@firestartr/cli 2.11.0-snapshot-import-filter-fix-2 → 2.11.0-snapshot-feature-git-traceability-1

package/build/index.js

@@ -134117,6 +134117,7 @@ class GithubCheckRun {
         this.pullNumber = params.pullNumber;
         this.includeCheckRunComment = Boolean(params.includeCheckRunComment);
         this.checkRunComment = params.checkRunComment;
+        this.stickyCommentBaseKind = params.stickyCommentBaseKind;
         this.buffer = new CheckRunBuffer('', (data) => this.__updateCheckRun(data).catch(() => { }), { intervalSec: FLUSH_TIMEOUT });
     }
     /**
@@ -134188,7 +134189,13 @@ class GithubCheckRun {
                     text,
                 },
             });
-            if (this.includeCheckRunComment && this.pullNumber !== undefined) {
+            // With a shared sticky base kind, the result publisher targeting the
+            // same base kind is always the last word: close() performs no sticky
+            // rewrite (it could otherwise land after the result publish on error
+            // paths and clobber it with a stale progress comment).
+            if (this.includeCheckRunComment &&
+                this.pullNumber !== undefined &&
+                !this.stickyCommentBaseKind) {
                 try {
                     await this.__ensureAndUpdateStickyComment(this.__buildCheckRunUrl());
                     this.hasCommented = true;
@@ -134253,7 +134260,14 @@ class GithubCheckRun {
                 text,
             },
         });
-        if (this.includeCheckRunComment && this.pullNumber !== undefined) {
+        // After the awaits above, close() may have begun. With a shared sticky
+        // base kind the result publisher must be the last word, so an in-flight
+        // progress upsert must not land after it. Legacy flows (no shared base
+        // kind) keep their current behavior.
+        const closedMidFlight = this.stickyCommentBaseKind && (this.closed || this.closing);
+        if (this.includeCheckRunComment &&
+            this.pullNumber !== undefined &&
+            !closedMidFlight) {
             try {
                 await this.__ensureAndUpdateStickyComment(this.__buildCheckRunUrl());
             }
@@ -134300,7 +134314,7 @@ class GithubCheckRun {
             owner: this.owner,
             repo: this.repo,
             pullNumber: this.pullNumber,
-            baseKind: `check-run:${this.name}`,
+            baseKind: this.stickyCommentBaseKind ?? `check-run:${this.name}`,
             bodies: [linkLine],
         });
     }
@@ -134338,6 +134352,7 @@ async function createCheckRunForOrg(org, owner, repo, name, opts) {
         pullNumber: opts?.pullNumber,
         includeCheckRunComment: Boolean(opts?.includeCheckRunComment),
         checkRunComment: opts?.checkRunComment,
+        stickyCommentBaseKind: opts?.stickyCommentBaseKind,
     });
 }
 async function createCheckRun(owner, repo, name, opts) {
@@ -134790,6 +134805,7 @@ function createFacade(profileName) {
                     pullNumber: opts?.pullNumber,
                     includeCheckRunComment: Boolean(opts?.includeCheckRunComment),
                     checkRunComment: opts?.checkRunComment,
+                    stickyCommentBaseKind: opts?.stickyCommentBaseKind,
                 });
             },
             CheckRun: CheckRun,
@@ -134943,6 +134959,100 @@ async function checkIfInstalledForOrg(org = 'default') {
 }
 
 
+/***/ }),
+
+/***/ 16907:
+/***/ ((__unused_webpack_module, __webpack_exports__, __nccwpck_require__) => {
+
+__nccwpck_require__.r(__webpack_exports__);
+/* harmony export */ __nccwpck_require__.d(__webpack_exports__, {
+/* harmony export */   "initTfDebug": () => (/* binding */ initTfDebug),
+/* harmony export */   "writeConfig": () => (/* binding */ writeConfig),
+/* harmony export */   "writeTfOutput": () => (/* binding */ writeTfOutput)
+/* harmony export */ });
+/* harmony import */ var catalog_common__WEBPACK_IMPORTED_MODULE_0__ = __nccwpck_require__(78542);
+/* harmony import */ var fs_promises__WEBPACK_IMPORTED_MODULE_1__ = __nccwpck_require__(73292);
+/* harmony import */ var fs_promises__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__nccwpck_require__.n(fs_promises__WEBPACK_IMPORTED_MODULE_1__);
+/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __nccwpck_require__(71017);
+/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__nccwpck_require__.n(path__WEBPACK_IMPORTED_MODULE_2__);
+/* harmony import */ var _logger__WEBPACK_IMPORTED_MODULE_3__ = __nccwpck_require__(31986);
+
+
+
+
+const DEBUG_PREFIX = '/tmp/tf-debug/';
+async function initTfDebug(ctx) {
+    try {
+        const projectPath = ctx?.projectPath;
+        if (!projectPath || !projectPath.startsWith(DEBUG_PREFIX))
+            return;
+        // Normalize projectPath by stripping a trailing UUID-like suffix from the
+        // final path segment. This makes the debug folder deterministic even if
+        // callers still supply a name with an embedded tfStateKey or uuid suffix.
+        const dir = path__WEBPACK_IMPORTED_MODULE_2__.dirname(projectPath);
+        const name = path__WEBPACK_IMPORTED_MODULE_2__.basename(projectPath);
+        const baseName = name.replace(/-[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/, '');
+        const normalizedProjectPath = path__WEBPACK_IMPORTED_MODULE_2__.join(dir, baseName);
+        // Ensure the session project dir and a dedicated subdir for
+        // terraform_provisioner exist. Do NOT remove an existing deterministic
+        // debug folder here — removing it during build() breaks the reuse
+        // validation when build() is invoked a second time for output().
+        await fs_promises__WEBPACK_IMPORTED_MODULE_1__.mkdir(normalizedProjectPath, { recursive: true });
+        const debugArtifactsDir = path__WEBPACK_IMPORTED_MODULE_2__.join(normalizedProjectPath, 'tf_provisioner_debug');
+        await fs_promises__WEBPACK_IMPORTED_MODULE_1__.mkdir(debugArtifactsDir, { recursive: true });
+        // Write cr.yaml and deps.yaml if provided on context
+        if (ctx.rawCr) {
+            await fs_promises__WEBPACK_IMPORTED_MODULE_1__.writeFile(path__WEBPACK_IMPORTED_MODULE_2__.join(debugArtifactsDir, 'cr.yaml'), catalog_common__WEBPACK_IMPORTED_MODULE_0__/* ["default"].io.toYaml */ .Z.io.toYaml(ctx.rawCr));
+        }
+        if (ctx.deps) {
+            await fs_promises__WEBPACK_IMPORTED_MODULE_1__.writeFile(path__WEBPACK_IMPORTED_MODULE_2__.join(debugArtifactsDir, 'deps.yaml'), catalog_common__WEBPACK_IMPORTED_MODULE_0__/* ["default"].io.toYaml */ .Z.io.toYaml(ctx.deps));
+        }
+        // Enable file logging for debug runs
+        _logger__WEBPACK_IMPORTED_MODULE_3__/* ["default"].enableFileLogging */ .Z.enableFileLogging(path__WEBPACK_IMPORTED_MODULE_2__.join(debugArtifactsDir, 'debug.log'));
+    }
+    catch (e) {
+        _logger__WEBPACK_IMPORTED_MODULE_3__/* ["default"].warn */ .Z.warn(`[terraform-provisioner]: failed to init tf debug artifacts: ${e}`);
+    }
+}
+async function writeTfOutput(projectPath, output) {
+    try {
+        if (!projectPath || !projectPath.startsWith(DEBUG_PREFIX))
+            return;
+        const debugArtifactsDir = path__WEBPACK_IMPORTED_MODULE_2__.join(projectPath, 'tf_provisioner_debug');
+        await fs_promises__WEBPACK_IMPORTED_MODULE_1__.mkdir(debugArtifactsDir, { recursive: true });
+        await fs_promises__WEBPACK_IMPORTED_MODULE_1__.writeFile(path__WEBPACK_IMPORTED_MODULE_2__.join(debugArtifactsDir, 'terraform-output.txt'), output);
+    }
+    catch (e) {
+        _logger__WEBPACK_IMPORTED_MODULE_3__/* ["default"].warn */ .Z.warn(`[terraform-provisioner]: failed to write terraform output: ${e}`);
+    }
+}
+async function writeConfig(projectPath, config) {
+    try {
+        if (!projectPath || !projectPath.startsWith(DEBUG_PREFIX))
+            return;
+        const debugArtifactsDir = path__WEBPACK_IMPORTED_MODULE_2__.join(projectPath, 'tf_provisioner_debug');
+        await fs_promises__WEBPACK_IMPORTED_MODULE_1__.mkdir(debugArtifactsDir, { recursive: true });
+        await fs_promises__WEBPACK_IMPORTED_MODULE_1__.writeFile(path__WEBPACK_IMPORTED_MODULE_2__.join(debugArtifactsDir, 'config.json'), JSON.stringify(config, null, 2));
+    }
+    catch (e) {
+        _logger__WEBPACK_IMPORTED_MODULE_3__/* ["default"].warn */ .Z.warn(`[terraform-provisioner]: failed to write config.json: ${e}`);
+    }
+}
+
+
+/***/ }),
+
+/***/ 31986:
+/***/ ((__unused_webpack_module, __webpack_exports__, __nccwpck_require__) => {
+
+/* harmony export */ __nccwpck_require__.d(__webpack_exports__, {
+/* harmony export */   "Z": () => (__WEBPACK_DEFAULT_EXPORT__)
+/* harmony export */ });
+/* harmony import */ var catalog_common__WEBPACK_IMPORTED_MODULE_0__ = __nccwpck_require__(78542);
+
+/* harmony default export */ const __WEBPACK_DEFAULT_EXPORT__ = (catalog_common__WEBPACK_IMPORTED_MODULE_0__/* ["default"].logger */ .Z.logger);
+
+
 /***/ }),
 
 /***/ 71421:
@@ -160443,6 +160553,13 @@ InitializerClaimRef.applicableKinds = [
  * and the value is the rendered CR
  */
 let renderedClaims = {};
+/**
+ * previousClaimsSymbols holds previously rendered claims (from prior import
+ * runs, e.g. the CRs already present on disk) keyed by claim kind and name.
+ * It is only consulted as a fallback when a claim reference is not part of the
+ * current render run but still exists as a previous CR.
+ */
+let previousClaimsSymbols = {};
 
 function setRenderedClaim(claim, cr) {
     const claimKey = `${claim.kind}-${claim.name}`;
@@ -160452,8 +160569,12 @@ function setRenderedClaim(claim, cr) {
     }
     renderedClaims[claimKey] = cr;
 }
+function setPreviousClaimsSymbols(symbols) {
+    previousClaimsSymbols = symbols ?? {};
+}
 function emptyRenderedClaims() {
     renderedClaims = {};
+    previousClaimsSymbols = {};
 }
 /**
  * Resolves a claim reference
@@ -160466,9 +160587,13 @@ function resolveClaimRef(kind, name, symbolsTable = renderedClaims) {
     if (symbolsTable[`${kind}-${name}`]) {
         return symbolsTable[`${kind}-${name}`];
     }
-    else {
-        throw new Error(`Claim ${kind}-${name} not found`);
+    if (symbolsTable === renderedClaims) {
+        const previousCr = previousClaimsSymbols[`${kind}-${name}`];
+        if (previousCr) {
+            return previousCr;
+        }
     }
+    throw new Error(`Claim ${kind}-${name} not found`);
 }
 
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/utils/repositoryClaimUtils.ts
@@ -166134,12 +166259,19 @@ function addTraceability(context, src, content) {
 }
 function addTraceabilityStamp(context, content) {
     const traceability = context.traceability || {};
-    const stamp = `---
-# FEATURE_NAME: ${traceability.name}
-# FEATURE_VERSION: ${traceability.version}
-# FEATURE_URL: ${traceability.url}
-
-`;
+    const stampLines = [
+        '---',
+        `# FEATURE_NAME: ${traceability.name}`,
+        `# FEATURE_VERSION: ${traceability.version}`,
+        `# FEATURE_URL: ${traceability.url}`,
+    ];
+    if (traceability.sha) {
+        stampLines.push(`# FEATURE_GIT_SHA: "${traceability.sha}"`);
+    }
+    if (Array.isArray(traceability.tags) && traceability.tags.length > 0) {
+        stampLines.push(`# FEATURE_GIT_TAGS: ${JSON.stringify(traceability.tags)}`);
+    }
+    const stamp = `${stampLines.join('\n')}\n\n`;
     const output = [];
     let replaced = false;
     for (const line of content.split(/\n/)) {
@@ -166308,6 +166440,7 @@ function buildExpectedOutput(config, renderDir) {
     return {
         files,
         patches: config.patches || [],
+        traceability: {},
     };
 }
 /* ---------- Context-style API for a render temp dir ---------- */
@@ -166478,6 +166611,7 @@ function render(featurePath, featureRenderPath, entity, firestartrConfig = {}, f
         // Not used anymore
         // output.unpatches = context.config.unpatches
     });
+    output.traceability = context.traceability;
     external_fs_default().writeFileSync(external_path_default().join(featureRenderPath, 'config.json'), JSON.stringify(context.config));
     // write the output file
     const configFile = external_path_default().join(featureRenderPath, 'output.json');
@@ -166709,6 +166843,7 @@ featureArgs = {}, repo = 'features', owner = 'prefapp') {
 async function processFeature(featureName, reference, featureOwner, // -> cr
 featureArgs = {}, repo = 'features', owner = 'prefapp') {
     await downloadFeatureZip(repo, featureName, reference, owner);
+    const commitInfo = await resolveFeatureCommit(owner, repo, reference);
     featureArgs['traceability'] = {
         version: reference,
         owner,
@@ -166716,9 +166851,44 @@ featureArgs = {}, repo = 'features', owner = 'prefapp') {
         name: featureName,
         ref: reference,
         url: `https://github.com/${owner}/${repo}/tree/${reference}/packages/${featureName}`,
+        sha: commitInfo.sha,
+        tags: commitInfo.tags,
     };
     return renderFeature(featureName, reference, owner, repo, featureOwner, '/tmp', featureArgs);
 }
+async function resolveFeatureCommit(owner, repo, reference) {
+    try {
+        const octokit = await github["default"].getOctokitForOrg(owner, true);
+        // Get the resolved commit SHA
+        const { data: commit } = await octokit.rest.repos.getCommit({
+            owner,
+            repo,
+            ref: reference,
+        });
+        const sha = commit.sha;
+        // Get all tags pointing to this commit. `paginate` is all-or-nothing:
+        // if listing fails, we still return the resolved SHA with an empty tag set.
+        let tags = [];
+        try {
+            const allTags = await octokit.paginate(octokit.rest.repos.listTags, {
+                owner,
+                repo,
+                per_page: 100,
+            });
+            tags = allTags
+                .filter((t) => t.commit?.sha === sha)
+                .map((t) => t.name);
+        }
+        catch (tagError) {
+            features_preparer_src_logger.warn(`[features_preparer] Failed to list tags for ${owner}/${repo}@${reference}: ${tagError instanceof Error ? tagError.message : String(tagError)}`);
+        }
+        return { sha, tags };
+    }
+    catch (error) {
+        features_preparer_src_logger.warn(`[features_preparer] Failed to resolve commit for ${owner}/${repo}@${reference}: ${error instanceof Error ? error.message : String(error)}`);
+        return { sha: '', tags: [] };
+    }
+}
 async function prepareFeature(featureName, version, repo = 'features', owner = 'prefapp') {
     await downloadFeatureZip(repo, featureName, version, owner);
 }
@@ -166804,11 +166974,20 @@ async function utils_renderFeature(featureName, featureVersion, featureOutputObj
         files.push({ path, userManaged, content, targetBranch });
     }
     const featName = catalog_common/* default.generic.normalizeName */.Z.generic.normalizeName(`${featureName}-${cr.spec.firestartr.tfStateKey}`);
+    const traceability = featureOutputObject.traceability || {};
     return {
         kind: 'GithubRepositoryFeatureClaim',
         version: '1.0.0',
         name: featName,
-        feature: { name: featureName, version: featureVersion },
+        feature: {
+            name: featureName,
+            version: featureVersion,
+            ref: traceability.ref,
+            repo: traceability.repo,
+            sha: traceability.sha,
+            tags: traceability.tags,
+            url: traceability.url,
+        },
         firestartr: { tfStateKey: cr.spec.firestartr.tfStateKey },
         files,
         claimRepoName,
@@ -170675,13 +170854,29 @@ class FeatureRepoChart extends BaseGithubChart {
     template() {
         const claim = this.get('claim');
         const repositoryTarget = this.resolveRepositoryTarget();
+        const annotations = {
+            'firestartr.dev/external-name': claim.name,
+            'firestartr.dev/feature-name': claim.feature.name,
+        };
+        if (claim.feature.sha) {
+            annotations['firestartr.dev/feature-git-sha'] = claim.feature.sha;
+        }
+        if (claim.feature.tags?.length) {
+            annotations['firestartr.dev/feature-git-tags'] = JSON.stringify(claim.feature.tags);
+        }
+        if (claim.feature.url) {
+            annotations['firestartr.dev/feature-url'] = claim.feature.url;
+        }
+        if (claim.feature.ref) {
+            annotations['firestartr.dev/feature-ref'] = claim.feature.ref;
+        }
+        if (claim.feature.repo) {
+            annotations['firestartr.dev/feature-repo'] = claim.feature.repo;
+        }
         const cr = {
             metadata: {
                 name: claim.name,
-                annotations: {
-                    'firestartr.dev/external-name': claim.name,
-                    'firestartr.dev/feature-name': claim.feature.name,
-                },
+                annotations,
             },
             spec: {
                 context: claim.context,
@@ -170701,7 +170896,7 @@ class FeatureRepoChart extends BaseGithubChart {
                 },
             },
         };
-        const annotations = this.getAnnotationsFromRepo(this.get('repoCr'), [
+        const repoAnnotations = this.getAnnotationsFromRepo(this.get('repoCr'), [
             'claim-ref',
             'revision',
             'sync-enabled',
@@ -170709,7 +170904,7 @@ class FeatureRepoChart extends BaseGithubChart {
         ]);
         cr.metadata.annotations = {
             ...cr.metadata.annotations,
-            ...annotations,
+            ...repoAnnotations,
         };
         // We do this to remove undefined variables from the template
         const crTemplate = JSON.parse(JSON.stringify(cr, null, 2));
@@ -171316,19 +171511,18 @@ const ORG_ROLE_ANNOTATION = 'firestartr.backstage.dev/org-role';
 class CatalogUserChart extends BaseCatalogChart {
     template() {
         const claim = this.get('claim');
-        const explicitOrgRole = claim.annotations?.[ORG_ROLE_ANNOTATION];
         const inferredOrgRole = claim.providers &&
             typeof claim.providers === 'object' &&
             'github' in claim.providers &&
             claim.providers.github?.role === 'admin'
             ? 'owner'
             : undefined;
-        const orgRole = explicitOrgRole ?? inferredOrgRole;
+        const { [ORG_ROLE_ANNOTATION]: _, ...claimAnnotations } = claim.annotations || {};
         const annotations = {
-            ...(claim.annotations || {}),
+            ...claimAnnotations,
         };
-        if (orgRole) {
-            annotations[ORG_ROLE_ANNOTATION] = orgRole;
+        if (inferredOrgRole) {
+            annotations[ORG_ROLE_ANNOTATION] = inferredOrgRole;
         }
         return {
             apiVersion: 'backstage.io/v1alpha1',
@@ -172826,6 +173020,8 @@ function walkArray(arr, symbolsToResolve, renderClaim) {
 
 
 
+
+
 /*
  * Function called when rendering from the importer class.
  *
@@ -172849,8 +173045,9 @@ async function renderFromImports(rClaims, crs = {}, catalogOutputDir = '/tmp/.ca
     }
     // type: is the kind of the claim
     // value: is the imported-ref (the name in Github, can be with special characters, spaces, etc)
+    const previousClaimsIndex = buildPreviousClaimsIndex(crs);
     const fSolver = (type, value) => {
-        return solver(type, value, rClaims);
+        return solver(type, value, rClaims, previousClaimsIndex);
     };
     try {
         // we need to expand the imported-refs
@@ -172880,6 +173077,9 @@ async function renderFromImports(rClaims, crs = {}, catalogOutputDir = '/tmp/.ca
         outputFileExtension: '.yaml',
         yamlOutputType: lib.YamlOutputType.FILE_PER_RESOURCE,
     });
+    // Claims skipped from this run (e.g. by fCheckCRExistsOnDisk) but still
+    // present as previous CRs must be resolvable by charts that reference them.
+    setPreviousClaimsSymbols(buildPreviousClaimsSymbols(crs));
     const result = await renderClaims(catalogScope, firestartrScope, { renderClaims: rClaims, crs, renames: [] });
     firestartrScope.synth();
     if (crOutputDir) {
@@ -172887,8 +173087,58 @@ async function renderFromImports(rClaims, crs = {}, catalogOutputDir = '/tmp/.ca
     }
     return result;
 }
-async function solver(type, value, rClaims) {
-    // TODO: we need to receive the claims directory as a parameter, and read all the claims to find the one that matches the imported-ref
+function buildPreviousClaimsIndex(crs) {
+    const index = {
+        user: new Map(),
+        group: new Map(),
+    };
+    for (const cr of Object.values(crs ?? {})) {
+        const anyCr = cr;
+        const kind = anyCr?.kind;
+        const externalName = anyCr?.metadata?.annotations?.[catalog_common/* default.generic.getFirestartrAnnotation */.Z.generic.getFirestartrAnnotation('external-name')];
+        const claimRef = anyCr?.metadata?.annotations?.[catalog_common/* default.generic.getFirestartrAnnotation */.Z.generic.getFirestartrAnnotation('claim-ref')];
+        if (!kind || !externalName || !claimRef) {
+            continue;
+        }
+        const claimName = claimRef.split('/')[1];
+        if (!claimName) {
+            continue;
+        }
+        if (kind === 'FirestartrGithubMembership') {
+            index.user.set(externalName, claimName);
+        }
+        else if (kind === 'FirestartrGithubGroup') {
+            index.group.set(externalName, claimName);
+        }
+    }
+    return index;
+}
+function buildPreviousClaimsSymbols(crs) {
+    const symbols = {};
+    for (const cr of Object.values(crs ?? {})) {
+        const anyCr = cr;
+        const kind = anyCr?.kind;
+        const claimRef = anyCr?.metadata?.annotations?.[catalog_common/* default.generic.getFirestartrAnnotation */.Z.generic.getFirestartrAnnotation('claim-ref')];
+        if (!kind || !claimRef) {
+            continue;
+        }
+        const claimName = claimRef.split('/')[1];
+        if (!claimName) {
+            continue;
+        }
+        const claimKind = kind === 'FirestartrGithubMembership'
+            ? 'UserClaim'
+            : kind === 'FirestartrGithubGroup'
+                ? 'GroupClaim'
+                : undefined;
+        if (!claimKind) {
+            continue;
+        }
+        symbols[`${claimKind}-${claimName}`] = anyCr;
+    }
+    return symbols;
+}
+async function solver(type, value, rClaims, previousClaimsIndex) {
     const claimKind = type === 'user' ? 'UserClaim' : 'GroupClaim';
     for (const key in rClaims) {
         if (key.startsWith(claimKind)) {
@@ -172898,6 +173148,12 @@ async function solver(type, value, rClaims) {
             }
         }
     }
+    const previousClaimName = type === 'user'
+        ? previousClaimsIndex.user.get(value)
+        : previousClaimsIndex.group.get(value);
+    if (previousClaimName) {
+        return `${type}:${previousClaimName}`;
+    }
     throw new Error(`Could not resolve imported-ref of type ${type} with value ${value}`);
 }
 
@@ -173409,23 +173665,25 @@ class CollectionMixins {
     async filter(kind, filters, elementList) {
         if (filters.length === 0)
             return elementList;
-        let filteredList = elementList;
         if (this.IS_FILTER_BY_NAME_SET(filters, kind)) {
-            filteredList = this.FILTER_BY_NAME_APPLY(filters, kind, (names) => filteredList.filter((el) => names.indexOf(el) !== -1));
+            return this.FILTER_BY_NAME_APPLY(filters, kind, (names) => {
+                const result = elementList.filter((el) => names.indexOf(el) !== -1);
+                return result;
+            });
         }
-        else if (this.IS_FILTER_BY_REGEXP_SET(filters, kind)) {
-            filteredList = this.FILTER_BY_REGEXP_APPLY(filters, kind, (nameRegExp) => {
-                return filteredList.filter((el) => nameRegExp.test(el));
+        if (this.IS_FILTER_BY_REGEXP_SET(filters, kind)) {
+            return this.FILTER_BY_REGEXP_APPLY(filters, kind, (nameRegExp) => {
+                return elementList.filter((el) => nameRegExp.test(el));
             });
         }
         if (this.IS_FILTER_BY_FUNCTION_SET(filters, kind)) {
-            filteredList = await this.FILTER_BY_FUNCTION_APPLY(filters, kind, async (fn) => {
-                return (await Promise.all(filteredList.map(async (el) => {
+            await this.FILTER_BY_FUNCTION_APPLY(filters, kind, async (fn) => {
+                elementList = (await Promise.all(elementList.map(async (el) => {
                     return (await fn(kind, el)) ? el : undefined;
                 }))).filter((el) => el !== undefined);
             });
         }
-        return filteredList;
+        return elementList;
     }
 }
 
@@ -360975,10 +361233,8 @@ class TFPlanItemVersion extends TFPlanItem {
     }
 }
 
-;// CONCATENATED MODULE: ../terraform_provisioner/src/logger.ts
-
-/* harmony default export */ const terraform_provisioner_src_logger = (catalog_common/* default.logger */.Z.logger);
-
+// EXTERNAL MODULE: ../terraform_provisioner/src/logger.ts
+var terraform_provisioner_src_logger = __nccwpck_require__(31986);
 ;// CONCATENATED MODULE: ../terraform_provisioner/src/process_handler.ts
 
 const GRACE_PERIOD = 60 * 2; // 2 min
@@ -360996,7 +361252,7 @@ function processHandler(processToHandle, ctl, onTimedOut) {
             }
         }
         catch (error) {
-            terraform_provisioner_src_logger.error(`FATAL: timeout signal ${signal} could not be delivered to the process: ${error}`);
+            terraform_provisioner_src_logger/* default.error */.Z.error(`FATAL: timeout signal ${signal} could not be delivered to the process: ${error}`);
             if (!callerNotified) {
                 ctl.processKilled(false);
                 callerNotified = true;
@@ -361008,15 +361264,15 @@ function processHandler(processToHandle, ctl, onTimedOut) {
         onTimedOut();
         timedOut = true;
         // send sigInt
-        terraform_provisioner_src_logger.error(`Terraform process has not exited after initial timeout of ${ctl.hardTimeout} seconds, sending SIGINT...`);
+        terraform_provisioner_src_logger/* default.error */.Z.error(`Terraform process has not exited after initial timeout of ${ctl.hardTimeout} seconds, sending SIGINT...`);
         safeKill('SIGINT');
         // grace period
         gracefulResetId = setTimeout(() => {
-            terraform_provisioner_src_logger.error(`Terraform process has not exited after SIGINT grace period of ${GRACE_PERIOD} seconds (total elapsed ~${ctl.hardTimeout + GRACE_PERIOD} seconds), sending SIGTERM...`);
+            terraform_provisioner_src_logger/* default.error */.Z.error(`Terraform process has not exited after SIGINT grace period of ${GRACE_PERIOD} seconds (total elapsed ~${ctl.hardTimeout + GRACE_PERIOD} seconds), sending SIGTERM...`);
             safeKill('SIGTERM');
             // hard reset period
             hardResetId = setTimeout(() => {
-                terraform_provisioner_src_logger.error(`Terraform process has not exited after SIGTERM hard reset period of ${HARD_RESET_PERIOD} seconds (total elapsed ~${ctl.hardTimeout + GRACE_PERIOD + HARD_RESET_PERIOD} seconds), sending SIGKILL...`);
+                terraform_provisioner_src_logger/* default.error */.Z.error(`Terraform process has not exited after SIGTERM hard reset period of ${HARD_RESET_PERIOD} seconds (total elapsed ~${ctl.hardTimeout + GRACE_PERIOD + HARD_RESET_PERIOD} seconds), sending SIGKILL...`);
                 safeKill('SIGKILL');
                 setTimeout(() => {
                     // we send if the process was killed or not to the caller
@@ -361379,7 +361635,7 @@ async function initFromModule(path, source, secrets, stream, ctl) {
     return tfExec(path, ['init', `-from-module=${source}`], secrets, [], stream, ctl);
 }
 async function plan(path, secrets, format, args = ['plan'], stream, ctl) {
-    terraform_provisioner_src_logger.info(`Running terraform plan with ${format} in path ${path}`);
+    terraform_provisioner_src_logger/* default.info */.Z.info(`Running terraform plan with ${format} in path ${path}`);
     const plan = await tfExec(path, args.concat(format === 'json' ? ['-json'] : []), secrets, ['-input=false'], stream, ctl);
     if (format === 'json') {
         const tfPlan = planGet(plan);
@@ -361388,7 +361644,7 @@ async function plan(path, secrets, format, args = ['plan'], stream, ctl) {
     return plan;
 }
 async function apply(path, secrets, stream, ctl) {
-    terraform_provisioner_src_logger.debug(`Running terraform apply in path ${path}`);
+    terraform_provisioner_src_logger/* default.debug */.Z.debug(`Running terraform apply in path ${path}`);
     let lastError;
     for (let attempt = 1; attempt <= MAX_APPLY_ATTEMPTS; attempt++) {
         try {
@@ -361398,11 +361654,11 @@ async function apply(path, secrets, stream, ctl) {
             lastError = error;
             if (isGitHubInconsistentApplyError(lastError)) {
                 if (attempt < MAX_APPLY_ATTEMPTS) {
-                    terraform_provisioner_src_logger.warn(`Transient GitHub provider apply error detected (attempt ${attempt} of ${MAX_APPLY_ATTEMPTS}); retrying after ${TRANSIENT_APPLY_RETRY_DELAY_MS}ms: ${GITHUB_INCONSISTENT_APPLY_SIGNATURE.join(', ')}`);
+                    terraform_provisioner_src_logger/* default.warn */.Z.warn(`Transient GitHub provider apply error detected (attempt ${attempt} of ${MAX_APPLY_ATTEMPTS}); retrying after ${TRANSIENT_APPLY_RETRY_DELAY_MS}ms: ${GITHUB_INCONSISTENT_APPLY_SIGNATURE.join(', ')}`);
                     await catalog_common/* default.generic.sleep */.Z.generic.sleep(TRANSIENT_APPLY_RETRY_DELAY_MS);
                     continue;
                 }
-                terraform_provisioner_src_logger.warn(`Transient GitHub provider apply error persisted after ${MAX_APPLY_ATTEMPTS} attempts; giving up.`);
+                terraform_provisioner_src_logger/* default.warn */.Z.warn(`Transient GitHub provider apply error persisted after ${MAX_APPLY_ATTEMPTS} attempts; giving up.`);
             }
             throw lastError;
         }
@@ -361410,15 +361666,15 @@ async function apply(path, secrets, stream, ctl) {
     throw lastError;
 }
 async function customCommand(path, secrets, args, stream) {
-    terraform_provisioner_src_logger.debug(`Running terraform customCommand in path ${path} ${args.join(',')}`);
+    terraform_provisioner_src_logger/* default.debug */.Z.debug(`Running terraform customCommand in path ${path} ${args.join(',')}`);
     return await tfExec(path, args, secrets, [], stream);
 }
 async function destroy(path, secrets, stream, ctl) {
-    terraform_provisioner_src_logger.debug(`Running terraform destroy in path ${path}`);
+    terraform_provisioner_src_logger/* default.debug */.Z.debug(`Running terraform destroy in path ${path}`);
     return await tfExec(path, ['destroy', '-auto-approve', TOFU_LOCK_TIMEOUT], secrets, ['-input=false'], stream, ctl);
 }
 async function output(path, secrets) {
-    terraform_provisioner_src_logger.debug(`Running terraform output in path ${path}`);
+    terraform_provisioner_src_logger/* default.debug */.Z.debug(`Running terraform output in path ${path}`);
     return await tfExec(path, ['output', '-json'], secrets, []);
 }
 async function tfExec(path, args, secrets, extraArgs = ['-input=false'], stream, ctl) {
@@ -361476,7 +361732,7 @@ async function tfExec(path, args, secrets, extraArgs = ['-input=false'], stream,
             // this process has been killed/terminated
             // by timeout (not in our control)
             if (processTimeout) {
-                terraform_provisioner_src_logger.error(`Terraform output ${path}: ${[output, outputErrors].join('')}`);
+                terraform_provisioner_src_logger/* default.error */.Z.error(`Terraform output ${path}: ${[output, outputErrors].join('')}`);
                 ko(catalog_common/* default.generic.buildCommandExecutionError */.Z.generic.buildCommandExecutionError([output, outputErrors, '\n<PROCESS TIMEOUT>'].join(''), catalog_common/* default.generic.normalizeExitCode */.Z.generic.normalizeExitCode(code), args.concat(extraArgs), {
                     errorName: 'TerraformCommandError',
                     label: 'Terraform command',
@@ -361484,14 +361740,14 @@ async function tfExec(path, args, secrets, extraArgs = ['-input=false'], stream,
                 return;
             }
             if (code !== 0) {
-                terraform_provisioner_src_logger.error(`Terraform output ${path}: ${[output, outputErrors].join('')}`);
+                terraform_provisioner_src_logger/* default.error */.Z.error(`Terraform output ${path}: ${[output, outputErrors].join('')}`);
                 ko(catalog_common/* default.generic.buildCommandExecutionError */.Z.generic.buildCommandExecutionError([output, outputErrors].join(''), catalog_common/* default.generic.normalizeExitCode */.Z.generic.normalizeExitCode(code), args.concat(extraArgs), {
                     errorName: 'TerraformCommandError',
                     label: 'Terraform command',
                 }));
             }
             else {
-                terraform_provisioner_src_logger.info(`Terraform output ${path}: ${output}`);
+                terraform_provisioner_src_logger/* default.info */.Z.info(`Terraform output ${path}: ${output}`);
                 ok(output);
             }
         });
@@ -361629,6 +361885,62 @@ async function configGit() {
     external_fs_.writeFileSync(gitconfigPath, `[url "https://firestartr:${ghToken}@github.com"]\ninsteadOf = https://github.com\n`);
 }
 
+;// CONCATENATED MODULE: ../terraform_provisioner/src/writer_additional_files.ts
+
+
+
+class WriterAdditionalFiles extends writer {
+    constructor(files) {
+        super();
+        this.files = files;
+    }
+    // This writer complies with the abstract Writer class but does not render content in the traditional sense.
+    async _render() {
+        return '';
+    }
+    async writeToTerraformProject(projectPath) {
+        for (const file of this.files) {
+            try {
+                const targetPath = external_path_.resolve(projectPath, file.path);
+                const absProjectPath = external_path_.resolve(projectPath);
+                if (!targetPath.startsWith(absProjectPath + external_path_.sep)) {
+                    throw new Error(`Path traversal detected: ${file.path}`);
+                }
+                await promises_.mkdir(external_path_.dirname(targetPath), { recursive: true });
+                await promises_.writeFile(targetPath, Buffer.from(file.content, 'base64').toString('utf8'));
+            }
+            catch (err) {
+                throw new Error(`Error writing additional file: ${file.path}: ${err}`);
+            }
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../terraform_provisioner/src/writer_imports.ts
+
+class WriterImports extends writer {
+    constructor(config) {
+        super();
+        this.config = config;
+    }
+    async _render() {
+        let importBlocks = '';
+        for (const importBlock of this.config.imports) {
+            importBlocks += `
+        
+   import {
+       
+       to = ${importBlock.to}
+
+       id = "${importBlock.id}"
+   }
+
+        `;
+        }
+        this.output = importBlocks;
+    }
+}
+
 ;// CONCATENATED MODULE: ../terraform_provisioner/src/writer_main_tf.ts
 
 
@@ -361651,6 +361963,31 @@ ${this.mainBlock}
     }
 }
 
+;// CONCATENATED MODULE: ../terraform_provisioner/src/writer_provider_tf_json.ts
+
+
+
+class WriterProviderJson extends writer {
+    constructor(mainBlock, providers, backend, tfStateKey) {
+        super();
+        this.mainBlock = mainBlock;
+        this.providers = providers;
+        this.backend = backend;
+        this.tfStateKey = tfStateKey;
+    }
+    async _render() {
+        this.output = await new WriterTerraform(this.providers, this.backend, this.tfStateKey, false).render('json');
+    }
+    writeToTerraformProject(mainTfPath) {
+        if (this.output.trim() === '') {
+            terraform_provisioner_src_logger/* default.info */.Z.info(`Skipping writing ${mainTfPath} as there is no provider to write.`);
+        }
+        else {
+            super.writeToTerraformProject(mainTfPath);
+        }
+    }
+}
+
 ;// CONCATENATED MODULE: ../terraform_provisioner/src/resolutor/resolver.ts
 
 const REG_IS_CLAIM_SECRET_REF = new RegExp(/^secret-ref-\d+$/);
@@ -361710,7 +362047,7 @@ function getRefNameFromKey(key) {
 function resolveClaimSecret(value, refs) {
     if (typeof value === 'string' && REG_IS_CLAIM_SECRET_REF.test(value)) {
         if (!Object.prototype.hasOwnProperty.call(refs, value)) {
-            terraform_provisioner_src_logger.error(`SecretsClaim ref ${value} is not present on references`);
+            terraform_provisioner_src_logger/* default.error */.Z.error(`SecretsClaim ref ${value} is not present on references`);
             throw new Error(`SecretsClaim ref ${value} is not present on references`);
         }
         return refs[value];
@@ -361806,87 +362143,6 @@ function fCheckString(keys, refs) {
     return true;
 }
 
-;// CONCATENATED MODULE: ../terraform_provisioner/src/writer_provider_tf_json.ts
-
-
-
-class WriterProviderJson extends writer {
-    constructor(mainBlock, providers, backend, tfStateKey) {
-        super();
-        this.mainBlock = mainBlock;
-        this.providers = providers;
-        this.backend = backend;
-        this.tfStateKey = tfStateKey;
-    }
-    async _render() {
-        this.output = await new WriterTerraform(this.providers, this.backend, this.tfStateKey, false).render('json');
-    }
-    writeToTerraformProject(mainTfPath) {
-        if (this.output.trim() === '') {
-            terraform_provisioner_src_logger.info(`Skipping writing ${mainTfPath} as there is no provider to write.`);
-        }
-        else {
-            super.writeToTerraformProject(mainTfPath);
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../terraform_provisioner/src/writer_additional_files.ts
-
-
-
-class WriterAdditionalFiles extends writer {
-    constructor(files) {
-        super();
-        this.files = files;
-    }
-    // This writer complies with the abstract Writer class but does not render content in the traditional sense.
-    async _render() {
-        return '';
-    }
-    async writeToTerraformProject(projectPath) {
-        for (const file of this.files) {
-            try {
-                const targetPath = external_path_.resolve(projectPath, file.path);
-                const absProjectPath = external_path_.resolve(projectPath);
-                if (!targetPath.startsWith(absProjectPath + external_path_.sep)) {
-                    throw new Error(`Path traversal detected: ${file.path}`);
-                }
-                await promises_.mkdir(external_path_.dirname(targetPath), { recursive: true });
-                await promises_.writeFile(targetPath, Buffer.from(file.content, 'base64').toString('utf8'));
-            }
-            catch (err) {
-                throw new Error(`Error writing additional file: ${file.path}: ${err}`);
-            }
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../terraform_provisioner/src/writer_imports.ts
-
-class WriterImports extends writer {
-    constructor(config) {
-        super();
-        this.config = config;
-    }
-    async _render() {
-        let importBlocks = '';
-        for (const importBlock of this.config.imports) {
-            importBlocks += `
-        
-   import {
-       
-       to = ${importBlock.to}
-
-       id = "${importBlock.id}"
-   }
-
-        `;
-        }
-        this.output = importBlocks;
-    }
-}
-
 // EXTERNAL MODULE: external "stream"
 var external_stream_ = __nccwpck_require__(12781);
 ;// CONCATENATED MODULE: ../terraform_provisioner/src/project_tf.ts
@@ -361907,10 +362163,14 @@ class project_tf_TFProjectManager {
             ? external_path_.resolve(this.projectPath)
             : '';
         // Remove the entire workspace directory
+        // Never delete debug workspaces. Support both gh-debug (existing) and
+        // the new tf-debug workspace prefix.
         if (resolvedProjectPath &&
-            resolvedProjectPath.startsWith('/tmp/gh-debug/')) {
+            (resolvedProjectPath.startsWith('/tmp/gh-debug/') ||
+                resolvedProjectPath.startsWith('/tmp/tf-debug/') ||
+                process.env.FIRESTARTR_DEBUG === 'true')) {
             // Never delete debug workspaces, per spec.
-            terraform_provisioner_src_logger.info(`[terraform-provisioner]: SKIP teardown for debug workspace at ${this.projectPath}`);
+            terraform_provisioner_src_logger/* default.info */.Z.info(`[terraform-provisioner]: SKIP teardown for debug workspace at ${this.projectPath}`);
             return;
         }
         if (resolvedProjectPath &&
@@ -361921,7 +362181,7 @@ class project_tf_TFProjectManager {
                     recursive: true,
                     force: true,
                 });
-                terraform_provisioner_src_logger.info(`[terraform-provisioner]: Workspace at ${resolvedProjectPath} torn up successfully`);
+                terraform_provisioner_src_logger/* default.info */.Z.info(`[terraform-provisioner]: Workspace at ${resolvedProjectPath} torn up successfully`);
             }
             catch (e) {
                 throw new Error(`[terraform-provisioner]: Failed to tear up local project at ${this.projectPath}: ${e}`);
@@ -361937,7 +362197,81 @@ class project_tf_TFProjectManager {
         this.onImport = false;
         this.onImport = !!ctx.importMode;
         this.ctx = ctx;
-        this.projectPath = ctx.projectPath;
+        // Normalize incoming debug project paths so the provisioner tolerates both
+        // old (suffixed) and new (stripped) naming. If ctx.projectPath points to a
+        // /tmp/tf-debug path, strip a trailing UUID-like suffix from the final
+        // segment so reuse checks look at the deterministic folder.
+        const incomingPath = ctx.projectPath;
+        if (typeof incomingPath === 'string' &&
+            incomingPath.startsWith('/tmp/tf-debug/')) {
+            const dir = external_path_.dirname(incomingPath);
+            const name = external_path_.basename(incomingPath);
+            // If the incoming debug folder includes a tfStateKey suffix, preserve
+            // it when normalizing. We expect the operator to set projectPath to
+            // `/tmp/tf-debug/<kind>-<baseName>-<tfStateKey>` when tfStateKey is
+            // available. Strip only a trailing UUID-like suffix if present.
+            const baseName = name.replace(/-[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/, '');
+            const normalized = external_path_.join(dir, baseName);
+            // If the deterministic folder exists, use it. If not, but there is an
+            // existing legacy suffixed folder, fall back to that so we remain
+            // tolerant of older operators that still write suffixed debug folders.
+            if (external_fs_.existsSync(normalized)) {
+                this.projectPath = normalized;
+            }
+            else {
+                try {
+                    const entries = external_fs_.readdirSync(dir, { withFileTypes: true });
+                    const escapedBaseName = baseName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+                    const legacyDirRegex = new RegExp(`^${escapedBaseName}-[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$`);
+                    const candidate = entries
+                        .filter((e) => e.isDirectory())
+                        .map((e) => e.name)
+                        .find((n) => legacyDirRegex.test(n));
+                    if (candidate) {
+                        // Prefer using the deterministic normalized path even if a
+                        // legacy suffixed candidate exists. Try to atomically rename the
+                        // legacy folder to the normalized name so subsequent runs use
+                        // a single, stable location. If rename fails, fall back to the
+                        // legacy candidate to avoid breaking execution.
+                        const candidatePath = external_path_.join(dir, candidate);
+                        try {
+                            external_fs_.renameSync(candidatePath, normalized);
+                            this.projectPath = normalized;
+                        }
+                        catch (renameErr) {
+                            // Renaming may fail (permissions, cross-fs). Fall back to
+                            // legacy candidate to preserve behavior.
+                            terraform_provisioner_src_logger/* default.warn */.Z.warn(`[terraform-provisioner]: failed to rename legacy debug folder ${candidatePath} -> ${normalized}: ${renameErr}`);
+                            this.projectPath = candidatePath;
+                        }
+                    }
+                    else {
+                        this.projectPath = normalized;
+                    }
+                }
+                catch (e) {
+                    // If reading the directory fails for any reason, fall back to the
+                    // normalized path — this keeps behavior deterministic and avoids
+                    // throwing from the constructor.
+                    this.projectPath = normalized;
+                }
+            }
+        }
+        else {
+            this.projectPath = ctx.projectPath;
+        }
+        // Ensure ctx.projectPath matches the resolved projectPath so subsequent
+        // debug initialization (which reads ctx.projectPath) operates on the
+        // same directory the project managers will write to. This prevents a
+        // timing mismatch where debug.init creates the deterministic folder but
+        // the project manager writes into a different (suffixed) folder.
+        try {
+            if (this.ctx && typeof this.ctx === 'object')
+                this.ctx.projectPath = this.projectPath;
+        }
+        catch (e) {
+            // Non-fatal: keep behavior deterministic even if we cannot mutate ctx
+        }
         this.mainTfWriter = new WriterMainTf(ctx.inline, ctx.requiredProviders, ctx.backend, ctx.tfStateKey);
         this.providerJsonWriter = new WriterProviderJson(ctx.inline, ctx.requiredProviders, ctx.backend, ctx.tfStateKey);
         this.tfVarsJsonWriter = new WriterTfVarsJson(ctx.values, ctx.references);
@@ -361965,14 +362299,41 @@ class project_tf_TFProjectManager {
         this.stream.on('end', fnEnd);
     }
     async build() {
+        // If this context indicates a debug workspace, initialize debug artifacts
+        // early so files like cr.yaml/deps.yaml are present before build steps.
+        try {
+            terraform_provisioner_src_logger/* default.debug */.Z.debug(`[terraform-provisioner]: build() start - ctx.projectPath=${this.ctx?.projectPath} projectPath=${this.projectPath}`);
+            // eslint-disable-next-line @typescript-eslint/no-var-requires
+            const debug = __nccwpck_require__(16907);
+            await debug.initTfDebug(this.ctx);
+            terraform_provisioner_src_logger/* default.debug */.Z.debug(`[terraform-provisioner]: build() after initTfDebug - ctx.projectPath=${this.ctx?.projectPath} projectPath=${this.projectPath}`);
+        }
+        catch (e) {
+            // Best-effort; failures here should not block normal execution but
+            // emit a warning so operators know why debug artifacts may be absent.
+            terraform_provisioner_src_logger/* default.warn */.Z.warn(`[terraform-provisioner]: failed to init tf debug artifacts: ${e?.message ?? e}`);
+        }
         if (this.ctx?.reuseExistingProject) {
             if (!external_fs_.existsSync(this.projectPath)) {
                 throw new Error(`[terraform-provisioner]: Workspace reuse requested but projectPath does not exist: ${this.projectPath}. Cannot continue.`);
             }
+            try {
+                const entries = external_fs_.readdirSync(this.projectPath);
+                // Directory listing may contain user-supplied filenames; keep at debug level
+                // to avoid leaking sensitive names in normal info logs.
+                terraform_provisioner_src_logger/* default.debug */.Z.debug(`[terraform-provisioner]: reuse check - projectPath contents: ${JSON.stringify(entries)}`);
+            }
+            catch (e) {
+                terraform_provisioner_src_logger/* default.warn */.Z.warn(`[terraform-provisioner]: failed to read projectPath ${this.projectPath}: ${e}`);
+            }
             const expectedFiles = await computeInlineWorkspaceFiles(this.ctx);
+            // expectedFiles may include user-supplied paths; log at debug level only.
+            terraform_provisioner_src_logger/* default.debug */.Z.debug(`[terraform-provisioner]: reuse check - expected files: ${JSON.stringify(expectedFiles)}`);
             const missing = validateWorkspaceStructure(this.projectPath, expectedFiles);
+            // Missing files may reveal internal filenames; keep at debug level.
+            terraform_provisioner_src_logger/* default.debug */.Z.debug(`[terraform-provisioner]: reuse check - missing files: ${JSON.stringify(missing)}`);
             if (missing.length === 0) {
-                terraform_provisioner_src_logger.info(`[terraform-provisioner]: Reusing existing Inline workspace at ${this.projectPath}`);
+                terraform_provisioner_src_logger/* default.info */.Z.info(`[terraform-provisioner]: Reusing existing Inline workspace at ${this.projectPath}`);
                 // imports.tf is command-scoped: always (re)generate it for import commands after reuse validation.
                 if (this.onImport) {
                     const writerImports = new WriterImports(this.customArgs);
@@ -361985,7 +362346,7 @@ class project_tf_TFProjectManager {
             }
             throw new Error(`[terraform-provisioner]: Workspace reuse requested but missing required files: ${missing.join(', ')}. Cannot continue.`);
         }
-        terraform_provisioner_src_logger.info(`[terraform-provisioner]: Creating new Inline workspace at ${this.projectPath}`);
+        terraform_provisioner_src_logger/* default.info */.Z.info(`[terraform-provisioner]: Creating new Inline workspace at ${this.projectPath}`);
         await this.mainTfWriter.render();
         this.mainTfWriter.writeToTerraformProject(external_path_.join(this.projectPath, 'firestartr-main.tf'));
         await this.providerJsonWriter.render();
@@ -362056,13 +362417,13 @@ class project_tf_TFProjectManager {
         const addressesList = (await customCommand(this.projectPath, this.secrets, ['state', 'list'], this.stream))
             .split(/\n/)
             .filter((line) => line.replace(/\n|\s/g, ''));
-        terraform_provisioner_src_logger.info(`[terraform-provisioner]: destroyStateOnly: Obtained the addresses of the resources ${addressesList.join(',')}`);
+        terraform_provisioner_src_logger/* default.info */.Z.info(`[terraform-provisioner]: destroyStateOnly: Obtained the addresses of the resources ${addressesList.join(',')}`);
         if (addressesList.length > 0) {
             await customCommand(this.projectPath, this.secrets, ['state', 'rm'].concat(addressesList), this.stream);
-            terraform_provisioner_src_logger.info(`[terraform-provisioner]: destroyStateOnly: deleted from the state the following addresses ${addressesList.join(',')}`);
+            terraform_provisioner_src_logger/* default.info */.Z.info(`[terraform-provisioner]: destroyStateOnly: deleted from the state the following addresses ${addressesList.join(',')}`);
         }
         else {
-            terraform_provisioner_src_logger.info('[terraform-provisioner]: destroyStateOnly: warning the state is already empty, no destroy has taken place');
+            terraform_provisioner_src_logger/* default.info */.Z.info('[terraform-provisioner]: destroyStateOnly: warning the state is already empty, no destroy has taken place');
         }
         if (this.stream)
             this.stream.end();
@@ -362112,7 +362473,7 @@ async function initializeMirrors(repos = [...DEFAULT_MIRROR_WARMUP_LIST]) {
                     await onError(err);
                 }
                 else {
-                    terraform_provisioner_src_logger.error('[mirror] Refresher beforeRefresh error:', err);
+                    terraform_provisioner_src_logger/* default.error */.Z.error('[mirror] Refresher beforeRefresh error:', err);
                 }
                 return; // skip this tick if beforeRefresh fails
             }
@@ -362131,7 +362492,7 @@ async function initializeMirrors(repos = [...DEFAULT_MIRROR_WARMUP_LIST]) {
                         await onError(err);
                     }
                     else {
-                        terraform_provisioner_src_logger.error('[mirror] Refresher error:', err);
+                        terraform_provisioner_src_logger/* default.error */.Z.error('[mirror] Refresher error:', err);
                     }
                 }
             }
@@ -362335,7 +362696,7 @@ async function installMirrorForRepo(remoteUrl) {
             const headPath = external_path_default().join(mirrorPath, 'HEAD');
             await external_fs_promises_default().access(configPath);
             await external_fs_promises_default().access(headPath);
-            terraform_provisioner_src_logger.info(`[mirror] Mirror exists at ${mirrorPath}, refreshing...`);
+            terraform_provisioner_src_logger/* default.info */.Z.info(`[mirror] Mirror exists at ${mirrorPath}, refreshing...`);
             await refreshMirror(mirrorPath);
         }
         catch (e) {
@@ -362345,7 +362706,7 @@ async function installMirrorForRepo(remoteUrl) {
     else if (stat === null) {
         try {
             await external_fs_promises_default().mkdir(external_path_default().posix.dirname(mirrorPath), { recursive: true });
-            terraform_provisioner_src_logger.info(`[mirror] Cloning bare mirror from ${repoUrl} to ${mirrorPath}`);
+            terraform_provisioner_src_logger/* default.info */.Z.info(`[mirror] Cloning bare mirror from ${repoUrl} to ${mirrorPath}`);
             await gitCloneMirror(repoUrl, mirrorPath);
         }
         catch (e) {
@@ -362431,7 +362792,7 @@ async function refreshMirror(mirrorPath) {
     }
     // Run the actual refresher, which throws on failure
     await gitFetchPrune(mirrorPath);
-    terraform_provisioner_src_logger.debug(`[mirror] Mirror at ${mirrorPath} was successfully refreshed`);
+    terraform_provisioner_src_logger/* default.debug */.Z.debug(`[mirror] Mirror at ${mirrorPath} was successfully refreshed`);
 }
 // --- Spec 002-mirror-tfm-usage: Warmup support ---
 
@@ -362486,7 +362847,7 @@ async function resolveMirroredModuleSource(source) {
         return translateModuleSource(source);
     }
     catch (e) {
-        terraform_provisioner_src_logger.warn(`[mirror] Could not mirror ${repoUrl}; failing provisioning. Reason: ${e.message}`);
+        terraform_provisioner_src_logger/* default.warn */.Z.warn(`[mirror] Could not mirror ${repoUrl}; failing provisioning. Reason: ${e.message}`);
         throw e;
     }
 }
@@ -362602,10 +362963,14 @@ class TFProjectManagerRemote {
             ? external_path_.resolve(this.projectPath)
             : '';
         // Remove the entire workspace directory
+        // Never delete debug workspaces. Support both gh-debug (existing) and
+        // the new tf-debug workspace prefix.
         if (resolvedProjectPath &&
-            resolvedProjectPath.startsWith('/tmp/gh-debug/')) {
+            (resolvedProjectPath.startsWith('/tmp/gh-debug/') ||
+                resolvedProjectPath.startsWith('/tmp/tf-debug/') ||
+                process.env.FIRESTARTR_DEBUG === 'true')) {
             // Never delete debug workspaces, per spec.
-            terraform_provisioner_src_logger.info(`[terraform-provisioner]: SKIP teardown for debug workspace at ${this.projectPath}`);
+            terraform_provisioner_src_logger/* default.info */.Z.info(`[terraform-provisioner]: SKIP teardown for debug workspace at ${this.projectPath}`);
             return;
         }
         if (resolvedProjectPath &&
@@ -362616,7 +362981,7 @@ class TFProjectManagerRemote {
                     recursive: true,
                     force: true,
                 });
-                terraform_provisioner_src_logger.info(`[terraform-provisioner]: Workspace at ${resolvedProjectPath} torn up successfully`);
+                terraform_provisioner_src_logger/* default.info */.Z.info(`[terraform-provisioner]: Workspace at ${resolvedProjectPath} torn up successfully`);
             }
             catch (e) {
                 throw new Error(`[terraform-provisioner]: Failed to tear up local project at ${this.projectPath}: ${e}`);
@@ -362663,6 +363028,18 @@ class TFProjectManagerRemote {
         this.stream.on('end', fnEnd);
     }
     async build() {
+        // If this context indicates a debug workspace, initialize debug artifacts
+        // early so files like cr.yaml/deps.yaml are present before build steps.
+        try {
+            // eslint-disable-next-line @typescript-eslint/no-var-requires
+            const debug = __nccwpck_require__(16907);
+            await debug.initTfDebug(this.ctx);
+        }
+        catch (e) {
+            // Best-effort; failures here should not block normal execution but
+            // emit a warning so operators know why debug artifacts may be absent.
+            terraform_provisioner_src_logger/* default.warn */.Z.warn(`[terraform-provisioner]: failed to init tf debug artifacts: ${e?.message ?? e}`);
+        }
         // Workspace reuse block for remote
         if (this.ctx?.reuseExistingProject) {
             if (!external_fs_.existsSync(this.projectPath)) {
@@ -362671,7 +363048,7 @@ class TFProjectManagerRemote {
             const expectedFiles = await computeRemoteWorkspaceFiles(this.ctx);
             const missing = validateWorkspaceStructure(this.projectPath, expectedFiles);
             if (missing.length === 0) {
-                terraform_provisioner_src_logger.info(`[terraform-provisioner]: Reusing existing Remote workspace at ${this.projectPath}`);
+                terraform_provisioner_src_logger/* default.info */.Z.info(`[terraform-provisioner]: Reusing existing Remote workspace at ${this.projectPath}`);
                 // imports.tf is command-scoped: always (re)generate it for import commands after reuse validation.
                 if (this.onImport) {
                     const writerImports = new WriterImports(this.customArgs);
@@ -362684,7 +363061,7 @@ class TFProjectManagerRemote {
             }
             throw new Error(`[terraform-provisioner]: Workspace reuse requested but missing required files: ${missing.join(', ')}. Cannot continue.`);
         }
-        terraform_provisioner_src_logger.info(`[terraform-provisioner]: Creating new Remote workspace at ${this.projectPath}`);
+        terraform_provisioner_src_logger/* default.info */.Z.info(`[terraform-provisioner]: Creating new Remote workspace at ${this.projectPath}`);
         external_fs_.rmSync(this.projectPath, { recursive: true, force: true });
         await configGit();
         await this.__initFromModule();
@@ -362761,13 +363138,13 @@ class TFProjectManagerRemote {
         const addressesList = (await customCommand(this.projectPath, this.secrets, ['state', 'list'], this.stream))
             .split(/\n/)
             .filter((line) => line.replace(/\n|\s/g, ''));
-        terraform_provisioner_src_logger.info(`[terraform-provisioner]: destroyStateOnly: Obtained the addresses of the resources ${addressesList.join(',')}`);
+        terraform_provisioner_src_logger/* default.info */.Z.info(`[terraform-provisioner]: destroyStateOnly: Obtained the addresses of the resources ${addressesList.join(',')}`);
         if (addressesList.length > 0) {
             await customCommand(this.projectPath, this.secrets, ['state', 'rm'].concat(addressesList), this.stream);
-            terraform_provisioner_src_logger.info(`[terraform-provisioner]: destroyStateOnly: deleted from the state the following addresses ${addressesList.join(',')}`);
+            terraform_provisioner_src_logger/* default.info */.Z.info(`[terraform-provisioner]: destroyStateOnly: deleted from the state the following addresses ${addressesList.join(',')}`);
         }
         else {
-            terraform_provisioner_src_logger.info('[terraform-provisioner]: destroyStateOnly: warning the state is already empty, no destroy has taken place');
+            terraform_provisioner_src_logger/* default.info */.Z.info('[terraform-provisioner]: destroyStateOnly: warning the state is already empty, no destroy has taken place');
         }
         if (this.stream)
             this.stream.end();
@@ -362840,7 +363217,7 @@ async function run() {
 }
 // Programatic API
 async function runTerraformProvisioner(context, command = 'init', streaming, customArgs, ctl) {
-    terraform_provisioner_src_logger.info(`Running command ${command} on a ${context.type} project`);
+    terraform_provisioner_src_logger/* default.info */.Z.info(`Running command ${command} on a ${context.type} project`);
     validateContext(context);
     let tfProject = {};
     if (context.type === 'Inline') {
@@ -362866,7 +363243,7 @@ async function runTerraformProvisioner(context, command = 'init', streaming, cus
             tfProject.context.importMode = true;
     }
     if (command === 'destroy-state-only') {
-        terraform_provisioner_src_logger.info('[gh-provisioner] WARNING! is a destroy-state-only');
+        terraform_provisioner_src_logger/* default.info */.Z.info('[gh-provisioner] WARNING! is a destroy-state-only');
     }
     if (ctl) {
         tfProject.ctl = ctl;
@@ -362875,7 +363252,7 @@ async function runTerraformProvisioner(context, command = 'init', streaming, cus
     return output;
 }
 async function execCommand(command, tfProject) {
-    terraform_provisioner_src_logger.info(`Executing command ${command} on ${tfProject.projectPath}`);
+    terraform_provisioner_src_logger/* default.info */.Z.info(`Executing command ${command} on ${tfProject.projectPath}`);
     // Handle no-build commands FIRST
     if (command === 'tear-up-project') {
         if (tfProject.tearUpProject) {
@@ -362937,6 +363314,28 @@ function operatorProfile() {
     return github["default"].withProfile('operator');
 }
 
+function resolveProgressCommentResource(item) {
+    return { kind: item.kind, name: item.metadata?.name ?? 'unknown' };
+}
+/**
+ * Single builder of the sticky base kind shared by the apply progress
+ * comment (upserted by the check run while the operation runs) and the
+ * final result publisher (which updates that same comment in place).
+ * Keyed per resource so claims of the same kind never overwrite each
+ * other's feedback.
+ */
+function progressCommentBaseKind(cmd, item) {
+    const { kind, name } = resolveProgressCommentResource(item);
+    return `${cmd}:${kind}:${name}`;
+}
+/**
+ * Body of the apply progress comment. The check-run module appends the
+ * `[here](<check-run-url>)` link to it.
+ */
+function progressCommentText(cmd, item) {
+    const { kind, name } = resolveProgressCommentResource(item);
+    return `The ${kind} '${name}' is being processed (cmd=${cmd}). Details: `;
+}
 async function tryPublishApply(item, planOutput, isSuccess = true, exitCode) {
     const kind = item.kind;
     const metadataName = item.metadata?.name ?? 'unknown';
@@ -362990,7 +363389,7 @@ ${commentContent}
             owner: org,
             repo,
             pullNumber: prNumber,
-            baseKind: `${kind.toLowerCase()}:destroy`,
+            baseKind: progressCommentBaseKind('destroy', item),
             bodies: commentBodies,
         });
         operator_src_logger.debug(`The user feedback for the '${item.kind}/${item.metadata.name}' destroy operation has been published as a comment on pull request '${prNumber}'.`);
@@ -363027,7 +363426,7 @@ ${commentContent}
         owner: org,
         repo,
         pullNumber: prNumber,
-        baseKind: `apply:${kind}`,
+        baseKind: progressCommentBaseKind('apply', item),
         bodies: commentBodies,
     });
 }
@@ -363128,93 +363527,6 @@ ${commentContent}
     }
 }
 
-;// CONCATENATED MODULE: ../operator/src/tfworkspaces/policies.ts
-
-
-
-function policyAllowsOp(policy, op, item) {
-    let msg = '';
-    const foundPolicy = catalog_common/* default.policies.getPolicyByName */.Z.policies.getPolicyByName(policy);
-    if (op === OperationType.RETRY.toString() &&
-        foundPolicy?.allowedOps.includes(op)) {
-        if ('deletionTimestamp' in item.metadata && 'full-control' !== policy) {
-            msg = `A RETRY operation is not allowed on a resource with a deletionTimestamp. It means
-that the resource is being deleted and it is not possible to retry the operation with policy: ${policy}.
-
-To fix this issue, you must first delete the "firestartr.dev/finalizer" from finalizers array in the resource manifest,
-it will be automatically deleted by Kubernetes. Terraform will not execute any operation on the resource.
-`;
-            return { allowed: false, msg };
-        }
-        else {
-            return { allowed: true, msg };
-        }
-    }
-    if (op === OperationType.RETRY_SYNC.toString() &&
-        foundPolicy?.allowedOps.includes(OperationType.SYNC.toString())) {
-        if ('deletionTimestamp' in item.metadata && 'full-control' !== policy) {
-            msg = `A RETRY_SYNC operation is not allowed on a resource with a deletionTimestamp. It means
-that the resource is being deleted and it is not possible to retry the operation with policy: ${policy}.
-
-To fix this issue, you must first delete the "firestartr.dev/finalizer" from finalizers array in the resource manifest,
-it will be automatically deleted by Kubernetes. Terraform will not execute any operation on the resource.
-`;
-            return { allowed: false, msg };
-        }
-        return { allowed: true, msg };
-    }
-    if (!foundPolicy) {
-        msg = `Policy ${policy} not found`;
-        return { allowed: false, msg };
-    }
-    const allowed = foundPolicy.allowedOps.includes(op);
-    if (!allowed) {
-        msg = searchAllowedPolicies(op, policy);
-    }
-    return { allowed, msg };
-}
-function searchAllowedPolicies(op, policy) {
-    const allowedPolicies = [];
-    for (const policy of catalog_common/* default.policies.FIRESTARTR_POLICIES */.Z.policies.FIRESTARTR_POLICIES) {
-        if (policy.allowedOps.includes(op)) {
-            allowedPolicies.push(policy.name);
-        }
-    }
-    let policies = '';
-    if (allowedPolicies.length > 0) {
-        policies = allowedPolicies.join(', ');
-    }
-    return `
-    
-Operation ${op} not allowed by policy \`${policy}\`, to allow this operation,
-
-switch to one of the following policies: \`${policies}\`
-
-`;
-}
-async function* errorPolicyCompatibility(syncPolicy, generalPolicy, item, op) {
-    const message = `Conflict: 'sync-policy': ${syncPolicy} and 'policy': ${generalPolicy} are not compatible`;
-    for (const typeStatus of [
-        ['ERROR', 'True'],
-        ['PROVISIONED', 'False'],
-        ['PROVISIONING', 'False'],
-        ['OUT_OF_SYNC', 'False'],
-        ['DELETED', 'False'],
-        ['PLANNING', 'False'],
-        ['DELETING', 'False'],
-    ]) {
-        const [type, status] = typeStatus;
-        yield {
-            item,
-            reason: op,
-            type,
-            status,
-            message,
-        };
-    }
-    await tryPublishError(item, op, message);
-}
-
 ;// CONCATENATED MODULE: ../operator/src/user-feedback-ops/tf-checkrun.ts
 
 
@@ -363227,7 +363539,12 @@ async function TFCheckRun(cmd, item) {
         const prInfo = extractPrInfo(item);
         const checkRun = await tf_checkrun_operatorProfile().feedback.createCheckRun(prInfo.org, prInfo.repo, helperCreateCheckRunName(cmd, item), {
             pullNumber: Number(prInfo.prNumber),
-            // check-run comments removed: redundant with native checks widget (#1985)
+            // Apply progress comment: the result publisher updates this same
+            // comment in place when the operation ends (shared sticky base
+            // kind keyed per resource).
+            includeCheckRunComment: true,
+            checkRunComment: progressCommentText(cmd, item),
+            stickyCommentBaseKind: progressCommentBaseKind(cmd, item),
         });
         checkRun.mdOptionsDetails({
             quotes: 'terraform',
@@ -363325,6 +363642,93 @@ function extractErrorDetails(error) {
     return { output: String(error), exitCode };
 }
 
+;// CONCATENATED MODULE: ../operator/src/tfworkspaces/policies.ts
+
+
+
+function policyAllowsOp(policy, op, item) {
+    let msg = '';
+    const foundPolicy = catalog_common/* default.policies.getPolicyByName */.Z.policies.getPolicyByName(policy);
+    if (op === OperationType.RETRY.toString() &&
+        foundPolicy?.allowedOps.includes(op)) {
+        if ('deletionTimestamp' in item.metadata && 'full-control' !== policy) {
+            msg = `A RETRY operation is not allowed on a resource with a deletionTimestamp. It means
+that the resource is being deleted and it is not possible to retry the operation with policy: ${policy}.
+
+To fix this issue, you must first delete the "firestartr.dev/finalizer" from finalizers array in the resource manifest,
+it will be automatically deleted by Kubernetes. Terraform will not execute any operation on the resource.
+`;
+            return { allowed: false, msg };
+        }
+        else {
+            return { allowed: true, msg };
+        }
+    }
+    if (op === OperationType.RETRY_SYNC.toString() &&
+        foundPolicy?.allowedOps.includes(OperationType.SYNC.toString())) {
+        if ('deletionTimestamp' in item.metadata && 'full-control' !== policy) {
+            msg = `A RETRY_SYNC operation is not allowed on a resource with a deletionTimestamp. It means
+that the resource is being deleted and it is not possible to retry the operation with policy: ${policy}.
+
+To fix this issue, you must first delete the "firestartr.dev/finalizer" from finalizers array in the resource manifest,
+it will be automatically deleted by Kubernetes. Terraform will not execute any operation on the resource.
+`;
+            return { allowed: false, msg };
+        }
+        return { allowed: true, msg };
+    }
+    if (!foundPolicy) {
+        msg = `Policy ${policy} not found`;
+        return { allowed: false, msg };
+    }
+    const allowed = foundPolicy.allowedOps.includes(op);
+    if (!allowed) {
+        msg = searchAllowedPolicies(op, policy);
+    }
+    return { allowed, msg };
+}
+function searchAllowedPolicies(op, policy) {
+    const allowedPolicies = [];
+    for (const policy of catalog_common/* default.policies.FIRESTARTR_POLICIES */.Z.policies.FIRESTARTR_POLICIES) {
+        if (policy.allowedOps.includes(op)) {
+            allowedPolicies.push(policy.name);
+        }
+    }
+    let policies = '';
+    if (allowedPolicies.length > 0) {
+        policies = allowedPolicies.join(', ');
+    }
+    return `
+    
+Operation ${op} not allowed by policy \`${policy}\`, to allow this operation,
+
+switch to one of the following policies: \`${policies}\`
+
+`;
+}
+async function* errorPolicyCompatibility(syncPolicy, generalPolicy, item, op) {
+    const message = `Conflict: 'sync-policy': ${syncPolicy} and 'policy': ${generalPolicy} are not compatible`;
+    for (const typeStatus of [
+        ['ERROR', 'True'],
+        ['PROVISIONED', 'False'],
+        ['PROVISIONING', 'False'],
+        ['OUT_OF_SYNC', 'False'],
+        ['DELETED', 'False'],
+        ['PLANNING', 'False'],
+        ['DELETING', 'False'],
+    ]) {
+        const [type, status] = typeStatus;
+        yield {
+            item,
+            reason: op,
+            type,
+            status,
+            message,
+        };
+    }
+    await tryPublishError(item, op, message);
+}
+
 ;// CONCATENATED MODULE: ../operator/src/tfworkspaces/process-operation.ts
 
 
@@ -363337,11 +363741,36 @@ function extractErrorDetails(error) {
 
 
 
+
 const TF_PROJECTS_PATH = '/tmp/tfworkspaces';
 const TF_CACHES_PATH = '/tmp/tfcaches';
 function generateSessionId() {
     return Math.random().toString(36).substring(2, 6).padEnd(4, '0');
 }
+// Recursively copy session workspace to debugPath (best-effort)
+async function copyDir(src, dest) {
+    await promises_.mkdir(dest, { recursive: true });
+    const entries = await promises_.readdir(src, { withFileTypes: true });
+    for (const e of entries) {
+        const s = external_path_.join(src, e.name);
+        const d = external_path_.join(dest, e.name);
+        if (e.isDirectory()) {
+            await copyDir(s, d);
+        }
+        else if (e.isSymbolicLink()) {
+            try {
+                const link = await promises_.readlink(s);
+                await promises_.symlink(link, d);
+            }
+            catch (err) {
+                // ignore symlink copy failures
+            }
+        }
+        else {
+            await promises_.copyFile(s, d);
+        }
+    }
+}
 async function tearUpSessionWorkspace(item, deps, sessionId, failureContext) {
     try {
         const context = buildProvisionerContext(item, deps, sessionId);
@@ -363733,6 +364162,9 @@ async function* process_operation_sync(item, op, handler, syncPolicy, generalPol
     }
 }
 async function* process_operation_markedToDeletion(item, op, handler) {
+    // Apply progress comment: announces the destroy on the wet-repo PR and
+    // streams its output; the result publisher updates it in place at the end.
+    const checkRunCtl = await TFCheckRun('destroy', item);
     let error = false;
     let deps;
     let terraformExecutionStarted = false;
@@ -363797,7 +364229,7 @@ async function* process_operation_markedToDeletion(item, op, handler) {
         deps = await handler.resolveReferences();
         const context = buildProvisionerContext(item, deps, sessionId);
         terraformExecutionStarted = true;
-        const destroyOutput = await runTerraformProvisioner(context, 'destroy', null, undefined, {
+        const destroyOutput = await runTerraformProvisioner(context, 'destroy', checkRunCtl, undefined, {
             tfCacheDir: external_path_.join(TF_CACHES_PATH, `slot_${handler.getSlotInfo().slotId}`),
             hardTimeout: handler.recommendedTimeout(),
             processKilled: (killed) => {
@@ -363834,6 +364266,7 @@ async function* process_operation_markedToDeletion(item, op, handler) {
     catch (e) {
         error = true;
         const { output: errorMsg } = extractErrorDetails(e);
+        checkRunCtl.fnOnError(errorMsg);
         await tryPublishDestroy(item, errorMsg, false);
         await handler.writeTerraformOutputInTfResult(item, errorMsg, 1);
         if (item.metadata.annotations['firestartr.dev/last-state-pr'] || false) {
@@ -363943,6 +364376,7 @@ async function* doApply(item, op, handler) {
         operator_src_logger.info(`The Terraform processor is applying and assessing dependencies for item '${item.kind}/${item.metadata.name}' with dependencies: '${deps}'.`);
         const context = buildProvisionerContext(item, deps, sessionId);
         terraformExecutionStarted = true;
+        operator_src_logger.info(`[operator]: runTerraformProvisioner apply - projectPath=${context.projectPath} reuseExistingProject=${context.reuseExistingProject}`);
         const applyOutput = await runTerraformProvisioner(context, 'apply', checkRunCtl, undefined, {
             tfCacheDir: external_path_.join(TF_CACHES_PATH, `slot_${handler.getSlotInfo().slotId}`),
             hardTimeout: handler.recommendedTimeout(),
@@ -363955,7 +364389,70 @@ async function* doApply(item, op, handler) {
                 }
             },
         });
+        // If tf-debug annotation is present, create a snapshot copy of the
+        // session-scoped workspace into the deterministic debug folder. We do
+        // this as a best-effort, non-fatal operation so debug artifacts are
+        // available for inspection without interfering with the reuse flow.
+        try {
+            const tfDebug = item && item.metadata && item.metadata.annotations
+                ? item.metadata.annotations['firestartr.dev/tf-debug']
+                : undefined;
+            if (sessionId && tfDebug === '1' && context.projectPath) {
+                const rawName = item.metadata.name;
+                const baseName = rawName.replace(/-[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/, // strip uuid
+                '');
+                const tfStateKey = context.tfStateKey ||
+                    item?.spec?.firestartr?.tfStateKey;
+                const safeKey = tfStateKey
+                    ? String(tfStateKey).replace(/\//g, '-')
+                    : '';
+                const debugPath = external_path_.join('/tmp/tf-debug', `${item.kind.toLowerCase()}-${baseName}${safeKey ? `-${safeKey}` : ''}`);
+                // If the session workspace is already the deterministic debugPath,
+                // do not remove or copy it (that would delete the freshly-created
+                // workspace). Instead, just ensure the debug artifacts folder exists
+                // and write the metadata files there. When the source and target are
+                // different, perform a best-effort copy as before.
+                const srcPath = context.projectPath;
+                try {
+                    if (srcPath && external_path_.resolve(srcPath) === external_path_.resolve(debugPath)) {
+                        const debugArtifactsDir = external_path_.join(debugPath, 'tf_provisioner_debug');
+                        await promises_.mkdir(debugArtifactsDir, { recursive: true });
+                        await promises_.writeFile(external_path_.join(debugArtifactsDir, 'cr.yaml'), catalog_common/* default.io.toYaml */.Z.io.toYaml(item));
+                        await promises_.writeFile(external_path_.join(debugArtifactsDir, 'deps.yaml'), catalog_common/* default.io.toYaml */.Z.io.toYaml(deps));
+                        operator_src_logger.info(`[operator]: debug snapshot preserved at ${debugPath}`);
+                    }
+                    else {
+                        // Remove any previous debug snapshot; ignore failures
+                        try {
+                            await promises_.rm(debugPath, { recursive: true, force: true });
+                        }
+                        catch (e) {
+                            operator_src_logger.warn(`Failed to remove existing debug path ${debugPath}: ${e}`);
+                        }
+                        try {
+                            if (srcPath)
+                                await copyDir(srcPath, debugPath);
+                            const debugArtifactsDir = external_path_.join(debugPath, 'tf_provisioner_debug');
+                            await promises_.mkdir(debugArtifactsDir, { recursive: true });
+                            await promises_.writeFile(external_path_.join(debugArtifactsDir, 'cr.yaml'), catalog_common/* default.io.toYaml */.Z.io.toYaml(item));
+                            await promises_.writeFile(external_path_.join(debugArtifactsDir, 'deps.yaml'), catalog_common/* default.io.toYaml */.Z.io.toYaml(deps));
+                            operator_src_logger.info(`[operator]: debug snapshot created at ${debugPath}`);
+                        }
+                        catch (e) {
+                            operator_src_logger.warn(`[operator]: failed to snapshot debug workspace: ${e}`);
+                        }
+                    }
+                }
+                catch (e) {
+                    operator_src_logger.warn(`[operator]: debug snapshot flow failed: ${e}`);
+                }
+            }
+        }
+        catch (e) {
+            operator_src_logger.warn(`[operator]: debug snapshot flow failed: ${e}`);
+        }
         context.reuseExistingProject = true;
+        operator_src_logger.info(`[operator]: runTerraformProvisioner output - projectPath=${context.projectPath} reuseExistingProject=${context.reuseExistingProject}`);
         const terraformOutputJson = await runTerraformProvisioner(context, 'output');
         if (!terraformOutputJson) {
             throw new Error(`Terraform output is empty for ${item.kind}/${item.metadata.name}`);
@@ -364111,6 +364608,16 @@ function buildProvisionerContext(item, deps, sessionId) {
     if (typeof tfStateKey !== 'string' || tfStateKey.trim() === '') {
         throw new Error(`Invalid terraform state key: ${tfStateKey}`);
     }
+    // Preserve the raw CR and resolved dependencies on the context so provisioners
+    // can emit debug artifacts when requested. This is intentionally additive
+    // and does not change the public runTerraformProvisioner API shape.
+    context['rawCr'] = item;
+    context['deps'] = deps;
+    // Always use a session-scoped projectPath for apply/plan/etc when a
+    // sessionId is provided. Do not hand the deterministic debug path to the
+    // provisioner; instead, the operator will perform a copy to /tmp/tf-debug
+    // after apply if the tf-debug annotation is present. This avoids races and
+    // accidental deletion of debug folders during the provisioner lifecycle.
     if (sessionId) {
         context['projectPath'] = external_path_.join(TF_PROJECTS_PATH, `${item.kind.toLowerCase()}-${item.metadata.name}-${sessionId}`);
     }
@@ -366511,13 +367018,17 @@ function providers_replaceInlineSecrets(inline, secrets) {
 const DEBUG_DIR = external_path_default().join(external_os_default().tmpdir(), 'gh-debug');
 // Returns the project path to use for debug artifacts (always SessionProjectPath for consistency)
 function getDebugProjectPath(entity) {
-    // Use the sessionProjectPath, which now always includes the 4-character sessionId
+    // Use the sessionProjectPath if present. sessionProjectPath will include
+    // the tfStateKey suffix when in debug mode, as set by runGhProvisioner.
     return (entity.sessionProjectPath ||
         external_path_default().join(DEBUG_DIR, entity.k8sId.replace(/\//, '-') + '-id_missing'));
 }
 async function initDebug(entity, deps) {
-    // Clean only this session's project debug directory, NOT all debug workspaces
-    // Only create the specific debug project path for this session; never remove in debug mode
+    // If a previous deterministic debug folder exists for this resource, wipe it
+    // We intentionally remove only the per-claim debug folder (the whole folder)
+    // to ensure a fresh debug run and avoid accumulating files between runs.
+    await (0,promises_namespaceObject.rm)(getDebugProjectPath(entity), { recursive: true, force: true });
+    // Create the (fresh) project path and debug artifacts dir
     await (0,promises_namespaceObject.mkdir)(getDebugProjectPath(entity), { recursive: true });
     const debugArtifactsDir = external_path_default().join(getDebugProjectPath(entity), 'gh_provisioner_debug');
     await (0,promises_namespaceObject.mkdir)(debugArtifactsDir, { recursive: true });
@@ -367440,9 +367951,21 @@ async function runGhProvisioner(data, opts) {
     try {
         entity = await initSystem(data.mainCr, data.deps);
         // Generate per-execution sessionId and session projectPath
+        // For debug mode we want a deterministic per-resource folder (no random suffix)
+        // Use the resource's tfStateKey when present for stability, otherwise fall
+        // back to metadata UID-like deterministic id stored on the CR name/fields.
         sessionId = generateSessionId();
         if (entity.inDebugMode) {
-            sessionProjectPath = `/tmp/gh-debug/${entity.cr.kind.toLowerCase()}-${entity.cr.name}-${sessionId}`;
+            // Use deterministic per-resource folder under /tmp/gh-debug. Include
+            // the tfStateKey as a suffix when available to avoid collisions for
+            // resources (like features) that share a human-friendly name.
+            const rawName = entity.cr.name;
+            const baseName = rawName.replace(/-[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/, '');
+            const tfStateKey = entity.cr?.spec?.firestartr?.tfStateKey;
+            const safeKey = typeof tfStateKey === 'string' && tfStateKey.trim() !== ''
+                ? tfStateKey
+                : null;
+            sessionProjectPath = `/tmp/gh-debug/${entity.cr.kind.toLowerCase()}-${baseName}${safeKey ? `-${safeKey}` : ''}`;
         }
         else {
             sessionProjectPath = `/tmp/gh-workspaces/${entity.cr.kind.toLowerCase()}-${entity.cr.name}-${sessionId}`;
@@ -368440,6 +368963,11 @@ async function* gh_process_operation_markedToDeletion(item, op, handler) {
         // we close it with an error
         if (checkRunCtl)
             checkRunCtl.fnOnError(errorMsg);
+        // also close the Terraform check run: its periodic flush would
+        // otherwise keep rewriting the apply progress comment after the
+        // final destroy result is published
+        if (checkRunTFCtl)
+            checkRunTFCtl.fnOnError(errorMsg);
         await tryPublishDestroy(item, errorMsg, false);
         await handler.writeTerraformOutputInTfResult(item, errorMsg, errCode ?? 1);
         void handler.error();
@@ -368694,10 +369222,18 @@ async function tfPlanner(claimFilePath, claim, namespace, debug, jobTtl = 300, c
     job.spec.ttlSecondsAfterFinished = jobTtl;
     job.spec.template = controllerDeploy.spec.template;
     job.spec.template.spec.containers[0].image = withToolImageTag(job.spec.template.spec.containers[0].image, toolImageTag);
-    // set activeDeadlineSeconds to force terminate jobs that exceed this time
-    // see https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup
-    job.spec.activeDeadlineSeconds = 3600;
+    if (!debug) {
+        // set activeDeadlineSeconds to force terminate jobs that exceed this time
+        // see https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup
+        job.spec.activeDeadlineSeconds = 3600;
+    }
     job.spec.template.spec.containers[0].env = [{ name: 'CI', value: 'True' }];
+    if (debug) {
+        job.spec.template.spec.containers[0].env.push({
+            name: 'FIRESTARTR_DEBUG',
+            value: 'true',
+        });
+    }
     job.spec.template.spec.containers[0].command = [
         'sh',
         '-c',
@@ -368705,7 +369241,7 @@ async function tfPlanner(claimFilePath, claim, namespace, debug, jobTtl = 300, c
     ];
     if (debug) {
         job.spec.template.spec.containers[0].command[2] =
-            job.spec.template.spec.containers[0].command[2].concat(' || tail -f /dev/null');
+            job.spec.template.spec.containers[0].command[2].concat(' ; tail -f /dev/null');
     }
     job.spec.template.spec.restartPolicy = 'Never';
     job.metadata = metadata;
@@ -368720,7 +369256,7 @@ async function tfPlanner(claimFilePath, claim, namespace, debug, jobTtl = 300, c
         ctlCleanUp: () => cleanUp(namespace, metadata.name),
     });
     await batchV1Api.createNamespacedJob({ namespace, body: job });
-    await copyClaimAndGetLogs(namespace, job.metadata.name, claimFilePath);
+    await copyClaimAndGetLogs(namespace, job.metadata.name, claimFilePath, debug);
 }
 async function cleanUp(namespace, jobName) {
     try {
@@ -368731,7 +369267,7 @@ async function cleanUp(namespace, jobName) {
         await batchV1Api.deleteNamespacedJob({
             name: jobName,
             namespace,
-            gracePeriodSeconds: 1 * 60,
+            gracePeriodSeconds: 0,
             propagationPolicy: 'Foreground',
         });
     }
@@ -368744,7 +369280,7 @@ async function cleanUp(namespace, jobName) {
         console.error(cleanError);
     }
 }
-async function copyClaimAndGetLogs(namespace, jobName, sourcePath) {
+async function copyClaimAndGetLogs(namespace, jobName, sourcePath, skipLogs = false) {
     const { kc } = await getConnection();
     const k8sApi = kc.makeApiClient(client.CoreV1Api);
     const logStream = new stream.PassThrough();
@@ -368786,6 +369322,10 @@ async function copyClaimAndGetLogs(namespace, jobName, sourcePath) {
     console.log('Copying claim to pod');
     await kubectlCp(sourcePath, namespace, pod.metadata.name);
     console.log('Claim copied to pod');
+    if (skipLogs) {
+        console.log('Debug mode: skipping log streaming');
+        return;
+    }
     try {
         const logClient = new client.Log(kc);
         await new Promise((resolve, reject) => {
@@ -713423,7 +713963,7 @@ const crsStatusSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = JSON.parse('{"i8":"2.11.0-snapshot-import-filter-fix-2"}');
+const package_namespaceObject = JSON.parse('{"i8":"2.11.0-snapshot-feature-git-traceability-1"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"i8":"2.10.0"};
 // EXTERNAL MODULE: ../../node_modules/semver/index.js