@firestartr/cli 2.11.0-snapshot-patches-patch-claims-1 → 2.11.0-snapshot-features-traceability-00

package/build/index.js

@@ -128395,7 +128395,7 @@ function trasformLeg(leg) {
 
 
 function getFeatureRenderedPathForEntity(entity, featureName, basePath = '/tmp') {
-    const entityFolderName = `${entity.metadata?.name ?? entity.name}`.toLowerCase();
+    const entityFolderName = `${entity.metadata.name}`.toLowerCase();
     return external_path_default().join(basePath, entityFolderName, featureName);
 }
 function getFeatureRenderedConfigForComponent(entity, featureName, basePath = '/tmp/features') {
@@ -164379,6 +164379,771 @@ const base_secrets_schema = 'firestartr.dev://common/SecretsClaim';
     SecretsClaimSchema: base_secrets_schema,
 });
 
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/lazy_loader.ts
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+// We need to ensure the grep command is a gnu version
+let IS_GNU_GREP = false;
+let GREP_ON_CHECK = false;
+// this loop is for avoid race conditions
+// once a check is running no more checks
+async function waitForCheck() {
+    const f_wait = () => new Promise((timeOut) => setTimeout(timeOut, 10));
+    do {
+        await f_wait();
+    } while (GREP_ON_CHECK);
+}
+function checkGrep() {
+    return new Promise((ok, ko) => {
+        // idempotency: already checked
+        if (IS_GNU_GREP)
+            return ok();
+        // a check is already running no new checks
+        if (GREP_ON_CHECK)
+            return waitForCheck();
+        logger.info('Checking the grep command');
+        GREP_ON_CHECK = true;
+        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['--version']);
+        handler.on('close', (code) => {
+            GREP_ON_CHECK = false;
+            if (code === 0) {
+                logger.debug('Grep is a gnu grep');
+                IS_GNU_GREP = true;
+                ok();
+            }
+            else {
+                ko('Lazy evaluation needs a gnu-grep command');
+            }
+        });
+    });
+}
+async function loadClaim(claimRef, org, defaults = loadClaimDefaults(), patchClaim = loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, existingRefs = {}, postValidations = new Map()) {
+    await checkGrep();
+    let result = existingRefs;
+    logger.info(`Load reference ${claimRef}`);
+    initVirtualClaims(org);
+    logger.info(`Load reference (parts) ${claimRef.split(/-/)[0]} ${claimRef.replace(/^[^-]+-/, '')}`);
+    // cargas datos con grep
+    try {
+        const claimData = await lazyGetClaim(claimRef.split(/-/)[0], claimRef.replace(/^[^-]+-/, ''), org, cwd);
+        const claim = patchClaim(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(claimData), defaults);
+        let variants = [];
+        if (claim.kind === 'TFWorkspaceClaim' &&
+            claim.providers?.terraform?.variants) {
+            variants = claim.providers.terraform.variants;
+            delete claim.providers.terraform.variants;
+        }
+        logger.silly(`Patched claim is:
+		 ---
+			${catalog_common/* default.io.toYaml */.Z.io.toYaml(claim)}`);
+        try {
+            validateClaim(claim, base[`${claim.kind}Schema`]);
+            await optionalValidation(claim);
+        }
+        catch (error) {
+            let errorMsg = '';
+            if (Array.isArray(error)) {
+                for (const data of error) {
+                    errorMsg = `${errorMsg}
+  - ${data.instancePath}: ${data.message}`;
+                }
+            }
+            else {
+                errorMsg = error instanceof Error ? error.message : String(error);
+            }
+            throw new Error(`Error when validating claim ${claimRef}: ${errorMsg}`);
+        }
+        result[claimRef] = {};
+        result[claimRef]['claim'] = claim;
+        result[claimRef]['claimPath'] = VisitedClaims[claimRef];
+        if (VisitedClaims[claimRef] === 'virtual') {
+            result = await setVirtualClaimAdditionalData(result, claim, claimRef);
+        }
+        else {
+            result = await setNonVirtualClaimAdditionalData(result, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
+        }
+        const claimKind = claim.kind;
+        const references = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(claim));
+        for (const ref of references) {
+            if (!result[ref]) {
+                const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
+                result = lodash_default().merge(result, resolvedReferences);
+            }
+        }
+        if (variants.length > 0) {
+            const parentClaimPath = VisitedClaims[claimRef];
+            for (const variant of variants) {
+                if (!variant.name || !variant.overrides) {
+                    throw new Error(`Variant in claim ${claimRef} is missing required field 'name' or 'overrides'`);
+                }
+                const prohibitedOverrideFields = ['source', 'module', 'name'];
+                for (const field of prohibitedOverrideFields) {
+                    if (field in variant.overrides) {
+                        throw new Error(`Variant '${variant.name}' in claim ${claimRef} cannot override '${field}'`);
+                    }
+                }
+                const composedName = claim.providers.terraform.name + '-' + variant.name;
+                const variantClaim = lodash_default().cloneDeep(claim);
+                variantClaim._parentClaimName = claim.name;
+                variantClaim.name = composedName;
+                variantClaim.providers.terraform = lodash_default().merge({}, claim.providers.terraform, variant.overrides);
+                variantClaim.providers.terraform.name = composedName;
+                if (!variantClaim.annotations) {
+                    variantClaim.annotations = {};
+                }
+                variantClaim.annotations['firestartr.dev/variant-of'] =
+                    claim.providers.terraform.name;
+                const variantRef = `TFWorkspaceClaim-${composedName}`;
+                if (result[variantRef]) {
+                    throw new Error(`Variant name '${variant.name}' (composed: '${composedName}') from claim '${claimRef}' conflicts with existing claim '${variantRef}'`);
+                }
+                logger.info(`Creating synthetic variant claim ${variantRef}`);
+                result[variantRef] = {};
+                result[variantRef]['claim'] = variantClaim;
+                result[variantRef]['claimPath'] = parentClaimPath;
+                result = await setNonVirtualClaimAdditionalData(result, variantClaim, variantRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
+                const variantReferences = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(variantClaim));
+                for (const ref of variantReferences) {
+                    if (!result[ref]) {
+                        const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
+                        result = lodash_default().merge(result, resolvedReferences);
+                    }
+                }
+            }
+        }
+    }
+    catch (err) {
+        throw `Lazy Loading: ${err}`;
+    }
+    return [result, postValidations];
+}
+let LoadedClaims = {};
+let VisitedClaims = {};
+let DuplicatedClaims = {};
+function resetLazyLoader() {
+    LoadedClaims = {};
+    VisitedClaims = {};
+    DuplicatedClaims = {};
+}
+async function lazyGetClaim(kind, name, org, cwd) {
+    const indice = `${kind}-${name}`;
+    logger.info(`Lazy loading ${kind}-${name} with index ${indice}`);
+    if (indice in LoadedClaims)
+        return LoadedClaims[indice];
+    if (isVirtualClaim(kind, name)) {
+        await loadVirtualClaim(kind, name, org);
+    }
+    else {
+        await getClaimsByName(name, cwd);
+    }
+    if (indice in LoadedClaims) {
+        return LoadedClaims[indice];
+    }
+    else {
+        throw new Error(`Error: ${kind}-${name} not found`);
+    }
+}
+async function getClaimsByName(name, cwd = '.') {
+    return new Promise((ok, ko) => {
+        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['-r', '-l', '--include=*', '-E', `name: "?${name}"?`, '.'], {
+            cwd: cwd,
+        });
+        logger.info(`Running ${['grep', '-r', '-l', '--include', '-E', 'name: "' + name + '"?', '.'].join(' ')}`);
+        const entradas = [];
+        const chunks = [];
+        handler.stdout.on('data', (data) => {
+            chunks.push(data.toString('utf-8'));
+        });
+        handler.on('close', () => {
+            const dataFinal = chunks.join('');
+            const fileNameList = dataFinal.split(/\n/).filter((line) => line !== '');
+            for (const fileName of fileNameList) {
+                // only yaml files
+                if (!fileName.match(/\.yml$|\.yaml$/)) {
+                    continue;
+                }
+                // only entries not already visited
+                if (Object.values(VisitedClaims).includes(fileName)) {
+                    continue;
+                }
+                entradas.push(external_path_.join(cwd, fileName));
+            }
+            return Promise.all(entradas.map((entrada) => {
+                return loadRawClaim(entrada);
+            }))
+                .then(() => {
+                ok();
+            })
+                .catch((err) => {
+                ko(err);
+            });
+        });
+    });
+}
+async function loadRawClaim(entry) {
+    return new Promise((ok, ko) => {
+        external_fs_.readFile(entry, 'utf-8', (error, data) => {
+            if (error)
+                return ko(`Reading ${entry}: ${error}`);
+            const claim = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
+            if (!('kind' in claim && 'name' in claim)) {
+                logger.warn(`Invalid claim file ${entry}`);
+            }
+            else {
+                const claimKey = `${claim.kind}-${claim.name}`;
+                if (Object.keys(DuplicatedClaims).includes(claimKey) &&
+                    DuplicatedClaims[claimKey] !== entry) {
+                    return ko(`Duplicated claim ${claimKey} found files: ${DuplicatedClaims[claimKey]} and ${entry}`);
+                }
+                LoadedClaims[claimKey] = data;
+                VisitedClaims[claimKey] = entry;
+                DuplicatedClaims[claimKey] = entry;
+                ok();
+            }
+        });
+    });
+}
+async function setVirtualClaimAdditionalData(renderedData, claim, claimRef) {
+    const virtualClaim = getVirtualClaim(claim.kind, claim.name);
+    renderedData[claimRef]['initializers'] = [
+        new UUIDInitializer(claim),
+        new InitializerClaimRef(),
+        new InitializerDefault(virtualClaim.getDefaultConfig()),
+    ];
+    renderedData[claimRef]['globals'] = [];
+    renderedData[claimRef]['overrides'] = [];
+    renderedData[claimRef]['normalizers'] = [new NameNormalizer()];
+    return renderedData;
+}
+async function setNonVirtualClaimAdditionalData(renderedData, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers) {
+    renderedData[claimRef]['initializers'] = await loadInitializers(claim, renderedData[claimRef]['claimPath']);
+    renderedData[claimRef]['globals'] = await loadGlobals(claim);
+    renderedData[claimRef]['overrides'] = loadOverrides(claim);
+    renderedData[claimRef]['normalizers'] = await loadNormalizers(claim, renderedData[claimRef]['claimPath']);
+    return renderedData;
+}
+async function loadVirtualClaim(kind, name, org) {
+    const virtualClaim = getVirtualClaim(kind, name);
+    const expandedClaim = await virtualClaim.expand({ org });
+    logger.info(`Loading virtual claim ${kind} ${name} ${org}`);
+    LoadedClaims[`${kind}-${name}`] = catalog_common/* default.io.toYaml */.Z.io.toYaml(expandedClaim);
+    VisitedClaims[`${kind}-${name}`] = 'virtual';
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/claimsDefaulter.ts
+
+
+
+/*
+ * Default blocks are objects that cannot be merged but applied as a whole. Meaning:
+ * - If the object is defined at the claim-level it is maintained *AS IT IS* (no merge)
+ * - If the block is missing at the claim-level, the default block is applied
+ */
+const defaultBlocksPaths = ['/providers/terraform/sync'];
+function applyBlockAwareDefaults(claim, defaultClaim) {
+    // we always work with a clone of the original
+    const claimClone = JSON.parse(JSON.stringify(claim));
+    // if the block is claim-level defined we store it here
+    const defaultBlocks = new Map();
+    // we remove the blocks entirely of the claim
+    // to achieve an add copy
+    for (const defaultBlockPath of defaultBlocksPaths) {
+        if (claimsDefaulter_hasDeepPath(claimClone, defaultBlockPath) !== true)
+            continue;
+        const originalValue = fast_json_patch_default().getValueByPointer(claimClone, defaultBlockPath);
+        if (originalValue) {
+            logger.silly(`${claim.kind}/${claim.name}: has an original ${defaultBlockPath}: preserving`);
+            defaultBlocks.set(defaultBlockPath, originalValue);
+            fast_json_patch_default().applyPatch(claimClone, [{ op: 'remove', path: defaultBlockPath }]);
+        }
+    }
+    // if the patch has the same path of a block
+    // and the block was defined at claim-level
+    // we interchange the value with the original value
+    // otherwise we use the default
+    const jsonPatchOps = fast_json_patch_default().compare(claimClone, defaultClaim)
+        .filter((jp) => jp.op === 'add')
+        .map((jp) => {
+        if (defaultBlocks.has(jp.path)) {
+            return {
+                ...jp,
+                value: defaultBlocks.get(jp.path),
+            };
+        }
+        else {
+            return jp;
+        }
+    });
+    return fast_json_patch_default().applyPatch(claimClone, jsonPatchOps).newDocument;
+}
+function claimsDefaulter_hasDeepPath(data, deepPath) {
+    return lodash_default().has(data, deepPath.replace(/\//g, '.').replace(/^\./, ''));
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/loader.ts
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+const isYamlFile = new RegExp(/\.(yaml|yml)$/);
+/**
+ *
+ * @returns Virtual Claims
+ */
+const virtualClaims = [new FirestartrAllClaim()];
+/*
+ * Loads all applicable globals for a given claim and stores them into a list.
+ *
+ * Input:
+ * - claim: our custom claim object, with which we check if the global is applicable
+ *
+ * Returns:
+ * - A GlobalSection array promise, containing all the globals loaded for this claim
+ *
+ */
+async function loadGlobals(claim) {
+    const result = [];
+    await crawl(getPath('globals'), (entry) => {
+        return isYamlFile.test(entry);
+    }, async (entry, data) => {
+        const globalData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
+        const ext = external_path_.extname(entry);
+        const name = external_path_.basename(entry, ext);
+        if (name in SECTIONS_BY_FILE_NAME) {
+            const section = new SECTIONS_BY_FILE_NAME[name](globalData);
+            if (!(await section.validate(SCHEMAS_BY_SECTION_NAME[name] || {}))) {
+                throw new Error(`Invalid ${name} global file`);
+            }
+            if (globalData.kind === claim.kind) {
+                result.push(section);
+            }
+            else {
+                logger.debug(`Skipping global ${name} because it is not applicable to ${claim.kind}`);
+            }
+        }
+    });
+    logger.info(`Loaded globals ${result}`);
+    return result;
+}
+/*
+ * If the input claim is a GithubRepositoryClaim, it loads all it's applicable
+ * overrides and stores them into a list. Otherwise, it returns an empty list.
+ *
+ * Input:
+ * - claim: our custom claim object, which should be a GithubRepositoryClaim
+ *
+ * Returns:
+ * - An Overrider array, with a GithubRepositoryOverrider if the claim
+ *   was a GithubRepositoryClaim, or empty if it was not.
+ *
+ */
+function loadOverrides(claim) {
+    const overrides = [];
+    if (claim.kind === 'ComponentClaim' && claim.providers.github.overrides) {
+        overrides.push(new GithubRepositoryOverrider());
+    }
+    return overrides;
+}
+/**
+ * Load all normalizers and stores them into a list.
+ * @param claim
+ * @returns
+ */
+async function loadNormalizers(_claim, path) {
+    const result = [];
+    for (const normalizer of NORMALIZERS) {
+        result.push(new normalizer({ path: path }));
+    }
+    return result;
+}
+/*
+ * Loads all applicable initializers for a given claim and stores them into a list.
+ *
+ * Input:
+ * - claim: our custom claim object, with which we check if the initializer is applicable
+ *
+ * Returns:
+ * - An Initializer array promise, containing all the initializers loaded for this claim
+ *
+ */
+let loadedInitializers = false;
+async function loadInitializers(claim, claimPath, initializersPath = getPath('initializers')) {
+    const result = [];
+    await crawl(initializersPath, (entry) => {
+        return isYamlFile.test(entry);
+    }, async (entry, data) => {
+        const initializerData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
+        const ext = external_path_.extname(entry);
+        const name = external_path_.basename(entry, ext);
+        if (name in INITIALIZERS_BY_FILE_NAME) {
+            const initializerBfN = new INITIALIZERS_BY_FILE_NAME[name](initializerData);
+            if (!(await initializerBfN.validate(SCHEMAS_BY_INITIALIZER_NAME[name] || {}))) {
+                throw new Error(`Invalid ${name} initializer file`);
+            }
+            if (initializerData.kind === claim.kind) {
+                result.push(initializerBfN);
+            }
+            else {
+                logger.debug(`Skipping initializer ${name} because it is not applicable to ${claim.kind}`);
+            }
+        }
+    });
+    for (const initializer of INITIALIZERS) {
+        if (initializer.applicableKinds.includes(claim.kind)) {
+            result.push(new initializer({ path: claimPath }));
+        }
+    }
+    logger.info(`Loaded initializers ${JSON.stringify(result)}`);
+    loadedInitializers = result;
+    return loadedInitializers;
+}
+function loadClaimDefaults() {
+    try {
+        return catalog_common/* default.io.fromYaml */.Z.io.fromYaml(external_fs_.readFileSync(`${getPath('claimsDefaults')}/claims_defaults.yaml`, 'utf-8'));
+    }
+    catch (error) {
+        const errMsg = `Could not read claims defaults file in path ${getPath('claimsDefaults')}/claims_defaults.yaml: ${error}`;
+        logger.error(errMsg);
+        throw new Error(errMsg);
+    }
+}
+/*
+ * Using fast-json-patch, compares a claim to its kind's defaults, then patches it.
+ *
+ * Input:
+ * - claim: our custom claim object, which we want to patch
+ * - defaultsClaims: an object, containing the defaults for each claim kind,
+ *   with the same structure that we use for the actual claims
+ *
+ * Returns:
+ * - The patched claim
+ *
+ */
+function loader_patchClaim(claim, defaultsClaims) {
+    if (defaultsClaims[claim.kind]) {
+        claim = applyBlockAwareDefaults(claim, defaultsClaims[claim.kind]);
+    }
+    return claim;
+}
+async function loadCRsWithFullSet(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
+    const result = {};
+    const fullResult = {};
+    await crawlWithExclusions(crsPath, (entry) => {
+        return isYamlFile.test(entry);
+    }, async (entry, data) => {
+        const yamlData = stripKnownRelations(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data));
+        const metadata = yamlData?.metadata;
+        if (!(yamlData &&
+            typeof yamlData === 'object' &&
+            'kind' in yamlData &&
+            metadata &&
+            typeof metadata === 'object' &&
+            'name' in metadata)) {
+            logger.warn(`Invalid CR file ${entry}`);
+        }
+        else {
+            const crKey = `${yamlData.kind}-${metadata.name}`;
+            if (fullResult[crKey]) {
+                logger.error(`Duplicate CR ${crKey}`);
+            }
+            // Keep the complete CR set for validations that need repository-wide context.
+            fullResult[crKey] = yamlData;
+            // Keep the filtered CR set for previous-CR lookup during claim rendering.
+            if (allowedClaimReferences.length === 0 ||
+                allowedClaimReferences.includes(yamlData.metadata?.annotations?.[catalog_common/* default.generic.getFirestartrAnnotation */.Z.generic.getFirestartrAnnotation('claim-ref')])) {
+                result[crKey] = yamlData;
+            }
+        }
+    }, excludedPaths.concat(getAdditionalPaths()));
+    return { crs: result, fullCrs: fullResult };
+}
+async function loadCRs(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
+    const { crs } = await loadCRsWithFullSet(crsPath, excludedPaths, allowedClaimReferences);
+    return crs;
+}
+/*
+ * Description: Get the renamed using claimRef annotation
+ * Input: claims: any, crs: any
+ * Output: renames: IRenameResult[]
+ */
+async function loadRenames(claims, crs) {
+    /*
+     * If checkRenames is false, we don't need to check for renames
+     */
+    const renamesEnabled = getRenamesEnabled();
+    if (!renamesEnabled)
+        return [];
+    const result = [];
+    /**
+     * For each CR, look for a claim that does not match the name with CR's firestartr.dev/claim-ref annotation
+     */
+    for (const cr of Object.values(crs)) {
+        const anyCr = cr;
+        if (!anyCr?.metadata?.annotations)
+            continue;
+        // if the annotation is a claimRef
+        const annotationName = common.generic.getFirestartrAnnotation('claim-ref');
+        const annotations = anyCr?.metadata?.annotations || {};
+        if (annotationName in annotations) {
+            const claimRef = anyCr.metadata.annotations[annotationName];
+            // split the annotation into kind and name
+            const [kind, name] = claimRef.split('/');
+            // if the claim exists, check if the name is different for the given provider
+            const referencedClaim = claims[`${kind}-${name}`].claim;
+            const oldName = anyCr.metadata.name;
+            const newName = referencedClaim.providers[getConfiguredProvider()].name;
+            if (oldName !== newName) {
+                result.push({
+                    kind: referencedClaim.kind,
+                    claimPath: claims[`${kind}-${name}`].claimPath,
+                    claimName: referencedClaim.name,
+                    oldName,
+                    newName,
+                });
+            }
+        }
+    }
+    return result;
+}
+async function loadClaimsList(claimRefList, claimsPath = getPath('claims')) {
+    const data = {
+        renderClaims: {},
+        crs: {},
+        fullCrs: {},
+    };
+    const defaults = loadClaimDefaults();
+    for await (const claimRef of claimRefList) {
+        const [renderedClaimData] = await loadClaim(claimRef, getOrg(), defaults, loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, claimsPath);
+        data.renderClaims = lodash_default().merge(data.renderClaims, renderedClaimData);
+    }
+    const crClaimReferences = [];
+    for (const ref of Object.keys(data.renderClaims)) {
+        // Replaces only the first instance of '-'
+        crClaimReferences.push(ref.replace('-', '/'));
+    }
+    const loadedCrs = await loadCRsWithFullSet(getPath('crs'), [getPath('globals'), getPath('initializers')], crClaimReferences);
+    data['crs'] = loadedCrs.crs;
+    data['fullCrs'] = loadedCrs.fullCrs;
+    return data;
+}
+function getOrg() {
+    const groupOrg = catalog_common/* default.environment.getFromEnvironmentWithDefault */.Z.environment.getFromEnvironmentWithDefault(catalog_common/* default.types.envVars.org */.Z.types.envVars.org, '');
+    return groupOrg;
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/references.ts
+function validateTfStateKeyUniqueness(crs) {
+    const tfStateKeys = {};
+    for (const crKey of Object.keys(crs)) {
+        const cr = crs[crKey];
+        if (!isTerraformWorkspace(cr))
+            continue;
+        const tfKey = cr.spec.firestartr.tfStateKey;
+        if (tfStateKeys[tfKey]) {
+            throw new Error(`❗❗ ❌ RENDER ERROR ❌ ❗❗
+
+The tfStateKey ${tfKey} is not unique,
+
+It is being used by the following CRs:
+
+- ${tfStateKeys[tfKey].kind} ${tfStateKeys[tfKey].metadata.name}
+
+- ${cr.kind} ${cr.metadata.name}
+
+Check the following Claims to ensure that the tfStateKey is unique:
+
+- ${tfStateKeys[tfKey].metadata.annotations['firestartr.dev/claim-ref']}
+
+- ${cr.metadata.annotations['firestartr.dev/claim-ref']}
+`);
+        }
+        tfStateKeys[cr.spec.firestartr.tfStateKey] = cr;
+    }
+}
+function references_isCatalogEntity(cr) {
+    return [
+        'Component',
+        'Domain',
+        'System',
+        'User',
+        'Group',
+        'Resource',
+    ].includes(cr.kind);
+}
+function isTerraformWorkspace(cr) {
+    return cr.kind === 'FirestartrTerraformWorkspace';
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/crSize.ts
+
+const K8S_OBJECT_SIZE_LIMIT = 1572864; // 1.5 MiB in bytes, etcd recommended limit: https://etcd.io/docs/latest/dev-guide/limit/
+function validateCrSizes(crs) {
+    for (const key of Object.keys(crs)) {
+        const cr = crs[key];
+        const serialized = catalog_common/* default.io.toYaml */.Z.io.toYaml(cr);
+        const size = Buffer.byteLength(serialized, 'utf8');
+        if (size > K8S_OBJECT_SIZE_LIMIT) {
+            throw new Error(`CR "${cr.kind}-${cr.metadata.name}" exceeds the Kubernetes object size limit by ${size - K8S_OBJECT_SIZE_LIMIT} bytes. Maximum allowed is ${K8S_OBJECT_SIZE_LIMIT} bytes (1.5MiB).`);
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/permissions.ts
+
+function validatePermissionsUniqueness(crs) {
+    for (const crkey in crs) {
+        const cr = crs[crkey];
+        if (cr.kind === 'FirestartrGithubRepository') {
+            const permissions = cr.spec.permissions;
+            logger.debug(`Validating Permissions Uniqueness of ${crkey}`);
+            if (permissions) {
+                const rolesByIdentifier = new Map();
+                for (const perm of permissions) {
+                    const identifier = perm.collaborator
+                        ? perm.collaborator
+                        : `ref:${perm.ref.kind}:${perm.ref.name}`;
+                    const role = perm.role;
+                    const prevRole = rolesByIdentifier.get(identifier);
+                    if (prevRole === undefined) {
+                        rolesByIdentifier.set(identifier, role);
+                    }
+                    else if (prevRole !== role) {
+                        throw new Error(`Conflicting permission role in FirestartrGithubRepository ${crkey}: ${identifier} has roles "${prevRole}" and "${role}".\nFull CR: ${JSON.stringify(cr, null, 2)}`);
+                    }
+                }
+            }
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/backstageAnnotations.ts
+const backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX = 'firestartr.backstage.dev/';
+const CATALOG_KINDS = new Set([
+    'User',
+    'Group',
+    'Component',
+    'System',
+    'Domain',
+    'API',
+    'Resource',
+    'CatalogKubernetesResource',
+    'CatalogTerraformWorkspace',
+    'CatalogArgoDeploy',
+    'CatalogOrgWebhook',
+    'CatalogSecrets',
+]);
+function validateNoBackstageAnnotationsInK8sCrs(crs) {
+    for (const crKey in crs) {
+        const cr = crs[crKey];
+        if (CATALOG_KINDS.has(cr.kind))
+            continue;
+        if (cr.metadata?.annotations) {
+            const backstageKeys = Object.keys(cr.metadata.annotations).filter((k) => k.startsWith(backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX));
+            if (backstageKeys.length > 0) {
+                throw new Error(`K8s CR ${crKey} contains Backstage-only annotations (${backstageKeys.join(', ')}). ` +
+                    `Annotations with prefix ${backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX} must only appear on Backstage catalog entities, not on Kubernetes CRs.`);
+            }
+        }
+    }
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/refsSorter/refsSorter.ts
+
+/**
+ * @param renderClaims renderClaims to sort
+ * @param kinds kinds to get from renderClaims
+ * @returns renderClaims with only the kinds specified
+ */
+function sortRenderClaimsByKind(renderClaims, kinds) {
+    let result = {};
+    for (const kind of kinds) {
+        for (const key in renderClaims) {
+            if (renderClaims[key].claim.kind === kind) {
+                result[key] = renderClaims[key];
+            }
+        }
+        result = sortSelfKindRefs(result, kind);
+    }
+    return result;
+}
+function sortSelfKindRefs(renderClaims, kind) {
+    if (!hasSelfRefs(kind)) {
+        return renderClaims;
+    }
+    const newRenderClaims = {};
+    const data = extractRefs(renderClaims, kind);
+    const ordered = [];
+    const visiting = [];
+    const visited = [];
+    for (const key of Object.keys(data)) {
+        if (!visited.find((obj) => obj.name === key)) {
+            sortRefs(data, data[key], ordered, visiting, visited);
+        }
+    }
+    for (const cr of ordered) {
+        newRenderClaims[cr.name] = renderClaims[cr.name];
+    }
+    return newRenderClaims;
+}
+function sortRefs(data, claim, ordered = [], visiting = [], visited = []) {
+    if (visiting.find((obj) => obj.name === claim.name)) {
+        throw new Error(`Circular dependency detected for '${claim.name}'`);
+    }
+    if (!visited.find((obj) => obj.name === claim.name)) {
+        visiting.push(claim);
+        if (claim.refs) {
+            for (const ref of claim.refs) {
+                const referencedObject = data[ref];
+                if (!referencedObject) {
+                    throw new Error(`Reference '${ref}' does not exist for '${claim.name}'`);
+                }
+                sortRefs(data, referencedObject, ordered, visiting, visited);
+            }
+        }
+        visited.push(visiting.pop());
+        ordered.push(claim);
+    }
+}
+function hasSelfRefs(kind) {
+    return ['TFWorkspaceClaim', 'GroupClaim'].includes(kind);
+}
+
+;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-sorter.ts
+
+function sortKinds(orderedKinds, claims) {
+    const result = [];
+    for (const kind of orderedKinds) {
+        const kindRenderClaims = sortRenderClaimsByKind(claims, [kind]);
+        result.push(kindRenderClaims);
+    }
+    return result;
+}
+
 ;// CONCATENATED MODULE: ../features_renderer/src/common.ts
 
 function isDirectory(path) {
@@ -164419,9 +165184,14 @@ var ajv_default = /*#__PURE__*/__nccwpck_require__.n(dist_ajv);
                     },
                 },
                 patches: {
-                    type: 'array',
-                    items: {
-                        $ref: '#/definitions/Patch',
+                    type: 'object',
+                    patternProperties: {
+                        '^.+$': {
+                            type: 'array',
+                            items: {
+                                $ref: '#/definitions/Patch',
+                            },
+                        },
                     },
                 },
                 filesTemplates: {
@@ -164524,7 +165294,7 @@ var ajv_default = /*#__PURE__*/__nccwpck_require__.n(dist_ajv);
                     type: 'string',
                 },
                 value: {
-                    type: ['string', 'object', 'array', 'number', 'boolean', 'null'],
+                    type: 'string',
                 },
             },
             required: ['name', 'op', 'path'],
@@ -164566,12 +165336,6 @@ function __validateFeatureConfig(featurePath) {
     }
 }
 function __validateFeatureConfigData(configData) {
-    // Detect old provider-keyed patches shape for migration hint (PLAN #2648)
-    if (configData.patches &&
-        !Array.isArray(configData.patches) &&
-        typeof configData.patches === 'object') {
-        throw `Feature: config.yaml invalid patches: expected flat array of patches (claim-relative pointers like /annotations/backstage.io~1techdocs-ref), but got provider-keyed object ${JSON.stringify(Object.keys(configData.patches))}. Migrate: patches: { catalog: [...] } → patches: [{ op, path: /annotations/backstage.io~1techdocs-ref, value }]. See #2648. $ref paths also migrate: [spec, org] → [providers, github, org], [metadata, annotations, firestartr.dev/external-name] → [providers, github, name]`;
-    }
     const ajv = new (ajv_default())({
         allowUnionTypes: true,
     });
@@ -164593,12 +165357,14 @@ function stripAnchoringConstraints(schemaDef) {
     return clone;
 }
 function __validateJsonPatches(configData) {
-    const patches = configData.patches;
-    if (!Array.isArray(patches))
-        return;
-    const err = fast_json_patch_default().validate(patches);
-    if (err) {
-        throw `Feature: config.yaml -> patches: invalid patches ${JSON.stringify(err.message ?? err)}`;
+    const keys = Object.keys(configData.patches);
+    for (const key of keys) {
+        if (configData.patches[key]) {
+            if (fast_json_patch_default().validate(configData.patches[key])) {
+                const errors = JSON.stringify(fast_json_patch_default().validate(configData.patches[key]).message);
+                throw `Feature: config.yaml -> patches: invalid patches ${errors}`;
+            }
+        }
     }
 }
 
@@ -165384,12 +166150,19 @@ function addTraceability(context, src, content) {
 }
 function addTraceabilityStamp(context, content) {
     const traceability = context.traceability || {};
-    const stamp = `---
-# FEATURE_NAME: ${traceability.name}
-# FEATURE_VERSION: ${traceability.version}
-# FEATURE_URL: ${traceability.url}
-
-`;
+    const stampLines = [
+        '---',
+        `# FEATURE_NAME: ${traceability.name}`,
+        `# FEATURE_VERSION: ${traceability.version}`,
+        `# FEATURE_URL: ${traceability.url}`,
+    ];
+    if (traceability.sha) {
+        stampLines.push(`# FEATURE_GIT_SHA: "${traceability.sha}"`);
+    }
+    if (Array.isArray(traceability.tags) && traceability.tags.length > 0) {
+        stampLines.push(`# FEATURE_GIT_TAGS: [${traceability.tags.join(', ')}]`);
+    }
+    const stamp = `${stampLines.join('\n')}\n\n`;
     const output = [];
     let replaced = false;
     for (const line of content.split(/\n/)) {
@@ -165436,12 +166209,10 @@ const renderTestsSchema = {
             items: {
                 type: 'object',
                 additionalProperties: false,
-                required: ['name'],
-                anyOf: [{ required: ['cr'] }, { required: ['claim'] }],
+                required: ['name', 'cr'],
                 properties: {
                     name: { type: 'string', minLength: 1 },
                     cr: { type: 'string', minLength: 1 },
-                    claim: { type: 'string', minLength: 1 },
                     args: { type: 'object' },
                 },
             },
@@ -165496,9 +166267,6 @@ function resolveCrPath(featurePath, crRelPath) {
     }
     return resolved;
 }
-function resolveClaimPath(featurePath, claimRelPath) {
-    return resolveCrPath(featurePath, claimRelPath);
-}
 function listYamlFiles(dir) {
     if (!fs.existsSync(dir))
         return [];
@@ -165563,6 +166331,7 @@ function buildExpectedOutput(config, renderDir) {
     return {
         files,
         patches: config.patches || [],
+        traceability: {},
     };
 }
 /* ---------- Context-style API for a render temp dir ---------- */
@@ -165616,7 +166385,6 @@ async function createRenderContext(prefix = 'feature-render-') {
     buildExpectedOutput,
     loadAndValidateRenderTests,
     resolveCrPath,
-    resolveClaimPath,
 });
 
 ;// CONCATENATED MODULE: ../features_renderer/src/featureArgsValidation.ts
@@ -165734,103 +166502,26 @@ function render(featurePath, featureRenderPath, entity, firestartrConfig = {}, f
         // Not used anymore
         // output.unpatches = context.config.unpatches
     });
+    output.traceability = context.traceability;
     external_fs_default().writeFileSync(external_path_default().join(featureRenderPath, 'config.json'), JSON.stringify(context.config));
     // write the output file
     const configFile = external_path_default().join(featureRenderPath, 'output.json');
     external_fs_default().writeFileSync(configFile, JSON.stringify(output));
     return output;
 }
-function getPatches(featurePath, entity, firestartrConfig = {}, featureArgs = {}) {
-    const configData = validate(featurePath);
-    validateFeatureArgs(featurePath, featureArgs);
-    const context = buildContext(entity, configData.args, firestartrConfig, featureArgs);
-    const rendered = JSON.parse(renderContent(JSON.stringify(configData), context));
-    return rendered.patches ?? [];
-}
-function buildContext(stitchedClaim, args, firestartrConfig, featureArgs) {
+function buildContext(entity, args, firestartrConfig, featureArgs) {
     const context = {};
-    const resolveRef = (doc, ref) => {
-        const v = lodash_default().get(doc, ref);
-        if (v !== undefined)
-            return v;
-        // Fallback for transition: try CR-shaped alternatives when stitchedClaim is CR-shaped
-        // and vice versa. Covers the ADR 0006 table plus legacy feature_a provisioner paths.
-        const altTable = {
-            'providers,github,org': [
-                ['spec', 'org'],
-                ['spec', 'provisioner', 'org'],
-                ['spec', 'firestartr', 'technology', 'stack'],
-            ],
-            'providers,github,branchStrategy,defaultBranch': [
-                ['spec', 'repo', 'defaultBranch'],
-                ['spec', 'provisioner', 'repo', 'defaultBranch'],
-            ],
-            'providers,github,name': [
-                ['metadata', 'annotations', 'firestartr.dev/external-name'],
-                ['metadata', 'name'],
-            ],
-            name: [['metadata', 'name']],
-            'annotations,firestartr.dev/dest-annotation': [
-                ['metadata', 'annotations', 'firestartr.dev/dest-annotation'],
-            ],
-        };
-        const key = ref.join(',');
-        const alts = altTable[key];
-        if (alts) {
-            for (const alt of alts) {
-                const av = lodash_default().get(doc, alt);
-                if (av !== undefined)
-                    return av;
-            }
-        }
-        // Reverse fallback: if ref is CR-shaped, try claim-shaped
-        const reverseTable = {
-            'spec,org': ['providers', 'github', 'org'],
-            'spec,provisioner,technology,stack': ['providers', 'github', 'org'],
-            'spec,firestartr,technology,stack': ['providers', 'github', 'org'],
-            'metadata,name': ['name'],
-            'metadata,annotations,firestartr.dev/dest-annotation': [
-                'annotations',
-                'firestartr.dev/dest-annotation',
-            ],
-            'spec,provisioner,org': ['providers', 'github', 'org'],
-            'spec,provisioner,repo,defaultBranch': [
-                'providers',
-                'github',
-                'branchStrategy',
-                'defaultBranch',
-            ],
-            'spec,repo,defaultBranch': [
-                'providers',
-                'github',
-                'branchStrategy',
-                'defaultBranch',
-            ],
-            'metadata,annotations,firestartr.dev/external-name': [
-                'providers',
-                'github',
-                'name',
-            ],
-        };
-        const rev = reverseTable[ref.join(',')];
-        if (rev) {
-            const rv = lodash_default().get(doc, rev);
-            if (rv !== undefined)
-                return rv;
-        }
-        return v;
-    };
     Object.entries(args).forEach(([key, arg]) => {
         if ('$default' in arg) {
             if (Array.isArray(arg['$default'])) {
-                context[key] = resolveRef(stitchedClaim, arg['$default']);
+                context[key] = lodash_default().get(entity, arg['$default']);
             }
             else {
                 context[key] = arg['$default'];
             }
         }
         if ('$ref' in arg) {
-            const refValue = resolveRef(stitchedClaim, arg['$ref']);
+            const refValue = lodash_default().get(entity, arg['$ref']);
             context[key] = refValue;
         }
         else if ('$lit' in arg) {
@@ -165960,7 +166651,6 @@ function updateFileContent(featureRenderPath, filePath, content) {
 
 
 
-
 /* harmony default export */ const features_renderer = ({
     validate: validate,
     render: render,
@@ -165970,7 +166660,6 @@ function updateFileContent(featureRenderPath, filePath, content) {
     renderContent: renderContent,
     expandFiles: expandFiles,
     validateFeatureArgs: validateFeatureArgs,
-    getPatches: getPatches,
 });
 
 ;// CONCATENATED MODULE: ../features_preparer/src/logger.ts
@@ -165995,13 +166684,6 @@ function renderFeature(featureName, version, owner, repo, featureOwner, renderPa
 function renderFeatureFromPath(extractPath, renderedPath, featureOwner, featureArgs = {}) {
     return features_renderer.render(extractPath, renderedPath, featureOwner, {}, featureArgs);
 }
-function getFeaturePatches(featureName, version, owner, repo, featureOwner, featureArgs = {}) {
-    const extractPath = external_path_default().join(catalog_common/* default.features.tarballs.getFeaturesExtractPath */.Z.features.tarballs.getFeaturesExtractPath(featureName, version, owner, repo), 'packages', featureName);
-    return getPatches(extractPath, featureOwner, {}, featureArgs);
-}
-function getFeaturePatchesFromPath(extractPath, featureOwner, featureArgs = {}) {
-    return getPatches(extractPath, featureOwner, {}, featureArgs);
-}
 
 // EXTERNAL MODULE: ../../node_modules/adm-zip/adm-zip.js
 var adm_zip = __nccwpck_require__(7993);
@@ -166060,27 +166742,56 @@ featureArgs = {}, repo = 'features', owner = 'prefapp') {
         ref: reference,
         url: `https://github.com/${owner}/${repo}/tree/${reference}/packages/${featureName}`,
     };
-    return renderFeature(featureName, reference, owner, repo, featureOwner, '/tmp', featureArgs);
-}
-async function installer_getFeaturePatches(featureName, version, featureOwner, featureArgs = {}, repo = 'features', owner = 'prefapp') {
-    const reference = `${featureName}-v${version}`;
-    return processFeaturePatches(featureName, reference, featureOwner, featureArgs, repo, owner);
-}
-async function getFeaturePatchesFromRef(featureName, featureRef, featureOwner, featureArgs = {}, repo = 'features', owner = 'prefapp') {
-    const reference = `${featureRef}`;
-    return processFeaturePatches(featureName, reference, featureOwner, featureArgs, repo, owner);
-}
-async function processFeaturePatches(featureName, reference, featureOwner, featureArgs = {}, repo = 'features', owner = 'prefapp') {
-    await downloadFeatureZip(repo, featureName, reference, owner);
+    const commitInfo = await resolveFeatureCommit(owner, repo, reference);
     featureArgs['traceability'] = {
-        version: reference,
-        owner,
-        repo,
-        name: featureName,
-        ref: reference,
-        url: `https://github.com/${owner}/${repo}/tree/${reference}/packages/${featureName}`,
+        ...featureArgs['traceability'],
+        sha: commitInfo.sha,
+        tags: commitInfo.tags,
     };
-    return getFeaturePatches(featureName, reference, owner, repo, featureOwner, featureArgs);
+    return renderFeature(featureName, reference, owner, repo, featureOwner, '/tmp', featureArgs);
+}
+async function resolveFeatureCommit(owner, repo, reference) {
+    try {
+        const octokit = await github["default"].getOctokitForOrg(owner);
+        // Get the resolved commit SHA
+        const { data: commit } = await octokit.rest.repos.getCommit({
+            owner,
+            repo,
+            ref: reference,
+        });
+        const sha = commit.sha;
+        // Get all tags pointing to this commit.
+        // Tag enumeration is wrapped separately so a pagination failure
+        // still returns the successfully resolved SHA.
+        const tags = [];
+        try {
+            let page = 1;
+            while (true) {
+                const { data: tagList } = await octokit.rest.repos.listTags({
+                    owner,
+                    repo,
+                    per_page: 100,
+                    page,
+                });
+                const matchingTags = tagList.filter((t) => t.commit?.sha === sha);
+                tags.push(...matchingTags.map((t) => t.name));
+                if (tagList.length < 100)
+                    break;
+                page++;
+            }
+        }
+        catch (tagError) {
+            // Clear partial results so consumers don't publish an incomplete
+            // tag set as if it were the full list.
+            tags.length = 0;
+            features_preparer_src_logger.warn(`[features_preparer] Failed to list tags for ${owner}/${repo}@${reference}: ${tagError instanceof Error ? tagError.message : String(tagError)}`);
+        }
+        return { sha, tags };
+    }
+    catch (error) {
+        features_preparer_src_logger.warn(`[features_preparer] Failed to resolve commit for ${owner}/${repo}@${reference}: ${error instanceof Error ? error.message : String(error)}`);
+        return { sha: '', tags: [] };
+    }
 }
 async function prepareFeature(featureName, version, repo = 'features', owner = 'prefapp') {
     await downloadFeatureZip(repo, featureName, version, owner);
@@ -166136,9 +166847,6 @@ async function downloadFeatureZip(repo, featureName, reference, owner = 'prefapp
 /* harmony default export */ const src = ({
     renderFeature: renderFeature,
     renderFeatureFromPath: renderFeatureFromPath,
-    getFeaturePatches: installer_getFeaturePatches,
-    getFeaturePatchesFromRef: getFeaturePatchesFromRef,
-    getFeaturePatchesFromPath: getFeaturePatchesFromPath,
     getFeatureConfigFromRef: getFeatureConfigFromRef,
     getFeatureConfig: getFeatureConfig,
     prepareFeature: prepareFeature,
@@ -166155,1118 +166863,6 @@ async function downloadFeatureZip(repo, featureName, reference, owner = 'prefapp
     getFeatureConfigFromRef: src.getFeatureConfigFromRef,
 });
 
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/stitching/protectedPaths.ts
-// Platform-curated protected claim paths — features may not write to these.
-// Stored as JSON Pointers (RFC 6901). Supports wildcard `*` for a single segment.
-// Example: /providers/STAR/org matches /providers/github/org where STAR is *.
-const PROTECTED_CLAIM_PATHS = [
-    '/kind',
-    '/name',
-    '/providers/*/org',
-    '/providers/github/org',
-    '/providers/github/name',
-    '/metadata/name',
-    '/metadata/namespace',
-];
-function isProtectedPath(patchPath) {
-    const normalizedPatch = normalizePointer(patchPath);
-    for (const protectedPath of PROTECTED_CLAIM_PATHS) {
-        if (matchesProtected(protectedPath, normalizedPatch)) {
-            return true;
-        }
-    }
-    return false;
-}
-function normalizePointer(pointer) {
-    if (!pointer.startsWith('/')) {
-        return '/' + pointer;
-    }
-    return pointer;
-}
-function matchesProtected(protectedPointer, patchPointer) {
-    const protectedSegments = protectedPointer
-        .split('/')
-        .slice(1)
-        .map(unescapePointer);
-    const patchSegments = patchPointer.split('/').slice(1).map(unescapePointer);
-    // Treat ancestor/descendant as protected: a patch to a parent (e.g. /metadata)
-    // would replace the protected child (/metadata/name), and a patch to a child
-    // (e.g. /metadata/name/extra) is also under the protected tree. Match when
-    // the shorter prefix equals the longer prefix (with wildcard support).
-    const minLen = Math.min(protectedSegments.length, patchSegments.length);
-    for (let i = 0; i < minLen; i++) {
-        if (protectedSegments[i] === '*')
-            continue;
-        if (protectedSegments[i] !== patchSegments[i])
-            return false;
-    }
-    return true;
-}
-function unescapePointer(segment) {
-    return segment.replace(/~1/g, '/').replace(/~0/g, '~');
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/stitching/errors.ts
-class StitchingError extends Error {
-    constructor(violations) {
-        const lines = violations.map((v) => `  - ${v.message}`).join('\n');
-        super(`Claim stitching failed with ${violations.length} violation(s):\n${lines}`);
-        this.name = 'StitchingError';
-        this.violations = violations;
-    }
-}
-function formatStitchingError(error) {
-    return error.message;
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/claims/stitching/stitching.ts
-
-
-
-
-let MOCK_FEATURES_FN;
-function MOCK_STITCHING_FEATURES(mock) {
-    MOCK_FEATURES_FN = mock;
-}
-function pointerExists(doc, pointer) {
-    const segments = pointer
-        .split('/')
-        .slice(1)
-        .map((s) => s.replace(/~1/g, '/').replace(/~0/g, '~'));
-    let cur = doc;
-    for (const seg of segments) {
-        if (cur === null || cur === undefined || typeof cur !== 'object')
-            return false;
-        if (!Object.prototype.hasOwnProperty.call(cur, seg))
-            return false;
-        cur = cur[seg];
-    }
-    return true;
-}
-function isAppendPointer(pointer) {
-    return pointer.endsWith('/-');
-}
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-// Deduplication identity for a feature patch. Ordinary writes collide on the
-// normalized pointer. Array appends (`add ... /-`) collide on the pointer plus
-// the appended element's `name` when present, so several features can each add
-// a distinct label to /providers/github/labels/- while the same label name from
-// two features is silently deduplicated (or errors if values differ).
-function writeIdentity(patch) {
-    const path = normalizePointer(patch.path);
-    if (patch.op === 'add' &&
-        isAppendPointer(path) &&
-        isRecord(patch.value) &&
-        typeof patch.value.name === 'string') {
-        return `${path}#${patch.value.name}`;
-    }
-    return path;
-}
-// Check whether an array at `appendPath`'s parent already contains an element
-// whose `name` matches `value.name`.  Used for the "claim wins" gate: when a
-// feature tries to append an array element that already exists in the claim,
-// the patch is silently dropped.
-function arrayElementExists(doc, appendPath, value) {
-    if (!isRecord(value) || typeof value.name !== 'string')
-        return false;
-    const parentPath = appendPath.slice(0, -2); // strip trailing /-
-    const segments = parentPath
-        .split('/')
-        .slice(1)
-        .map((s) => s.replace(/~1/g, '/').replace(/~0/g, '~'));
-    let cur = doc;
-    for (const seg of segments) {
-        if (cur === null || cur === undefined || typeof cur !== 'object')
-            return false;
-        if (!Object.prototype.hasOwnProperty.call(cur, seg))
-            return false;
-        cur = cur[seg];
-    }
-    if (!Array.isArray(cur))
-        return false;
-    return cur.some((el) => isRecord(el) && el.name === value.name);
-}
-// fast-json-patch does not create intermediate containers for `add`, and
-// appending to an array requires the array to already exist. Ensure every
-// ancestor segment exists before applying an `add`: missing containers are
-// created as objects, except the immediate parent of a `/-` append, which is
-// created as an array. Existing (user/default-declared) values are never
-// overwritten.
-function ensureAddParents(doc, patch) {
-    const segments = patch.path.split('/').slice(1);
-    let prefix = '';
-    for (let i = 0; i < segments.length - 1; i++) {
-        prefix += '/' + segments[i];
-        if (pointerExists(doc, prefix))
-            continue;
-        const isArrayParent = isAppendPointer(patch.path) && i === segments.length - 2;
-        const value = isArrayParent ? [] : {};
-        try {
-            doc = fast_json_patch.applyPatch(doc, [{ op: 'add', path: prefix, value }], false, false).newDocument;
-        }
-        catch {
-            // Concurrent structural conflict — let the actual patch surface the error.
-        }
-    }
-    return doc;
-}
-async function stitchClaim(claimAfterDefaults, preCollectedEnvelopes) {
-    const envelopes = preCollectedEnvelopes ?? (await collectFeaturePatches(claimAfterDefaults));
-    if (envelopes.length === 0) {
-        return claimAfterDefaults;
-    }
-    // Normalize all patches once so every gate and the apply phase use the same pointers.
-    const normalizedEnvelopes = envelopes.map((env) => ({
-        feature: env.feature,
-        patches: env.patches.map((p) => ({
-            ...p,
-            path: normalizePointer(p.path),
-            _raw: p.path,
-        })),
-    }));
-    // ── Phase 1: silently drop patches that should not be applied ──────────
-    //  • Array append whose element already exists in the claim → claim wins
-    //  • Duplicate identity with identical value across features → silent dedup
-    const dropped = new Set(); // "envelopeIdx:patchIdx"
-    const seenIdentities = new Map();
-    for (let ei = 0; ei < normalizedEnvelopes.length; ei++) {
-        const envelope = normalizedEnvelopes[ei];
-        for (let pi = 0; pi < envelope.patches.length; pi++) {
-            const patch = envelope.patches[pi];
-            const key = `${ei}:${pi}`;
-            // Array claim-wins: element already in claim → drop
-            if (patch.op === 'add' && isAppendPointer(patch.path)) {
-                if (arrayElementExists(claimAfterDefaults, patch.path, patch.value)) {
-                    dropped.add(key);
-                    continue;
-                }
-            }
-            // Silent dedup: same identity + same value → drop
-            const identity = writeIdentity(patch);
-            const existing = seenIdentities.get(identity);
-            if (existing) {
-                if (JSON.stringify(existing.value) === JSON.stringify(patch.value)) {
-                    dropped.add(key);
-                    continue;
-                }
-                // Different value — kept here, caught as a violation in Phase 2.
-            }
-            else {
-                seenIdentities.set(identity, {
-                    feature: envelope.feature,
-                    value: patch.value,
-                });
-            }
-        }
-    }
-    // ── Phase 2: collect violations on non-dropped patches ─────────────────
-    const violations = [];
-    const seenForViolations = new Map(); // identity → feature
-    for (let ei = 0; ei < normalizedEnvelopes.length; ei++) {
-        const envelope = normalizedEnvelopes[ei];
-        for (let pi = 0; pi < envelope.patches.length; pi++) {
-            if (dropped.has(`${ei}:${pi}`))
-                continue;
-            const patch = envelope.patches[pi];
-            const path = patch.path;
-            const raw = patch._raw ?? path;
-            // Gate 1: protected path
-            if (isProtectedPath(path)) {
-                violations.push({
-                    feature: envelope.feature,
-                    op: patch.op,
-                    path,
-                    reason: 'protected-path',
-                    message: `Feature '${envelope.feature}' patch ${patch.op} ${raw} (normalized ${path}) targets protected claim path`,
-                });
-            }
-            // Gate 2: conflicting value from another feature
-            const identity = writeIdentity(patch);
-            if (seenForViolations.has(identity)) {
-                violations.push({
-                    feature: envelope.feature,
-                    op: patch.op,
-                    path,
-                    reason: 'duplicate-path',
-                    conflictingFeature: seenForViolations.get(identity),
-                    message: `Feature '${envelope.feature}' and '${seenForViolations.get(identity)}' both write to ${path} (deduplication)`,
-                });
-            }
-            else {
-                seenForViolations.set(identity, envelope.feature);
-            }
-            // Gate 3: replace / remove to an absent path
-            if (['replace', 'remove'].includes(patch.op)) {
-                if (!pointerExists(claimAfterDefaults, path)) {
-                    violations.push({
-                        feature: envelope.feature,
-                        op: patch.op,
-                        path,
-                        reason: 'overwrite-protected',
-                        message: `Feature '${envelope.feature}' patch ${patch.op} ${raw} (normalized ${path}) targets absent path (replace/remove requires existing value)`,
-                    });
-                }
-            }
-        }
-    }
-    if (violations.length > 0) {
-        throw new StitchingError(violations);
-    }
-    // ── Phase 3: apply remaining patches ───────────────────────────────────
-    let stitched = JSON.parse(JSON.stringify(claimAfterDefaults));
-    for (let ei = 0; ei < normalizedEnvelopes.length; ei++) {
-        const envelope = normalizedEnvelopes[ei];
-        const patchesToApply = envelope.patches.filter((_, pi) => !dropped.has(`${ei}:${pi}`));
-        if (patchesToApply.length === 0)
-            continue;
-        for (const patch of patchesToApply) {
-            if (patch.op === 'add') {
-                stitched = ensureAddParents(stitched, patch);
-            }
-        }
-        const result = fast_json_patch.applyPatch(stitched, patchesToApply, false, false);
-        stitched = result.newDocument;
-    }
-    return stitched;
-}
-async function collectFeaturePatches(claim) {
-    if (MOCK_FEATURES_FN) {
-        return MOCK_FEATURES_FN(claim);
-    }
-    const typedClaim = claim;
-    const features = typedClaim.providers?.github?.features ?? [];
-    if (features.length === 0)
-        return [];
-    // In unit tests without GitHub credentials, avoid real download — tests that care
-    // about stitching should set MOCK_STITCHING_FEATURES explicitly.
-    if (process.env.JEST_WORKER_ID && !process.env.GITHUB_TOKEN) {
-        return [];
-    }
-    const envelopes = [];
-    for (const feature of features) {
-        const featureName = feature.name;
-        const versionOrRef = feature.ref ?? feature.version ?? '';
-        const repo = feature.repo
-            ? (feature.repo.split('/')[1] ?? 'features')
-            : 'features';
-        const owner = feature.repo
-            ? (feature.repo.split('/')[0] ?? 'prefapp')
-            : 'prefapp';
-        const args = feature.args ?? {};
-        try {
-            let patchesOrRendered;
-            const preparerAny = features_preparer;
-            if (feature.ref) {
-                if (typeof preparerAny.getFeaturePatchesFromRef === 'function') {
-                    patchesOrRendered = await preparerAny.getFeaturePatchesFromRef(featureName, versionOrRef, claim, args, repo, owner);
-                }
-                else {
-                    patchesOrRendered = await preparerAny.getFeatureConfigFromRef(featureName, versionOrRef, claim, args, repo, owner);
-                }
-            }
-            else {
-                if (typeof preparerAny.getFeaturePatches === 'function') {
-                    patchesOrRendered = await preparerAny.getFeaturePatches(featureName, versionOrRef, claim, args, repo, owner);
-                }
-                else {
-                    patchesOrRendered = await preparerAny.getFeatureConfig(featureName, versionOrRef, claim, args, repo, owner);
-                }
-            }
-            const patches = Array.isArray(patchesOrRendered)
-                ? patchesOrRendered
-                : extractClaimPatches(patchesOrRendered);
-            envelopes.push({ feature: featureName, patches });
-        }
-        catch (err) {
-            throw new Error(`Failed to collect patches for feature '${featureName}': ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
-    return envelopes;
-}
-function extractClaimPatches(rendered) {
-    const patches = rendered.patches;
-    if (!patches)
-        return [];
-    if (Array.isArray(patches))
-        return patches;
-    throw new Error(`Feature patches must be a flat array (claim-relative pointers like /annotations/...), got ${typeof patches}: ${JSON.stringify(patches).slice(0, 200)}. See #2648`);
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/lazy_loader.ts
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-// We need to ensure the grep command is a gnu version
-let IS_GNU_GREP = false;
-let GREP_ON_CHECK = false;
-// this loop is for avoid race conditions
-// once a check is running no more checks
-async function waitForCheck() {
-    const f_wait = () => new Promise((timeOut) => setTimeout(timeOut, 10));
-    do {
-        await f_wait();
-    } while (GREP_ON_CHECK);
-}
-function checkGrep() {
-    return new Promise((ok, ko) => {
-        // idempotency: already checked
-        if (IS_GNU_GREP)
-            return ok();
-        // a check is already running no new checks
-        if (GREP_ON_CHECK)
-            return waitForCheck();
-        logger.info('Checking the grep command');
-        GREP_ON_CHECK = true;
-        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['--version']);
-        handler.on('close', (code) => {
-            GREP_ON_CHECK = false;
-            if (code === 0) {
-                logger.debug('Grep is a gnu grep');
-                IS_GNU_GREP = true;
-                ok();
-            }
-            else {
-                ko('Lazy evaluation needs a gnu-grep command');
-            }
-        });
-    });
-}
-async function loadClaim(claimRef, org, defaults = loadClaimDefaults(), patchClaim = loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, existingRefs = {}, postValidations = new Map()) {
-    await checkGrep();
-    let result = existingRefs;
-    logger.info(`Load reference ${claimRef}`);
-    initVirtualClaims(org);
-    logger.info(`Load reference (parts) ${claimRef.split(/-/)[0]} ${claimRef.replace(/^[^-]+-/, '')}`);
-    // cargas datos con grep
-    try {
-        const claimData = await lazyGetClaim(claimRef.split(/-/)[0], claimRef.replace(/^[^-]+-/, ''), org, cwd);
-        let claim = patchClaim(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(claimData), defaults);
-        // Claim stitching: feature claim-patches with three gates before AJV
-        try {
-            claim = await stitchClaim(claim);
-        }
-        catch (e) {
-            throw new Error(`Error when stitching claim ${claimRef}: ${e instanceof Error ? e.message : String(e)}`);
-        }
-        let variants = [];
-        if (claim.kind === 'TFWorkspaceClaim' &&
-            claim.providers?.terraform?.variants) {
-            variants = claim.providers.terraform.variants;
-            delete claim.providers.terraform.variants;
-        }
-        logger.silly(`Patched claim is:
-		 ---
-			${catalog_common/* default.io.toYaml */.Z.io.toYaml(claim)}`);
-        try {
-            validateClaim(claim, base[`${claim.kind}Schema`]);
-            await optionalValidation(claim);
-        }
-        catch (error) {
-            let errorMsg = '';
-            if (Array.isArray(error)) {
-                for (const data of error) {
-                    errorMsg = `${errorMsg}
-  - ${data.instancePath}: ${data.message}`;
-                }
-            }
-            else {
-                errorMsg = error instanceof Error ? error.message : String(error);
-            }
-            throw new Error(`Error when validating claim ${claimRef}: ${errorMsg}`);
-        }
-        result[claimRef] = {};
-        result[claimRef]['claim'] = claim;
-        result[claimRef]['claimPath'] = VisitedClaims[claimRef];
-        if (VisitedClaims[claimRef] === 'virtual') {
-            result = await setVirtualClaimAdditionalData(result, claim, claimRef);
-        }
-        else {
-            result = await setNonVirtualClaimAdditionalData(result, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
-        }
-        const claimKind = claim.kind;
-        const references = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(claim));
-        for (const ref of references) {
-            if (!result[ref]) {
-                const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
-                result = lodash_default().merge(result, resolvedReferences);
-            }
-        }
-        if (variants.length > 0) {
-            const parentClaimPath = VisitedClaims[claimRef];
-            for (const variant of variants) {
-                if (!variant.name || !variant.overrides) {
-                    throw new Error(`Variant in claim ${claimRef} is missing required field 'name' or 'overrides'`);
-                }
-                const prohibitedOverrideFields = ['source', 'module', 'name'];
-                for (const field of prohibitedOverrideFields) {
-                    if (field in variant.overrides) {
-                        throw new Error(`Variant '${variant.name}' in claim ${claimRef} cannot override '${field}'`);
-                    }
-                }
-                const composedName = claim.providers.terraform.name + '-' + variant.name;
-                const variantClaim = lodash_default().cloneDeep(claim);
-                variantClaim._parentClaimName = claim.name;
-                variantClaim.name = composedName;
-                variantClaim.providers.terraform = lodash_default().merge({}, claim.providers.terraform, variant.overrides);
-                variantClaim.providers.terraform.name = composedName;
-                if (!variantClaim.annotations) {
-                    variantClaim.annotations = {};
-                }
-                variantClaim.annotations['firestartr.dev/variant-of'] =
-                    claim.providers.terraform.name;
-                const variantRef = `TFWorkspaceClaim-${composedName}`;
-                if (result[variantRef]) {
-                    throw new Error(`Variant name '${variant.name}' (composed: '${composedName}') from claim '${claimRef}' conflicts with existing claim '${variantRef}'`);
-                }
-                logger.info(`Creating synthetic variant claim ${variantRef}`);
-                result[variantRef] = {};
-                result[variantRef]['claim'] = variantClaim;
-                result[variantRef]['claimPath'] = parentClaimPath;
-                result = await setNonVirtualClaimAdditionalData(result, variantClaim, variantRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers);
-                const variantReferences = extractAllRefs(catalog_common/* default.io.toYaml */.Z.io.toYaml(variantClaim));
-                for (const ref of variantReferences) {
-                    if (!result[ref]) {
-                        const [resolvedReferences] = await loadClaim(ref, org, defaults, patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, cwd, result, postValidations);
-                        result = lodash_default().merge(result, resolvedReferences);
-                    }
-                }
-            }
-        }
-    }
-    catch (err) {
-        throw `Lazy Loading: ${err}`;
-    }
-    return [result, postValidations];
-}
-let LoadedClaims = {};
-let VisitedClaims = {};
-let DuplicatedClaims = {};
-function resetLazyLoader() {
-    LoadedClaims = {};
-    VisitedClaims = {};
-    DuplicatedClaims = {};
-}
-async function lazyGetClaim(kind, name, org, cwd) {
-    const indice = `${kind}-${name}`;
-    logger.info(`Lazy loading ${kind}-${name} with index ${indice}`);
-    if (indice in LoadedClaims)
-        return LoadedClaims[indice];
-    if (isVirtualClaim(kind, name)) {
-        await loadVirtualClaim(kind, name, org);
-    }
-    else {
-        await getClaimsByName(name, cwd);
-    }
-    if (indice in LoadedClaims) {
-        return LoadedClaims[indice];
-    }
-    else {
-        throw new Error(`Error: ${kind}-${name} not found`);
-    }
-}
-async function getClaimsByName(name, cwd = '.') {
-    return new Promise((ok, ko) => {
-        const handler = (0,external_node_child_process_namespaceObject.spawn)('grep', ['-r', '-l', '--include=*', '-E', `name: "?${name}"?`, '.'], {
-            cwd: cwd,
-        });
-        logger.info(`Running ${['grep', '-r', '-l', '--include', '-E', 'name: "' + name + '"?', '.'].join(' ')}`);
-        const entradas = [];
-        const chunks = [];
-        handler.stdout.on('data', (data) => {
-            chunks.push(data.toString('utf-8'));
-        });
-        handler.on('close', () => {
-            const dataFinal = chunks.join('');
-            const fileNameList = dataFinal.split(/\n/).filter((line) => line !== '');
-            for (const fileName of fileNameList) {
-                // only yaml files
-                if (!fileName.match(/\.yml$|\.yaml$/)) {
-                    continue;
-                }
-                // only entries not already visited
-                if (Object.values(VisitedClaims).includes(fileName)) {
-                    continue;
-                }
-                entradas.push(external_path_.join(cwd, fileName));
-            }
-            return Promise.all(entradas.map((entrada) => {
-                return loadRawClaim(entrada);
-            }))
-                .then(() => {
-                ok();
-            })
-                .catch((err) => {
-                ko(err);
-            });
-        });
-    });
-}
-async function loadRawClaim(entry) {
-    return new Promise((ok, ko) => {
-        external_fs_.readFile(entry, 'utf-8', (error, data) => {
-            if (error)
-                return ko(`Reading ${entry}: ${error}`);
-            const claim = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
-            if (!('kind' in claim && 'name' in claim)) {
-                logger.warn(`Invalid claim file ${entry}`);
-            }
-            else {
-                const claimKey = `${claim.kind}-${claim.name}`;
-                if (Object.keys(DuplicatedClaims).includes(claimKey) &&
-                    DuplicatedClaims[claimKey] !== entry) {
-                    return ko(`Duplicated claim ${claimKey} found files: ${DuplicatedClaims[claimKey]} and ${entry}`);
-                }
-                LoadedClaims[claimKey] = data;
-                VisitedClaims[claimKey] = entry;
-                DuplicatedClaims[claimKey] = entry;
-                ok();
-            }
-        });
-    });
-}
-async function setVirtualClaimAdditionalData(renderedData, claim, claimRef) {
-    const virtualClaim = getVirtualClaim(claim.kind, claim.name);
-    renderedData[claimRef]['initializers'] = [
-        new UUIDInitializer(claim),
-        new InitializerClaimRef(),
-        new InitializerDefault(virtualClaim.getDefaultConfig()),
-    ];
-    renderedData[claimRef]['globals'] = [];
-    renderedData[claimRef]['overrides'] = [];
-    renderedData[claimRef]['normalizers'] = [new NameNormalizer()];
-    return renderedData;
-}
-async function setNonVirtualClaimAdditionalData(renderedData, claim, claimRef, loadInitializers, loadGlobals, loadOverrides, loadNormalizers) {
-    renderedData[claimRef]['initializers'] = await loadInitializers(claim, renderedData[claimRef]['claimPath']);
-    renderedData[claimRef]['globals'] = await loadGlobals(claim);
-    renderedData[claimRef]['overrides'] = loadOverrides(claim);
-    renderedData[claimRef]['normalizers'] = await loadNormalizers(claim, renderedData[claimRef]['claimPath']);
-    return renderedData;
-}
-async function loadVirtualClaim(kind, name, org) {
-    const virtualClaim = getVirtualClaim(kind, name);
-    const expandedClaim = await virtualClaim.expand({ org });
-    logger.info(`Loading virtual claim ${kind} ${name} ${org}`);
-    LoadedClaims[`${kind}-${name}`] = catalog_common/* default.io.toYaml */.Z.io.toYaml(expandedClaim);
-    VisitedClaims[`${kind}-${name}`] = 'virtual';
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/claimsDefaulter.ts
-
-
-
-/*
- * Default blocks are objects that cannot be merged but applied as a whole. Meaning:
- * - If the object is defined at the claim-level it is maintained *AS IT IS* (no merge)
- * - If the block is missing at the claim-level, the default block is applied
- */
-const defaultBlocksPaths = ['/providers/terraform/sync'];
-function applyBlockAwareDefaults(claim, defaultClaim) {
-    // we always work with a clone of the original
-    const claimClone = JSON.parse(JSON.stringify(claim));
-    // if the block is claim-level defined we store it here
-    const defaultBlocks = new Map();
-    // we remove the blocks entirely of the claim
-    // to achieve an add copy
-    for (const defaultBlockPath of defaultBlocksPaths) {
-        if (claimsDefaulter_hasDeepPath(claimClone, defaultBlockPath) !== true)
-            continue;
-        const originalValue = fast_json_patch_default().getValueByPointer(claimClone, defaultBlockPath);
-        if (originalValue) {
-            logger.silly(`${claim.kind}/${claim.name}: has an original ${defaultBlockPath}: preserving`);
-            defaultBlocks.set(defaultBlockPath, originalValue);
-            fast_json_patch_default().applyPatch(claimClone, [{ op: 'remove', path: defaultBlockPath }]);
-        }
-    }
-    // if the patch has the same path of a block
-    // and the block was defined at claim-level
-    // we interchange the value with the original value
-    // otherwise we use the default
-    const jsonPatchOps = fast_json_patch_default().compare(claimClone, defaultClaim)
-        .filter((jp) => jp.op === 'add')
-        .map((jp) => {
-        if (defaultBlocks.has(jp.path)) {
-            return {
-                ...jp,
-                value: defaultBlocks.get(jp.path),
-            };
-        }
-        else {
-            return jp;
-        }
-    });
-    return fast_json_patch_default().applyPatch(claimClone, jsonPatchOps).newDocument;
-}
-function claimsDefaulter_hasDeepPath(data, deepPath) {
-    return lodash_default().has(data, deepPath.replace(/\//g, '.').replace(/^\./, ''));
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/loader/loader.ts
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-const isYamlFile = new RegExp(/\.(yaml|yml)$/);
-/**
- *
- * @returns Virtual Claims
- */
-const virtualClaims = [new FirestartrAllClaim()];
-/*
- * Loads all applicable globals for a given claim and stores them into a list.
- *
- * Input:
- * - claim: our custom claim object, with which we check if the global is applicable
- *
- * Returns:
- * - A GlobalSection array promise, containing all the globals loaded for this claim
- *
- */
-async function loadGlobals(claim) {
-    const result = [];
-    await crawl(getPath('globals'), (entry) => {
-        return isYamlFile.test(entry);
-    }, async (entry, data) => {
-        const globalData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
-        const ext = external_path_.extname(entry);
-        const name = external_path_.basename(entry, ext);
-        if (name in SECTIONS_BY_FILE_NAME) {
-            const section = new SECTIONS_BY_FILE_NAME[name](globalData);
-            if (!(await section.validate(SCHEMAS_BY_SECTION_NAME[name] || {}))) {
-                throw new Error(`Invalid ${name} global file`);
-            }
-            if (globalData.kind === claim.kind) {
-                result.push(section);
-            }
-            else {
-                logger.debug(`Skipping global ${name} because it is not applicable to ${claim.kind}`);
-            }
-        }
-    });
-    logger.info(`Loaded globals ${result}`);
-    return result;
-}
-/*
- * If the input claim is a GithubRepositoryClaim, it loads all it's applicable
- * overrides and stores them into a list. Otherwise, it returns an empty list.
- *
- * Input:
- * - claim: our custom claim object, which should be a GithubRepositoryClaim
- *
- * Returns:
- * - An Overrider array, with a GithubRepositoryOverrider if the claim
- *   was a GithubRepositoryClaim, or empty if it was not.
- *
- */
-function loadOverrides(claim) {
-    const overrides = [];
-    if (claim.kind === 'ComponentClaim' && claim.providers.github.overrides) {
-        overrides.push(new GithubRepositoryOverrider());
-    }
-    return overrides;
-}
-/**
- * Load all normalizers and stores them into a list.
- * @param claim
- * @returns
- */
-async function loadNormalizers(_claim, path) {
-    const result = [];
-    for (const normalizer of NORMALIZERS) {
-        result.push(new normalizer({ path: path }));
-    }
-    return result;
-}
-/*
- * Loads all applicable initializers for a given claim and stores them into a list.
- *
- * Input:
- * - claim: our custom claim object, with which we check if the initializer is applicable
- *
- * Returns:
- * - An Initializer array promise, containing all the initializers loaded for this claim
- *
- */
-let loadedInitializers = false;
-async function loadInitializers(claim, claimPath, initializersPath = getPath('initializers')) {
-    const result = [];
-    await crawl(initializersPath, (entry) => {
-        return isYamlFile.test(entry);
-    }, async (entry, data) => {
-        const initializerData = catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data);
-        const ext = external_path_.extname(entry);
-        const name = external_path_.basename(entry, ext);
-        if (name in INITIALIZERS_BY_FILE_NAME) {
-            const initializerBfN = new INITIALIZERS_BY_FILE_NAME[name](initializerData);
-            if (!(await initializerBfN.validate(SCHEMAS_BY_INITIALIZER_NAME[name] || {}))) {
-                throw new Error(`Invalid ${name} initializer file`);
-            }
-            if (initializerData.kind === claim.kind) {
-                result.push(initializerBfN);
-            }
-            else {
-                logger.debug(`Skipping initializer ${name} because it is not applicable to ${claim.kind}`);
-            }
-        }
-    });
-    for (const initializer of INITIALIZERS) {
-        if (initializer.applicableKinds.includes(claim.kind)) {
-            result.push(new initializer({ path: claimPath }));
-        }
-    }
-    logger.info(`Loaded initializers ${JSON.stringify(result)}`);
-    loadedInitializers = result;
-    return loadedInitializers;
-}
-function loadClaimDefaults() {
-    try {
-        return catalog_common/* default.io.fromYaml */.Z.io.fromYaml(external_fs_.readFileSync(`${getPath('claimsDefaults')}/claims_defaults.yaml`, 'utf-8'));
-    }
-    catch (error) {
-        const errMsg = `Could not read claims defaults file in path ${getPath('claimsDefaults')}/claims_defaults.yaml: ${error}`;
-        logger.error(errMsg);
-        throw new Error(errMsg);
-    }
-}
-/*
- * Using fast-json-patch, compares a claim to its kind's defaults, then patches it.
- *
- * Input:
- * - claim: our custom claim object, which we want to patch
- * - defaultsClaims: an object, containing the defaults for each claim kind,
- *   with the same structure that we use for the actual claims
- *
- * Returns:
- * - The patched claim
- *
- */
-function loader_patchClaim(claim, defaultsClaims) {
-    if (defaultsClaims[claim.kind]) {
-        claim = applyBlockAwareDefaults(claim, defaultsClaims[claim.kind]);
-    }
-    return claim;
-}
-async function loadCRsWithFullSet(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
-    const result = {};
-    const fullResult = {};
-    await crawlWithExclusions(crsPath, (entry) => {
-        return isYamlFile.test(entry);
-    }, async (entry, data) => {
-        const yamlData = stripKnownRelations(catalog_common/* default.io.fromYaml */.Z.io.fromYaml(data));
-        const metadata = yamlData?.metadata;
-        if (!(yamlData &&
-            typeof yamlData === 'object' &&
-            'kind' in yamlData &&
-            metadata &&
-            typeof metadata === 'object' &&
-            'name' in metadata)) {
-            logger.warn(`Invalid CR file ${entry}`);
-        }
-        else {
-            const crKey = `${yamlData.kind}-${metadata.name}`;
-            if (fullResult[crKey]) {
-                logger.error(`Duplicate CR ${crKey}`);
-            }
-            // Keep the complete CR set for validations that need repository-wide context.
-            fullResult[crKey] = yamlData;
-            // Keep the filtered CR set for previous-CR lookup during claim rendering.
-            if (allowedClaimReferences.length === 0 ||
-                allowedClaimReferences.includes(yamlData.metadata?.annotations?.[catalog_common/* default.generic.getFirestartrAnnotation */.Z.generic.getFirestartrAnnotation('claim-ref')])) {
-                result[crKey] = yamlData;
-            }
-        }
-    }, excludedPaths.concat(getAdditionalPaths()));
-    return { crs: result, fullCrs: fullResult };
-}
-async function loadCRs(crsPath = getPath('crs'), excludedPaths = [getPath('globals'), getPath('initializers')], allowedClaimReferences = []) {
-    const { crs } = await loadCRsWithFullSet(crsPath, excludedPaths, allowedClaimReferences);
-    return crs;
-}
-/*
- * Description: Get the renamed using claimRef annotation
- * Input: claims: any, crs: any
- * Output: renames: IRenameResult[]
- */
-async function loadRenames(claims, crs) {
-    /*
-     * If checkRenames is false, we don't need to check for renames
-     */
-    const renamesEnabled = getRenamesEnabled();
-    if (!renamesEnabled)
-        return [];
-    const result = [];
-    /**
-     * For each CR, look for a claim that does not match the name with CR's firestartr.dev/claim-ref annotation
-     */
-    for (const cr of Object.values(crs)) {
-        const anyCr = cr;
-        if (!anyCr?.metadata?.annotations)
-            continue;
-        // if the annotation is a claimRef
-        const annotationName = common.generic.getFirestartrAnnotation('claim-ref');
-        const annotations = anyCr?.metadata?.annotations || {};
-        if (annotationName in annotations) {
-            const claimRef = anyCr.metadata.annotations[annotationName];
-            // split the annotation into kind and name
-            const [kind, name] = claimRef.split('/');
-            // if the claim exists, check if the name is different for the given provider
-            const referencedClaim = claims[`${kind}-${name}`].claim;
-            const oldName = anyCr.metadata.name;
-            const newName = referencedClaim.providers[getConfiguredProvider()].name;
-            if (oldName !== newName) {
-                result.push({
-                    kind: referencedClaim.kind,
-                    claimPath: claims[`${kind}-${name}`].claimPath,
-                    claimName: referencedClaim.name,
-                    oldName,
-                    newName,
-                });
-            }
-        }
-    }
-    return result;
-}
-async function loadClaimsList(claimRefList, claimsPath = getPath('claims')) {
-    const data = {
-        renderClaims: {},
-        crs: {},
-        fullCrs: {},
-    };
-    const defaults = loadClaimDefaults();
-    for await (const claimRef of claimRefList) {
-        const [renderedClaimData] = await loadClaim(claimRef, getOrg(), defaults, loader_patchClaim, loadInitializers, loadGlobals, loadOverrides, loadNormalizers, claimsPath);
-        data.renderClaims = lodash_default().merge(data.renderClaims, renderedClaimData);
-    }
-    const crClaimReferences = [];
-    for (const ref of Object.keys(data.renderClaims)) {
-        // Replaces only the first instance of '-'
-        crClaimReferences.push(ref.replace('-', '/'));
-    }
-    const loadedCrs = await loadCRsWithFullSet(getPath('crs'), [getPath('globals'), getPath('initializers')], crClaimReferences);
-    data['crs'] = loadedCrs.crs;
-    data['fullCrs'] = loadedCrs.fullCrs;
-    return data;
-}
-function getOrg() {
-    const groupOrg = catalog_common/* default.environment.getFromEnvironmentWithDefault */.Z.environment.getFromEnvironmentWithDefault(catalog_common/* default.types.envVars.org */.Z.types.envVars.org, '');
-    return groupOrg;
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/references.ts
-function validateTfStateKeyUniqueness(crs) {
-    const tfStateKeys = {};
-    for (const crKey of Object.keys(crs)) {
-        const cr = crs[crKey];
-        if (!isTerraformWorkspace(cr))
-            continue;
-        const tfKey = cr.spec.firestartr.tfStateKey;
-        if (tfStateKeys[tfKey]) {
-            throw new Error(`❗❗ ❌ RENDER ERROR ❌ ❗❗
-
-The tfStateKey ${tfKey} is not unique,
-
-It is being used by the following CRs:
-
-- ${tfStateKeys[tfKey].kind} ${tfStateKeys[tfKey].metadata.name}
-
-- ${cr.kind} ${cr.metadata.name}
-
-Check the following Claims to ensure that the tfStateKey is unique:
-
-- ${tfStateKeys[tfKey].metadata.annotations['firestartr.dev/claim-ref']}
-
-- ${cr.metadata.annotations['firestartr.dev/claim-ref']}
-`);
-        }
-        tfStateKeys[cr.spec.firestartr.tfStateKey] = cr;
-    }
-}
-function references_isCatalogEntity(cr) {
-    return [
-        'Component',
-        'Domain',
-        'System',
-        'User',
-        'Group',
-        'Resource',
-    ].includes(cr.kind);
-}
-function isTerraformWorkspace(cr) {
-    return cr.kind === 'FirestartrTerraformWorkspace';
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/crSize.ts
-
-const K8S_OBJECT_SIZE_LIMIT = 1572864; // 1.5 MiB in bytes, etcd recommended limit: https://etcd.io/docs/latest/dev-guide/limit/
-function validateCrSizes(crs) {
-    for (const key of Object.keys(crs)) {
-        const cr = crs[key];
-        const serialized = catalog_common/* default.io.toYaml */.Z.io.toYaml(cr);
-        const size = Buffer.byteLength(serialized, 'utf8');
-        if (size > K8S_OBJECT_SIZE_LIMIT) {
-            throw new Error(`CR "${cr.kind}-${cr.metadata.name}" exceeds the Kubernetes object size limit by ${size - K8S_OBJECT_SIZE_LIMIT} bytes. Maximum allowed is ${K8S_OBJECT_SIZE_LIMIT} bytes (1.5MiB).`);
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/permissions.ts
-
-function validatePermissionsUniqueness(crs) {
-    for (const crkey in crs) {
-        const cr = crs[crkey];
-        if (cr.kind === 'FirestartrGithubRepository') {
-            const permissions = cr.spec.permissions;
-            logger.debug(`Validating Permissions Uniqueness of ${crkey}`);
-            if (permissions) {
-                const rolesByIdentifier = new Map();
-                for (const perm of permissions) {
-                    const identifier = perm.collaborator
-                        ? perm.collaborator
-                        : `ref:${perm.ref.kind}:${perm.ref.name}`;
-                    const role = perm.role;
-                    const prevRole = rolesByIdentifier.get(identifier);
-                    if (prevRole === undefined) {
-                        rolesByIdentifier.set(identifier, role);
-                    }
-                    else if (prevRole !== role) {
-                        throw new Error(`Conflicting permission role in FirestartrGithubRepository ${crkey}: ${identifier} has roles "${prevRole}" and "${role}".\nFull CR: ${JSON.stringify(cr, null, 2)}`);
-                    }
-                }
-            }
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/validations/backstageAnnotations.ts
-const backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX = 'firestartr.backstage.dev/';
-const CATALOG_KINDS = new Set([
-    'User',
-    'Group',
-    'Component',
-    'System',
-    'Domain',
-    'API',
-    'Resource',
-    'CatalogKubernetesResource',
-    'CatalogTerraformWorkspace',
-    'CatalogArgoDeploy',
-    'CatalogOrgWebhook',
-    'CatalogSecrets',
-]);
-function validateNoBackstageAnnotationsInK8sCrs(crs) {
-    for (const crKey in crs) {
-        const cr = crs[crKey];
-        if (CATALOG_KINDS.has(cr.kind))
-            continue;
-        if (cr.metadata?.annotations) {
-            const backstageKeys = Object.keys(cr.metadata.annotations).filter((k) => k.startsWith(backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX));
-            if (backstageKeys.length > 0) {
-                throw new Error(`K8s CR ${crKey} contains Backstage-only annotations (${backstageKeys.join(', ')}). ` +
-                    `Annotations with prefix ${backstageAnnotations_BACKSTAGE_ANNOTATION_PREFIX} must only appear on Backstage catalog entities, not on Kubernetes CRs.`);
-            }
-        }
-    }
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/refsSorter/refsSorter.ts
-
-/**
- * @param renderClaims renderClaims to sort
- * @param kinds kinds to get from renderClaims
- * @returns renderClaims with only the kinds specified
- */
-function sortRenderClaimsByKind(renderClaims, kinds) {
-    let result = {};
-    for (const kind of kinds) {
-        for (const key in renderClaims) {
-            if (renderClaims[key].claim.kind === kind) {
-                result[key] = renderClaims[key];
-            }
-        }
-        result = sortSelfKindRefs(result, kind);
-    }
-    return result;
-}
-function sortSelfKindRefs(renderClaims, kind) {
-    if (!hasSelfRefs(kind)) {
-        return renderClaims;
-    }
-    const newRenderClaims = {};
-    const data = extractRefs(renderClaims, kind);
-    const ordered = [];
-    const visiting = [];
-    const visited = [];
-    for (const key of Object.keys(data)) {
-        if (!visited.find((obj) => obj.name === key)) {
-            sortRefs(data, data[key], ordered, visiting, visited);
-        }
-    }
-    for (const cr of ordered) {
-        newRenderClaims[cr.name] = renderClaims[cr.name];
-    }
-    return newRenderClaims;
-}
-function sortRefs(data, claim, ordered = [], visiting = [], visited = []) {
-    if (visiting.find((obj) => obj.name === claim.name)) {
-        throw new Error(`Circular dependency detected for '${claim.name}'`);
-    }
-    if (!visited.find((obj) => obj.name === claim.name)) {
-        visiting.push(claim);
-        if (claim.refs) {
-            for (const ref of claim.refs) {
-                const referencedObject = data[ref];
-                if (!referencedObject) {
-                    throw new Error(`Reference '${ref}' does not exist for '${claim.name}'`);
-                }
-                sortRefs(data, referencedObject, ordered, visiting, visited);
-            }
-        }
-        visited.push(visiting.pop());
-        ordered.push(claim);
-    }
-}
-function hasSelfRefs(kind) {
-    return ['TFWorkspaceClaim', 'GroupClaim'].includes(kind);
-}
-
-;// CONCATENATED MODULE: ../cdk8s_renderer/src/renderer/claims-sorter.ts
-
-function sortKinds(orderedKinds, claims) {
-    const result = [];
-    for (const kind of orderedKinds) {
-        const kindRenderClaims = sortRenderClaimsByKind(claims, [kind]);
-        result.push(kindRenderClaims);
-    }
-    return result;
-}
-
 ;// CONCATENATED MODULE: ../cdk8s_renderer/src/overriders/utils.ts
 
 
@@ -167282,11 +166878,20 @@ async function utils_renderFeature(featureName, featureVersion, featureOutputObj
         files.push({ path, userManaged, content, targetBranch });
     }
     const featName = catalog_common/* default.generic.normalizeName */.Z.generic.normalizeName(`${featureName}-${cr.spec.firestartr.tfStateKey}`);
+    const traceability = featureOutputObject.traceability || {};
     return {
         kind: 'GithubRepositoryFeatureClaim',
         version: '1.0.0',
         name: featName,
-        feature: { name: featureName, version: featureVersion },
+        feature: {
+            name: featureName,
+            version: featureVersion,
+            ref: traceability.ref,
+            repo: traceability.repo,
+            sha: traceability.sha,
+            tags: traceability.tags,
+            url: traceability.url,
+        },
         firestartr: { tfStateKey: cr.spec.firestartr.tfStateKey },
         files,
         claimRepoName,
@@ -167308,12 +166913,14 @@ async function utils_renderFeature(featureName, featureVersion, featureOutputObj
 
 
 
+
+
 // this is the only way currently to make
 // work the system and inject our code
 // without having to download a feature
-let featureOverride_MOCK_FEATURES_FN;
+let MOCK_FEATURES_FN;
 function MOCK_FEATURES(mock) {
-    featureOverride_MOCK_FEATURES_FN = mock;
+    MOCK_FEATURES_FN = mock;
     if (mock) {
         log.warn('⚠️ Warning features system downloader has been mocked, it should only happen in unit testing');
     }
@@ -167344,8 +166951,8 @@ class FeaturesOverrider extends OverriderPatches {
         let owner = 'prefapp';
         let versionOrRef = this.featureVersion;
         let renderer = 'getFeatureConfig';
-        if (featureOverride_MOCK_FEATURES_FN) {
-            return featureOverride_MOCK_FEATURES_FN();
+        if (MOCK_FEATURES_FN) {
+            return MOCK_FEATURES_FN();
         }
         if (this.featureRepo) {
             [owner, repo] = this.featureRepo.split(/\//);
@@ -167363,8 +166970,8 @@ class FeaturesOverrider extends OverriderPatches {
         const featureName = this.featureName;
         const featureVersion = this.featureVersion || this.featureRef;
         const featureArgs = this.featureArgs;
-        const fSetUpAndRunRenderer = function (target) {
-            return this.setUpAndRunRenderer(target);
+        const fSetUpAndRunRenderer = function (cr) {
+            return this.setUpAndRunRenderer(cr);
         }.bind(this);
         let renderedFeatureConfig = null;
         return [
@@ -167373,7 +166980,7 @@ class FeaturesOverrider extends OverriderPatches {
                     return true;
                 },
                 async apply(cr) {
-                    renderedFeatureConfig = await fSetUpAndRunRenderer(claim);
+                    renderedFeatureConfig = await fSetUpAndRunRenderer(cr);
                     return cr;
                 },
                 identify() {
@@ -167386,6 +166993,28 @@ class FeaturesOverrider extends OverriderPatches {
                     return utils_renderFeature(featureName, featureVersion, renderedFeatureConfig, cr, claim.name);
                 },
             },
+            {
+                isPostPatch: true,
+                validate() {
+                    return true;
+                },
+                async apply(cr) {
+                    if (!renderedFeatureConfig) {
+                        logger.warn(`Feature ${featureName}: renderedFeatureConfig is null, skipping post-patch`);
+                        return cr;
+                    }
+                    const provider = helperCTX(this).provider;
+                    const jsonPatches = renderedFeatureConfig.patches?.[provider] || [];
+                    fast_json_patch_default().applyPatch(cr, jsonPatches);
+                    return cr;
+                },
+                identify() {
+                    return `feature-json-patch/${featureName}`;
+                },
+                applicable() {
+                    return { applicableProviders: ['catalog', 'github'] };
+                },
+            },
         ];
     }
 }
@@ -171135,6 +170764,23 @@ class FeatureRepoChart extends BaseGithubChart {
                 annotations: {
                     'firestartr.dev/external-name': claim.name,
                     'firestartr.dev/feature-name': claim.feature.name,
+                    ...(claim.feature.sha
+                        ? { 'firestartr.dev/feature-git-sha': claim.feature.sha }
+                        : {}),
+                    ...(claim.feature.tags && claim.feature.tags.length > 0
+                        ? {
+                            'firestartr.dev/feature-git-tags': JSON.stringify(claim.feature.tags),
+                        }
+                        : {}),
+                    ...(claim.feature.url
+                        ? { 'firestartr.dev/feature-url': claim.feature.url }
+                        : {}),
+                    ...(claim.feature.ref
+                        ? { 'firestartr.dev/feature-ref': claim.feature.ref }
+                        : {}),
+                    ...(claim.feature.repo
+                        ? { 'firestartr.dev/feature-repo': claim.feature.repo }
+                        : {}),
                 },
             },
             spec: {
@@ -363740,7 +363386,7 @@ function helperCreateCheckRunName(cmd, item) {
 
 ;// CONCATENATED MODULE: ../operator/src/utils/index.ts
 const secretRegex = /\$\{\{ secrets\.(.*?) \}\}/g;
-function utils_isRecord(value) {
+function isRecord(value) {
     return typeof value === 'object' && value !== null;
 }
 function getFirstNonEmptyString(...values) {
@@ -363778,7 +363424,7 @@ function replaceInlineSecrets(inline, secrets) {
     return result;
 }
 function extractErrorDetails(error) {
-    const exitCode = utils_isRecord(error) && typeof error.exitCode === 'number'
+    const exitCode = isRecord(error) && typeof error.exitCode === 'number'
         ? error.exitCode
         : undefined;
     if (typeof error === 'string') {
@@ -363789,7 +363435,7 @@ function extractErrorDetails(error) {
         const output = getFirstNonEmptyString(errorWithOutput.output, error.message);
         return { output: output ?? String(error), exitCode };
     }
-    if (utils_isRecord(error)) {
+    if (isRecord(error)) {
         const output = getFirstNonEmptyString(error.output, error.message, error.error);
         if (output !== undefined) {
             return { output, exitCode };
@@ -713911,7 +713557,7 @@ const crsStatusSubcommand = {
 };
 
 ;// CONCATENATED MODULE: ./package.json
-const package_namespaceObject = JSON.parse('{"i8":"2.11.0-snapshot-patches-patch-claims-1"}');
+const package_namespaceObject = JSON.parse('{"i8":"2.11.0-snapshot-features-traceability-00"}');
 ;// CONCATENATED MODULE: ../../package.json
 const package_namespaceObject_1 = {"i8":"2.10.0"};
 // EXTERNAL MODULE: ../../node_modules/semver/index.js