@firestartr/cli 3.1.0 → 3.1.1-snapshot-pagination-fix

package/build/index.js

@@ -34415,7 +34415,7 @@ const resolve_1 = __nccwpck_require__(50921);
 const API_OBJECT_SYMBOL = Symbol.for('cdk8s.ApiObject');
 class ApiObject extends constructs_1.Construct {
     props;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.ApiObject", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.ApiObject", version: "2.70.115" };
     /**
      * Return whether the given object is an `ApiObject`.
      *
@@ -34662,7 +34662,7 @@ class SynthRequestCache {
  * Represents a cdk8s application.
  */
 class App extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.App", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.App", version: "2.70.115" };
     /**
      * Synthesize a single chart.
      *
@@ -34947,7 +34947,7 @@ const names_1 = __nccwpck_require__(21021);
 const CHART_SYMBOL = Symbol.for('cdk8s.Chart');
 const CRONJOB = 'CronJob';
 class Chart extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Chart", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Chart", version: "2.70.115" };
     /**
      * Return whether the given object is a Chart.
      *
@@ -35071,7 +35071,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
  * Represents a cron schedule
  */
 class Cron {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Cron", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Cron", version: "2.70.115" };
     /**
      * Create a cron schedule which runs every minute
      */
@@ -35157,7 +35157,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
  *
  */
 class DependencyGraph {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.DependencyGraph", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.DependencyGraph", version: "2.70.115" };
     _fosterParent;
     constructor(node) {
         this._fosterParent = new DependencyVertex();
@@ -35222,7 +35222,7 @@ exports.DependencyGraph = DependencyGraph;
  * The value of each vertex is an `IConstruct` that is accessible via the `.value` getter.
  */
 class DependencyVertex {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.DependencyVertex", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.DependencyVertex", version: "2.70.115" };
     _value;
     _children = new Set();
     _parents = new Set();
@@ -35328,7 +35328,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
  *
  */
 class Duration {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Duration", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Duration", version: "2.70.115" };
     /**
      * Create a Duration representing an amount of milliseconds
      *
@@ -35608,7 +35608,7 @@ const MAX_HELM_BUFFER = 10 * 1024 * 1024;
  * Use this construct to import an existing Helm chart and incorporate it into your constructs.
  */
 class Helm extends include_1.Include {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Helm", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Helm", version: "2.70.115" };
     /**
      * The helm release name.
      */
@@ -35690,7 +35690,7 @@ const yaml_1 = __nccwpck_require__(84286);
  * from the manifest.
  */
 class Include extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Include", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Include", version: "2.70.115" };
     constructor(scope, id, props) {
         super(scope, id);
         const objects = yaml_1.Yaml.load(props.url);
@@ -35780,7 +35780,7 @@ const fast_json_patch_1 = __nccwpck_require__(34151);
  */
 class JsonPatch {
     operation;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.JsonPatch", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.JsonPatch", version: "2.70.115" };
     /**
      * Applies a set of JSON-Patch (RFC-6902) operations to `document` and returns the result.
      * @param document The document to patch
@@ -35858,7 +35858,7 @@ exports.Lazy = void 0;
 const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 class Lazy {
     producer;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Lazy", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Lazy", version: "2.70.115" };
     static any(producer) {
         return new Lazy(producer);
     }
@@ -35887,7 +35887,7 @@ const resolve_1 = __nccwpck_require__(50921);
  * Object metadata.
  */
 class ApiObjectMetadataDefinition {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.ApiObjectMetadataDefinition", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.ApiObjectMetadataDefinition", version: "2.70.115" };
     /**
      * The name of the API object.
      *
@@ -36056,7 +36056,7 @@ const HASH_LEN = 8;
  * Utilities for generating unique and stable names.
  */
 class Names {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Names", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Names", version: "2.70.115" };
     /**
      * Generates a unique and stable name compatible DNS_LABEL from RFC-1123 from
      * a path.
@@ -36224,7 +36224,7 @@ class ResolutionContext {
     obj;
     key;
     value;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.ResolutionContext", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.ResolutionContext", version: "2.70.115" };
     /**
      * The replaced value that was set via the `replaceValue` method.
      */
@@ -36264,7 +36264,7 @@ exports.ResolutionContext = ResolutionContext;
  * Resolvers instanecs of `Lazy`.
  */
 class LazyResolver {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.LazyResolver", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.LazyResolver", version: "2.70.115" };
     resolve(context) {
         if (context.value instanceof lazy_1.Lazy) {
             const resolved = context.value.produce();
@@ -36277,7 +36277,7 @@ exports.LazyResolver = LazyResolver;
  * Resolves implicit tokens.
  */
 class ImplicitTokenResolver {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.ImplicitTokenResolver", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.ImplicitTokenResolver", version: "2.70.115" };
     resolve(context) {
         if (typeof (context.value.resolve) === 'function') {
             const resolved = context.value.resolve();
@@ -36292,7 +36292,7 @@ exports.ImplicitTokenResolver = ImplicitTokenResolver;
  * E.g IntOrString, Quantity, ...
  */
 class NumberStringUnionResolver {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.NumberStringUnionResolver", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.NumberStringUnionResolver", version: "2.70.115" };
     static TYPES = ['number', 'string'];
     resolve(context) {
         if (context.value.constructor === Object) {
@@ -36358,7 +36358,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
  * When the amount is passed as a token, unit conversion is not possible.
  */
 class Size {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Size", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Size", version: "2.70.115" };
     /**
      * Create a Storage representing an amount kibibytes.
      * 1 KiB = 1024 bytes
@@ -36546,7 +36546,7 @@ const chart_1 = __nccwpck_require__(75525);
  * Testing utilities for cdk8s applications.
  */
 class Testing {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Testing", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Testing", version: "2.70.115" };
     /**
      * Returns an app for testing with the following properties:
      * - Output directory is a temp dir.
@@ -36637,7 +36637,7 @@ const yamlSchemaVersion = '1.1';
  * YAML utilities.
  */
 class Yaml {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Yaml", version: "2.70.111" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk8s.Yaml", version: "2.70.115" };
     /**
      * @deprecated use `stringify(doc[, doc, ...])`
      */
@@ -94020,7 +94020,7 @@ class Range {
     debug('hyphen replace', range)
 
     // `> 1.2.3 < 1.2.5` => `>1.2.3 <1.2.5`
-    range = range.replace(re[t.COMPARATORTRIM], comparatorTrimReplace)
+    range = trimComparatorWhitespace(range)
     debug('comparator trim', range)
 
     // `~ 1.2.3` => `~1.2.3`
@@ -94125,11 +94125,11 @@ const parseOptions = __nccwpck_require__(74464)
 const Comparator = __nccwpck_require__(15895)
 const debug = __nccwpck_require__(28195)
 const SemVer = __nccwpck_require__(69855)
+const trimComparatorWhitespace = __nccwpck_require__(99853)
 const {
   safeRe: re,
   src,
   t,
-  comparatorTrimReplace,
   tildeTrimReplace,
   caretTrimReplace,
 } = __nccwpck_require__(23227)
@@ -95512,6 +95512,35 @@ const MAX_SAFE_COMPONENT_LENGTH = 16
 // the shortest version with a build 0.0.0+BUILD.
 const MAX_SAFE_BUILD_LENGTH = MAX_LENGTH - 6
 
+// ECMAScript whitespace and line terminators matched by \s.
+const WHITESPACE_CHARACTERS = [
+  '\t',
+  '\n',
+  '\v',
+  '\f',
+  '\r',
+  ' ',
+  '\u00a0',
+  '\u1680',
+  '\u2000',
+  '\u2001',
+  '\u2002',
+  '\u2003',
+  '\u2004',
+  '\u2005',
+  '\u2006',
+  '\u2007',
+  '\u2008',
+  '\u2009',
+  '\u200a',
+  '\u2028',
+  '\u2029',
+  '\u202f',
+  '\u205f',
+  '\u3000',
+  '\ufeff',
+]
+
 const RELEASE_TYPES = [
   'major',
   'premajor',
@@ -95527,6 +95556,7 @@ module.exports = {
   MAX_SAFE_COMPONENT_LENGTH,
   MAX_SAFE_BUILD_LENGTH,
   MAX_SAFE_INTEGER,
+  WHITESPACE_CHARACTERS,
   RELEASE_TYPES,
   SEMVER_SPEC_VERSION,
   FLAG_INCLUDE_PRERELEASE: 0b001,
@@ -95891,6 +95921,451 @@ createToken('GTE0', '^\\s*>=\\s*0\\.0\\.0\\s*$')
 createToken('GTE0PRE', '^\\s*>=\\s*0\\.0\\.0-0\\s*$')
 
 
+/***/ }),
+
+/***/ 99853:
+/***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
+
+// @ts-check
+
+
+// Reproduce safeRe[COMPARATORTRIM] replacement boundaries, not version
+// validation. Each end-index finder returns an exclusive end, or its start
+// on no match.
+// Positions count from zero. An end of 3 means characters 0, 1, and 2 were read;
+// range.slice(start, end) gives the matched text, not a converted number.
+const {
+  MAX_LENGTH,
+  MAX_SAFE_BUILD_LENGTH,
+  WHITESPACE_CHARACTERS,
+} = __nccwpck_require__(1825)
+
+/**
+ * Remembers the last two rows of digits so their characters need not be reread.
+ * Positions start at -1 until a row has been found.
+ *
+ * @typedef {object} DigitRunCache
+ * @property {number} start The first character of the most recently found row.
+ * @property {number} end The position after that row's last character.
+ * @property {number} previousStart The first character of the previous row.
+ * @property {number} previousEnd The position after the previous row.
+ */
+
+// One entry per UTF-16 code unit keeps membership checks constant-time.
+const whitespace = new Uint8Array(0x10000)
+for (const char of WHITESPACE_CHARACTERS) {
+  whitespace[char.charCodeAt(0)] = 1
+}
+
+/**
+ * Checks whether a character is whitespace, like a space, tab, or newline.
+ * Looking past the end of the string returns false.
+ *
+ * @param {string|undefined} char One character, or undefined past the string's end.
+ * @returns {boolean} Whether the character is whitespace.
+ * @example isWhitespace(' ') // true
+ * @example isWhitespace('1') // false
+ */
+const isWhitespace = char =>
+  char !== undefined && whitespace[char.charCodeAt(0)] === 1
+
+/**
+ * Checks for v, =, or whitespace before the version number.
+ * These are historical version prefixes, not range operators:
+ * < and > are handled separately, as are tilde and caret ranges.
+ *
+ * @param {string|undefined} char One character to check.
+ * @returns {boolean} Whether the character can belong to a version prefix.
+ * @example isVersionPrefix('=') // true
+ * @example isVersionPrefix('>') // false
+ */
+const isVersionPrefix = char =>
+  char === 'v' ||
+  char === '=' ||
+  isWhitespace(char)
+
+/**
+ * Checks whether a character is one of the digits 0 through 9.
+ *
+ * @param {string|undefined} char One character to check.
+ * @returns {boolean} Whether the character is an ASCII digit.
+ * @example isDigit('7') // true
+ * @example isDigit('.') // false
+ */
+const isDigit = char => char !== undefined && char >= '0' && char <= '9'
+
+/**
+ * Checks whether a character is an English letter, uppercase or lowercase.
+ *
+ * @param {string|undefined} char One character to check.
+ * @returns {boolean} Whether the character is an ASCII letter.
+ * @example isLetter('b') // true
+ * @example isLetter('7') // false
+ */
+const isLetter = char =>
+  char !== undefined && (
+    (char >= 'a' && char <= 'z') ||
+    (char >= 'A' && char <= 'Z')
+  )
+
+/**
+ * Checks for a letter, digit, or hyphen: the characters allowed inside
+ * prerelease and build names such as beta-1.
+ *
+ * @param {string|undefined} char One character to check.
+ * @returns {boolean} Whether the character can be part of an identifier.
+ * @example isIdentifierCharacter('-') // true
+ * @example isIdentifierCharacter('.') // false; dots separate identifiers
+ */
+const isIdentifierCharacter = char => isDigit(char) || isLetter(char) || char === '-'
+
+/**
+ * Checks whether a version component can begin here: with a digit or
+ * a wildcard such as x, X, or *.
+ *
+ * @param {string|undefined} char One character to check.
+ * @returns {boolean} Whether a number or wildcard can start with this character.
+ * @example isVersionStart('x') // true
+ * @example isVersionStart('v') // false; v belongs to the prefix
+ */
+const isVersionStart = char =>
+  isDigit(char) ||
+  char === 'x' ||
+  char === 'X' ||
+  char === '*'
+
+/**
+ * Finds the end of a row of digits, but returns no more than limit digits.
+ * Remembers the last two rows so looking at them again does not reread them.
+ *
+ * @param {string} range The text to read; it is not changed.
+ * @param {number} start The position of the first character to check.
+ * @param {number} limit The most digit characters the returned match can include.
+ * @param {DigitRunCache} digitRuns Shared cache of digit-run positions, updated in place.
+ * @returns {number} The position after the matched digits, or start if none match.
+ * @example findDigitsEndIndex('123abc', 0, 10, digitRuns) // 3, pointing at a
+ * @example findDigitsEndIndex('123abc', 0, 2, digitRuns) // 2, pointing at the unread 3
+ */
+const findDigitsEndIndex = (range, start, limit, digitRuns) => {
+  if (!isDigit(range[start])) {
+    return start
+  }
+  if (start >= digitRuns.start && start < digitRuns.end) {
+    return Math.min(start + limit, digitRuns.end)
+  }
+  if (start >= digitRuns.previousStart && start < digitRuns.previousEnd) {
+    return Math.min(start + limit, digitRuns.previousEnd)
+  }
+  let end = start + 1
+  while (isDigit(range[end])) {
+    end++
+  }
+  // A failed full version can rewind from its second run to its first.
+  digitRuns.previousStart = digitRuns.start
+  digitRuns.previousEnd = digitRuns.end
+  digitRuns.start = start
+  digitRuns.end = end
+  return Math.min(start + limit, end)
+}
+
+/**
+ * Reads a number using the old regex's length and leading-zero rules.
+ * Strict mode reads just the first zero in 012; loose mode can read all three.
+ *
+ * @param {string} range The text to read; it is not changed.
+ * @param {number} start The position where the number should begin.
+ * @param {boolean} loose Whether to allow leading zeros.
+ * @param {DigitRunCache} digitRuns Shared digit-run cache, updated as needed.
+ * @returns {number} The position after the matched digits, not their numeric value.
+ * @example findVersionNumberEndIndex('012', 0, false, digitRuns) // 1
+ * @example findVersionNumberEndIndex('012', 0, true, digitRuns) // 3
+ */
+const findVersionNumberEndIndex = (range, start, loose, digitRuns) => {
+  if (!loose && range[start] === '0') {
+    return start + 1
+  }
+  // Strict syntax allows an initial nonzero digit plus MAX_LENGTH digits.
+  return findDigitsEndIndex(range, start, loose ? MAX_LENGTH : MAX_LENGTH + 1, digitRuns)
+}
+
+/**
+ * Reads one piece of a prerelease name, such as beta or 1 in beta.1.
+ * Tries the letter-or-hyphen form first, then the number-only form.
+ *
+ * @param {string} range The text to read; it is not changed.
+ * @param {number} start The position where the identifier should begin.
+ * @param {boolean} loose Whether numeric identifiers may have leading zeros.
+ * @param {DigitRunCache} digitRuns Shared digit-run cache, updated as needed.
+ * @returns {number} The position after the identifier, or start if none matches.
+ * @example findPrereleaseIdentifierEndIndex('beta.1', 0, false, digitRuns) // 4, at the dot
+ * @example findPrereleaseIdentifierEndIndex('001beta', 0, false, digitRuns) // 7
+ */
+const findPrereleaseIdentifierEndIndex = (range, start, loose, digitRuns) => {
+  const digitsEnd = findDigitsEndIndex(range, start, MAX_LENGTH, digitRuns)
+  // The legacy regex tries a nonnumeric identifier before a numeric one.
+  if (isLetter(range[digitsEnd]) || range[digitsEnd] === '-') {
+    let end = digitsEnd + 1
+    const limit = end + MAX_SAFE_BUILD_LENGTH
+    while (end < limit && isIdentifierCharacter(range[end])) {
+      end++
+    }
+    return end
+  }
+  return findVersionNumberEndIndex(range, start, loose, digitRuns)
+}
+
+/**
+ * Reads a prerelease suffix such as -beta.1, one dot-separated piece at a time.
+ * Loose mode also allows the name without its opening hyphen.
+ *
+ * @param {string} range The text to read; it is not changed.
+ * @param {number} start The position where the suffix should begin, including -.
+ * @param {boolean} loose Whether the opening hyphen is optional and zeros allowed.
+ * @param {DigitRunCache} digitRuns Shared digit-run cache, updated as needed.
+ * @returns {number} The position after the matched suffix, or start if absent.
+ * @example findPrereleaseEndIndex('-beta.1+sha', 0, false, digitRuns) // 7, at the plus
+ * @example findPrereleaseEndIndex('beta', 0, false, digitRuns) // 0; no opening hyphen
+ */
+const findPrereleaseEndIndex = (range, start, loose, digitRuns) => {
+  const hyphen = range[start] === '-'
+  if (!loose && !hyphen) {
+    return start
+  }
+  const identifierStart = start + (hyphen ? 1 : 0)
+  let end = findPrereleaseIdentifierEndIndex(range, identifierStart, loose, digitRuns)
+  if (end === identifierStart) {
+    if (!loose || !hyphen) {
+      return start
+    }
+    // In loose syntax, a lone hyphen can itself be the identifier.
+    end = findPrereleaseIdentifierEndIndex(range, start, loose, digitRuns)
+  }
+  while (range[end] === '.') {
+    const next = findPrereleaseIdentifierEndIndex(range, end + 1, loose, digitRuns)
+    if (next === end + 1) {
+      break
+    }
+    end = next
+  }
+  return end
+}
+
+/**
+ * Reads one build-name piece, such as sha or 123 in +sha.123.
+ * Stops at a disallowed character or the old regex's length limit.
+ *
+ * @param {string} range The text to read; it is not changed.
+ * @param {number} start The position where the identifier should begin.
+ * @returns {number} The position after the identifier, or start if none matches.
+ * @example findBuildIdentifierEndIndex('sha.123', 0) // 3, at the dot
+ * @example findBuildIdentifierEndIndex('001', 0) // 3; leading zeros are allowed
+ */
+const findBuildIdentifierEndIndex = (range, start) => {
+  let end = start
+  while (end - start < MAX_SAFE_BUILD_LENGTH && isIdentifierCharacter(range[end])) {
+    end++
+  }
+  return end
+}
+
+/**
+ * Reads optional build metadata such as +sha.123.
+ * Leaves the position unchanged if there is no plus sign followed by a name.
+ *
+ * @param {string} range The text to read; it is not changed.
+ * @param {number} start The position where the opening + should be.
+ * @returns {number} The position after the matched metadata, or start if absent.
+ * @example findBuildEndIndex('+sha.123 <2', 0) // 8, at the space
+ * @example findBuildEndIndex('+', 0) // 0; a plus sign alone is not a match
+ */
+const findBuildEndIndex = (range, start) => {
+  if (range[start] !== '+') {
+    return start
+  }
+  let end = findBuildIdentifierEndIndex(range, start + 1)
+  if (end === start + 1) {
+    return start
+  }
+  while (range[end] === '.') {
+    const next = findBuildIdentifierEndIndex(range, end + 1)
+    if (next === end + 1) {
+      break
+    }
+    end = next
+  }
+  return end
+}
+
+/**
+ * Reads three numbers separated by dots, then any prerelease and build suffixes.
+ * Uses loose rules, so forms such as 01.02.03beta can match here.
+ *
+ * @param {string} range The text to read; it is not changed.
+ * @param {number} start The position of the first number, after any prefix.
+ * @param {DigitRunCache} digitRuns Shared digit-run cache, updated as needed.
+ * @returns {number} The position after the version match, or start if none matches.
+ * @example findLooseFullVersionEndIndex('1.2.3-beta+sha <2', 0, digitRuns) // 14
+ * @example findLooseFullVersionEndIndex('1.2', 0, digitRuns) // 0; needs three numbers
+ */
+const findLooseFullVersionEndIndex = (range, start, digitRuns) => {
+  let end = start
+  for (let component = 0; component < 3; component++) {
+    const next = findVersionNumberEndIndex(range, end, true, digitRuns)
+    if (next === end) {
+      return start
+    }
+    end = next
+    if (component < 2) {
+      if (range[end] !== '.') {
+        return start
+      }
+      end++
+    }
+  }
+  const prereleaseEnd = findPrereleaseEndIndex(range, end, true, digitRuns)
+  return findBuildEndIndex(range, prereleaseEnd)
+}
+
+/**
+ * Reads one component of a partial or wildcard version, such as 2 or x in 2.x.
+ * Numbers use strict leading-zero rules; wildcards take up one character.
+ *
+ * @param {string} range The text to read; it is not changed.
+ * @param {number} start The position where the component should begin.
+ * @param {DigitRunCache} digitRuns Shared digit-run cache, updated as needed.
+ * @returns {number} The position after the component, or start if none matches.
+ * @example findPartialVersionComponentEndIndex('2.x', 0, digitRuns) // 1, at the dot
+ * @example findPartialVersionComponentEndIndex('2.x', 2, digitRuns) // 3, after x
+ */
+const findPartialVersionComponentEndIndex = (range, start, digitRuns) => {
+  if (isDigit(range[start])) {
+    return findVersionNumberEndIndex(range, start, false, digitRuns)
+  }
+  return isVersionStart(range[start]) ? start + 1 : start
+}
+
+/**
+ * Reads up to three components, allowing forms such as 1, 1.2, or 1.x.
+ * After the third component, also reads any strict prerelease and build suffixes.
+ *
+ * @param {string} range The text to read; it is not changed.
+ * @param {number} start The position of a number or wildcard, after any prefix.
+ * @param {DigitRunCache} digitRuns Shared digit-run cache, updated as needed.
+ * @returns {number} The position after the matched version text.
+ * @example findPartialVersionEndIndex('1.x <2', 0, digitRuns) // 3, at the space
+ * @example findPartialVersionEndIndex('1.', 0, digitRuns) // 1; the trailing dot is unread
+ */
+const findPartialVersionEndIndex = (range, start, digitRuns) => {
+  let end = findPartialVersionComponentEndIndex(range, start, digitRuns)
+  for (let component = 0; component < 2; component++) {
+    if (range[end] !== '.') {
+      return end
+    }
+    const next = findPartialVersionComponentEndIndex(range, end + 1, digitRuns)
+    if (next === end + 1) {
+      return end
+    }
+    end = next
+  }
+  const prereleaseEnd = findPrereleaseEndIndex(range, end, false, digitRuns)
+  return findBuildEndIndex(range, prereleaseEnd)
+}
+
+/**
+ * Finds where a version match ends, without deciding whether the range is valid.
+ * Tries a loose full version first, then a partial or wildcard version, just
+ * like the old regex's LOOSEPLAIN and XRANGEPLAIN alternatives.
+ *
+ * @param {string} range The text to read; it is not changed.
+ * @param {number} start The position of a number or wildcard, after any prefix.
+ * @param {DigitRunCache} digitRuns Shared digit-run cache, updated as needed.
+ * @returns {number} The position where scanning the next candidate can resume.
+ * @example findVersionEndIndex('1.2.3 <2', 0, digitRuns) // 5, at the space
+ * @example findVersionEndIndex('1.x <2', 0, digitRuns) // 3, at the space
+ */
+const findVersionEndIndex = (range, start, digitRuns) => {
+  const fullVersionEnd = findLooseFullVersionEndIndex(range, start, digitRuns)
+  return fullVersionEnd !== start
+    ? fullVersionEnd
+    : findPartialVersionEndIndex(range, start, digitRuns)
+}
+
+/**
+ * Finds the one whitespace character the old replacement would remove.
+ * Keeps leading whitespace, skips an optional operator, and checks immediately
+ * after it. Returns -1 if there is nothing to remove.
+ *
+ * @param {string} range The text containing a candidate already found by the caller.
+ * @param {number} matchStart The candidate's position, including leading whitespace.
+ * @returns {number} The position of the removable whitespace, or -1 if absent.
+ * @example findRemovableWhitespaceIndex(' > 1', 0) // 2; keep the space at position 0
+ * @example findRemovableWhitespaceIndex('>1', 0) // -1
+ */
+const findRemovableWhitespaceIndex = (range, matchStart) => {
+  let position = matchStart
+  if (isWhitespace(range[position])) {
+    position++
+  }
+  if (range[position] === '<' || range[position] === '>') {
+    position++
+  }
+  if (range[position] === '=') {
+    position++
+  }
+  return isWhitespace(range[position]) ? position : -1
+}
+
+/**
+ * Joins an operator to its version, turning > 1.2.3 into >1.2.3.
+ * Copies everything else according to the old regex's matching rules.
+ * Moves forward through prefixes and whole versions to avoid repeatedly
+ * searching the same characters on long inputs.
+ *
+ * @param {string} range The range text to process; the original string is unchanged.
+ * @returns {string} The range with matched operator whitespace removed.
+ * @example trimComparatorWhitespace('> 1.2.3 < 2') // '>1.2.3 <2'
+ * @example trimComparatorWhitespace('> invalid') // '> invalid'
+ */
+const trimComparatorWhitespace = range => {
+  let result = ''
+  let copyFrom = 0
+  let cursor = 0
+  const digitRuns = { start: -1, end: -1, previousStart: -1, previousEnd: -1 }
+
+  while (cursor < range.length) {
+    const matchStart = cursor
+    if (range[cursor] === '<' || range[cursor] === '>') {
+      cursor++
+    } else if (!isVersionPrefix(range[cursor]) && !isVersionStart(range[cursor])) {
+      cursor++
+      continue
+    }
+
+    // Consume a v/=/whitespace run once, even when no version follows it.
+    while (cursor < range.length && isVersionPrefix(range[cursor])) {
+      cursor++
+    }
+    if (!isVersionStart(range[cursor])) {
+      continue
+    }
+
+    const whitespacePosition = findRemovableWhitespaceIndex(range, matchStart)
+    if (whitespacePosition !== -1) {
+      result += range.slice(copyFrom, whitespacePosition)
+      copyFrom = whitespacePosition + 1
+    }
+
+    // Skip the entire match, so a prerelease's trailing v cannot be
+    // reconsidered as the prefix of another version.
+    cursor = findVersionEndIndex(range, cursor, digitRuns)
+  }
+
+  return result + range.slice(copyFrom)
+}
+
+module.exports = trimComparatorWhitespace
+
+
 /***/ }),
 
 /***/ 98736:
@@ -124740,22 +125215,37 @@ async function getOrgTeamsDirectAccess(org, octokit) {
             id
             name
             slug
-            repositories {
+          }
+          pageInfo {
+            hasNextPage
+            endCursor
+          }
+        }
+      }
+    }`, { org });
+    // The GraphQL paginator handles one connection per query, so each team's
+    // repositories must be paginated separately from the organization's teams.
+    for (const team of response?.organization?.teams?.nodes ?? []) {
+        const repositoryResponse = await octokit.graphql.paginate(`query paginate($cursor: String, $org: String!, $slug: String!) {
+        organization(login: $org) {
+          team(slug: $slug) {
+            repositories(first: 100, after: $cursor) {
               edges {
                 permission
                 node {
                   name
                 }
               }
+              pageInfo {
+                hasNextPage
+                endCursor
+              }
             }
           }
-          pageInfo {
-            hasNextPage
-            endCursor
-          }
         }
-      }
-    }`, { org });
+      }`, { org, slug: team.slug });
+        team.repositories = repositoryResponse.organization.team.repositories;
+    }
     return transformGraphQLResponse(response);
 }
 function transformGraphQLResponse(response) {
@@ -139639,22 +140129,30 @@ function seededRandom(str) {
 
 
 
-const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = __nccwpck_require__(88753)
+const { normalizeIPv6, removeDotSegments, removeDotSegmentsRelative, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = __nccwpck_require__(88753)
 const { SCHEMES, getSchemeHandler } = __nccwpck_require__(52256)
 
 const VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u
 const MALFORMED_SCHEME_ERROR = 'URI scheme is malformed.'
+const MALFORMED_HOST_ERROR = 'URI host is malformed.'
+// ASCII characters outside the RFC 3986 reg-name set (unreserved, sub-delims
+// and "%" for pct-encoded): C0 controls, space, DEL, and "#/:<>?@[\]^`{|}.
+const FORBIDDEN_DOMAIN_HOST_CHARACTER = /[\0-\x20"#/:<>?@[\\\]^`{|}\x7F]/u
 
 /**
+ * RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so the
+ * scheme is validated as-is and never decoded. Decoding would let inert input
+ * such as `%6Aavascript:` become a live `javascript:` scheme.
+ *
  * @param {string} scheme
  * @returns {string}
  */
-function decodeValidScheme (scheme) {
-  const decodedScheme = unescape(String(scheme))
-  if (!VALID_SCHEME.test(decodedScheme)) {
+function validateScheme (scheme) {
+  const stringScheme = String(scheme)
+  if (!VALID_SCHEME.test(stringScheme)) {
     throw new TypeError(MALFORMED_SCHEME_ERROR)
   }
-  return decodedScheme
+  return stringScheme
 }
 
 /**
@@ -139715,6 +140213,12 @@ function resolve (baseURI, relativeURI, options) {
   const resolvedHost = resolved.host
   const resolvedHostIsIP = resolvedHost !== undefined && resolvedHost !== '' &&
     (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6)
+  // Inputs are parsed scheme-neutrally, so delimiters and controls in a domain
+  // host are only detected here, once the final scheme is known. They always
+  // fail closed, including in percent-encoded hosts.
+  if (hasForbiddenDomainHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)) {
+    throw new Error(MALFORMED_HOST_ERROR)
+  }
   canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)
   // Percent escapes in an ASCII reg-name are encoded data. The WHATWG hostname
   // parser can reject them even though fast-uri preserves them safely as RFC
@@ -139772,14 +140276,17 @@ function resolveComponent (base, relative, options, skipNormalization) {
         if (relative.path[0] === '/') {
           target.path = removeDotSegments(relative.path)
         } else {
-          if ((base.userinfo !== undefined || base.host !== undefined || base.port !== undefined) && !base.path) {
+          const baseHasAuthority = base.userinfo !== undefined || base.host !== undefined || base.port !== undefined
+          if (baseHasAuthority && !base.path) {
             target.path = '/' + relative.path
           } else if (!base.path) {
             target.path = relative.path
           } else {
             target.path = base.path.slice(0, base.path.lastIndexOf('/') + 1) + relative.path
           }
-          target.path = removeDotSegments(target.path)
+          target.path = base.scheme === undefined && !baseHasAuthority && target.path[0] !== '/'
+            ? removeDotSegmentsRelative(target.path)
+            : removeDotSegments(target.path)
         }
         target.query = relative.query
       }
@@ -139835,7 +140342,7 @@ function serialize (cmpts, opts) {
   const uriTokens = []
 
   if (component.scheme) {
-    component.scheme = decodeValidScheme(component.scheme)
+    component.scheme = validateScheme(component.scheme)
   }
 
   // find scheme handler
@@ -139845,7 +140352,11 @@ function serialize (cmpts, opts) {
   if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options)
 
   const hasAuthority = component.userinfo !== undefined || component.host !== undefined || component.port !== undefined
-  const pathNoScheme = !options.skipEscape && component.scheme === undefined && !hasAuthority
+  // A reference with no emitted scheme is path-noscheme: a bare ':' in its
+  // first path segment would reparse as a scheme (RFC 3986 3.3/4.2). Enforced
+  // under skipEscape too (resolve()), so the reapply below gates on this flag.
+  const schemelessReference = (component.scheme === undefined || options.reference === 'suffix') && !hasAuthority
+  const pathNoScheme = !options.skipEscape && schemelessReference
 
   if (component.path !== undefined) {
     if (!options.skipEscape) {
@@ -139857,7 +140368,7 @@ function serialize (cmpts, opts) {
 
   if (options.reference !== 'suffix' && component.scheme) {
     // Scheme handlers may replace the scheme during serialization.
-    component.scheme = decodeValidScheme(component.scheme)
+    component.scheme = validateScheme(component.scheme)
     uriTokens.push(component.scheme, ':')
   }
 
@@ -139877,13 +140388,18 @@ function serialize (cmpts, opts) {
     let s = component.path
 
     if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
-      s = removeDotSegments(s)
+      // A relative-path reference keeps its unresolvable leading ".." segments
+      // and must never become root-relative (RFC 3986 section 5.2.4 applies to
+      // merged target paths, not to the reference itself).
+      s = schemelessReference && s[0] !== '/'
+        ? removeDotSegmentsRelative(s)
+        : removeDotSegments(s)
     }
 
     // Dot-segment removal can expose a colon that was not originally in the
     // first segment (for example, "./a:b"). Reapply path-noscheme encoding so
     // the serialized relative reference cannot be reparsed as a URI scheme.
-    if (pathNoScheme) {
+    if (schemelessReference) {
       s = serializePathEncoding(s, true)
     }
 
@@ -139998,6 +140514,11 @@ function hasMalformedComponentPercentEncoding (matches) {
  * @returns {boolean} whether host conversion failed
  */
 function canonicalizeHost (parsed, options, schemeHandler, isIP) {
+  if (hasForbiddenDomainHost(parsed, options, schemeHandler, isIP)) {
+    parsed.error = parsed.error || MALFORMED_HOST_ERROR
+    return true
+  }
+
   if (
     !options.unicodeSupport &&
     (!schemeHandler || !schemeHandler.unicodeSupport) &&
@@ -140007,16 +140528,62 @@ function canonicalizeHost (parsed, options, schemeHandler, isIP) {
     isIP === false &&
     nonSimpleDomain(parsed.host)
   ) {
+    let url
     try {
-      parsed.host = new URL('http://' + parsed.host).hostname
+      url = new URL('http://' + parsed.host)
     } catch (e) {
       parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e
       return true
     }
+    // The WHATWG parser must have read the whole input as a host. Anything
+    // else means it found a delimiter fast-uri did not, so its hostname would
+    // describe a different authority.
+    if (!isHostOnlyURL(url)) {
+      parsed.error = parsed.error || MALFORMED_HOST_ERROR
+      return true
+    }
+    parsed.host = url.hostname
   }
   return false
 }
 
+/**
+ * Whether a domain host contains an ASCII character that RFC 3986 does not
+ * allow in a reg-name (unreserved, sub-delims, or pct-encoded). Such a host is
+ * rejected instead of being handed to the WHATWG URL parser, which would treat
+ * "@" as a userinfo delimiter (silently dropping the data before it) and strip
+ * TAB, LF, and CR. Non-ASCII characters remain allowed for IDNs.
+ *
+ * @param {import('./types/index').URIComponent} parsed
+ * @param {import('./types/index').Options} options
+ * @param {{ domainHost?: boolean }|undefined} schemeHandler
+ * @param {boolean} isIP
+ * @returns {boolean}
+ */
+function hasForbiddenDomainHost (parsed, options, schemeHandler, isIP) {
+  return Boolean(
+    parsed.host &&
+    isIP === false &&
+    !isIPLiteral(parsed.host) &&
+    (options.domainHost || (schemeHandler && schemeHandler.domainHost)) &&
+    FORBIDDEN_DOMAIN_HOST_CHARACTER.test(parsed.host)
+  )
+}
+
+/**
+ * @param {URL} url
+ * @returns {boolean}
+ */
+function isHostOnlyURL (url) {
+  return url.username === '' &&
+    url.password === '' &&
+    url.port === '' &&
+    url.pathname === '/' &&
+    url.search === '' &&
+    url.hash === '' &&
+    url.hostname !== ''
+}
+
 /**
  * @param {string} uri
  * @param {import('./types/index').Options} [opts]
@@ -140099,9 +140666,8 @@ function parseWithStatus (uri, opts) {
     parsed.fragment = matches[8]
 
     if (parsed.scheme !== undefined) {
-      const decodedScheme = unescape(parsed.scheme)
-      if (VALID_SCHEME.test(decodedScheme)) {
-        parsed.scheme = decodedScheme.toLowerCase()
+      if (VALID_SCHEME.test(parsed.scheme)) {
+        parsed.scheme = parsed.scheme.toLowerCase()
       } else {
         parsed.error = parsed.error || MALFORMED_SCHEME_ERROR
         malformedScheme = true
@@ -140135,7 +140701,7 @@ function parseWithStatus (uri, opts) {
         parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase()
 
         if (malformedIPLiteral) {
-          parsed.error = parsed.error || 'URI host is malformed.'
+          parsed.error = parsed.error || MALFORMED_HOST_ERROR
           malformedAuthorityOrPort = true
         }
       } else {
@@ -140172,7 +140738,11 @@ function parseWithStatus (uri, opts) {
         // pass only restores uppercase hex in escapes that remain encoded.
         host = normalizePercentEncoding(host.toLowerCase())
       }
-      parsed.host = reescapeHostDelimiters(host, isIP)
+      // Resolution parses both inputs with the internal `null` scheme before
+      // the effective scheme is known. Keep raw host delimiters for that step
+      // so resolve() can reject them for domain-host schemes; the resolved
+      // authority is encoded when it is serialized.
+      parsed.host = isIP || options.scheme !== 'null' ? reescapeHostDelimiters(host, isIP) : host
     }
 
     if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
@@ -140901,6 +141471,57 @@ function removeDotSegments (path) {
   return output.join('')
 }
 
+/**
+ * Removes dot segments from the path of a relative reference (a path that does
+ * not start with "/") without changing what it resolves to against any base.
+ * Unlike `removeDotSegments`, leading ".." segments that cannot be collapsed
+ * are kept, the result never becomes root-relative, and a result that would be
+ * empty or start with an empty segment is prefixed with "." (an empty path
+ * means "same document" and a leading "//" would introduce an authority).
+ *
+ * @param {string} path
+ * @returns {string}
+ */
+function removeDotSegmentsRelative (path) {
+  if (path === '' || path[0] === '/') {
+    return removeDotSegments(path)
+  }
+
+  const segments = path.split('/')
+  const last = segments.length - 1
+  /** @type {string[]} */
+  const output = []
+  let trailingDirectory = false
+
+  for (let i = 0; i <= last; i++) {
+    const segment = segments[i]
+    if (segment === '.' || segment === '..') {
+      if (segment === '..') {
+        if (output.length !== 0 && output[output.length - 1] !== '..') {
+          output.pop()
+        } else {
+          output.push('..')
+        }
+      }
+      trailingDirectory = i === last
+    } else {
+      output.push(segment)
+    }
+  }
+
+  if (trailingDirectory && output[output.length - 1] !== '..') {
+    output.push('')
+  }
+  if (output.length === 0 || output[0] === '' || output[0].includes(':')) {
+    // An empty path, a leading empty segment ("//"), or a first segment
+    // containing ":" (which would be mistaken for a scheme, RFC 3986 section
+    // 4.2) must stay behind a "." segment so the reference keeps its meaning.
+    output.unshift('.')
+  }
+
+  return output.join('/')
+}
+
 /**
  * Re-escape RFC 3986 gen-delims that must not appear literally in the host.
  * After the URI regex parses, these characters cannot be literal in the host
@@ -141296,6 +141917,7 @@ module.exports = {
   encodeFragment,
   escapePreservingEscapes,
   removeDotSegments,
+  removeDotSegmentsRelative,
   isIPv4,
   isUUID,
   normalizeIPv6,
@@ -154998,9 +155620,25 @@ function createExpanders(path) {
 ;// CONCATENATED MODULE: external "node:fs/promises"
 const promises_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:fs/promises");
 var promises_default = /*#__PURE__*/__nccwpck_require__.n(promises_namespaceObject);
+// EXTERNAL MODULE: external "node:fs"
+var external_node_fs_ = __nccwpck_require__(73024);
+// EXTERNAL MODULE: external "node:path"
+var external_node_path_ = __nccwpck_require__(76760);
+var external_node_path_default = /*#__PURE__*/__nccwpck_require__.n(external_node_path_);
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/utils/fileIgnore.ts
+
+
+const FIRESTARTR_IGNORE_FILE = '.firestartrignore';
+/** Only the file's own directory matters; markers are not inherited. */
+function fileIgnore_isIgnoredFile(file) {
+    return (/\.(yaml|yml)$/.test(file) &&
+        (0,external_node_fs_.existsSync)(external_node_path_default().join(external_node_path_default().dirname(file), FIRESTARTR_IGNORE_FILE)));
+}
+
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/crawler.ts
 
 
+
 // Number of files being currently slurped
 let activeSlurps = 0;
 // Max number of files that can be being slurped at a given time
@@ -155110,11 +155748,16 @@ async function crawlDirectory(dirEnt, exec) {
         const entries = (await promises_namespaceObject.readdir(dirEnt))
             .map((entry) => external_path_.join(dirEnt, entry))
             .sort();
+        const ignoreFiles = entries.includes(external_path_.join(dirEnt, FIRESTARTR_IGNORE_FILE));
         for (const entry of entries) {
             const testDir = await isDir(entry);
             if (testDir) {
                 await crawlDirectory(entry, exec);
             }
+            else if (external_path_.basename(entry) === FIRESTARTR_IGNORE_FILE ||
+                (ignoreFiles && /\.(yaml|yml)$/.test(entry))) {
+                continue;
+            }
             else {
                 await slurpFile(entry, exec);
             }
@@ -159484,10 +160127,6 @@ function addTraceabilityStamp(context, content) {
     }
 }
 
-// EXTERNAL MODULE: external "node:path"
-var external_node_path_ = __nccwpck_require__(76760);
-// EXTERNAL MODULE: external "node:fs"
-var external_node_fs_ = __nccwpck_require__(73024);
 ;// CONCATENATED MODULE: external "node:os"
 const external_node_os_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:os");
 ;// CONCATENATED MODULE: ../features_renderer/src/auxiliar.ts
@@ -160861,6 +161500,7 @@ function extractClaimPatches(rendered) {
 
 
 
+
 // We need to ensure the grep command is a gnu version
 let IS_GNU_GREP = false;
 let GREP_ON_CHECK = false;
@@ -161054,7 +161694,9 @@ async function getClaimsByName(name, cwd = '.') {
                 if (Object.values(VisitedClaims).includes(fileName)) {
                     continue;
                 }
-                entradas.push(external_path_.join(cwd, fileName));
+                const entry = external_path_.join(cwd, fileName);
+                if (!fileIgnore_isIgnoredFile(entry))
+                    entradas.push(entry);
             }
             return Promise.all(entradas.map((entrada) => {
                 return loadRawClaim(entrada);
@@ -161184,6 +161826,7 @@ function claimsDefaulter_hasDeepPath(data, deepPath) {
 
 
 
+
 const isYamlFile = new RegExp(/\.(yaml|yml)$/);
 /**
  *
@@ -161307,6 +161950,9 @@ async function loadInitializers(claim, claimPath, initializersPath = getPath('in
     return result;
 }
 function loadClaimDefaults() {
+    if (fileIgnore_isIgnoredFile(`${getPath('claimsDefaults')}/claims_defaults.yaml`)) {
+        return {};
+    }
     try {
         return catalog_common/* default */.A.io.fromYaml(external_fs_.readFileSync(`${getPath('claimsDefaults')}/claims_defaults.yaml`, 'utf-8'));
     }
@@ -161445,30 +162091,51 @@ function validateTfStateKeyUniqueness(crs) {
     const tfStateKeys = {};
     for (const crKey of Object.keys(crs)) {
         const cr = crs[crKey];
-        if (!isTerraformWorkspace(cr))
+        if (!cr.spec?.firestartr?.tfStateKey)
             continue;
         const tfKey = cr.spec.firestartr.tfStateKey;
-        if (tfStateKeys[tfKey]) {
+        const claimRef = cr.metadata?.annotations?.['firestartr.dev/claim-ref'];
+        const existing = tfStateKeys[tfKey];
+        if (existing) {
+            const existingClaimRef = existing.metadata?.annotations?.['firestartr.dev/claim-ref'];
+            const sameClaim = claimRef !== undefined && existingClaimRef === claimRef;
+            const workspaceInvolved = isTerraformWorkspace(cr) || isTerraformWorkspace(existing);
+            if (sameClaim && !workspaceInvolved) {
+                continue;
+            }
             throw new Error(`❗❗ ❌ RENDER ERROR ❌ ❗❗
 
 The tfStateKey ${tfKey} is not unique,
 
 It is being used by the following CRs:
 
-- ${tfStateKeys[tfKey].kind} ${tfStateKeys[tfKey].metadata.name}
+- ${existing.kind} ${existing.metadata.name}
 
 - ${cr.kind} ${cr.metadata.name}
 
 Check the following Claims to ensure that the tfStateKey is unique:
 
-- ${tfStateKeys[tfKey].metadata.annotations['firestartr.dev/claim-ref']}
+- ${existingClaimRef}
 
-- ${cr.metadata.annotations['firestartr.dev/claim-ref']}
+- ${claimRef}
 `);
         }
         tfStateKeys[cr.spec.firestartr.tfStateKey] = cr;
     }
 }
+function validateClaimRefOwnership(previousCrs, renderedCrs) {
+    for (const crKey of Object.keys(renderedCrs)) {
+        const previous = previousCrs[crKey];
+        if (!previous)
+            continue;
+        const previousClaimRef = previous.metadata?.annotations?.['firestartr.dev/claim-ref'];
+        const renderedClaimRef = renderedCrs[crKey].metadata?.annotations?.['firestartr.dev/claim-ref'];
+        if (previousClaimRef === renderedClaimRef)
+            continue;
+        const cr = renderedCrs[crKey];
+        throw new Error(`The rendered ${cr.kind} ${cr.metadata?.name} would overwrite an existing resource owned by ${previousClaimRef ?? '<unknown claim>'} (rendered by ${renderedClaimRef ?? '<unknown claim>'})`);
+    }
+}
 function references_isCatalogEntity(cr) {
     return [
         'Component',
@@ -161870,6 +162537,7 @@ const KINDS_CR_MAP = {
 
 
 
+
 function resolveStringReference(reference) {
     const referenceElements = reference.split(':');
     const actualKind = KINDS_CR_MAP[referenceElements[0]];
@@ -161890,6 +162558,8 @@ function resolveClaimFilesList(claimRefsList) {
     const fileList = claimRefsList.replace(/\s/g, '').split(',');
     const refList = [];
     for (const file of fileList) {
+        if (isIgnoredFile(file))
+            continue;
         try {
             const data = fs.readFileSync(file, 'utf-8');
             const claim = common.io.fromYaml(data);
@@ -161920,6 +162590,8 @@ async function* resolveClaimEntries(claimRefsList) {
                 yield* resolveDirEntries(claimEntry);
             }
             else if (claimEntryStats.isFile()) {
+                if (fileIgnore_isIgnoredFile(claimEntry))
+                    continue;
                 logger.debug(`Sending entry ${resolveClaimFileRef(claimEntry)} (${claimEntry})`);
                 yield resolveClaimFileRef(claimEntry);
             }
@@ -161939,12 +162611,15 @@ async function* resolveDirEntries(dir) {
     catch (err) {
         throw new Error(`Reading dir: ${dir}: ${err}`);
     }
+    const ignoreFiles = entries.some((entry) => entry.name === FIRESTARTR_IGNORE_FILE);
     for (const entry of entries) {
         const fullPath = external_path_default().join(dir, entry.name);
         if (entry.isDirectory()) {
             yield* resolveDirEntries(fullPath);
         }
-        else if (entry.isFile() && entry.name.match(/\.yaml$|\.yml$/)) {
+        else if (!ignoreFiles &&
+            entry.isFile() &&
+            entry.name.match(/\.yaml$|\.yml$/)) {
             const claimRef = await resolveClaimFileRef(fullPath);
             logger.debug(`Sending entry ${claimRef} (${fullPath})`);
             yield claimRef;
@@ -162019,12 +162694,15 @@ async function crawlClaimsDir(dir, basePath, claims) {
     catch (err) {
         throw new Error(`Reading directory ${dir}: ${err}`);
     }
+    const ignoreFiles = entries.some((entry) => entry.name === FIRESTARTR_IGNORE_FILE);
     for (const entry of entries) {
         const fullPath = external_path_default().join(dir, entry.name);
         if (entry.isDirectory()) {
             await crawlClaimsDir(fullPath, basePath, claims);
         }
-        else if (entry.isFile() && entry.name.match(/\.yaml$|\.yml$/)) {
+        else if (!ignoreFiles &&
+            entry.isFile() &&
+            entry.name.match(/\.yaml$|\.yml$/)) {
             try {
                 const data = await external_fs_default().promises.readFile(fullPath, 'utf-8');
                 const claim = catalog_common/* default */.A.io.fromYaml(data);
@@ -167084,7 +167762,8 @@ async function renderer_render(catalogScope, firestartrScope, claimList) {
     try {
         validateSubReferences(data.renderClaims);
         validateComponentPagesPath(data.renderClaims);
-        validateTfStateKeyUniqueness(result);
+        validateClaimRefOwnership(data.fullCrs, result);
+        validateTfStateKeyUniqueness(fullCrSet);
         validateGithubOrgSettingsSingleton(fullCrSet);
         validateGithubOrgVariableSectionSingleton(fullCrSet);
         validateActionsVariablesUniqueness(result);
@@ -354102,87 +354781,94 @@ function getDiagnosticErrorCount() {
 
 
 
-
 const DIAGNOSTIC_FILE = '/tmp/diagnostic';
-const DIAGNOSTIC_INTERVAL_MS = 10 * 1000;
+const DEFAULT_DIAGNOSTIC_INTERVAL_SECONDS = 10;
+// setTimeout/setInterval clamp any delay above 2^31-1 ms to 1 ms, which would
+// turn a large configured interval into a tight write loop.
+const MAX_DIAGNOSTIC_INTERVAL_SECONDS = Math.floor((2 ** 31 - 1) / 1000);
 let _diagnosticTimer;
-// Capture the set of CRD plurals that were missing when diagnostics began.
-// Once recorded, observedKinds will permanently exclude kinds whose plural
-// was missing at startup so that CRDs applied later while the operator is
-// running do not retroactively appear in the observed list.
-let _initialMissingPlurals;
-function clearTimer() {
-    if (_diagnosticTimer !== undefined) {
-        clearInterval(_diagnosticTimer);
-        _diagnosticTimer = undefined;
+/**
+ * Reads `OPERATOR_DIAGNOSTIC_INTERVAL_SECONDS`, falling back to the default for
+ * absent or unusable values so a typo cannot disable diagnostics.
+ */
+function getDiagnosticIntervalSeconds(env = process.env) {
+    const raw = env.OPERATOR_DIAGNOSTIC_INTERVAL_SECONDS;
+    if (raw === undefined)
+        return DEFAULT_DIAGNOSTIC_INTERVAL_SECONDS;
+    const parsed = Number(raw.trim());
+    if (!Number.isFinite(parsed) ||
+        parsed < 1 ||
+        parsed > MAX_DIAGNOSTIC_INTERVAL_SECONDS) {
+        return DEFAULT_DIAGNOSTIC_INTERVAL_SECONDS;
     }
+    return Math.round(parsed);
 }
-function loopDiagnosticFile(queue, maxSlots) {
-    if (process.env.DISABLE_DIAGNOSTIC_FILE) {
+/**
+ * Starts the periodic diagnostic writer and writes the first snapshot right
+ * away, so the file exists before any work item arrives.
+ *
+ * Idempotent: a second call while a writer is running is a no-op, so the
+ * startup path and the in-loop call never race on the same file.
+ *
+ * @returns whether this call started the writer.
+ */
+function startDiagnosticFile(source, maxSlots, env = process.env) {
+    if (_diagnosticTimer !== undefined) {
+        operator_src_logger.info('Diagnostic file writer already running, keeping the active one');
+        return false;
+    }
+    if (env.DISABLE_DIAGNOSTIC_FILE) {
         operator_src_logger.info('Diagnostic file disabled by DISABLE_DIAGNOSTIC_FILE');
-        return;
+        return false;
     }
+    const intervalSeconds = getDiagnosticIntervalSeconds(env);
     let running = false;
-    _diagnosticTimer = setInterval(() => {
+    const writeSnapshot = () => {
         if (running)
             return;
         running = true;
-        writeDiagnosticSnapshot(queue, maxSlots)
+        // The source is read inside the snapshot builder, so a throwing seam becomes
+        // a logged rejection instead of escaping into the caller.
+        writeDiagnosticSnapshot(source, maxSlots)
             .then(() => {
             running = false;
         })
             .catch((err) => {
+            // Best-effort: a failed snapshot never crashes the operator; the next
+            // tick retries with a fresh snapshot.
             running = false;
             operator_src_logger.error(`Error writing diagnostic file: ${err}`);
         });
-    }, DIAGNOSTIC_INTERVAL_MS);
-    // Clear the interval on termination signals so the process can exit cleanly
-    const onSignal = () => clearTimer();
-    process.on('SIGTERM', onSignal);
-    process.on('SIGINT', onSignal);
+    };
+    writeSnapshot();
+    _diagnosticTimer = setInterval(writeSnapshot, intervalSeconds * 1000);
+    // Diagnostics must never keep the process alive nor change termination
+    // behaviour: an unref'd timer cannot hold the process open, so shutting down
+    // is left entirely to the operator's own signal handlers.
+    if (typeof _diagnosticTimer.unref === 'function')
+        _diagnosticTimer.unref();
+    operator_src_logger.info(`Diagnostic file writer started (every ${intervalSeconds}s)`);
+    return true;
+}
+function stopDiagnosticFile() {
+    if (_diagnosticTimer !== undefined) {
+        clearInterval(_diagnosticTimer);
+        _diagnosticTimer = undefined;
+    }
 }
 /** @internal for testing */
 function getDiagnosticTimer() {
     return _diagnosticTimer;
 }
-async function writeDiagnosticSnapshot(queue, maxSlots) {
+async function writeDiagnosticSnapshot(source, maxSlots) {
+    const snapshot = source();
     const now = new Date().toISOString();
-    // Queue counts
-    let pending = 0;
-    let processing = 0;
-    let finished = 0;
-    let blocked = 0;
-    let deadLetter = 0;
+    const { pending, processing, finished, blocked, deadLetter } = snapshot;
     // Per-slot items
     const slotsMap = {};
-    for (const wi of queue) {
-        switch (wi.workStatus) {
-            case WorkStatus.PENDING:
-                pending++;
-                break;
-            case WorkStatus.PROCESSING:
-                processing++;
-                break;
-            case WorkStatus.FINISHED:
-                finished++;
-                break;
-        }
-        if (wi.isBlocked) {
-            blocked++;
-        }
-        if (wi.isDeadLetter) {
-            deadLetter++;
-        }
-        if (wi.workStatus === WorkStatus.PROCESSING && wi.slotId !== undefined) {
-            slotsMap[`slot-${wi.slotId}`] =
-                `${wi.item.kind}/${wi.item.metadata.name}`;
-        }
-    }
-    // Fill empty slots with null
     for (let i = 0; i < maxSlots; i++) {
-        if (!slotsMap[`slot-${i}`]) {
-            slotsMap[`slot-${i}`] = 'null';
-        }
+        const key = `slot-${i}`;
+        slotsMap[key] = snapshot.slots[key] ?? 'null';
     }
     // Semaphore stats
     const semaphoreCurrent = getCurrentConcurrentApiCalls();
@@ -354201,23 +354887,32 @@ async function writeDiagnosticSnapshot(queue, maxSlots) {
     const envBackendProvider = process.env.BACKEND_PROVIDER_NAME || 'kubernetes-provider';
     const envGithubAppId = process.env.GITHUB_APP_ID || '';
     const envTfmSkipGitConfig = process.env.TFM_SKIP_GIT_CONFIG || 'false';
-    // CRD diagnostics: observed kinds (from OPERATOR_KIND_LIST) and missing CRDs
-    // missing CRDs are derived from the runtime __crdMonitors map; any monitor
-    // that is started indicates an actively-missing CRD that is being watched.
+    // CRD diagnostics: observed kinds (from OPERATOR_KIND_LIST) and missing CRDs.
+    // `__crdMonitors` keeps one registration per kind whose CRD was absent when
+    // observeKind ran, and a stopped monitor stays registered (crdMonitor only
+    // flips isStarted). Such a kind has no informer attached until the operator is
+    // restarted, so it must never be reported as observed. Deriving the
+    // exclusions from the retained registrations - not from a sampled isStarted()
+    // state - keeps a kind excluded when its monitor starts and stops between two
+    // ticks, or registers after the first snapshot.
     const observedKindsRaw = envKindList
         .split(',')
         .map((s) => s.trim())
         .filter((s) => s.length > 0);
     const missingCrds = [];
+    const registeredPlurals = new Set();
     try {
         const monitors = global.__crdMonitors;
         if (monitors && typeof monitors === 'object') {
             for (const [key, monitor] of monitors) {
+                // key shape is namespace/plural (reflector uses `${namespace}/${plural}`)
+                const plural = String(key).split('/').pop()?.toLowerCase();
+                if (plural)
+                    registeredPlurals.add(plural);
                 try {
                     if (monitor &&
                         typeof monitor.isStarted === 'function' &&
                         monitor.isStarted()) {
-                        // key shape is namespace/plural (reflector uses `${namespace}/${plural}`)
                         missingCrds.push(String(key));
                     }
                 }
@@ -354230,13 +354925,7 @@ async function writeDiagnosticSnapshot(queue, maxSlots) {
     catch (e) {
         // defensive: do not fail diagnostic writing if globals are not present
     }
-    // Compute the set of plurals that were missing when diagnostics started.
-    // We only capture this once so that CRDs installed while the operator
-    // is running do not cause previously-missing kinds to become observed.
-    if (!_initialMissingPlurals) {
-        _initialMissingPlurals = new Set(missingCrds.map((k) => String(k).split('/').pop()?.toLowerCase() || ''));
-    }
-    const observedKinds = observedKindsRaw.filter((k) => !_initialMissingPlurals.has(k.toLowerCase()));
+    const observedKinds = observedKindsRaw.filter((k) => !registeredPlurals.has(k.toLowerCase()));
     // Build YAML output
     let output = '';
     output += `timestamp: "${now}"\n`;
@@ -354251,7 +354940,7 @@ async function writeDiagnosticSnapshot(queue, maxSlots) {
     output += `  GITHUB_APP_ID: ${envGithubAppId}\n`;
     output += `  TFM_SKIP_GIT_CONFIG: ${envTfmSkipGitConfig}\n`;
     output += 'queue:\n';
-    output += `  total: ${queue.length}\n`;
+    output += `  total: ${snapshot.total}\n`;
     output += `  pending: ${pending}\n`;
     output += `  processing: ${processing}\n`;
     output += `  finished: ${finished}\n`;
@@ -355135,6 +355824,13 @@ function getMaxSlotsFromEnvironment() {
     return parsedMaxSlots;
 }
 const MAX_SLOTS = getMaxSlotsFromEnvironment();
+/**
+ * Number of concurrent processing slots, used by startup wiring that needs the
+ * same capacity the processor loop uses.
+ */
+function getMaxSlots() {
+    return MAX_SLOTS;
+}
 function getQueueMetrics() {
     let renamed = 0;
     let updated = 0;
@@ -355195,6 +355891,37 @@ function getQueueMetrics() {
         },
     };
 }
+/**
+ * Queue state for the diagnostic file. Counts come from the existing metrics
+ * seam (`getQueueMetrics`) so scheduling state is never counted twice, and only
+ * the fields the diagnostic file documents differently are derived here: `blocked`
+ * keeps the historical `isBlocked` meaning instead of the parent-aware gauge,
+ * and `slots` needs the per-slot assignment the gauge does not expose.
+ */
+function getOperatorQueueSnapshot() {
+    const metrics = getQueueMetrics();
+    const slots = {};
+    let blocked = 0;
+    for (const workItem of queue) {
+        if (workItem.isBlocked) {
+            blocked++;
+        }
+        if (workItem.workStatus === WorkStatus.PROCESSING &&
+            workItem.slotId !== undefined) {
+            slots[`slot-${workItem.slotId}`] =
+                `${workItem.item.kind}/${workItem.item.metadata.name}`;
+        }
+    }
+    return {
+        total: metrics.nItems,
+        pending: metrics.nItemsPending,
+        processing: metrics.nItemsProcessing,
+        finished: metrics.nItemsFinished,
+        blocked,
+        deadLetter: metrics.nItemsInDeadLetterHandling,
+        slots,
+    };
+}
 let INIT = false;
 let podIsTerminating = false;
 const handleTerminationSignal = (signal) => {
@@ -355230,7 +355957,7 @@ async function processItem(workItem) {
  */
 async function processItem_loop() {
     loopWorkItemDebug(queue);
-    loopDiagnosticFile(queue, MAX_SLOTS);
+    startDiagnosticFile(getOperatorQueueSnapshot, MAX_SLOTS);
     const deferredBookkeeper = new DeferredSchedulingBookkeeper();
     _deferredBookkeeper = deferredBookkeeper;
     const processItemSlotsManager = initProcessItemsSlots(MAX_SLOTS, true, (w) => deferredBookkeeper.incrementBlockedAttempt(w));
@@ -362066,6 +362793,11 @@ async function planTerraformWorkspace(cr, status, opts) {
 async function planGithubResource(cr, status, opts) {
     fDebug('Resolving references');
     const deps = await resolve(cr, getPrAwareItemByItemPath(opts, status), getSecret, opts.namespace);
+    deps['self-outputs'] = {
+        cr: cr?.metadata?.name
+            ? await resolveSecretRef(cr.metadata.namespace || opts.namespace, cr, getSecret)
+            : undefined,
+    };
     fDebug('Running GitHub provisioner plan');
     return await gh_provisioner.runGhProvisioner({
         mainCr: cr,
@@ -363154,6 +363886,7 @@ async function tfLocal(cr, namespace, cmd = 'plan') {
 
 
 
+
 let importModeActive = false;
 let withMetricsMode = false;
 
@@ -363187,6 +363920,9 @@ function runOperator(opts) {
     if (importModeSkipPlan)
         importModeSkipPlanActive = importModeSkipPlan;
     initActivityLog();
+    // Start the /tmp/diagnostic flight recorder before any work arrives so the
+    // file exists right after startup, independently of the processor loop.
+    startDiagnosticFile(getOperatorQueueSnapshot, getMaxSlots());
     operator_src_logger.info(`started the operator with options ${JSON.stringify(opts)}`);
     // Create the immutable operator profile from startup env snapshot
     // Must happen before any work processing or feedback machinery
@@ -364201,9 +364937,9 @@ const crsStatusSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = {"rE":"3.1.0"};
+const package_namespaceObject = /*#__PURE__*/JSON.parse('{"rE":"3.1.1-snapshot-pagination-fix"}');
 ;// CONCATENATED MODULE: ../../package.json
-const package_namespaceObject_1 = {"rE":"3.1.0"};
+const package_namespaceObject_1 = {"rE":"3.1.1"};
 // EXTERNAL MODULE: ../../node_modules/semver/index.js
 var semver = __nccwpck_require__(90084);
 var semver_default = /*#__PURE__*/__nccwpck_require__.n(semver);