/${ownerName}`);
+        const ownerReference = {
+            apiVersion: owner.apiVersion,
+            kind: owner.kind,
+            name: ownerName,
+            controller: true,
+            blockOwnerDeletion,
+            uid: owner.metadata.uid,
+        };
+        // we get the item (to prevent race conditions)
+        item = await getItemByItemPath(itemPath);
+        const ownerReferences = item.metadata.ownerReferences ?? [];
+        const existingRefIndex = ownerReferences.findIndex((ref) => ref.uid === ownerReference.uid);
+        if (existingRefIndex === -1) {
+            // Reference does not exist, add it
+            ownerReferences.push(ownerReference);
+        }
+        else {
+            ownerReferences[existingRefIndex] = ownerReference;
+        }
+        await writeOwnerReferences(getPluralFromKind(item.kind), item.metadata.namespace, item, ownerReferences);
     }
     catch (err) {
-        operator_src_logger.error(`Error traversing ${namespace}/${pluralKind}: ${err}`);
-        throw new Error(`Error traversing ${namespace}/${pluralKind}: ${err}`);
+        log.error(err);
+        throw `Setting OwnerReferences to ${item.kind}/${item.metadata.name}: ${err}`;
+    }
+}
+async function writeOwnerReferences(kind, namespace, item, ownerReferences) {
+    log.debug(`The ctl is setting the ownerReferences for '${kind}/${item.metadata.name}' in namespace '${namespace}'.`);
+    const { kc, opts } = await getConnection();
+    const url = `${kc.getCurrentCluster().server}/apis/firestartr.dev/v1/namespaces/${namespace}/${kind}/${item.metadata.name}`;
+    opts.headers['Content-Type'] = 'application/json-patch+json';
+    opts.headers['Accept'] = '*';
+    const patch = {
+        op: 'replace',
+        path: '/metadata/ownerReferences',
+        value: ownerReferences,
+    };
+    const r = await fetch(url, {
+        method: 'PATCH',
+        headers: opts.headers,
+        body: JSON.stringify([patch]),
+    });
+    if (!r.ok) {
+        throw `Error on setOwnerReferences: ${namespace}/${kind}/${item['metadata']['name']}: ${r.statusText}`;
     }
+    return r.json();
 }
 
 ;// CONCATENATED MODULE: ../operator/src/children.ts
@@ -302373,7 +303261,7 @@ async function manageOwnershipReferences(item, handler, op) {
      *******************************************************************************/
     if (kindsWithFirestartrGithubRepositoryDependence.indexOf(item.kind) !== -1) {
         // we need the parent
-        const parentItem = await getItemByItemPath([
+        const parentItem = await ctl_getItemByItemPath([
             item.metadata.namespace,
             definitions_getPluralFromKind('FirestartrGithubRepository'),
             item.spec.repositoryTarget.ref.name,
@@ -302384,24 +303272,24 @@ async function manageOwnershipReferences(item, handler, op) {
 async function manageOwnershipReferencesPostDeletion(item, handler, op) {
     // We will check if the repo has still some references left
     if (kindsWithFirestartrGithubRepositoryDependence.indexOf(item.kind) !== -1) {
-        await manageChildrenReferences(item, handler, op);
+        await ownership_manageChildrenReferences(item, handler, op);
     }
     // if the parent is being deleted is ok to control there are no more children
     // for preventing a stuck deletion
     else if (kindsWithChildren.indexOf(item.kind) !== -1) {
-        await removeFinalizerIfNoMoreChildren(item, handler, op);
+        await ownership_removeFinalizerIfNoMoreChildren(item, handler, op);
     }
 }
-async function manageChildrenReferences(item, handler, op) {
+async function ownership_manageChildrenReferences(item, handler, op) {
     // for now is only FirestartrGithubRepository
-    const parentItem = await getItemByItemPath([
+    const parentItem = await ctl_getItemByItemPath([
         item.metadata.namespace,
         definitions_getPluralFromKind('FirestartrGithubRepository'),
         item.spec.repositoryTarget.ref.name,
     ].join('/'));
-    await removeFinalizerIfNoMoreChildren(parentItem, handler, op);
+    await ownership_removeFinalizerIfNoMoreChildren(parentItem, handler, op);
 }
-async function removeFinalizerIfNoMoreChildren(parentItem, handler, op) {
+async function ownership_removeFinalizerIfNoMoreChildren(parentItem, handler, op) {
     try {
         let numberOfChildren = 0;
         for (const child of kindsWithFirestartrGithubRepositoryDependence) {
@@ -302411,7 +303299,17 @@ async function removeFinalizerIfNoMoreChildren(parentItem, handler, op) {
         operator_src_logger.error(`Number of children ${numberOfChildren}`);
         if (numberOfChildren === 0) {
             operator_src_logger.info(`${parentItem.kind}/${parentItem.metadata.name} has no more children. Removing finalizer of foreground-deletion`);
-            await unsetFinalizer(definitions_getPluralFromKind(parentItem.kind), parentItem.metadata.namespace, parentItem, 'firestartr.dev/foreground-deletion');
+            try {
+                await unsetFinalizer(definitions_getPluralFromKind(parentItem.kind), parentItem.metadata.namespace, parentItem, 'firestartr.dev/foreground-deletion');
+            }
+            catch (unsetErr) {
+                if (typeof unsetErr === 'string' && unsetErr.includes('Not Found')) {
+                    operator_src_logger.info(`${parentItem.kind}/${parentItem.metadata.name} was already deleted; skipping finalizer removal`);
+                }
+                else {
+                    throw unsetErr;
+                }
+            }
         }
     }
     catch (err) {
@@ -302454,10 +303352,8 @@ async function GHCheckRun(cmd, item) {
         throw new Error('GHCheckRun: prNumber not retrievable');
     }
     const checkRun = await gh_checkrun_operatorProfile().feedback.createCheckRun(prInfo.org, prInfo.repo, gh_checkrun_helperCreateCheckRunName(cmd, item), {
-        //Number(pr_number),
         pullNumber: Number(prInfo.prNumber),
-        includeCheckRunComment: true,
-        checkRunComment: `The Github ${item.kind} is being processed (cmd=${cmd}). Details: `,
+        // check-run comments removed: redundant with native checks widget (#1985)
     });
     checkRun.mdOptionsDetails({
         quotes: 'terraform',
@@ -303183,6 +304079,7 @@ function getProvisionImplementation(plural) {
         case 'githubrepositoryfeatures':
         case 'githubmemberships':
         case 'githuborgwebhooks':
+        case 'githuborganizationsettings':
             implementation = process_operation_processOperation;
             break;
         case 'fsdummiesa':
@@ -303296,6 +304193,14 @@ const cdk8s_rendererSubcommands = {
         { name: 'disableRenames', type: Boolean, defaultValue: false },
         { name: 'claimRefsList', type: String, defaultValue: '' },
         { name: 'claimFilesList', type: String, defaultValue: '' },
+        /**
+         * Repository URL for backstage.io/edit-url annotation
+         */
+        { name: 'repositoryUrl', type: String },
+        /**
+         * Default branch for backstage.io/edit-url annotation
+         */
+        { name: 'defaultBranch', type: String, defaultValue: 'main' },
         /**
          * Path where the claims defaults are located
          */
@@ -303324,7 +304229,7 @@ const cdk8s_rendererSubcommands = {
     run: async (options) => {
         if (options['render']) {
             console.table(options);
-            await runRenderer(options['globals'], options['initializers'], options['claims'], options['previousCRs'], options['claimsDefaults'], options['outputCatalogDir'], options['outputCrDir'], !options['disableRenames'], options['provider'], options['excludePath'], options['validateReferentialIntegrity'], options['claimRefsList'], options['claimFilesList']);
+            await runRenderer(options['globals'], options['initializers'], options['claims'], options['previousCRs'], options['claimsDefaults'], options['outputCatalogDir'], options['outputCrDir'], !options['disableRenames'], options['provider'], options['excludePath'], options['validateReferentialIntegrity'], options['claimRefsList'], options['claimFilesList'], options['repositoryUrl'], options['defaultBranch']);
         }
         else if (options['compare']) {
             await cdk8s_renderer.runComparer(options['claimsFromMain'], options['claimsFromPr'], options['claimsDefaults'], options['wetReposConfig'], options['outputComparer']);
@@ -303606,7 +304511,7 @@ const crs_analyzerSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = JSON.parse('{"i8":"2.7.0-snapshot-13"}');
+const package_namespaceObject = JSON.parse('{"i8":"2.7.0-snapshot-15"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"i8":"2.6.4"};
 ;// CONCATENATED MODULE: ./src/subcommands/index.ts